Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample Name:	file.exe
Analysis ID:	694011
MD5:	1611db9a8c67f61ce0760633edd43c48
SHA1:	d2ba3efe05c12cfe47b84241e00fae494b2a1e0d
SHA256:	9808d6a6b9ae7baef6715e6440988055682a88d1b5b1096148acdddc371ecfd2
Tags:	exeSmokeLoader
Infos:

Detection

Djvu, Fabookie, ManusCrypt, SmokeLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected SmokeLoader

Detected unpacking (changes PE section rights)

Antivirus detection for URL or domain

Antivirus detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected Fabookie

Benign windows process drops PE files

Malicious sample detected (through community Yara rule)

Yara detected Djvu Ransomware

Yara detected ManusCrypt

Multi AV Scanner detection for dropped file

Maps a DLL or memory area into another process

Found Tor onion address

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Creates processes via WMI

Machine Learning detection for sample

Allocates memory in foreign processes

Injects a PE file into a foreign processes

Contains functionality to inject code into remote processes

Deletes itself after installation

Tries to detect virtualization through RDTSC time measurements

Creates a thread in another existing process (thread injection)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Checks if the current machine is a virtual machine (disk enumeration)

Tries to harvest and steal browser information (history, passwords, etc)

Detected VMProtect packer

Writes to foreign memory regions

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Machine Learning detection for dropped file

C2 URLs / IPs found in malware configuration

Antivirus or Machine Learning detection for unpacked file

May sleep (evasive loops) to hinder dynamic analysis

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Found evasive API chain (may stop execution after checking a module file name)

Contains functionality to dynamically determine API calls

Contains long sleeps (>= 3 min)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Drops files with a non-matching file extension (content does not match file extension)

PE file contains strange resources

Drops PE files

Tries to load missing DLLs

Contains functionality to read the PEB

Checks if the current process is being debugged

Registers a DLL

Launches processes in debugging mode, may be used to hinder debugging

Dropped file seen in connection with other malware

Creates a process in suspended mode (likely to inject code)

Uses 32bit PE files

Yara signature match

Contains functionality to check if a debugger is running (IsDebuggerPresent)

PE file contains sections with non-standard names

Found potential string decryption / allocating functions

Contains functionality to call native functions

Found dropped PE file which has not been started or loaded

PE file contains executable resources (Code or Archives)

IP address seen in connection with other malware

Contains functionality for execution timing, often used to detect debuggers

Entry point lies outside standard sections

Creates a DirectInput object (often for capturing keystrokes)

PE file contains an invalid checksum

Connects to several IPs in different countries

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Classification

Process Tree

System is w10x64

file.exe (PID: 2904 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 1611DB9A8C67F61CE0760633EDD43C48)

explorer.exe (PID: 3528 cmdline: C:\Windows\Explorer.EXE MD5: AD5296B280E8F522A8A897C96BAB0E1D)

regsvr32.exe (PID: 3328 cmdline: regsvr32 /s C:\Users\user\AppData\Local\Temp\70E4.dll MD5: D78B75FC68247E8A63ACBA846182740E)

regsvr32.exe (PID: 4712 cmdline: /s C:\Users\user\AppData\Local\Temp\70E4.dll MD5: 426E7499F6A7346F0410DEAD0805586B)

87B9.exe (PID: 5612 cmdline: C:\Users\user\AppData\Local\Temp\87B9.exe MD5: E990ACDB640F13969C55C38E857AB4AB)

87B9.exe (PID: 4652 cmdline: C:\Users\user\AppData\Local\Temp\87B9.exe MD5: E990ACDB640F13969C55C38E857AB4AB)

A024.exe (PID: 3064 cmdline: C:\Users\user\AppData\Local\Temp\A024.exe MD5: 2679869D7C3C730553BDB94848DDEEA5)

C05F.exe (PID: 2484 cmdline: C:\Users\user\AppData\Local\Temp\C05F.exe MD5: AE9E2CE4CF9B092A5BBFD1D5A609166E)

conhost.exe (PID: 2220 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

C05F.exe (PID: 4936 cmdline: "C:\Users\user\AppData\Local\Temp\C05F.exe" -h MD5: AE9E2CE4CF9B092A5BBFD1D5A609166E)

conhost.exe (PID: 4560 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

D86C.exe (PID: 5068 cmdline: C:\Users\user\AppData\Local\Temp\D86C.exe MD5: 1A86A0186CC8ABD0BE2907E9ED681756)

E9D3.exe (PID: 5264 cmdline: C:\Users\user\AppData\Local\Temp\E9D3.exe MD5: 3191DB3E8A8BD2AA891786059AC8636B)

ACE4.exe (PID: 1028 cmdline: C:\Users\user\AppData\Local\Temp\ACE4.exe MD5: AE9E2CE4CF9B092A5BBFD1D5A609166E)

conhost.exe (PID: 4216 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

C39A.exe (PID: 1700 cmdline: C:\Users\user\AppData\Local\Temp\C39A.exe MD5: 1A86A0186CC8ABD0BE2907E9ED681756)

dllhost.exe (PID: 2484 cmdline: C:\Windows\system32\DllHost.exe /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E} MD5: 2528137C6745C4EADD87817A1909677E)

Conhost.exe (PID: 2176 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

erhuush (PID: 2344 cmdline: C:\Users\user\AppData\Roaming\erhuush MD5: 1611DB9A8C67F61CE0760633EDD43C48)

svchost.exe (PID: 1900 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 4632 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

WmiPrvSE.exe (PID: 5656 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: A782A4ED336750D10B3CAF776AFE8E70)

rundll32.exe (PID: 3720 cmdline: rundll32.exe "C:\Users\user\AppData\Local\Temp\db.dll",open MD5: 73C519F050C20580F8A62C849D49215A)

rundll32.exe (PID: 6052 cmdline: rundll32.exe "C:\Users\user\AppData\Local\Temp\db.dll",open MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

svchost.exe (PID: 332 cmdline: c:\windows\system32\svchost.exe -k netsvcs -p -s gpsvc MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 2200 cmdline: c:\windows\system32\svchost.exe -k netsvcs -p -s IKEEXT MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 5360 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

cleanup

Malware Configuration

Threatname: Djvu

{"Download URLs": ["http://rgyui.top/dl/build2.exe", "http://acacaca.org/files/1/build3.exe"], "C2 url": "http://acacaca.org/lancer/get.php", "Ransom note file": "_readme.txt", "Ransom note": "ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-lFoTUDc1Fx\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nsupport@bestyourmail.ch\r\n\r\nReserve e-mail address to contact us:\r\ndatarestorehelp@airmail.cc\r\n\r\nYour personal ID:\r\n0549Jhyjd", "Ignore Files": ["ntuser.dat", "ntuser.dat.LOG1", "ntuser.dat.LOG2", "ntuser.pol", ".sys", ".ini", ".DLL", ".dll", ".blf", ".bat", ".lnk", ".regtrans-ms", "C:\\SystemID\\", "C:\\Users\\Default User\\", "C:\\Users\\Public\\", "C:\\Users\\All Users\\", "C:\\Users\\Default\\", "C:\\Documents and Settings\\", "C:\\ProgramData\\", "C:\\Recovery\\", "C:\\System Volume Information\\", "C:\\Users\\%username%\\AppData\\Roaming\\", "C:\\Users\\%username%\\AppData\\Local\\", "C:\\Windows\\", "C:\\PerfLogs\\", "C:\\ProgramData\\Microsoft\\", "C:\\ProgramData\\Package Cache\\", "C:\\Users\\Public\\", "C:\\$Recycle.Bin\\", "C:\\$WINDOWS.~BT\\", