Edit tour

Windows Analysis Report
nRNzqQOQwk.exe

Overview

General Information

Sample name:	nRNzqQOQwk.exe renamed because original name is a hash value
Original sample name:	a180642558a07876a9a047217ef75504a4fe7e1f02e22e1f19ffba8d33e6790a.exe
Analysis ID:	1587595
MD5:	c616c105a117d63de2b4f818c8fdd3e0
SHA1:	fe7d7c8863a5f71e02b2b5b76e1a8f506b08dba7
SHA256:	a180642558a07876a9a047217ef75504a4fe7e1f02e22e1f19ffba8d33e6790a
Tags:	exeuser-adrian__luca
Infos:

Detection

GuLoader

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Yara detected GuLoader

AI detected suspicious sample

Machine Learning detection for sample

Tries to detect virtualization through RDTSC time measurements

Abnormal high CPU Usage

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Creates files inside the system directory

Detected non-DNS traffic on DNS port

Detected potential crypto function

Drops PE files

Found dropped PE file which has not been started or loaded

PE / OLE file has an invalid certificate

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

nRNzqQOQwk.exe (PID: 7548 cmdline: "C:\Users\user\Desktop\nRNzqQOQwk.exe" MD5: C616C105A117D63DE2B4F818C8FDD3E0)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.3789872839.000000000414B000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: nRNzqQOQwk.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: nRNzqQOQwk.exe	Virustotal: Detection: 67%			Perma Link
Source: nRNzqQOQwk.exe	ReversingLabs: Detection: 70%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: nRNzqQOQwk.exe

Joe Sandbox ML: detected

Source: nRNzqQOQwk.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: nRNzqQOQwk.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\nRNzqQOQwk.exe	Code function: 0_2_00405642 GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	0_2_00405642
Source: C:\Users\user\Desktop\nRNzqQOQwk.exe	Code function: 0_2_004060A4 FindFirstFileA,FindClose,	0_2_004060A4
Source: C:\Users\user\Desktop\nRNzqQOQwk.exe	Code function: 0_2_0040270B FindFirstFileA,	0_2_0040270B

Source: global traffic

TCP traffic: 192.168.2.9:57686 -> 162.159.36.2:53

Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: 15.164.165.52.in-addr.arpa

Source: nRNzqQOQwk.exe	String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: nRNzqQOQwk.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError

Source: C:\Users\user\Desktop\nRNzqQOQwk.exe

Code function: 0_2_004050F7 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_004050F7

Source: C:\Users\user\Desktop\nRNzqQOQwk.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\nRNzqQOQwk.exe

Code function: 0_2_00403180 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

0_2_00403180

Source: C:\Users\user\Desktop\nRNzqQOQwk.exe	File created: C:\Windows\Fonts\prelegacy			Jump to behavior
Source: C:\Users\user\Desktop\nRNzqQOQwk.exe	File created: C:\Windows\Fonts\prelegacy\prster			Jump to behavior

Source: C:\Users\user\Desktop\nRNzqQOQwk.exe

Code function: 0_2_00404936

0_2_00404936

Source: nRNzqQOQwk.exe

Static PE information: invalid certificate

Source: nRNzqQOQwk.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal76.troj.evad.winEXE@1/7@1/0

Source: C:\Users\user\Desktop\nRNzqQOQwk.exe

0_2_00403180

Source: C:\Users\user\Desktop\nRNzqQOQwk.exe

Code function: 0_2_004043C3 GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,

0_2_004043C3

Source: C:\Users\user\Desktop\nRNzqQOQwk.exe

Code function: 0_2_004020CD CoCreateInstance,MultiByteToWideChar,

0_2_004020CD

Source: C:\Users\user\Desktop\nRNzqQOQwk.exe

File created: C:\Program Files (x86)\Fljtenists.ini

Jump to behavior

Source: C:\Users\user\Desktop\nRNzqQOQwk.exe

File created: C:\Users\user\slavelivets

Jump to behavior

Source: C:\Users\user\Desktop\nRNzqQOQwk.exe

File created: C:\Users\user\AppData\Local\Temp\nsz9F79.tmp

Jump to behavior

Source: nRNzqQOQwk.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\nRNzqQOQwk.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\nRNzqQOQwk.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: nRNzqQOQwk.exe	Virustotal: Detection: 67%
Source: nRNzqQOQwk.exe	ReversingLabs: Detection: 70%

Source: C:\Users\user\Desktop\nRNzqQOQwk.exe

File read: C:\Users\user\Desktop\nRNzqQOQwk.exe

Jump to behavior

Source: C:\Users\user\Desktop\nRNzqQOQwk.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\nRNzqQOQwk.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\nRNzqQOQwk.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\nRNzqQOQwk.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\nRNzqQOQwk.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\nRNzqQOQwk.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\nRNzqQOQwk.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\nRNzqQOQwk.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\nRNzqQOQwk.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\nRNzqQOQwk.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\nRNzqQOQwk.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\nRNzqQOQwk.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\nRNzqQOQwk.exe	Section loaded: profapi.dll	Jump to behavior

Source: C:\Users\user\Desktop\nRNzqQOQwk.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\nRNzqQOQwk.exe

File written: C:\Program Files (x86)\Fljtenists.ini

Jump to behavior

Source: nRNzqQOQwk.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

Yara detected GuLoader

Source: Yara match

File source: 00000000.00000002.3789872839.000000000414B000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\nRNzqQOQwk.exe

Code function: 0_2_10001A5D GlobalAlloc,lstrcpyA,lstrcpyA,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,LdrInitializeThunk,LdrInitializeThunk,lstrcpyA,GetModuleHandleA,LoadLibraryA,GetProcAddress,lstrlenA,

0_2_10001A5D

Source: C:\Users\user\Desktop\nRNzqQOQwk.exe

Code function: 0_2_10002D20 push eax; ret

0_2_10002D4E

Source: C:\Users\user\Desktop\nRNzqQOQwk.exe

File created: C:\Users\user\AppData\Local\Temp\nsp9F8A.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\nRNzqQOQwk.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\nRNzqQOQwk.exe

RDTSC instruction interceptor: First address: 4956AE9 second address: 4956AE9 instructions: 0x00000000 rdtsc 0x00000002 test edx, edx 0x00000004 cmp ebx, ecx 0x00000006 jc 00007EFC6CC15A45h 0x00000008 test dx, bx 0x0000000b inc ebp 0x0000000c inc ebx 0x0000000d rdtsc

Source: C:\Users\user\Desktop\nRNzqQOQwk.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsp9F8A.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\nRNzqQOQwk.exe	Code function: 0_2_00405642 GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	0_2_00405642
Source: C:\Users\user\Desktop\nRNzqQOQwk.exe	Code function: 0_2_004060A4 FindFirstFileA,FindClose,	0_2_004060A4
Source: C:\Users\user\Desktop\nRNzqQOQwk.exe	Code function: 0_2_0040270B FindFirstFileA,	0_2_0040270B

Source: C:\Users\user\Desktop\nRNzqQOQwk.exe	API call chain: ExitProcess graph end node			graph_0-3797
Source: C:\Users\user\Desktop\nRNzqQOQwk.exe	API call chain: ExitProcess graph end node			graph_0-3977

Source: C:\Users\user\Desktop\nRNzqQOQwk.exe

Code function: 0_2_00402B0E RegOpenKeyExA,RegEnumKeyA,RegEnumKeyA,RegCloseKey,LdrInitializeThunk,RegCloseKey,RegDeleteKeyA,

0_2_00402B0E

Source: C:\Users\user\Desktop\nRNzqQOQwk.exe

0_2_10001A5D

Source: C:\Users\user\Desktop\nRNzqQOQwk.exe

Code function: 0_2_00405DC2 GetVersion,GetSystemDirectoryA,GetWindowsDirectoryA,SHGetSpecialFolderLocation,SHGetPathFromIDListA,CoTaskMemFree,lstrcatA,lstrlenA,

0_2_00405DC2

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 Access Token Manipulation	12 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Access Token Manipulation	LSASS Memory	3 File and Directory Discovery	Remote Desktop Protocol	1 Clipboard Data	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Obfuscated Files or Information	Security Account Manager	13 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
nRNzqQOQwk.exe	67%	Virustotal		Browse
nRNzqQOQwk.exe	71%	ReversingLabs	Win32.Trojan.Guloader
nRNzqQOQwk.exe	100%	Avira	TR/AD.NsisInject.monhx
nRNzqQOQwk.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\nsp9F8A.tmp\System.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsp9F8A.tmp\System.dll	0%	Virustotal		Browse

Name	IP	Active	Malicious	Antivirus Detection	Reputation
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false		high
15.164.165.52.in-addr.arpa	unknown	unknown	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nsis.sf.net/NSIS_Error	nRNzqQOQwk.exe	false		high
http://nsis.sf.net/NSIS_ErrorError	nRNzqQOQwk.exe	false		high

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587595
Start date and time:	2025-01-10 15:20:50 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 50s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	nRNzqQOQwk.exe renamed because original name is a hash value
Original Sample Name:	a180642558a07876a9a047217ef75504a4fe7e1f02e22e1f19ffba8d33e6790a.exe
Detection:	MAL
Classification:	mal76.troj.evad.winEXE@1/7@1/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 40 Number of non-executed functions: 31
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240s for sample files taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 13.107.246.45, 4.245.163.56, 52.165.164.15, 172.202.163.200
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, otelrules.afd.azureedge.net, azureedge-t-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0017.t-0009.t-msedge.net	PO-0005082025 pdf.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	13.107.246.45
	PO-0005082025 pdf.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	13.107.246.45
	Shipping Document.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	13.107.246.45
	1712226379134618467.js	Get hash	malicious	Strela Downloader	Browse	13.107.246.45
	https://sign.zoho.com/zsguest?locale=en&sign_id=234b4d535f4956237c699124bb06f6840075804affff79070f72fbd27ec4885c3a2ba06657b8a52338eb80052baee9f74c4e2e0e7f85c073df939f1ac4dff75f76c95d46ac2361c7b14335e4f12c5c5d49c49b1d2f4c838a&action_type=SIGN	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://www.filemail.com/d/rxythqchkhluipl?skipreg=true	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://eu.jotform.com/app/250092704521347	Get hash	malicious	Unknown	Browse	13.107.246.45
	http://loginmicrosoftonline.Bdo.scoremasters.gr/cache/cdn?email=christian.wernli@bdo.ch	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://app.planable.io/review/0OPaw36t6M_k	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	PDFONLINE.exe	Get hash	malicious	Unknown	Browse	13.107.246.45

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\nsp9F8A.tmp\System.dll	ODjwCjQBAP.exe	Get hash	malicious	GuLoader	Browse
	ODjwCjQBAP.exe	Get hash	malicious	GuLoader	Browse
	Anfrage.exe	Get hash	malicious	FormBook, GuLoader	Browse
	Anfrage_244384.exe	Get hash	malicious	FormBook, GuLoader	Browse
	Anfrage_244384.exe	Get hash	malicious	FormBook, GuLoader	Browse
	Anfrage244384.exe	Get hash	malicious	FormBook, GuLoader	Browse
	Anfrage244384.exe	Get hash	malicious	FormBook, GuLoader	Browse
	Anfrage_244384.exe	Get hash	malicious	FormBook, GuLoader	Browse
	5112024976.exe	Get hash	malicious	FormBook, GuLoader	Browse
	5112024976.exe	Get hash	malicious	FormBook, GuLoader	Browse

Created / dropped Files

C:\Program Files (x86)\Fljtenists.ini

Download File

Process:	C:\Users\user\Desktop\nRNzqQOQwk.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	34
Entropy (8bit):	4.35937791471612
Encrypted:	false
SSDEEP:	3:oMXADiGWkon:xnGWn
MD5:	5BAD417385FA63549574090876DC680D
SHA1:	84E00066DC079E657BE9AF39E2C9E4EC42F5E527
SHA-256:	8B8CCA2780BD72F608E87BAEC979BBB17706AEFEB8D9F603E53AE144ECFAB71D
SHA-512:	EA709BAB31CFAAB4979617C4D1DFF414387F6988BE9F67E70BF7F941A9E7EA4C36CF320CE2518AE0DD9171DF5C46BE85D86D3F6031059A3CB3E79FD58E3F14E2
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	[Omniregent]..promovable=bugspyt..

C:\Users\user\AppData\Local\Temp\nsp9F8A.tmp\System.dll

Download File

Process:	C:\Users\user\Desktop\nRNzqQOQwk.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	5.7711167426271945
Encrypted:	false
SSDEEP:	192:OPtkumJX7zB22kGwfy0mtVgkCPOsX1un:/702k5qpdsXQn
MD5:	3F176D1EE13B0D7D6BD92E1C7A0B9BAE
SHA1:	FE582246792774C2C9DD15639FFA0ACA90D6FD0B
SHA-256:	FA4AB1D6F79FD677433A31ADA7806373A789D34328DA46CCB0449BBF347BD73E
SHA-512:	0A69124819B7568D0DEA4E9E85CE8FE61C7BA697C934E3A95E2DCFB9F252B1D9DA7FAF8774B6E8EFD614885507ACC94987733EBA09A2F5E7098B774DFC8524B6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: ODjwCjQBAP.exe, Detection: malicious, Browse Filename: ODjwCjQBAP.exe, Detection: malicious, Browse Filename: Anfrage.exe, Detection: malicious, Browse Filename: Anfrage_244384.exe, Detection: malicious, Browse Filename: Anfrage_244384.exe, Detection: malicious, Browse Filename: Anfrage244384.exe, Detection: malicious, Browse Filename: Anfrage244384.exe, Detection: malicious, Browse Filename: Anfrage_244384.exe, Detection: malicious, Browse Filename: 5112024976.exe, Detection: malicious, Browse Filename: 5112024976.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......)...m.m.m...k.m.~....j.9..i....l....l.Richm.........................PE..L.....MX...........!.................'.......0...............................`.......................................2.......0..P............................P.......................................................0..X............................text...O........................... ..`.rdata..S....0......."..............@..@.data...h....@.......&..............@....reloc..`....P.......(..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\slavelivets\Frimenigheders.Lin

Download File

Process:	C:\Users\user\Desktop\nRNzqQOQwk.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	457262
Entropy (8bit):	2.660957868808711
Encrypted:	false
SSDEEP:	3072:D/3hlxuinGt/VhqT1iOn8lRgQ69dV1Vbx:7oig/VYRJz9Xt
MD5:	CDE198D8ADD807141052775916060A46
SHA1:	BA64728F6A13AEE536B9EF46484A7938F52D9272
SHA-256:	C9BBC92FD69037DCCF745A1ECC71F4BCE8867E41CD9D2DCDB8332587A1A147B6
SHA-512:	898011AB3D1BAA68E702091C465F2BB1EBD172475CE73439A9BB8B205E68ABAFAE71776445BC7DC87227F9E0E80A04272944962C95CAE415786C252DEE256041
Malicious:	false
Reputation:	low
Preview:	00E100005252525200000000000000F00031313100AE0000005600FF00000000000000EAEAEAEAEAEA006300000000004E0056565656565656000000F2F2F2F200E6E6E60000DDDD00828200000000C600E5E50000DEDE0013131300AC00000000A9A900004900000000242424001313130038001F000075757575757500BE00004B4B4B0000080800004200005F00000000EFEF00F300006A005E004141000010101010004F4F0000CA0056560000272727005800290000000000000000000A00002A000065650085000000550000000000D0D0001B00008686005B00CA00000000003C3C00BA005700009C9C00898900008383005400CACACA0000AC00F100DDDD00E200FB0000007700110000000086860000000000000000ADADAD001A1A00D8D80000353535009A9A000000878700F8004141000000D0D0D000000000D900292929290000FBFB0006060600D00000535300F1F10000B000A6A6A600006C6C6C6C0029290000000000ADAD00B7B70000C300000000A2000000626262005E0000000000AAAAAA0000000042000000AAAA00002C002600D4D4000000101000002D005700200000ADAD0000030000D4D400000000001E1E1E1E1E00002F2F2F2F2F2F00D3004646002F000000F5F5F5F5F500B3B3B3B300006600161616160000282828280000DBDBDBDBDBDB00BB0000D70081

C:\Users\user\slavelivets\Tonsillary252.Ban

Download File

Process:	C:\Users\user\Desktop\nRNzqQOQwk.exe
File Type:	data
Category:	dropped
Size (bytes):	193843
Entropy (8bit):	7.55628710093093
Encrypted:	false
SSDEEP:	3072:H39dlMnmxBSEy9gi65aaTlHepUWtyW8ImC/BN2WlIP7AKAKUHjjuXKc:X5SHWhTlHwhXNPTH2bUDjuac
MD5:	FFAC979D13A99BF107CED6B9BBA2B7E4
SHA1:	04E8B535A2B67D6CBAA54626492583D0DF1C9435
SHA-256:	482E699C60E1B448B9953352AB2840956AB56E9C5559B5C06CF4F48D5AF98781
SHA-512:	7DA199810F2A6B76FDA110D419EA35A424A0155DB814AA081F84F1C7CB0B9072E64D8B1A89F606D557A8B54AF8AC6395200F1CF281C28BC06101916C5285FFF3
Malicious:	false
Reputation:	low
Preview:	......nnn.....aaaa....4..............R.P.......]]].......s.........)).............VV.........SS.........................................;.../..55...........z.....&.............$.3...&.....JJ..).......%.......................................a...........7.........#####...........}}}......................ss.....\\\...................................................TT..p......j..........?...++............bb.....................A..........z...............K.....................:::........cc........).............e.........M............)))..........]..&&&.GGGGGG..%......III.....................hh.....l..........y............./......X....Z..j................88.........................c..........9............................#........aaaa...................z...... ..........w....#.v.................K.................jjjjj.....99......................vv........--........Y.......6.........................................L..........uu....................r..................K................W.d......

C:\Users\user\slavelivets\alsmekill.sta

Download File

Process:	C:\Users\user\Desktop\nRNzqQOQwk.exe
File Type:	data
Category:	dropped
Size (bytes):	339393
Entropy (8bit):	1.2543469977620876
Encrypted:	false
SSDEEP:	1536:JwpZQcXbJ+mf8ME8s+dg5Z90uGaXF9Pl7:W4cX8ncmxhGm
MD5:	F6A8488B1B62B7AC3B0979C8FBEABB30
SHA1:	9725896EBC26CCB2CB9060640B9E0D4A0618916F
SHA-256:	34DC9B70D0CE5223A531E499611F1208F3AE85AAEF9973FC27E89190568F8EE2
SHA-512:	88A719685D0972290632C6B5A665184E79A98BE22B76AF28F18056F2E7A721A0B2D3B4A8815BCE562426643E69F998F9E45F3CA62B3288EAAFB71FE89A23AD20
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	..............................................o....D....................l.......k...................................._...2...........;..........................................0............................e......_....................}.......................,....4...................n.............T................j...z..........u.....#...................h............].............................................................................................................1......G...h.......g...3..(........................................................H......)...........o...................4.............^..................."....................$....................E..............................................................\|..........3.............1...........................S....................x..........................................................................................................................................................=..........................\|....

C:\Users\user\slavelivets\boat.ast

Download File

Process:	C:\Users\user\Desktop\nRNzqQOQwk.exe
File Type:	data
Category:	dropped
Size (bytes):	456047
Entropy (8bit):	1.2479728238915362
Encrypted:	false
SSDEEP:	768:WqBSYr/TzktUI9ql+6iD8iDu43pfrmQ+PHlyjwkZY51UG90JdfSDUsby4/FApmbO:I3TS9ymKhysrQEkRbwvL3xcbNyFN2Mv
MD5:	9911B32FE219697A738F39AE5766B512
SHA1:	DA67EBB043C778DEEA874E1C746483A2B65E533C
SHA-256:	1D3D52ECB41F725DC23080ACB1ACDFEDF29BB5F167DCB75F89AF837888421880
SHA-512:	FBF703CD56434BB14C6A1A34878F094BE183D9F638D0F34074F7EE4C9D12DB70A833679B496FCB1E4C6050C418A906221149AAC70035BCDA3C01D4272C0FE3E8
Malicious:	false
Preview:	.................................................z.................m.......L.......<.............................................................._.....y....._.........x.................................................................>............Q...........:e........................................................[.-.:....................................................A.....................................................................G................................+..............................z..........................................]...........................................................................................T.....&.}........G..............c...u.....................5......B....................................................................l................H..........................H.......................\|...........................m.............................................:...........(...............8..............................................g.....

C:\Users\user\slavelivets\rupis.txt

Download File

Process:	C:\Users\user\Desktop\nRNzqQOQwk.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	276
Entropy (8bit):	4.348758704403097
Encrypted:	false
SSDEEP:	6:4s/IdpH+oqGSUkJOlUjvMzJ7HxXEp6JN+qIN2CGZgw9n7FmNIb+:4skpesSUAOlSsJ7BEpg+H2XWwTmCq
MD5:	668A01D3AF55A42FBFDBB1E9DD730B59
SHA1:	E0949D489A15516B3CD09F1043543C38E3688F1A
SHA-256:	6A7FEEBFE1F4330E611E6E1B3804619D329A9D3ABD3A3ECBD9D441F884E9999D
SHA-512:	CF3F03583667362ADCEA4DEB094513B84D3E275EBCC42A993F9293B7374618A1BA060D4C4BAE446C02B329DDE2A4579C152F54A1F7537A0F83A3E88406509459
Malicious:	false
Preview:	vulcanizable zoanthidae raalam osullivan,phantasmic oxyluminescence fluidness pickin raadelig.muslimer broder encyclopaedically bessarabian bvt.skyggespillene shellfishes urmi fume panocha imago,troskabseder cypriotes thalassian,udvandringskontorers telfonmontrens bugtalende.

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.306164693512133
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	nRNzqQOQwk.exe
File size:	616'800 bytes
MD5:	c616c105a117d63de2b4f818c8fdd3e0
SHA1:	fe7d7c8863a5f71e02b2b5b76e1a8f506b08dba7
SHA256:	a180642558a07876a9a047217ef75504a4fe7e1f02e22e1f19ffba8d33e6790a
SHA512:	71499f14196cfc6b3c2dd9d767ef3174083ff384fa642cb46086fdba4cfa5bb13d13f0f7491f1e3da55eab19c5b431f667c0851466241258840dcbd308b9fc1c
SSDEEP:	6144:GyI5s2239X0wH5ky98puy+AMRYEBx2fKIn4jmTYzCr/5/dwgEhWSdfoVLg6XLCLl:D22tHb8MRYEBxAnPTYzA/7wRhW906OLl
TLSH:	A0D4F183340558E0F4E20DB154BB8A6105BF9F7ABB95282FB3DC731614F225A4B3A7D6
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........@............/...........s.../...............+.......Rich............................PE..L.....MX.................`....9....

File Icon


Icon Hash:	8b1985c04404416d

Static PE Info

General

Entrypoint:	0x403180
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x584DCA1F [Sun Dec 11 21:50:23 2016 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	b78ecf47c0a3e24a6f4af114e2d1f5de

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN="Congratulator Penetralia ", E=ida@Harpuneren9.Af, L=Wormsdorf, S=Sachsen-Anhalt, C=DE
Signature Validation Error:	A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider
Error Number:	-2146762487
Not Before, Not After	24/06/2024 04:12:24 24/06/2027 04:12:24
Subject Chain	CN="Congratulator Penetralia ", E=ida@Harpuneren9.Af, L=Wormsdorf, S=Sachsen-Anhalt, C=DE
Version:	3
Thumbprint MD5:	5F1213D251D7C1248101800D2397AEFA
Thumbprint SHA-1:	A24C9A43698A21F20F2503099FDB0E547144AFA5
Thumbprint SHA-256:	46FA314984A20ACD8945B5BC70EC2590BB3B9E7A27C8EA9AE030A1512F819942
Serial:	79B8813DC1624EA9849722EC81B484F6FED3A8A4

Entrypoint Preview

Instruction
sub esp, 00000184h
push ebx
push esi
push edi
xor ebx, ebx
push 00008001h
mov dword ptr [esp+18h], ebx
mov dword ptr [esp+10h], 00409198h
mov dword ptr [esp+20h], ebx
mov byte ptr [esp+14h], 00000020h
call dword ptr [004070A8h]
call dword ptr [004070A4h]
cmp ax, 00000006h
je 00007EFC6CEBCD83h
push ebx
call 00007EFC6CEBFCF1h
cmp eax, ebx
je 00007EFC6CEBCD79h
push 00000C00h
call eax
mov esi, 00407298h
push esi
call 00007EFC6CEBFC6Dh
push esi
call dword ptr [004070A0h]
lea esi, dword ptr [esi+eax+01h]
cmp byte ptr [esi], bl
jne 00007EFC6CEBCD5Dh
push ebp
push 00000009h
call 00007EFC6CEBFCC4h
push 00000007h
call 00007EFC6CEBFCBDh
mov dword ptr [007A1F44h], eax
call dword ptr [00407044h]
push ebx
call dword ptr [00407288h]
mov dword ptr [007A1FF8h], eax
push ebx
lea eax, dword ptr [esp+38h]
push 00000160h
push eax
push ebx
push 0079D500h
call dword ptr [00407174h]
push 00409188h
push 007A1740h
call 00007EFC6CEBF8E7h
call dword ptr [0040709Ch]
mov ebp, 007A8000h
push eax
push ebp
call 00007EFC6CEBF8D5h
push ebx
call dword ptr [00407154h]

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x7428	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x3c3000	0x28340	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x95610	0x1350	.data
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x7000	0x298	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x5e4a	0x6000	30c42419b2e69d0fb178ad82fde5a6a6	False	0.6707356770833334	data	6.461674766148295	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x7000	0x1246	0x1400	43fab6a80651bd97af8f34ecf44cd8ac	False	0.42734375	data	5.005029341587408	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x9000	0x399038	0x400	295703f29cbf0cc87537f54786ed1d01	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x3a3000	0x20000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x3c3000	0x28340	0x28400	0a923a42d1a39b5e7ff4cbf67045065c	False	0.21775524068322982	data	4.016272150271427	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x3c3358	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	English	United States	0.1348337868212469
RT_ICON	0x3d3b80	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 38016	English	United States	0.24942190456169855
RT_ICON	0x3dd028	0x5488	Device independent bitmap graphic, 72 x 144 x 32, image size 21600	English	United States	0.286090573012939
RT_ICON	0x3e24b0	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	United States	0.2502952290977799
RT_ICON	0x3e66d8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.3522821576763486
RT_ICON	0x3e8c80	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.37828330206378985
RT_ICON	0x3e9d28	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.4668032786885246
RT_ICON	0x3ea6b0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.5106382978723404
RT_DIALOG	0x3eab18	0x100	data	English	United States	0.5234375
RT_DIALOG	0x3eac18	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0x3ead38	0xc4	data	English	United States	0.5918367346938775
RT_DIALOG	0x3eae00	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x3eae60	0x76	data	English	United States	0.7542372881355932
RT_VERSION	0x3eaed8	0x128	data	English	United States	0.6114864864864865
RT_MANIFEST	0x3eb000	0x33e	XML 1.0 document, ASCII text, with very long lines (830), with no line terminators	English	United States	0.5542168674698795

Imports

DLL	Import
KERNEL32.dll	SetEnvironmentVariableA, Sleep, GetTickCount, GetFileSize, GetModuleFileNameA, GetCurrentProcess, CopyFileA, GetFileAttributesA, SetFileAttributesA, GetWindowsDirectoryA, GetTempPathA, GetCommandLineA, lstrlenA, GetVersion, SetErrorMode, lstrcpynA, ExitProcess, GetFullPathNameA, GlobalLock, CreateThread, GetLastError, CreateDirectoryA, CreateProcessA, RemoveDirectoryA, CreateFileA, GetTempFileNameA, ReadFile, WriteFile, lstrcpyA, MoveFileExA, lstrcatA, GetSystemDirectoryA, GetProcAddress, CloseHandle, SetCurrentDirectoryA, MoveFileA, CompareFileTime, GetShortPathNameA, SearchPathA, lstrcmpiA, SetFileTime, lstrcmpA, ExpandEnvironmentStringsA, GlobalUnlock, GetDiskFreeSpaceA, GlobalFree, FindFirstFileA, FindNextFileA, DeleteFileA, SetFilePointer, GetPrivateProfileStringA, FindClose, MultiByteToWideChar, FreeLibrary, MulDiv, WritePrivateProfileStringA, LoadLibraryExA, GetModuleHandleA, GetExitCodeProcess, WaitForSingleObject, GlobalAlloc
USER32.dll	ScreenToClient, GetSystemMenu, SetClassLongA, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongA, SetCursor, LoadCursorA, CheckDlgButton, GetMessagePos, LoadBitmapA, CallWindowProcA, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, PostQuitMessage, GetWindowRect, EnableMenuItem, CreatePopupMenu, GetSystemMetrics, SetDlgItemTextA, GetDlgItemTextA, MessageBoxIndirectA, CharPrevA, DispatchMessageA, PeekMessageA, ReleaseDC, EnableWindow, InvalidateRect, SendMessageA, DefWindowProcA, BeginPaint, GetClientRect, FillRect, DrawTextA, EndDialog, RegisterClassA, SystemParametersInfoA, CreateWindowExA, GetClassInfoA, DialogBoxParamA, CharNextA, ExitWindowsEx, GetDC, CreateDialogParamA, SetTimer, GetDlgItem, SetWindowLongA, SetForegroundWindow, LoadImageA, IsWindow, SendMessageTimeoutA, FindWindowExA, OpenClipboard, TrackPopupMenu, AppendMenuA, EndPaint, DestroyWindow, wsprintfA, ShowWindow, SetWindowTextA
GDI32.dll	SelectObject, SetBkMode, CreateFontIndirectA, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, SHGetPathFromIDListA, SHBrowseForFolderA, SHGetFileInfoA, ShellExecuteA, SHFileOperationA
ADVAPI32.dll	RegDeleteKeyA, SetFileSecurityA, OpenProcessToken, LookupPrivilegeValueA, AdjustTokenPrivileges, RegOpenKeyExA, RegEnumValueA, RegDeleteValueA, RegCloseKey, RegCreateKeyExA, RegSetValueExA, RegQueryValueExA, RegEnumKeyA
COMCTL32.dll	ImageList_Create, ImageList_AddMasked, ImageList_Destroy
ole32.dll	OleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 15:22:12.212737083 CET	57686	53	192.168.2.9	162.159.36.2
Jan 10, 2025 15:22:12.218421936 CET	53	57686	162.159.36.2	192.168.2.9
Jan 10, 2025 15:22:12.218549013 CET	57686	53	192.168.2.9	162.159.36.2
Jan 10, 2025 15:22:12.225150108 CET	53	57686	162.159.36.2	192.168.2.9
Jan 10, 2025 15:22:12.704155922 CET	57686	53	192.168.2.9	162.159.36.2
Jan 10, 2025 15:22:12.709167004 CET	53	57686	162.159.36.2	192.168.2.9
Jan 10, 2025 15:22:12.709223032 CET	57686	53	192.168.2.9	162.159.36.2

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 15:22:12.211992025 CET	53	55329	162.159.36.2	192.168.2.9
Jan 10, 2025 15:22:12.714577913 CET	49544	53	192.168.2.9	1.1.1.1
Jan 10, 2025 15:22:12.721642971 CET	53	49544	1.1.1.1	192.168.2.9

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 15:22:12.714577913 CET	192.168.2.9	1.1.1.1	0x69ce	Standard query (0)	15.164.165.52.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 15:21:39.179152012 CET	1.1.1.1	192.168.2.9	0x1075	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 15:21:39.179152012 CET	1.1.1.1	192.168.2.9	0x1075	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Jan 10, 2025 15:22:12.721642971 CET	1.1.1.1	192.168.2.9	0x69ce	Name error (3)	15.164.165.52.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false

Target ID:	0
Start time:	09:21:41
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\nRNzqQOQwk.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\nRNzqQOQwk.exe"
Imagebase:	0x400000
File size:	616'800 bytes
MD5 hash:	C616C105A117D63DE2B4F818C8FDD3E0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.3789872839.000000000414B000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	16.9%
Dynamic/Decrypted Code Coverage:	14.4%
Signature Coverage:	21.5%
Total number of Nodes:	1468
Total number of Limit Nodes:	37

Executed Functions

Function 00403180 Relevance: 91.4, APIs: 33, Strings: 19, Instructions: 357
stringcomfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE ref: 004031A5
GetVersion.KERNEL32 ref: 004031AB
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 004031D4
#17.COMCTL32(00000007,00000009), ref: 004031F6
OleInitialize.OLE32(00000000), ref: 004031FD
SHGetFileInfoA.SHELL32(0079D500,00000000,?,00000160,00000000), ref: 00403219
GetCommandLineA.KERNEL32(Pongids Setup,NSIS Error), ref: 0040322E
GetModuleHandleA.KERNEL32(00000000,"C:\Users\user\Desktop\nRNzqQOQwk.exe",00000000), ref: 00403241
CharNextA.USER32(00000000,"C:\Users\user\Desktop\nRNzqQOQwk.exe",00000020), ref: 0040326C
GetTempPathA.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,00000000,00000020), ref: 00403369
GetWindowsDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 0040337A
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 00403386
GetTempPathA.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp), ref: 0040339A
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low), ref: 004033A2
SetEnvironmentVariableA.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low), ref: 004033B3
SetEnvironmentVariableA.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\), ref: 004033BB
DeleteFileA.KERNELBASE(1033), ref: 004033CF

Part of subcall function 00406139: GetModuleHandleA.KERNEL32(?,?,?,004031EA,00000009), ref: 0040614B
Part of subcall function 00406139: GetProcAddress.KERNEL32(00000000,?), ref: 00406166

OleUninitialize.OLE32(?), ref: 0040347D
ExitProcess.KERNEL32 ref: 0040349E
GetCurrentProcess.KERNEL32(00000028,?), ref: 004035BB
OpenProcessToken.ADVAPI32(00000000), ref: 004035C2
LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 004035DA
AdjustTokenPrivileges.ADVAPI32(?,?,?,?,00000000,?,00000000,00000000,00000000), ref: 004035F9
ExitWindowsEx.USER32(00000002,80040002), ref: 0040361D
ExitProcess.KERNEL32 ref: 00403640

Part of subcall function 00405596: MessageBoxIndirectA.USER32(00409218), ref: 004055F1

Strings

C:\Users\user\slavelivets, xrefs: 0040334E, 0040344F, 004034F9, 00403502
\Temp, xrefs: 00403380
1033, xrefs: 004033CA
Pongids Setup, xrefs: 00403224
NSIS Error, xrefs: 0040321F
C:\Users\user\AppData\Local\Temp\, xrefs: 0040335E, 00403363, 00403379, 00403385, 00403394, 004033A1, 004033AD, 004033B5, 004034AE, 004034BF, 004034CA, 004034D6, 004034E3, 004034F2, 004035A1
UXTHEME, xrefs: 004031C8, 004031CD, 004031D3
", xrefs: 00403291
Low, xrefs: 0040339C
"C:\Users\user\Desktop\nRNzqQOQwk.exe", xrefs: 00403234, 0040323A, 004033F3
C:\Users\user\Desktop, xrefs: 004034D0, 004034D5, 00403501
Error launching installer, xrefs: 00403435
C:\Users\user\Desktop\nRNzqQOQwk.exe, xrefs: 0040355B
.tmp, xrefs: 004034C5
TMP, xrefs: 004033B6
~nsu, xrefs: 004034A9
TEMP, xrefs: 004033AE
C:\Users\user\slavelivets, xrefs: 0040345A
SeShutdownPrivilege, xrefs: 004035D4

Memory Dump Source

Source File: 00000000.00000002.3789251743.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3789230297.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789271823.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: Process$Exit$EnvironmentFileHandleModulePathTempTokenVariableWindowslstrcat$AddressAdjustCharCommandCurrentDeleteDirectoryErrorIndirectInfoInitializeLineLookupMessageModeNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrlen
String ID: "$"C:\Users\user\Desktop\nRNzqQOQwk.exe"$.tmp$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\nRNzqQOQwk.exe$C:\Users\user\slavelivets$C:\Users\user\slavelivets$Error launching installer$Low$NSIS Error$Pongids Setup$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
API String ID: 3329125770-738695933
Opcode ID: bbf1fb5b53fc7b28b57eed0d95e8f77975159f1cadf5f6a8baec224272584505
Instruction ID: 9be49b359e088d3119d2258a489a24960a077000951b0681bd3593dcca7d42e2
Opcode Fuzzy Hash: bbf1fb5b53fc7b28b57eed0d95e8f77975159f1cadf5f6a8baec224272584505
Instruction Fuzzy Hash: 03C107706086816EE7116F719D4DA2F3EACAF86306F44457FF482B52E2C77C4A058B2E

Function 10001A5D Relevance: 20.0, APIs: 13, Instructions: 540stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 10001215: GlobalAlloc.KERNEL32(00000040,10001233,?,100012CF,-1000404B,100011AB,-000000A0), ref: 1000121D

GlobalAlloc.KERNELBASE(00000040,000014A4), ref: 10001B67
lstrcpyA.KERNEL32(00000008,?), ref: 10001BAF
lstrcpyA.KERNEL32(00000408,?), ref: 10001BB9
GlobalFree.KERNEL32(00000000), ref: 10001BCC
GlobalFree.KERNEL32(?), ref: 10001CC4
GlobalFree.KERNEL32(?), ref: 10001CC9
GlobalFree.KERNEL32(?), ref: 10001CCE
GlobalFree.KERNEL32(00000000), ref: 10001E76
lstrcpyA.KERNEL32(?,?), ref: 10001FCA

Memory Dump Source

Source File: 00000000.00000002.3796539761.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3796514530.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.3796598036.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.3796620571.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_nRNzqQOQwk.jbxd

Similarity

API ID: Global$Free$lstrcpy$Alloc
String ID:
API String ID: 4227406936-0
Opcode ID: 108015169a1f9511be137f3b76d088d284be53ebd3be1ec406ce9b744c5ee79e
Instruction ID: 780798ea066e4ece118e8e5fed0bf18c828ec290136deaf2e43fc5d0554b8685
Opcode Fuzzy Hash: 108015169a1f9511be137f3b76d088d284be53ebd3be1ec406ce9b744c5ee79e
Instruction Fuzzy Hash: 17129971D0424ADFFB20CFA4C8847EEBBF4FB043C4F61852AD5A1A2199DB749A81CB51

Function 00405DC2 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 199
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32(00000006,0079DD20,00000000,00404FF1,0079DD20,00000000), ref: 00405E73
GetSystemDirectoryA.KERNEL32(Call,00000400), ref: 00405EEE
GetWindowsDirectoryA.KERNEL32(Call,00000400), ref: 00405F01
SHGetSpecialFolderLocation.SHELL32(?,0078FCF8), ref: 00405F3D
SHGetPathFromIDListA.SHELL32(0078FCF8,Call), ref: 00405F4B
CoTaskMemFree.OLE32(0078FCF8), ref: 00405F56
lstrcatA.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch), ref: 00405F78
lstrlenA.KERNEL32(Call,00000006,0079DD20,00000000,00404FF1,0079DD20,00000000), ref: 00405FCA

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 00405EBD
Call, xrefs: 00405DE9, 00405EBB, 00405ED8, 00405EED, 00405F00, 00405F1C, 00405F47, 00405F77, 00405F7D, 00405F95, 00405FA8, 00405FC3, 00405FC9, 00405FD4, 00405FFE
\Microsoft\Internet Explorer\Quick Launch, xrefs: 00405F72

Memory Dump Source

Source File: 00000000.00000002.3789251743.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3789230297.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789271823.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
String ID: Call$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 900638850-1230650788
Opcode ID: 8aaebd9e83df3b37401bec0d629d687f6ba259a9d136d118ad02b0f801d1bc8a
Instruction ID: 6cdfcc9d134e5fa542626d346f44b404821d9f3efcf53b1aa70e88c92b4f8a03
Opcode Fuzzy Hash: 8aaebd9e83df3b37401bec0d629d687f6ba259a9d136d118ad02b0f801d1bc8a
Instruction Fuzzy Hash: A4610271A04A06AEEB115B24CC84BBF3BA8EB56314F54813BE541BA2D0D37D4981DF4E

Function 00405642 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 159
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileA.KERNELBASE(?,?,76F93410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 0040566B
lstrcatA.KERNEL32(0079F548,\*.*,0079F548,?,?,76F93410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 004056B3
lstrcatA.KERNEL32(?,00409014,?,0079F548,?,?,76F93410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 004056D4
lstrlenA.KERNEL32(?,?,00409014,?,0079F548,?,?,76F93410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 004056DA
FindFirstFileA.KERNEL32(0079F548,?,?,?,00409014,?,0079F548,?,?,76F93410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 004056EB
FindNextFileA.KERNEL32(00000000,00000010,000000F2,?,?,?,00000000,?,?,0000003F), ref: 00405798
FindClose.KERNEL32(00000000), ref: 004057A9

Strings

\*.*, xrefs: 004056AD
C:\Users\user\AppData\Local\Temp\, xrefs: 0040564F
"C:\Users\user\Desktop\nRNzqQOQwk.exe", xrefs: 00405642

Memory Dump Source

Source File: 00000000.00000002.3789251743.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3789230297.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789271823.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\Desktop\nRNzqQOQwk.exe"$C:\Users\user\AppData\Local\Temp\$\*.*
API String ID: 2035342205-4123645989
Opcode ID: 66d41853b2e100f8aa5dc84de00091d649ca301df736d3cc4483c22267dac329
Instruction ID: 760187f4f4892300bbc2109203202489edd73d97d78a60d5512a31c146a0733f
Opcode Fuzzy Hash: 66d41853b2e100f8aa5dc84de00091d649ca301df736d3cc4483c22267dac329
Instruction Fuzzy Hash: 8F51D631804A08EADB216B618C45BBF7B78DF42714F14813BF955721D1D77C8982EE6E

Function 00402B0E Relevance: 7.6, APIs: 5, Instructions: 67
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(?,?,00000000,00000000,?), ref: 00402B2F
RegEnumKeyA.ADVAPI32(?,00000000,?,00000105), ref: 00402B6B
RegCloseKey.ADVAPI32(?), ref: 00402B74
RegCloseKey.ADVAPI32(?), ref: 00402B99
RegDeleteKeyA.ADVAPI32(?,?), ref: 00402BB7

Memory Dump Source

Source File: 00000000.00000002.3789251743.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3789230297.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789271823.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 835a18ee0712391a14b10fd83abfdacb871c0e1db67dd3faae47ba34dcff1796
Instruction ID: e8770432982ab8decd1ca443e4f50ff6a20a1eaa2a88b85c41c9a6e6fa4e92e0
Opcode Fuzzy Hash: 835a18ee0712391a14b10fd83abfdacb871c0e1db67dd3faae47ba34dcff1796
Instruction Fuzzy Hash: 49117F36900109FFEF119F90DE89DAE3B7DEB55384F004076FA05B10A0D3B8AE51AB69

Function 004060A4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNELBASE(76F93410,0079FD90,C:\,00405943,C:\,C:\,00000000,C:\,C:\,76F93410,?,C:\Users\user\AppData\Local\Temp\,00405662,?,76F93410,C:\Users\user\AppData\Local\Temp\), ref: 004060AF
FindClose.KERNELBASE(00000000), ref: 004060BB

Strings

C:\, xrefs: 004060A4

Memory Dump Source

Source File: 00000000.00000002.3789251743.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3789230297.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789271823.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: C:\
API String ID: 2295610775-3404278061
Opcode ID: d30bbc16997dfcf9f9a572ec6341a2188e66bfdc939d37fad3f946c8dc482195
Instruction ID: 4d264840bddbdcf8954fb0232b098af143b8be61859f100819b52cc90bd9207d
Opcode Fuzzy Hash: d30bbc16997dfcf9f9a572ec6341a2188e66bfdc939d37fad3f946c8dc482195
Instruction Fuzzy Hash: AAD0127595A1205BC71197787C0C84B7A589B053307114A32F46AF22E0D6349C7686E9

Function 00403720 Relevance: 47.5, APIs: 13, Strings: 14, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406139: GetModuleHandleA.KERNEL32(?,?,?,004031EA,00000009), ref: 0040614B
Part of subcall function 00406139: GetProcAddress.KERNEL32(00000000,?), ref: 00406166

lstrcatA.KERNEL32(1033,0079E540,80000001,Control Panel\Desktop\ResourceLocale,00000000,0079E540,00000000,00000002,76F93410,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\nRNzqQOQwk.exe",00000000), ref: 0040379B
lstrlenA.KERNEL32(Call,?,?,?,Call,00000000,C:\Users\user\slavelivets,1033,0079E540,80000001,Control Panel\Desktop\ResourceLocale,00000000,0079E540,00000000,00000002,76F93410), ref: 00403810
lstrcmpiA.KERNEL32(?,.exe), ref: 00403823
GetFileAttributesA.KERNEL32(Call), ref: 0040382E
LoadImageA.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\slavelivets), ref: 00403877

Part of subcall function 00405CFE: wsprintfA.USER32 ref: 00405D0B

RegisterClassA.USER32(007A16E0), ref: 004038B4
SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 004038CC
CreateWindowExA.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403901
ShowWindow.USER32(00000005,00000000), ref: 00403937
GetClassInfoA.USER32(00000000,RichEdit20A,007A16E0), ref: 00403963
GetClassInfoA.USER32(00000000,RichEdit,007A16E0), ref: 00403970
RegisterClassA.USER32(007A16E0), ref: 00403979
DialogBoxParamA.USER32(?,00000000,00403AB2,00000000), ref: 00403998

Strings

C:\Users\user\slavelivets, xrefs: 004037AA, 004037B2, 0040384A, 00403850, 00403860
RichEdit20A, xrefs: 0040395B, 00403961
1033, xrefs: 00403740, 00403796
RichEdit, xrefs: 0040396A
C:\Users\user\AppData\Local\Temp\, xrefs: 00403725
_Nb, xrefs: 00403893, 004038FB
RichEd32, xrefs: 0040394B
RichEd20, xrefs: 0040393D
"C:\Users\user\Desktop\nRNzqQOQwk.exe", xrefs: 00403724
@y, xrefs: 0040374C
.DEFAULT\Control Panel\International, xrefs: 00403786
Call, xrefs: 004037DE, 004037E6, 004037F3, 0040383D, 00403843
Control Panel\Desktop\ResourceLocale, xrefs: 00403754
.exe, xrefs: 0040381D

Memory Dump Source

Source File: 00000000.00000002.3789251743.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3789230297.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789271823.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\Desktop\nRNzqQOQwk.exe"$.DEFAULT\Control Panel\International$.exe$1033$@y$C:\Users\user\AppData\Local\Temp\$C:\Users\user\slavelivets$Call$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb
API String ID: 1975747703-971541054
Opcode ID: 72abac218aef0aa68c8201db2a2c7bc2da9bafc71593619d8738dd7e58f1acdc
Instruction ID: 69823c21e20ed545a36681f3e22a73ce5ba8c54c43716b07ce110ef4df70eff0
Opcode Fuzzy Hash: 72abac218aef0aa68c8201db2a2c7bc2da9bafc71593619d8738dd7e58f1acdc
Instruction Fuzzy Hash: 1361D6B5544240AEE310BF619C45F3B3AACEB85789F40857FF941B22E2D77D9D018A2D

Function 00402CFA Relevance: 28.2, APIs: 5, Strings: 11, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402D0B
GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\nRNzqQOQwk.exe,00000400), ref: 00402D27

Part of subcall function 00405A13: GetFileAttributesA.KERNELBASE(?,00402D3A,C:\Users\user\Desktop\nRNzqQOQwk.exe,80000000,?), ref: 00405A17
Part of subcall function 00405A13: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405A39

GetFileSize.KERNEL32(00000000,00000000,007AA000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\nRNzqQOQwk.exe,C:\Users\user\Desktop\nRNzqQOQwk.exe,80000000,?), ref: 00402D73

Strings

Error launching installer, xrefs: 00402D4A
Inst, xrefs: 00402DDF
`i, xrefs: 00402D7B
soft, xrefs: 00402DE8
C:\Users\user\Desktop\nRNzqQOQwk.exe, xrefs: 00402D11, 00402D20, 00402D34, 00402D54
C:\Users\user\AppData\Local\Temp\, xrefs: 00402D01
"C:\Users\user\Desktop\nRNzqQOQwk.exe", xrefs: 00402CFA
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error, xrefs: 00402ED2
T, xrefs: 00402E00, 00402E5D
Null, xrefs: 00402DF1
C:\Users\user\Desktop, xrefs: 00402D55, 00402D5A, 00402D60

Memory Dump Source

Source File: 00000000.00000002.3789251743.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3789230297.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789271823.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: T$"C:\Users\user\Desktop\nRNzqQOQwk.exe"$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\nRNzqQOQwk.exe$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error$Null$`i$soft
API String ID: 4283519449-467953008
Opcode ID: 01abee4385eb3164d7f4254af187e376370b625cc9aa48c6f885a033e7c9399e
Instruction ID: 3261349ff2f4a6e0e52cb66aedc5a428c749111a9fc88119453a55b84fe8b48b
Opcode Fuzzy Hash: 01abee4385eb3164d7f4254af187e376370b625cc9aa48c6f885a033e7c9399e
Instruction Fuzzy Hash: 9A510671940215AFDB119F60DE89B9E7BB8EB44364F20413BF904B62D1D7BC8D408B9D

Function 00401759 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 147
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatA.KERNEL32(00000000,00000000,Call,C:\Users\user\slavelivets,00000000,00000000,00000031), ref: 00401798
CompareFileTime.KERNEL32(-00000014,?,Call,Call,00000000,00000000,Call,C:\Users\user\slavelivets,00000000,00000000,00000031), ref: 004017C2

Part of subcall function 00405DA0: lstrcpynA.KERNEL32(?,?,00000400,0040322E,Pongids Setup,NSIS Error), ref: 00405DAD

Part of subcall function 00404FB9: lstrlenA.KERNEL32(0079DD20,00000000,0078FCF8,76F923A0,?,?,?,?,?,?,?,?,?,0040306B,00000000,?), ref: 00404FF2
Part of subcall function 00404FB9: lstrlenA.KERNEL32(0040306B,0079DD20,00000000,0078FCF8,76F923A0,?,?,?,?,?,?,?,?,?,0040306B,00000000), ref: 00405002
Part of subcall function 00404FB9: lstrcatA.KERNEL32(0079DD20,0040306B,0040306B,0079DD20,00000000,0078FCF8,76F923A0), ref: 00405015
Part of subcall function 00404FB9: SetWindowTextA.USER32(0079DD20,0079DD20), ref: 00405027
Part of subcall function 00404FB9: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 0040504D
Part of subcall function 00404FB9: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00405067
Part of subcall function 00404FB9: SendMessageA.USER32(?,00001013,?,00000000), ref: 00405075

Strings

C:\Users\user\AppData\Local\Temp\nsp9F8A.tmp, xrefs: 004017A3, 00401812, 00401830
C:\Users\user\slavelivets, xrefs: 00401786
C:\Users\user\AppData\Local\Temp\nsp9F8A.tmp\System.dll, xrefs: 00401826, 00401842
Call, xrefs: 00401775, 0040177E, 0040178B, 0040179D, 004017AE, 004017E4, 004017FA, 00401818, 00401858, 004018D9, 004018E2, 004018EC, 004018F7

Memory Dump Source

Source File: 00000000.00000002.3789251743.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3789230297.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789271823.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Local\Temp\nsp9F8A.tmp$C:\Users\user\AppData\Local\Temp\nsp9F8A.tmp\System.dll$C:\Users\user\slavelivets$Call
API String ID: 1941528284-3652099504
Opcode ID: cdcb808499d7bb2f0a4c73bf048b8b395a32dade74052f7c380448fa0df2b33b
Instruction ID: dbbb128bf7935f0aed0e50e9380fc9841c9442f81e714e1827c6660095eaabca
Opcode Fuzzy Hash: cdcb808499d7bb2f0a4c73bf048b8b395a32dade74052f7c380448fa0df2b33b
Instruction Fuzzy Hash: FE41E772910515BACB107BB5CC49DAF7AB9EF45368B20C23BF121F10E1C77C8A418A6D

Function 0040547F Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\), ref: 004054C2
GetLastError.KERNEL32 ref: 004054D6
SetFileSecurityA.ADVAPI32(?,80000007,00000001), ref: 004054EB
GetLastError.KERNEL32 ref: 004054F5

Strings

ts@, xrefs: 00405485
C:\Users\user\AppData\Local\Temp\, xrefs: 004054A5
ds@, xrefs: 004054B4
C:\Users\user\Desktop, xrefs: 0040547F

Memory Dump Source

Source File: 00000000.00000002.3789251743.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3789230297.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789271823.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$ds@$ts@
API String ID: 3449924974-3398839520
Opcode ID: f69d3160a82a2859f106a017fa20b71bd819ec85ae22b078452fa26fbc967781
Instruction ID: 09fe99030eccae78cb9d2ce19bbf77f9f972de75acbbd1990c032815ad2a971a
Opcode Fuzzy Hash: f69d3160a82a2859f106a017fa20b71bd819ec85ae22b078452fa26fbc967781
Instruction Fuzzy Hash: 2F010871D14259EADF119BA4C944BEFBFB8EB14315F00417AE904B6280E378A644CFAA

Function 00401D95 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDC.USER32(?), ref: 00401D98
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401DB2
MulDiv.KERNEL32(00000000,00000000), ref: 00401DBA
ReleaseDC.USER32(?,00000000), ref: 00401DCB
CreateFontIndirectA.GDI32(0040A7F0), ref: 00401E1A

Strings

Times New Roman, xrefs: 00401E00

Memory Dump Source

Source File: 00000000.00000002.3789251743.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3789230297.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789271823.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID: Times New Roman
API String ID: 3808545654-927190056
Opcode ID: 648d7b0dc9db80ea036042f47a1e498ac7e57b814f90c6129580178fecebfba8
Instruction ID: 37723da549b7de6e047f5ddf6566bf04a0332ae81d9da388354d8b2e576e77f8
Opcode Fuzzy Hash: 648d7b0dc9db80ea036042f47a1e498ac7e57b814f90c6129580178fecebfba8
Instruction Fuzzy Hash: 3A015272948340AFE7006B70AE49F9A3FF4AB55315F10847AF241B62E2C6B904569B3E

Function 004060CB Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryA.KERNEL32(?,00000104), ref: 004060E2
wsprintfA.USER32 ref: 0040611B
LoadLibraryExA.KERNELBASE(?,00000000,00000008), ref: 0040612F

Strings

%s%s.dll, xrefs: 00406115
UXTHEME, xrefs: 004060D4
\, xrefs: 004060F3

Memory Dump Source

Source File: 00000000.00000002.3789251743.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3789230297.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789271823.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%s.dll$UXTHEME$\
API String ID: 2200240437-4240819195
Opcode ID: 38f932dad6d10820f3564912fa7e39c047c8ada2afd73a6a353afcde48b08f1a
Instruction ID: e39d6de12310bdbc02ec2e887020ee50980fcceaee6e7f6f8e64b4e94942106c
Opcode Fuzzy Hash: 38f932dad6d10820f3564912fa7e39c047c8ada2afd73a6a353afcde48b08f1a
Instruction Fuzzy Hash: 80F0FC30A40115A6EF1497A4DC0DFEB365CAB08305F140176A547E51D2D5B8E9248B69

Function 00402F33 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 161
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402F9A
GetTickCount.KERNEL32 ref: 0040301E
MulDiv.KERNEL32(7FFFFFFF,00000064,00000020), ref: 00403047
wsprintfA.USER32 ref: 00403057

Strings

... %d%%, xrefs: 00403051

Memory Dump Source

Source File: 00000000.00000002.3789251743.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3789230297.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789271823.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: CountTick$wsprintf
String ID: ... %d%%
API String ID: 551687249-2449383134
Opcode ID: 85c538cc075ba04794855290aa18cdf04ceba737772e139ba8f68ecbd5a835b1
Instruction ID: c8fbb3e8d9104581ad396ff7879acfc5b753e67115e275f424ba67d933986381
Opcode Fuzzy Hash: 85c538cc075ba04794855290aa18cdf04ceba737772e139ba8f68ecbd5a835b1
Instruction Fuzzy Hash: 6551A27280121AABCB10DF65DA44A9F7BB8EF44756F10413BF800B72C5C7788E51DBAA

Function 004023D3 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExA.KERNELBASE(00000000,00000000,?,?,?,00000000,?,?,?,00000011,00000002), ref: 00402411
lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsp9F8A.tmp,00000023,?,?,?,00000000,?,?,?,00000011,00000002), ref: 00402431
RegSetValueExA.KERNELBASE(?,?,?,?,C:\Users\user\AppData\Local\Temp\nsp9F8A.tmp,00000000,?,?,?,00000000,?,?,?,00000011,00000002), ref: 0040246E
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nsp9F8A.tmp,00000000,?,?,?,00000000,?,?,?,00000011,00000002), ref: 0040254F

Strings

C:\Users\user\AppData\Local\Temp\nsp9F8A.tmp, xrefs: 00402422, 00402430, 00402444, 00402458, 00402463

Memory Dump Source

Source File: 00000000.00000002.3789251743.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3789230297.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789271823.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: CloseCreateValuelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsp9F8A.tmp
API String ID: 1356686001-1975534377
Opcode ID: 58ca12bb9b10d669de694a7c47c1b43db751d89a42ce97c50d122ce1fa55df52
Instruction ID: 00e854f1b6d20388f4b464fcc1b804607db5fe0ac9957b4d3390b69bb90c797e
Opcode Fuzzy Hash: 58ca12bb9b10d669de694a7c47c1b43db751d89a42ce97c50d122ce1fa55df52
Instruction Fuzzy Hash: 3921A1B1E00109BEEB00EFA4DE49EAF7A78EB50358F20403AF505B61D1C6B85D019B28

Function 00405A42 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405A56
GetTempFileNameA.KERNELBASE(?,?,00000000,?), ref: 00405A70

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405A45
nsa, xrefs: 00405A4D
"C:\Users\user\Desktop\nRNzqQOQwk.exe", xrefs: 00405A42

Memory Dump Source

Source File: 00000000.00000002.3789251743.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3789230297.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789271823.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: "C:\Users\user\Desktop\nRNzqQOQwk.exe"$C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-1669564857
Opcode ID: a71f6d19a672690ae76045f6a92713abfaab32ef542e638d1cc3651a1fbf987a
Instruction ID: a3d8867ec022398f00e7cc0b64f9ef92c2764b579e17a6718397eb4594f2c545
Opcode Fuzzy Hash: a71f6d19a672690ae76045f6a92713abfaab32ef542e638d1cc3651a1fbf987a
Instruction Fuzzy Hash: 07F0E2327082047BDB108F55EC44B9B7B9CDF91750F10C037FE049A180D2B198448F59

Function 100016BD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 118
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 10001A5D: GlobalFree.KERNEL32(?), ref: 10001CC4
Part of subcall function 10001A5D: GlobalFree.KERNEL32(?), ref: 10001CC9
Part of subcall function 10001A5D: GlobalFree.KERNEL32(?), ref: 10001CCE

GlobalFree.KERNEL32(00000000), ref: 10001768
FreeLibrary.KERNEL32(?), ref: 100017DF
GlobalFree.KERNEL32(00000000), ref: 10001804

Part of subcall function 100021B0: GlobalAlloc.KERNEL32(00000040,7D8BEC45), ref: 100021E2

Part of subcall function 10002589: GlobalAlloc.KERNEL32(00000040,?,?,?,00000000,?,?,?,?,10001739,00000000), ref: 100025FB

Part of subcall function 10001559: lstrcpyA.KERNEL32(00000000,10004010,00000000,10001695,00000000), ref: 10001572

Strings

, xrefs: 100017E5

Memory Dump Source

Source File: 00000000.00000002.3796539761.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3796514530.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.3796598036.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.3796620571.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_nRNzqQOQwk.jbxd

Similarity

API ID: Global$Free$Alloc$Librarylstrcpy
String ID:
API String ID: 1791698881-3916222277
Opcode ID: ee4c9fc9ebc314f30cf8369a5322713cb2bdaef71cd7754c4cd252d6b1501433
Instruction ID: 7bd52774c71d274dd6e07030a7ef65efb9a892d3f5f2eddd47f658e3267813e4
Opcode Fuzzy Hash: ee4c9fc9ebc314f30cf8369a5322713cb2bdaef71cd7754c4cd252d6b1501433
Instruction Fuzzy Hash: B5319C79408205DAFB41DF649CC5BCA37ECFF042D5F018465FA0A9A09EDF78A8858B60

Function 00405900 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00405DA0: lstrcpynA.KERNEL32(?,?,00000400,0040322E,Pongids Setup,NSIS Error), ref: 00405DAD

Part of subcall function 004058AB: CharNextA.USER32(?,?,C:\,?,00405917,C:\,C:\,76F93410,?,C:\Users\user\AppData\Local\Temp\,00405662,?,76F93410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 004058B9
Part of subcall function 004058AB: CharNextA.USER32(00000000), ref: 004058BE
Part of subcall function 004058AB: CharNextA.USER32(00000000), ref: 004058D2

lstrlenA.KERNEL32(C:\,00000000,C:\,C:\,76F93410,?,C:\Users\user\AppData\Local\Temp\,00405662,?,76F93410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405953
GetFileAttributesA.KERNELBASE(C:\,C:\,C:\,C:\,C:\,C:\,00000000,C:\,C:\,76F93410,?,C:\Users\user\AppData\Local\Temp\,00405662,?,76F93410,C:\Users\user\AppData\Local\Temp\), ref: 00405963

Strings

C:\, xrefs: 00405906, 0040590B, 00405911, 0040594C, 00405952, 0040595A, 00405962
C:\Users\user\AppData\Local\Temp\, xrefs: 00405900

Memory Dump Source

Source File: 00000000.00000002.3789251743.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3789230297.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789271823.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: C:\$C:\Users\user\AppData\Local\Temp\
API String ID: 3248276644-263117582
Opcode ID: 2b232cbcfe35a2a259e0e65083c3ab1013c8774cdbeba63489dc7f6696da3121
Instruction ID: 7328fd33adb38864c40c3ad9044401c3b5e3aae7bd0e1b9e961d96be1e2df883
Opcode Fuzzy Hash: 2b232cbcfe35a2a259e0e65083c3ab1013c8774cdbeba63489dc7f6696da3121
Instruction Fuzzy Hash: D5F0A466115D6096D722333A1C05B9F1A48CEC2374759453BF891F12D2DB3C8953DD7E

Function 00401FFF Relevance: 6.1, APIs: 4, Instructions: 73libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNELBASE(00000000,00000001,000000F0), ref: 0040202A

Part of subcall function 00404FB9: lstrlenA.KERNEL32(0079DD20,00000000,0078FCF8,76F923A0,?,?,?,?,?,?,?,?,?,0040306B,00000000,?), ref: 00404FF2
Part of subcall function 00404FB9: lstrlenA.KERNEL32(0040306B,0079DD20,00000000,0078FCF8,76F923A0,?,?,?,?,?,?,?,?,?,0040306B,00000000), ref: 00405002
Part of subcall function 00404FB9: lstrcatA.KERNEL32(0079DD20,0040306B,0040306B,0079DD20,00000000,0078FCF8,76F923A0), ref: 00405015
Part of subcall function 00404FB9: SetWindowTextA.USER32(0079DD20,0079DD20), ref: 00405027
Part of subcall function 00404FB9: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 0040504D
Part of subcall function 00404FB9: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00405067
Part of subcall function 00404FB9: SendMessageA.USER32(?,00001013,?,00000000), ref: 00405075

LoadLibraryExA.KERNELBASE(00000000,?,00000008,00000001,000000F0), ref: 0040203A
GetProcAddress.KERNEL32(00000000,?), ref: 0040204A
FreeLibrary.KERNELBASE(00000000,00000000,000000F7,?,?,00000008,00000001,000000F0), ref: 004020B4

Memory Dump Source

Source File: 00000000.00000002.3789251743.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3789230297.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789271823.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$AddressFreeHandleLoadModuleProcTextWindowlstrcat
String ID:
API String ID: 2987980305-0
Opcode ID: 4202f4d316499dad14767a3dddc2a55a2a20820dc3803045f4bbb6100d55ec8c
Instruction ID: 6acd92e4f6ebcd949653744c87f359efbc1ef98484dd96508818b65b31ed9250
Opcode Fuzzy Hash: 4202f4d316499dad14767a3dddc2a55a2a20820dc3803045f4bbb6100d55ec8c
Instruction Fuzzy Hash: 5921F671E00225EBDF307FA48F48AAE7A706B45354F20023BF701B22D1C6BE4A42D65E

Function 004015BB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

Part of subcall function 004058AB: CharNextA.USER32(?,?,C:\,?,00405917,C:\,C:\,76F93410,?,C:\Users\user\AppData\Local\Temp\,00405662,?,76F93410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 004058B9
Part of subcall function 004058AB: CharNextA.USER32(00000000), ref: 004058BE
Part of subcall function 004058AB: CharNextA.USER32(00000000), ref: 004058D2

GetFileAttributesA.KERNELBASE(00000000,00000000,00000000,0000005C,00000000,000000F0), ref: 0040160D

Part of subcall function 0040547F: CreateDirectoryA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\), ref: 004054C2

SetCurrentDirectoryA.KERNELBASE(00000000,C:\Users\user\slavelivets,00000000,00000000,000000F0), ref: 0040163C

Strings

C:\Users\user\slavelivets, xrefs: 00401631

Memory Dump Source

Source File: 00000000.00000002.3789251743.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3789230297.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789271823.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID: C:\Users\user\slavelivets
API String ID: 1892508949-3386343164
Opcode ID: 6bc0dae3d02dedea01775736eece2e422667a5252a9e6a0cfe147c79ae2cd54f
Instruction ID: f4e9a0c94948f709858838e9eb50a0f2792b4ff72a3a1ac07d5dbe4c8cdc963c
Opcode Fuzzy Hash: 6bc0dae3d02dedea01775736eece2e422667a5252a9e6a0cfe147c79ae2cd54f
Instruction Fuzzy Hash: D3112731508052EBDB217BB54D409BF26B09E92324B28457FF8D2B22E2D63D4D43A63F

Function 00405C87 Relevance: 4.5, APIs: 3, Instructions: 45registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE(80000002,00405ECC,00000000,00000002,?,00000002,003804CD,?,00405ECC,80000002,Software\Microsoft\Windows\CurrentVersion,003804CD,Call,00B22445), ref: 00405CB0
RegQueryValueExA.KERNELBASE(003804CD,?,00000000,00405ECC,003804CD,00405ECC), ref: 00405CD1
RegCloseKey.KERNELBASE(?), ref: 00405CF2

Memory Dump Source

Source File: 00000000.00000002.3789251743.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3789230297.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789271823.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 0c8888e50600bbfc423f29d3e13c34afc4b2d72f1a725d9a4029968a390a76be
Instruction ID: a78e2699c87532439836dc2b9ae7a1408ac691edae8af3cd19914ba1cc6957ae
Opcode Fuzzy Hash: 0c8888e50600bbfc423f29d3e13c34afc4b2d72f1a725d9a4029968a390a76be
Instruction Fuzzy Hash: 9C015A7254420AEFEB128F65EC45EEB3FACEF14354F004436F905A6220D235D964DBA5

Function 100027E8 Relevance: 3.2, APIs: 2, Instructions: 156memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(00000000), ref: 100028A7
GetLastError.KERNEL32 ref: 100029AE

Memory Dump Source

Source File: 00000000.00000002.3796539761.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3796514530.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.3796598036.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.3796620571.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_nRNzqQOQwk.jbxd

Similarity

API ID: AllocErrorLastVirtual
String ID:
API String ID: 497505419-0
Opcode ID: 7af5c486cb8ea8547353861cfd678fbd8d20862330e18d67419e74999799b2ae
Instruction ID: 700bf99a33fcd989ee77f819fa46e2371db99389a88ce2eb288524e3b596c0af
Opcode Fuzzy Hash: 7af5c486cb8ea8547353861cfd678fbd8d20862330e18d67419e74999799b2ae
Instruction Fuzzy Hash: 9751A2BA908214DFFB10DF64DCC674937A4EB443D4F21842AEA08E726DCF34A9808B95

Function 00402483 Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402BD8: RegOpenKeyExA.KERNELBASE(00000000,?,00000000,00000022,00000000,?,?), ref: 00402C00

RegQueryValueExA.ADVAPI32(00000000,00000000,?,?,?,?), ref: 004024B3
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nsp9F8A.tmp,00000000,?,?,?,00000000,?,?,?,00000011,00000002), ref: 0040254F

Memory Dump Source

Source File: 00000000.00000002.3789251743.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3789230297.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789271823.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 4dbe4e27a5dd0c3d8049c72a419abcba5a776563f6d5143b74a27c3584d80593
Instruction ID: 0483b46094dd03155b9d0e3ed9d5b90596ace3d3fa60599072770b53af9213ab
Opcode Fuzzy Hash: 4dbe4e27a5dd0c3d8049c72a419abcba5a776563f6d5143b74a27c3584d80593
Instruction Fuzzy Hash: 8811E371A05205EFDB20CF60CA985AEBBB4AF00359F20443FE142B72C0D2B84A81DB5A

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageA.USER32(?,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000000.00000002.3789251743.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3789230297.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789271823.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: b63ad44f694a207690e677ec35bda8f999f5426b301403e6904e10af90410016
Instruction ID: 00097469377630013da62b9f7c31fbdee85021c234e60ac5accdaffcc3ed26dc
Opcode Fuzzy Hash: b63ad44f694a207690e677ec35bda8f999f5426b301403e6904e10af90410016
Instruction Fuzzy Hash: BE01F4316242209BF7194B389C04B6A3698E751354F10813BF811F62F1D678DC028B4D

Function 00402377 Relevance: 3.0, APIs: 2, Instructions: 40registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402BD8: RegOpenKeyExA.KERNELBASE(00000000,?,00000000,00000022,00000000,?,?), ref: 00402C00

RegDeleteValueA.ADVAPI32(00000000,00000000,00000033), ref: 00402396
RegCloseKey.ADVAPI32(00000000), ref: 0040239F

Memory Dump Source

Source File: 00000000.00000002.3789251743.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3789230297.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789271823.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: CloseDeleteOpenValue
String ID:
API String ID: 849931509-0
Opcode ID: 70659a9ee038d5685ea3a72684203d97b2a691ce60163f99cecfca3f3fbf0de4
Instruction ID: 60c1e4243d723511b4c64426b25872ec533dbc6a778a8c73d92c97a5d2103592
Opcode Fuzzy Hash: 70659a9ee038d5685ea3a72684203d97b2a691ce60163f99cecfca3f3fbf0de4
Instruction Fuzzy Hash: 37F0A472A00111ABD710AFA09A8E9BE72A89B40344F24043BF201B71C0D5BD5D019769

Function 00401A1E Relevance: 3.0, APIs: 2, Instructions: 30stringCOMMON

Download Yara Rule

APIs

ExpandEnvironmentStringsA.KERNELBASE(00000000,?,00000400,00000001), ref: 00401A31
lstrcmpA.KERNEL32(?,?,?,00000400,00000001), ref: 00401A44

Memory Dump Source

Source File: 00000000.00000002.3789251743.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3789230297.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789271823.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: EnvironmentExpandStringslstrcmp
String ID:
API String ID: 1938659011-0
Opcode ID: 226ebda8d49e57add1e4023c770b03d66c0131867e800262347fb4bcf4abde27
Instruction ID: 4f813d77772bd54bf890c65dc17d1f1cff84f8c3aa104cf5f65d7bfaad8725e5
Opcode Fuzzy Hash: 226ebda8d49e57add1e4023c770b03d66c0131867e800262347fb4bcf4abde27
Instruction Fuzzy Hash: 3BF08231B05241EBCB20DF659D45A9A7FE8EFD1394B10843BE145F6190D2388541DA69

Function 00406139 Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,?,004031EA,00000009), ref: 0040614B
GetProcAddress.KERNEL32(00000000,?), ref: 00406166

Part of subcall function 004060CB: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 004060E2
Part of subcall function 004060CB: wsprintfA.USER32 ref: 0040611B
Part of subcall function 004060CB: LoadLibraryExA.KERNELBASE(?,00000000,00000008), ref: 0040612F

Memory Dump Source

Source File: 00000000.00000002.3789251743.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3789230297.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789271823.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: ad31075058678b318fb1acd60a85244af91915838e2bda58b2d8d9f4dd3fd24d
Instruction ID: 8cdf97aa15b56aed8909a69d1313546704d2aaf6dd9f7bed8459987902a8e277
Opcode Fuzzy Hash: ad31075058678b318fb1acd60a85244af91915838e2bda58b2d8d9f4dd3fd24d
Instruction Fuzzy Hash: EFE08632608111AAD31067705E0493B73B89A84710302083EF506F6292D7389C2196A9

Function 00405A13 Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(?,00402D3A,C:\Users\user\Desktop\nRNzqQOQwk.exe,80000000,?), ref: 00405A17
CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405A39

Memory Dump Source

Source File: 00000000.00000002.3789251743.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3789230297.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789271823.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 8635a13517db9147ca88e6c1994c1e63e85e115acab2f3846d9047911b568965
Instruction ID: 2848333a8a5b20597e43067d17cc290ce391feab13c7f73248cb22e1b8f9cacf
Opcode Fuzzy Hash: 8635a13517db9147ca88e6c1994c1e63e85e115acab2f3846d9047911b568965
Instruction Fuzzy Hash: 5CD09E31658301AFEF098F20DD16F2EBAA2EB84B01F10962CBA82950E0D6755C159B26

Function 004054FC Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNELBASE(?,00000000,00403173,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403370), ref: 00405502
GetLastError.KERNEL32 ref: 00405510

Memory Dump Source

Source File: 00000000.00000002.3789251743.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3789230297.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789271823.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 5a69f4d8b5a7b583b3b8a13bd9b089cb74a3312a80339e25d7f83e3ab18a8421
Instruction ID: 104873d821a1170e2273ca40e0eecd38832efcbc0b1179f41fab49dbd7078dd9
Opcode Fuzzy Hash: 5a69f4d8b5a7b583b3b8a13bd9b089cb74a3312a80339e25d7f83e3ab18a8421
Instruction Fuzzy Hash: 23C04C70629501FBDA106B209E097177D55AB90745F1049766106E20F4DA749451D92E

Function 004025D7 Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3789251743.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3789230297.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789271823.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: wsprintf
String ID:
API String ID: 2111968516-0
Opcode ID: 4ba2856da63ff7f435db743ac2a14cc2248dd3629aba4a8dceb7604ea70bc87f
Instruction ID: cbf00d81cb97437f3a5b335f5c35441536f11fd869f9e222d526ef6a243a720c
Opcode Fuzzy Hash: 4ba2856da63ff7f435db743ac2a14cc2248dd3629aba4a8dceb7604ea70bc87f
Instruction Fuzzy Hash: 9521C970D0429ABEDF218B9885486AEBF749F01314F1445BFEC95B63D1C2BE8A81CF19

Function 00402695 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,?,00000000,?,?), ref: 004026B3

Part of subcall function 00405CFE: wsprintfA.USER32 ref: 00405D0B

Memory Dump Source

Source File: 00000000.00000002.3789251743.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3789230297.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789271823.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: FilePointerwsprintf
String ID:
API String ID: 327478801-0
Opcode ID: abf4405e99e4dcb85fe8fe58243fd46f792263ec105484f86c7cee990d7a89bb
Instruction ID: fecccce0915ab20f046520e702d9d3c2ebd546ffbad39029680d96f2603726cc
Opcode Fuzzy Hash: abf4405e99e4dcb85fe8fe58243fd46f792263ec105484f86c7cee990d7a89bb
Instruction Fuzzy Hash: B8E01BB1B05115AFD701EB956A4987F7769DF40328F10443BF141F50D1C67E4D429B6D

Function 004022F2 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

WritePrivateProfileStringA.KERNEL32(00000000,00000000,?,00000000), ref: 0040232B

Memory Dump Source

Source File: 00000000.00000002.3789251743.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3789230297.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789271823.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: PrivateProfileStringWrite
String ID:
API String ID: 390214022-0
Opcode ID: 6b5e48cc008279052f1a47b51cc32cf127a00dc2733201354761e156b3ebbbdf
Instruction ID: 5f6267e841dd840bf6295cbe1617e7a0042591bb1814ca2e8a4844537e2a2c78
Opcode Fuzzy Hash: 6b5e48cc008279052f1a47b51cc32cf127a00dc2733201354761e156b3ebbbdf
Instruction Fuzzy Hash: 67E04F31B001246BD7307AB10F8E97F10999BC4304B39153ABA01B62C6EDBC4C414AB9

Function 0040171F Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

SearchPathA.KERNELBASE(?,00000000,?,00000400,?,?,000000FF), ref: 00401733

Memory Dump Source

Source File: 00000000.00000002.3789251743.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3789230297.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789271823.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: PathSearch
String ID:
API String ID: 2203818243-0
Opcode ID: 65278b850fb128378873a50eca4da36d0eedd748e79966e133675203528cf855
Instruction ID: e4e3c42305c0b2198e0aecdca264a5a1b937f2a52f25dfaad176198492f8ea82
Opcode Fuzzy Hash: 65278b850fb128378873a50eca4da36d0eedd748e79966e133675203528cf855
Instruction Fuzzy Hash: CFE026B2304111AFE740DF68DE48EAA3B98DB10368F30453AF151F60C0E2BA9A41A769

Function 00402BD8 Relevance: 1.5, APIs: 1, Instructions: 22registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE(00000000,?,00000000,00000022,00000000,?,?), ref: 00402C00

Memory Dump Source

Source File: 00000000.00000002.3789251743.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3789230297.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789271823.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 2def34932d008b1c6cdd5ca58b5769b0c908390d8f7109fb18f9f363c944e71c
Instruction ID: 12eae925539b7dc367c8ab6fa63785f67f6a0dd6345a275e5017c2f2efb43849
Opcode Fuzzy Hash: 2def34932d008b1c6cdd5ca58b5769b0c908390d8f7109fb18f9f363c944e71c
Instruction Fuzzy Hash: ADE0B676250108BEDB00EFA9EE4AE9977ECAB58740F108421B608E70A1C678E5508B69

Function 00405A8B Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,000000FF,?,00403135,00000000,00000000,00402F82,000000FF,00000004,00000000,00000000,00000000), ref: 00405A9F

Memory Dump Source

Source File: 00000000.00000002.3789251743.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3789230297.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789271823.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 9e9b74a17ccb5deaff559da35202fcfca8c983c6050daaa8761ff941af9ce947
Instruction ID: 3049aa00f6096361bf05a549768cb7fbda67778921cce1d2793645b00ea59393
Opcode Fuzzy Hash: 9e9b74a17ccb5deaff559da35202fcfca8c983c6050daaa8761ff941af9ce947
Instruction Fuzzy Hash: 56E08C3260521ABBEF119E508C40EEB3B6CEB043A0F008933F914E2180E230E8219FE4

Function 00405ABA Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,000000FF,?,004030EB,00000000,007890F8,000000FF,007890F8,000000FF,000000FF,00000004,00000000), ref: 00405ACE

Memory Dump Source

Source File: 00000000.00000002.3789251743.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3789230297.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789271823.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: d04482319dc3028e4ce08f739f1cf32aeeec85f3b87b0f01a1fec36d148a5575
Instruction ID: 32d48f6e8b76b53ead5095efbfc7dc84fe3b04974c76bcad3a7819726962f715
Opcode Fuzzy Hash: d04482319dc3028e4ce08f739f1cf32aeeec85f3b87b0f01a1fec36d148a5575
Instruction Fuzzy Hash: CEE0B63261429AABDF109E659C40AAB7B6CFF05360F148533B915E6150E231E8219EA5

Function 1000270B Relevance: 1.5, APIs: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(1000404C,00000004,00000040,1000403C), ref: 10002729

Memory Dump Source

Source File: 00000000.00000002.3796539761.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3796514530.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.3796598036.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.3796620571.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_nRNzqQOQwk.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 18430b4f65034898945c85cbd496d0600587ffef3804861361c874148a7acf75
Instruction ID: 4f82052a8ee677216feeb46ba648c84afb962adc58c95b92ee0d34447feb5494
Opcode Fuzzy Hash: 18430b4f65034898945c85cbd496d0600587ffef3804861361c874148a7acf75
Instruction Fuzzy Hash: B5F09BF19092A0DEF360DF688CC4B063FE4E3983D5B03892AE358F6269EB7441448B19

Function 00402336 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

GetPrivateProfileStringA.KERNEL32(00000000,?,?,?,000003FF,00000000), ref: 00402369

Memory Dump Source

Source File: 00000000.00000002.3789251743.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3789230297.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789271823.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: PrivateProfileString
String ID:
API String ID: 1096422788-0
Opcode ID: 90e07bb3a0b3f4804eab7f86ac5a4e71b50077df0b3d61eb17d11243db03f5ce
Instruction ID: 863d308e192ce4c0f66b0ae01519e0470cfafd3cecd099ef988cf845eccf6abb
Opcode Fuzzy Hash: 90e07bb3a0b3f4804eab7f86ac5a4e71b50077df0b3d61eb17d11243db03f5ce
Instruction Fuzzy Hash: D1E08630A04208BADB10AFA08F09EAD3A79AF41710F24003AF9507B0D1EAB84481DB2D

Function 0040159D Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNELBASE(00000000,?,000000F0), ref: 004015A8

Memory Dump Source

Source File: 00000000.00000002.3789251743.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3789230297.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789271823.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: d0fe9b386de643ef5aeea880a78091cb5ab4581d5f0663080ab49c8656d349c5
Instruction ID: 089d8403b4a3c67af6c4af196b8dedf915adbd4a042e4b2ee6fd832a67879694
Opcode Fuzzy Hash: d0fe9b386de643ef5aeea880a78091cb5ab4581d5f0663080ab49c8656d349c5
Instruction Fuzzy Hash: 34D05B72704115DBDB10DBE5EB0869D77A0AB40364F304537D151F21D0D2BADA559719

Function 00403138 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00402EC1,0002FFE4), ref: 00403146

Memory Dump Source

Source File: 00000000.00000002.3789251743.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3789230297.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789271823.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 0070af3e33726fe8c9f5218e9eb5d27e4edbe1e9193197dd8736a9b9f47decae
Instruction ID: 49fdcfdf8b1973cd13611e97ba0bfafd8618b6cb304eeeee9131019f9f046fb0
Opcode Fuzzy Hash: 0070af3e33726fe8c9f5218e9eb5d27e4edbe1e9193197dd8736a9b9f47decae
Instruction Fuzzy Hash: 03B01271644200BFDA214F00DF05F057B21A790700F10C030B748380F082712420EB4D

Function 004014D6 Relevance: 1.3, APIs: 1, Instructions: 19sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00000000), ref: 004014E9

Memory Dump Source

Source File: 00000000.00000002.3789251743.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3789230297.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789271823.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 5103c2e833fb6cec983ac643f83c5405fcf5b56718913b7927d61a5481dde75b
Instruction ID: a8a1054ff6e124a16992140d9831d4e67a861e682019e3b6a28de944f62df8e5
Opcode Fuzzy Hash: 5103c2e833fb6cec983ac643f83c5405fcf5b56718913b7927d61a5481dde75b
Instruction Fuzzy Hash: B5D05E73B141519BD750EBB8BAC445E77E4EB403257304837E502E2091E67989429618

Non-executed Functions

Function 004050F7 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 282windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 00405156
GetDlgItem.USER32(?,000003EE), ref: 00405165
GetClientRect.USER32(?,?), ref: 004051A2
GetSystemMetrics.USER32(00000002), ref: 004051A9
SendMessageA.USER32(?,0000101B,00000000,?), ref: 004051CA
SendMessageA.USER32(?,00001036,00004000,00004000), ref: 004051DB
SendMessageA.USER32(?,00001001,00000000,?), ref: 004051EE
SendMessageA.USER32(?,00001026,00000000,?), ref: 004051FC
SendMessageA.USER32(?,00001024,00000000,?), ref: 0040520F
ShowWindow.USER32(00000000,?,0000001B,?), ref: 00405231
ShowWindow.USER32(?,00000008), ref: 00405245
GetDlgItem.USER32(?,000003EC), ref: 00405266
SendMessageA.USER32(00000000,00000401,00000000,75300000), ref: 00405276
SendMessageA.USER32(00000000,00000409,00000000,?), ref: 0040528F
SendMessageA.USER32(00000000,00002001,00000000,?), ref: 0040529B
GetDlgItem.USER32(?,000003F8), ref: 00405174

Part of subcall function 00403FBA: SendMessageA.USER32(00000028,?,00000001,00403DEB), ref: 00403FC8

GetDlgItem.USER32(?,000003EC), ref: 004052B7
CreateThread.KERNEL32(00000000,00000000,Function_0000508B,00000000), ref: 004052C5
CloseHandle.KERNEL32(00000000), ref: 004052CC
ShowWindow.USER32(00000000), ref: 004052EF
ShowWindow.USER32(?,00000008), ref: 004052F6
ShowWindow.USER32(00000008), ref: 0040533C
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00405370
CreatePopupMenu.USER32 ref: 00405381
AppendMenuA.USER32(00000000,00000000,00000001,00000000), ref: 00405396
GetWindowRect.USER32(?,000000FF), ref: 004053B6
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004053CF
SendMessageA.USER32(?,0000102D,00000000,?), ref: 0040540B
OpenClipboard.USER32(00000000), ref: 0040541B
EmptyClipboard.USER32 ref: 00405421
GlobalAlloc.KERNEL32(00000042,?), ref: 0040542A
GlobalLock.KERNEL32(00000000), ref: 00405434
SendMessageA.USER32(?,0000102D,00000000,?), ref: 00405448
GlobalUnlock.KERNEL32(00000000), ref: 00405461
SetClipboardData.USER32(00000001,00000000), ref: 0040546C
CloseClipboard.USER32 ref: 00405472

Strings

@y, xrefs: 004053E7

Memory Dump Source

Source File: 00000000.00000002.3789251743.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3789230297.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789271823.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: @y
API String ID: 590372296-2793234042
Opcode ID: fb478b241302d14890c8e569f688314f17ac97b328ad1953f1dfc7460e5c88c7
Instruction ID: 669047f9f67e304dd712f5be3c8e464dbcc99e7ae4a165c688d328355b6db051
Opcode Fuzzy Hash: fb478b241302d14890c8e569f688314f17ac97b328ad1953f1dfc7460e5c88c7
Instruction Fuzzy Hash: 9DA16970900249BFEF119FA0DD89EAE7F79EB08354F00806AFA05B61A0C7795E50DF69

Function 00404936 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 0040494E
GetDlgItem.USER32(?,00000408), ref: 00404959
GlobalAlloc.KERNEL32(00000040,00000002), ref: 004049A3
LoadBitmapA.USER32(0000006E), ref: 004049B6
SetWindowLongA.USER32(?,000000FC,00404F2D), ref: 004049CF
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 004049E3
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 004049F5
SendMessageA.USER32(?,00001109,00000002), ref: 00404A0B
SendMessageA.USER32(?,0000111C,00000000,00000000), ref: 00404A17
SendMessageA.USER32(?,0000111B,00000010,00000000), ref: 00404A29
DeleteObject.GDI32(00000000), ref: 00404A2C
SendMessageA.USER32(?,00000143,00000000,00000000), ref: 00404A57
SendMessageA.USER32(?,00000151,00000000,00000000), ref: 00404A63
SendMessageA.USER32(?,00001100,00000000,?), ref: 00404AF8
SendMessageA.USER32(?,0000110A,?,00000000), ref: 00404B23
SendMessageA.USER32(?,00001100,00000000,?), ref: 00404B37
GetWindowLongA.USER32(?,000000F0), ref: 00404B66
SetWindowLongA.USER32(?,000000F0,00000000), ref: 00404B74
ShowWindow.USER32(?,00000005), ref: 00404B85
SendMessageA.USER32(?,00000419,00000000,?), ref: 00404C82
SendMessageA.USER32(?,00000147,00000000,00000000), ref: 00404CE7
SendMessageA.USER32(?,00000150,00000000,00000000), ref: 00404CFC
SendMessageA.USER32(?,00000420,00000000,00000020), ref: 00404D20
SendMessageA.USER32(?,00000200,00000000,00000000), ref: 00404D40
ImageList_Destroy.COMCTL32(?), ref: 00404D55
GlobalFree.KERNEL32(?), ref: 00404D65
SendMessageA.USER32(?,0000014E,00000000,00000000), ref: 00404DDE
SendMessageA.USER32(?,00001102,?,?), ref: 00404E87
SendMessageA.USER32(?,0000110D,00000000,00000008), ref: 00404E96
InvalidateRect.USER32(?,00000000,00000001), ref: 00404EB6
ShowWindow.USER32(?,00000000), ref: 00404F04
GetDlgItem.USER32(?,000003FE), ref: 00404F0F
ShowWindow.USER32(00000000), ref: 00404F16

Strings

, xrefs: 00404EEE
M, xrefs: 00404ADF
N, xrefs: 00404BC0

Memory Dump Source

Source File: 00000000.00000002.3789251743.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3789230297.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789271823.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: c0a9e003325bbf4aeebb07f179cc8a2e0ae178da990d22459e7e34e95fc5cae9
Instruction ID: 10d6cb261f95093856db0383de4589f8155b4d68da151c8c89fd000e0678f767
Opcode Fuzzy Hash: c0a9e003325bbf4aeebb07f179cc8a2e0ae178da990d22459e7e34e95fc5cae9
Instruction Fuzzy Hash: AB027CB0900209AFEB14DF64DC85AAE7BB9FB84314F10817AF610BA2E1D7789D51CF58

Function 004043C3 Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 274stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 00404412
SetWindowTextA.USER32(00000000,?), ref: 0040443C
SHBrowseForFolderA.SHELL32(?,0079D918,?), ref: 004044ED
CoTaskMemFree.OLE32(00000000), ref: 004044F8
lstrcmpiA.KERNEL32(Call,0079E540), ref: 0040452A
lstrcatA.KERNEL32(?,Call), ref: 00404536
SetDlgItemTextA.USER32(?,000003FB,?), ref: 00404548

Part of subcall function 0040557A: GetDlgItemTextA.USER32(?,?,00000400,0040457F), ref: 0040558D

Part of subcall function 0040600B: CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\nRNzqQOQwk.exe",76F93410,C:\Users\user\AppData\Local\Temp\,00000000,0040315B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403370), ref: 00406063
Part of subcall function 0040600B: CharNextA.USER32(?,?,?,00000000), ref: 00406070
Part of subcall function 0040600B: CharNextA.USER32(?,"C:\Users\user\Desktop\nRNzqQOQwk.exe",76F93410,C:\Users\user\AppData\Local\Temp\,00000000,0040315B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403370), ref: 00406075
Part of subcall function 0040600B: CharPrevA.USER32(?,?,76F93410,C:\Users\user\AppData\Local\Temp\,00000000,0040315B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403370), ref: 00406085

GetDiskFreeSpaceA.KERNEL32(0079D510,?,?,0000040F,?,0079D510,0079D510,?,00000001,0079D510,?,?,000003FB,?), ref: 00404606
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404621

Part of subcall function 0040477A: lstrlenA.KERNEL32(0079E540,0079E540,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,00404695,000000DF,00000000,00000400,?), ref: 00404818
Part of subcall function 0040477A: wsprintfA.USER32 ref: 00404820
Part of subcall function 0040477A: SetDlgItemTextA.USER32(?,0079E540), ref: 00404833

Strings

C:\Users\user\slavelivets, xrefs: 00404513
A, xrefs: 004044E6
Call, xrefs: 00404524, 00404529, 00404534
@y, xrefs: 004044C0

Memory Dump Source

Source File: 00000000.00000002.3789251743.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3789230297.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789271823.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: @y$A$C:\Users\user\slavelivets$Call
API String ID: 2624150263-76115890
Opcode ID: 3d12c395db0b8a5e031a22e6692dd266f1d5deac6801d88cb2d33c24727f66a7
Instruction ID: b79cf5757fdebc40129ea8bf430174fd55c22843b8008fc959c2d10819856cf3
Opcode Fuzzy Hash: 3d12c395db0b8a5e031a22e6692dd266f1d5deac6801d88cb2d33c24727f66a7
Instruction Fuzzy Hash: A3A170B1900209ABDB11EFA5CC45BAF77B8EF85314F10843BF611B62D1E77C9A418B69

Function 004020CD Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 139comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00407408,?,00000001,004073F8,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 0040214C
MultiByteToWideChar.KERNEL32(?,?,?,000000FF,?,00000400,?,00000001,004073F8,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 004021F8

Strings

C:\Users\user\slavelivets, xrefs: 0040218C

Memory Dump Source

Source File: 00000000.00000002.3789251743.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3789230297.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789271823.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID: C:\Users\user\slavelivets
API String ID: 123533781-3386343164
Opcode ID: 024ddeff904ea4e2027849ef916676ab51d53d58e968f5afcffc77d785a09d8a
Instruction ID: 3b959fe0d73b6f2ff8ba1a3dad26e84ad0429d5bc67268e837327fa781b0949d
Opcode Fuzzy Hash: 024ddeff904ea4e2027849ef916676ab51d53d58e968f5afcffc77d785a09d8a
Instruction Fuzzy Hash: 705116B5E00208BFCB00DFE4C988A9DBBB6EF48314B2445AAF515FB2D1DA799941CB54

Function 0040270B Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000002), ref: 0040271A

Memory Dump Source

Source File: 00000000.00000002.3789251743.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3789230297.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789271823.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 561abc1235fbb0d1b1b6368a868e1f0093475e7d00ee5c355f47c34ff1fd805f
Instruction ID: 3ccff3199aeab2db1e2dd923352da36f4292fa18247536f83ce369c7762b159a
Opcode Fuzzy Hash: 561abc1235fbb0d1b1b6368a868e1f0093475e7d00ee5c355f47c34ff1fd805f
Instruction Fuzzy Hash: 76F05572604110EFD700EBA49A089FEB768DF15324FA0407BF181F20C0CBBC8A429B2A

Function 00403AB2 Relevance: 59.8, APIs: 32, Strings: 2, Instructions: 345windowstringCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403AEE
ShowWindow.USER32(?), ref: 00403B0B
DestroyWindow.USER32 ref: 00403B1F
SetWindowLongA.USER32(?,00000000,00000000), ref: 00403B3B
GetDlgItem.USER32(?,?), ref: 00403B5C
SendMessageA.USER32(00000000,000000F3,00000000,00000000), ref: 00403B70
IsWindowEnabled.USER32(00000000), ref: 00403B77
GetDlgItem.USER32(?,00000001), ref: 00403C25
GetDlgItem.USER32(?,00000002), ref: 00403C2F
SetClassLongA.USER32(?,000000F2,?), ref: 00403C49
SendMessageA.USER32(0000040F,00000000,00000001,?), ref: 00403C9A
GetDlgItem.USER32(?,?), ref: 00403D40
ShowWindow.USER32(00000000,?), ref: 00403D61
EnableWindow.USER32(?,?), ref: 00403D73
EnableWindow.USER32(?,?), ref: 00403D8E
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00403DA4
EnableMenuItem.USER32(00000000), ref: 00403DAB
SendMessageA.USER32(?,000000F4,00000000,00000001), ref: 00403DC3
SendMessageA.USER32(?,00000401,00000002,00000000), ref: 00403DD6
lstrlenA.KERNEL32(0079E540,?,0079E540,Pongids Setup), ref: 00403DFF
SetWindowTextA.USER32(?,0079E540), ref: 00403E0E
ShowWindow.USER32(?,0000000A), ref: 00403F42

Strings

Pongids Setup, xrefs: 00403DF0
@y, xrefs: 00403DEB

Memory Dump Source

Source File: 00000000.00000002.3789251743.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3789230297.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789271823.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: Window$Item$MessageSend$EnableShow$LongMenu$ClassDestroyEnabledSystemTextlstrlen
String ID: @y$Pongids Setup
API String ID: 184305955-1393332770
Opcode ID: c2e5c8a98494131a3f5258506286a32dbf8d0bdf9ff6fe3114ac61fbbd238155
Instruction ID: 1a58b870ca21ce47ba752d56327be38b30dd2316994c96cb4837d6e7696a1104
Opcode Fuzzy Hash: c2e5c8a98494131a3f5258506286a32dbf8d0bdf9ff6fe3114ac61fbbd238155
Instruction Fuzzy Hash: 81C1AF71904201ABEB216F61ED89E2A7EBCEB4570AF40853EF601B11F1C73DA941DB1E

Function 004040CE Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 205windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(00000000,-0000040A,00000001), ref: 00404159
GetDlgItem.USER32(00000000,000003E8), ref: 0040416D
SendMessageA.USER32(00000000,0000045B,00000001,00000000), ref: 0040418B
GetSysColor.USER32(?), ref: 0040419C
SendMessageA.USER32(00000000,00000443,00000000,?), ref: 004041AB
SendMessageA.USER32(00000000,00000445,00000000,04010000), ref: 004041BA
lstrlenA.KERNEL32(?), ref: 004041BD
SendMessageA.USER32(00000000,00000435,00000000,00000000), ref: 004041CC
SendMessageA.USER32(00000000,00000449,?,00000110), ref: 004041E1
GetDlgItem.USER32(?,0000040A), ref: 00404243
SendMessageA.USER32(00000000), ref: 00404246
GetDlgItem.USER32(?,000003E8), ref: 00404271
SendMessageA.USER32(00000000,0000044B,00000000,00000201), ref: 004042B1
LoadCursorA.USER32(00000000,00007F02), ref: 004042C0
SetCursor.USER32(00000000), ref: 004042C9
ShellExecuteA.SHELL32(0000070B,open,007A0EE0,00000000,00000000,00000001), ref: 004042DC
LoadCursorA.USER32(00000000,00007F00), ref: 004042E9
SetCursor.USER32(00000000), ref: 004042EC
SendMessageA.USER32(00000111,00000001,00000000), ref: 00404318
SendMessageA.USER32(00000010,00000000,00000000), ref: 0040432C

Strings

open, xrefs: 004042D4
Call, xrefs: 0040429C
N, xrefs: 0040425F

Memory Dump Source

Source File: 00000000.00000002.3789251743.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3789230297.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789271823.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
String ID: Call$N$open
API String ID: 3615053054-2563687911
Opcode ID: 2bd72d0c45eb893bd58c56080fda348c45ce57ca2b38d375d74f0412c252b757
Instruction ID: 601bc5fe35b3c5de407f3786c3433e5d67f1b6e9b87549a619d2750a8ed94523
Opcode Fuzzy Hash: 2bd72d0c45eb893bd58c56080fda348c45ce57ca2b38d375d74f0412c252b757
Instruction Fuzzy Hash: 6B61A5B1A40209BFEB109F61CC45F6A7B79FB84705F108026FB05BA2D1C7B8A951CF58

Function 00401000 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcA.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectA.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,?), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextA.USER32(00000000,Pongids Setup,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

Pongids Setup, xrefs: 00401150
F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.3789251743.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3789230297.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789271823.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F$Pongids Setup
API String ID: 941294808-3581732227
Opcode ID: 0a68615732e4b88a98f313291f6562efd0598cab8c65ff7e1a40b4ddd25604da
Instruction ID: 5377a76c68583d826c01589a66ce84b6d9bb3dc06a218cd9f98f6b2c798b1645
Opcode Fuzzy Hash: 0a68615732e4b88a98f313291f6562efd0598cab8c65ff7e1a40b4ddd25604da
Instruction Fuzzy Hash: 74419C71804249AFCB058FA5CD459BFBFB9FF45310F00812AF961AA1A0C738EA50DFA5

Function 00405AE9 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 131stringmemoryCOMMON

Download Yara Rule

APIs

lstrcpyA.KERNEL32(007A02D0,NUL,?,00000000,?,00000000,00405C7C,?,?), ref: 00405AF8
CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,00405C7C,?,?), ref: 00405B1C
GetShortPathNameA.KERNEL32(?,007A02D0,00000400), ref: 00405B25

Part of subcall function 00405978: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405BD5,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405988
Part of subcall function 00405978: lstrlenA.KERNEL32(00000000,?,00000000,00405BD5,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004059BA

GetShortPathNameA.KERNEL32(007A06D0,007A06D0,00000400), ref: 00405B42
wsprintfA.USER32 ref: 00405B60
GetFileSize.KERNEL32(00000000,00000000,007A06D0,C0000000,00000004,007A06D0,?,?,?,?,?), ref: 00405B9B
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00405BAA
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405BE2
SetFilePointer.KERNEL32(004093B0,00000000,00000000,00000000,00000000,0079FED0,00000000,-0000000A,004093B0,00000000,[Rename],00000000,00000000,00000000), ref: 00405C38
GlobalFree.KERNEL32(00000000), ref: 00405C49
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00405C50

Part of subcall function 00405A13: GetFileAttributesA.KERNELBASE(?,00402D3A,C:\Users\user\Desktop\nRNzqQOQwk.exe,80000000,?), ref: 00405A17
Part of subcall function 00405A13: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405A39

Strings

[Rename], xrefs: 00405BCA, 00405BDC
NUL, xrefs: 00405AF2
%s=%s, xrefs: 00405B56

Memory Dump Source

Source File: 00000000.00000002.3789251743.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3789230297.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789271823.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrcpylstrlen$AllocAttributesCreateFreePointerSizewsprintf
String ID: %s=%s$NUL$[Rename]
API String ID: 222337774-4148678300
Opcode ID: 470faa373d492393558750a21a749fa660293524ffa589413fd4618ea5f3d9a4
Instruction ID: 1eed59494e777df17b5db6228b66ba1829f219dd2eba3e9b173e6ae731b9f24b
Opcode Fuzzy Hash: 470faa373d492393558750a21a749fa660293524ffa589413fd4618ea5f3d9a4
Instruction Fuzzy Hash: 503125B0A08B05ABE6203B615D48F6B3A5CDF45794F14053BFE01F62D2DA7CAC408EAD

Function 00402C13 Relevance: 14.0, APIs: 5, Strings: 3, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402C2E
MulDiv.KERNEL32(00095409,00000064,00096960), ref: 00402C59
wsprintfA.USER32 ref: 00402C69
SetWindowTextA.USER32(?,?), ref: 00402C79
SetDlgItemTextA.USER32(?,00000406,?), ref: 00402C8B

Strings

`i, xrefs: 00402C4A
T, xrefs: 00402C44
verifying installer: %d%%, xrefs: 00402C63

Memory Dump Source

Source File: 00000000.00000002.3789251743.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3789230297.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789271823.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: T$`i$verifying installer: %d%%
API String ID: 1451636040-1135715120
Opcode ID: 3ae07b054ad9b81f5b6108b272be1fee9de0c5ac9c6f7af5c303f160919c41b2
Instruction ID: 21607a1dc9e24acd8111b7ab95824f47c5a1c8f1a2671c4e1062bfa223269d08
Opcode Fuzzy Hash: 3ae07b054ad9b81f5b6108b272be1fee9de0c5ac9c6f7af5c303f160919c41b2
Instruction Fuzzy Hash: 8B014F70944209FBEF209F60DD4AEAE37A9AB04304F008039FA16A92D0D7B89951CB59

Function 0040600B Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\nRNzqQOQwk.exe",76F93410,C:\Users\user\AppData\Local\Temp\,00000000,0040315B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403370), ref: 00406063
CharNextA.USER32(?,?,?,00000000), ref: 00406070
CharNextA.USER32(?,"C:\Users\user\Desktop\nRNzqQOQwk.exe",76F93410,C:\Users\user\AppData\Local\Temp\,00000000,0040315B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403370), ref: 00406075
CharPrevA.USER32(?,?,76F93410,C:\Users\user\AppData\Local\Temp\,00000000,0040315B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403370), ref: 00406085

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 0040600C
*?|<>/":, xrefs: 00406053
"C:\Users\user\Desktop\nRNzqQOQwk.exe", xrefs: 00406047

Memory Dump Source

Source File: 00000000.00000002.3789251743.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3789230297.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789271823.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\Desktop\nRNzqQOQwk.exe"$*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-445350357
Opcode ID: ce3d7990729f771fdc32bb0ed1b54e2c2469674ae1568702cd8079844570f2a1
Instruction ID: 5800177166b7667d3eaf53a22357e4554d28550b3292ec339307e94a63baae70
Opcode Fuzzy Hash: ce3d7990729f771fdc32bb0ed1b54e2c2469674ae1568702cd8079844570f2a1
Instruction Fuzzy Hash: 5011276184479129FB3296384C00B7B6FD94F567A0F19007BE9C6722C2C67C5C62836D

Function 00403FEC Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000EB), ref: 00404009
GetSysColor.USER32(00000000), ref: 00404025
SetTextColor.GDI32(?,00000000), ref: 00404031
SetBkMode.GDI32(?,?), ref: 0040403D
GetSysColor.USER32(?), ref: 00404050
SetBkColor.GDI32(?,?), ref: 00404060
DeleteObject.GDI32(?), ref: 0040407A
CreateBrushIndirect.GDI32(?), ref: 00404084

Memory Dump Source

Source File: 00000000.00000002.3789251743.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3789230297.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789271823.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: e8c91e704ef8b2f1a11ad189bfd14f771d09f9d58710722270f9777396a44b4e
Instruction ID: c3620b6f473fad47e7a0c0791398936244beda297bc66feae6272bbc27e0e58c
Opcode Fuzzy Hash: e8c91e704ef8b2f1a11ad189bfd14f771d09f9d58710722270f9777396a44b4e
Instruction Fuzzy Hash: D7214FB1904704ABCB319F78DD48B5BBBF8AF41714F048A29EB96B22E0D734E944CB55

Function 100021FA Relevance: 10.6, APIs: 7, Instructions: 139memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(00000000), ref: 1000234A

Part of subcall function 10001224: lstrcpynA.KERNEL32(00000000,?,100012CF,-1000404B,100011AB,-000000A0), ref: 10001234

GlobalAlloc.KERNEL32(00000040,?), ref: 100022C3
MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,?), ref: 100022D8
GlobalAlloc.KERNEL32(00000040,00000010), ref: 100022E7
CLSIDFromString.OLE32(00000000,00000000), ref: 100022F4
GlobalFree.KERNEL32(00000000), ref: 100022FB

Memory Dump Source

Source File: 00000000.00000002.3796539761.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3796514530.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.3796598036.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.3796620571.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_nRNzqQOQwk.jbxd

Similarity

API ID: Global$AllocFree$ByteCharFromMultiStringWidelstrcpyn
String ID:
API String ID: 3730416702-0
Opcode ID: 8ca201b8c9dcbb45ad50e4cb45e4e1ae2e8a5d70f393ea2d6c63899163ff979d
Instruction ID: bfa8c22ebd78897ea4dc14f883c746723b208fa17a75ef0c69fbb79ff87ab60c
Opcode Fuzzy Hash: 8ca201b8c9dcbb45ad50e4cb45e4e1ae2e8a5d70f393ea2d6c63899163ff979d
Instruction Fuzzy Hash: B541ABB1108311EFF320DFA48884B5BB7F8FF443D1F218529F946D61A9DB34AA448B61

Function 100023DA Relevance: 10.6, APIs: 7, Instructions: 111COMMON

Download Yara Rule

APIs

Part of subcall function 10001215: GlobalAlloc.KERNEL32(00000040,10001233,?,100012CF,-1000404B,100011AB,-000000A0), ref: 1000121D

GlobalFree.KERNEL32(?), ref: 100024B5
GlobalFree.KERNEL32(00000000), ref: 100024EF

Memory Dump Source

Source File: 00000000.00000002.3796539761.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3796514530.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.3796598036.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.3796620571.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_nRNzqQOQwk.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: 8ed12168559ed504bf2d16f5614b25cf9b7800a5843296302d7a865f42518c80
Instruction ID: 4e6b36a645f71e2aed4a85f2c36ff1861f2741140ba068ae73f9b0a79c1593cf
Opcode Fuzzy Hash: 8ed12168559ed504bf2d16f5614b25cf9b7800a5843296302d7a865f42518c80
Instruction Fuzzy Hash: EA319CB1504250EFF322CF64CCC4C6B7BBDEB852D4B124529FA4193168CB31AC94DB62

Function 00404FB9 Relevance: 10.6, APIs: 7, Instructions: 73stringwindowCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(0079DD20,00000000,0078FCF8,76F923A0,?,?,?,?,?,?,?,?,?,0040306B,00000000,?), ref: 00404FF2
lstrlenA.KERNEL32(0040306B,0079DD20,00000000,0078FCF8,76F923A0,?,?,?,?,?,?,?,?,?,0040306B,00000000), ref: 00405002
lstrcatA.KERNEL32(0079DD20,0040306B,0040306B,0079DD20,00000000,0078FCF8,76F923A0), ref: 00405015
SetWindowTextA.USER32(0079DD20,0079DD20), ref: 00405027
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 0040504D
SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00405067
SendMessageA.USER32(?,00001013,?,00000000), ref: 00405075

Memory Dump Source

Source File: 00000000.00000002.3789251743.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3789230297.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789271823.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: 8aca45e27811aa21f79b642ec133e9ff2e42e250cada4605035ec104fac27bf5
Instruction ID: d1dd411a73e10bc413e7a6ba64919406d2bbbb657998d141ba589d50d7388124
Opcode Fuzzy Hash: 8aca45e27811aa21f79b642ec133e9ff2e42e250cada4605035ec104fac27bf5
Instruction Fuzzy Hash: 0D214C71900519AADF119FA5DD849DEBFA9EF09354F14807AF944A6290C7398D40CFA8

Function 00404884 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,0000110A,00000009,00000000), ref: 0040489F
GetMessagePos.USER32 ref: 004048A7
ScreenToClient.USER32(?,?), ref: 004048C1
SendMessageA.USER32(?,00001111,00000000,?), ref: 004048D3
SendMessageA.USER32(?,0000110C,00000000,?), ref: 004048F9

Strings

f, xrefs: 004048D5

Memory Dump Source

Source File: 00000000.00000002.3789251743.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3789230297.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789271823.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 13dcb630cae817d26763a7c5c34c1a537cec2b83c976c16d0abeb4614e4307e4
Instruction ID: 53a3bc3e7d347c8b02fcccb5944648bd46d0fd351ff65b71f1969629af7e9ac2
Opcode Fuzzy Hash: 13dcb630cae817d26763a7c5c34c1a537cec2b83c976c16d0abeb4614e4307e4
Instruction Fuzzy Hash: 12019275D00219BAEB00DBA5DC41BFEBBBCAF55711F10412BBA00B71D0C7B469018BA5

Function 00402749 Relevance: 9.1, APIs: 6, Instructions: 86memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00030000,00000000,40000000,00000002,00000000,00000000,?,?,?,000000F0), ref: 0040279D
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,000000F0), ref: 004027B9
GlobalFree.KERNEL32(?), ref: 004027F2
GlobalFree.KERNEL32(00000000), ref: 00402805
CloseHandle.KERNEL32(?,?,?,?,000000F0), ref: 0040281D
DeleteFileA.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,?,?,?,000000F0), ref: 00402831

Memory Dump Source

Source File: 00000000.00000002.3789251743.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3789230297.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789271823.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: 7f207ce07f6c5f0df932277b8913aa87d9610340000502d5a090f6ef4d334f19
Instruction ID: ecef423f8b7fb5116dd0415946ee68b484c5f893cd0af9153c7a5222f957d578
Opcode Fuzzy Hash: 7f207ce07f6c5f0df932277b8913aa87d9610340000502d5a090f6ef4d334f19
Instruction Fuzzy Hash: B921AE71C00128BBCF216FA5CE49D9E7E79EF09324F14423AF511762D0C6794D419FA9

Function 0040477A Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(0079E540,0079E540,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,00404695,000000DF,00000000,00000400,?), ref: 00404818
wsprintfA.USER32 ref: 00404820
SetDlgItemTextA.USER32(?,0079E540), ref: 00404833

Strings

%u.%u%s%s, xrefs: 00404802
@y, xrefs: 0040480A

Memory Dump Source

Source File: 00000000.00000002.3789251743.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3789230297.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789271823.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$@y
API String ID: 3540041739-3020698753
Opcode ID: ca56fcb4ff96a92767a948c37e1cdc386e941f7d7930a18b2193be96cb950031
Instruction ID: 9c2068d9445a5b6f252536eabbf1c91049bb0fb02782bdd1491d607ad1f2c465
Opcode Fuzzy Hash: ca56fcb4ff96a92767a948c37e1cdc386e941f7d7930a18b2193be96cb950031
Instruction Fuzzy Hash: E711E773A041283BDB0065699C45EAF3698DB86334F254237FA25F31D1EA78CC1182E9

Function 1000180D Relevance: 7.7, APIs: 5, Instructions: 189COMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(?), ref: 10001869
GlobalFree.KERNEL32(?), ref: 100019EF
GlobalFree.KERNEL32(?), ref: 100019F4

Memory Dump Source

Source File: 00000000.00000002.3796539761.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3796514530.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.3796598036.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.3796620571.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_nRNzqQOQwk.jbxd

Similarity

API ID: FreeGlobal
String ID:
API String ID: 2979337801-0
Opcode ID: 83a27a6a764e204457f331ddef67b06d43c1ca0f526d792f63dc3af4834dec0e
Instruction ID: adaf369aa6dab84e94bee76403d526b7d43184adb12fe210256c1aedb67fe499
Opcode Fuzzy Hash: 83a27a6a764e204457f331ddef67b06d43c1ca0f526d792f63dc3af4834dec0e
Instruction Fuzzy Hash: 43512536D04159AEFB55DFB488A4AEEBBF6EF453C0F124169E841B315DCA306E4087D2

Function 00401D3B Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?), ref: 00401D3F
GetClientRect.USER32(00000000,?), ref: 00401D4C
LoadImageA.USER32(?,00000000,?,?,?,?), ref: 00401D6D
SendMessageA.USER32(00000000,00000172,?,00000000), ref: 00401D7B
DeleteObject.GDI32(00000000), ref: 00401D8A

Memory Dump Source

Source File: 00000000.00000002.3789251743.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3789230297.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789271823.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 10b4ba4544f36a944a3439ba9066f9e77615bff6391fe62bbc71dfdeb426500d
Instruction ID: b8adc288744d91ba617009adb3e02bef21eb0d6e3f954176feac09388768b409
Opcode Fuzzy Hash: 10b4ba4544f36a944a3439ba9066f9e77615bff6391fe62bbc71dfdeb426500d
Instruction Fuzzy Hash: 45F0FFB2A04119BFE701EBA4DE88DAFB7BCEB44301B104466F601F2191C7749D018B79

Function 00401C04 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutA.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C74
SendMessageA.USER32(00000000,00000000,?,?), ref: 00401C8C

Strings

!, xrefs: 00401C40

Memory Dump Source

Source File: 00000000.00000002.3789251743.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3789230297.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789271823.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 8f69d8f01904616b30ba50563f994ab03a06e4adbc220725d3c81c21ac0e34de
Instruction ID: 44e87a32571ed3235eb7b96b36fbe9a42cad9ebb5189372230b031547819aef2
Opcode Fuzzy Hash: 8f69d8f01904616b30ba50563f994ab03a06e4adbc220725d3c81c21ac0e34de
Instruction Fuzzy Hash: ED21A271E44208BEEB15EFA4DA46AED7FB1EF84314F24403EF101B61D1DA788640DB28

Function 004039E5 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 71COMMON

Download Yara Rule

APIs

SetWindowTextA.USER32(00000000,Pongids Setup), ref: 00403A7D

Strings

Pongids Setup, xrefs: 00403A6C
1033, xrefs: 004039E9, 004039F3, 00403A64
"C:\Users\user\Desktop\nRNzqQOQwk.exe", xrefs: 004039E6

Memory Dump Source

Source File: 00000000.00000002.3789251743.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3789230297.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789271823.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: TextWindow
String ID: "C:\Users\user\Desktop\nRNzqQOQwk.exe"$1033$Pongids Setup
API String ID: 530164218-427815720
Opcode ID: 6c45f722f9a7ae4fb793d3ca626f1132432b1c01d3db27434527fc1e6ec0313f
Instruction ID: 535a85070ebab7a8ba56d21747a6201fabbada84c5c70f31dda2a066eb9b82e2
Opcode Fuzzy Hash: 6c45f722f9a7ae4fb793d3ca626f1132432b1c01d3db27434527fc1e6ec0313f
Instruction Fuzzy Hash: D1110E35B002019FD7209F15DC80A377B6CEBCA355728823BE841A73A0D73D9D028BA8

Function 00405812 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,0040316D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403370), ref: 00405818
CharPrevA.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,0040316D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403370), ref: 00405821
lstrcatA.KERNEL32(?,00409014), ref: 00405832

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405812

Memory Dump Source

Source File: 00000000.00000002.3789251743.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3789230297.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789271823.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-297319885
Opcode ID: 39623dee3265ed167cf4eb0d952b1efefe5673d98ca6e2622bb109ae9f6b3ea7
Instruction ID: 0a665bc2143073433464dc8fd220d9afc6aaff2f2e3703ee86bb110f897cf778
Opcode Fuzzy Hash: 39623dee3265ed167cf4eb0d952b1efefe5673d98ca6e2622bb109ae9f6b3ea7
Instruction Fuzzy Hash: DDD0A9A3606930AAE30222158C09EDF2A58CF12340B048037F200B22A2C63C8E418BFE

Function 004058AB Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

CharNextA.USER32(?,?,C:\,?,00405917,C:\,C:\,76F93410,?,C:\Users\user\AppData\Local\Temp\,00405662,?,76F93410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 004058B9
CharNextA.USER32(00000000), ref: 004058BE
CharNextA.USER32(00000000), ref: 004058D2

Strings

C:\, xrefs: 004058AC

Memory Dump Source

Source File: 00000000.00000002.3789251743.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3789230297.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789271823.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: CharNext
String ID: C:\
API String ID: 3213498283-3404278061
Opcode ID: b52e97735ebcacdda31b679af32a6ceda5c9d10ed76b2852ac30fc4ce6ba53e1
Instruction ID: e63bfe958a3d000d539ac339b3831bddf0e80049928d73a3bf58654b49e63fc9
Opcode Fuzzy Hash: b52e97735ebcacdda31b679af32a6ceda5c9d10ed76b2852ac30fc4ce6ba53e1
Instruction Fuzzy Hash: 5CF0F653904F552AFB3272280C40B775B88DB5A361F14C077EE40B62C1D27C4C609FAA

Function 00402C96 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000,00402E76,00000001), ref: 00402CA9
GetTickCount.KERNEL32 ref: 00402CC7
CreateDialogParamA.USER32(0000006F,00000000,00402C13,00000000), ref: 00402CE4
ShowWindow.USER32(00000000,00000005), ref: 00402CF2

Memory Dump Source

Source File: 00000000.00000002.3789251743.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3789230297.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789271823.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: e47f6d303f75ebd17c716a95d6a18f35b6dc664df62f34b119683803831f88dc
Instruction ID: 9ab3963fa07bdcc1a95f8d1ddaaeb6e773ff80e4731962a5f71ef67b0361f4de
Opcode Fuzzy Hash: e47f6d303f75ebd17c716a95d6a18f35b6dc664df62f34b119683803831f88dc
Instruction Fuzzy Hash: B9F03030809521AFD6125B24FF8EDDE7A64AB41701B114477F414B11E4D7781885CBD9

Function 00404F2D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00404F5C
CallWindowProcA.USER32(?,?,?,?), ref: 00404FAD

Part of subcall function 00403FD1: SendMessageA.USER32(00000000,00000000,00000000,00000000), ref: 00403FE3

Strings

, xrefs: 00404F3D

Memory Dump Source

Source File: 00000000.00000002.3789251743.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3789230297.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789271823.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: ba6800c79a5e421cc747068b2104ef880767bd6b1526ac3d2082a385ebb11f2d
Instruction ID: b201a4cd8f35b1f81cb2229438f9677fc33f9f69eb2c65fa3af33e2f38b160ff
Opcode Fuzzy Hash: ba6800c79a5e421cc747068b2104ef880767bd6b1526ac3d2082a385ebb11f2d
Instruction Fuzzy Hash: C9015EB150424AAFDF209F61DD81A5B3A26E7C4758F104037FB04B52D1D37AAC929A6E

Function 00405531 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,0079FD48,Error launching installer), ref: 0040555A
CloseHandle.KERNEL32(?), ref: 00405567

Strings

Error launching installer, xrefs: 00405544

Memory Dump Source

Source File: 00000000.00000002.3789251743.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3789230297.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789271823.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 9f0b0f85f0295080a22e5d155a7c66e390f8f607a8e504552004f12f3aafe87f
Instruction ID: a44fcad5754d04da23f251c2f5d6a8b7866741138784f0b9a4d91a551686e283
Opcode Fuzzy Hash: 9f0b0f85f0295080a22e5d155a7c66e390f8f607a8e504552004f12f3aafe87f
Instruction Fuzzy Hash: 93E0BFF4A002097FEB10AB64ED49F7B7BADEB00644F408561FD10F6190E674A9549A79

Function 0040368B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,76F93410,00000000,C:\Users\user\AppData\Local\Temp\,00403663,0040347D,?), ref: 004036A5
GlobalFree.KERNEL32(00B189F8), ref: 004036AC

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 0040368B

Memory Dump Source

Source File: 00000000.00000002.3789251743.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3789230297.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789271823.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 1100898210-297319885
Opcode ID: f64556832675c450ee94ce825956f3fa5fe3b9abfe3e42bbbd50814105250277
Instruction ID: cb5700cda5be72b1964cac96af1ae0fa6ff587f55f39b04be5f0e3e76017d6e4
Opcode Fuzzy Hash: f64556832675c450ee94ce825956f3fa5fe3b9abfe3e42bbbd50814105250277
Instruction Fuzzy Hash: 78E0C2338011206BC7315F04EE04B2A777C6F48B26F020467ED447B3A087792C524BDC

Function 00405859 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(80000000,C:\Users\user\Desktop,00402D66,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\nRNzqQOQwk.exe,C:\Users\user\Desktop\nRNzqQOQwk.exe,80000000,?), ref: 0040585F
CharPrevA.USER32(80000000,00000000,80000000,C:\Users\user\Desktop,00402D66,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\nRNzqQOQwk.exe,C:\Users\user\Desktop\nRNzqQOQwk.exe,80000000,?), ref: 0040586D

Strings

C:\Users\user\Desktop, xrefs: 00405859

Memory Dump Source

Source File: 00000000.00000002.3789251743.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3789230297.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789271823.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\Desktop
API String ID: 2709904686-2743851969
Opcode ID: cad1fee570528055bb4f840757e41c2b2d093a40416f1971c342fc3ba500c074
Instruction ID: 48f05854ad55b04522f039bc0829861de91cdd92fb90a6685f37373cdb6fd5ef
Opcode Fuzzy Hash: cad1fee570528055bb4f840757e41c2b2d093a40416f1971c342fc3ba500c074
Instruction Fuzzy Hash: 05D0C773409DB05EF30362259C04B9F6A98DF17700F094466E580E6191C6789D518BAE

Function 100010E0 Relevance: 5.1, APIs: 4, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?), ref: 1000115B
GlobalFree.KERNEL32(00000000), ref: 100011B4
GlobalFree.KERNEL32(?), ref: 100011C7
GlobalFree.KERNEL32(?), ref: 100011F5

Memory Dump Source

Source File: 00000000.00000002.3796539761.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3796514530.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.3796598036.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.3796620571.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_nRNzqQOQwk.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: 6ef9e3687ab983c99c874163fdcc0ee6cc2800f994ca68b8431a209e6fec97f5
Instruction ID: 5d3a3765e571093bf703368c32e31ec5bfeafbef09712c331e02e9e13643e521
Opcode Fuzzy Hash: 6ef9e3687ab983c99c874163fdcc0ee6cc2800f994ca68b8431a209e6fec97f5
Instruction Fuzzy Hash: 6531ABB1808255AFF715CFA8DC89AEA7FE8EB052C1B164115FA45D726CDB34D910CB24

Function 00405978 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405BD5,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405988
lstrcmpiA.KERNEL32(00000000,00000000), ref: 004059A0
CharNextA.USER32(00000000,?,00000000,00405BD5,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004059B1
lstrlenA.KERNEL32(00000000,?,00000000,00405BD5,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004059BA

Memory Dump Source

Source File: 00000000.00000002.3789251743.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3789230297.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789271823.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789304557.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789586334.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: d250403eeccc32afa1460bd507a63d74f6ad2c43926490d4129708a4008c1f50
Instruction ID: 2b31bcc4a158946671b74a97661090b9e56dbbcbef6738157e9c676b7350d0db
Opcode Fuzzy Hash: d250403eeccc32afa1460bd507a63d74f6ad2c43926490d4129708a4008c1f50
Instruction Fuzzy Hash: 7DF0C272515518FFCB029FA5DC00D9EBBA8EF16360B2540AAF800F7310D274EE019BA9

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report nRNzqQOQwk.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\Fljtenists.ini

C:\Users\user\AppData\Local\Temp\nsp9F8A.tmp\System.dll

C:\Users\user\slavelivets\Frimenigheders.Lin

C:\Users\user\slavelivets\Tonsillary252.Ban

C:\Users\user\slavelivets\alsmekill.sta

C:\Users\user\slavelivets\boat.ast

C:\Users\user\slavelivets\rupis.txt

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Network Port Distribution

Windows Analysis Report
nRNzqQOQwk.exe

Function 00403180 Relevance: 91.4, APIs: 33, Strings: 19, Instructions: 357
stringcomfileCOMMON

Function 00405DC2 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 199
stringCOMMON

Function 00405642 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 159
filestringCOMMON

Function 00402B0E Relevance: 7.6, APIs: 5, Instructions: 67
registryCOMMON

Function 00403720 Relevance: 47.5, APIs: 13, Strings: 14, Instructions: 215
stringregistryCOMMON

Function 00402CFA Relevance: 28.2, APIs: 5, Strings: 11, Instructions: 182
COMMON

Function 00401759 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 147
stringtimeCOMMON

Function 0040547F Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 39
COMMON

Function 00401D95 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43
COMMON

Function 004060CB Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Function 00402F33 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 161
COMMON

Function 004023D3 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73
registrystringCOMMON

Function 00405A42 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 33
COMMON

Function 100016BD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 118
COMMON

Function 00405900 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46
stringCOMMON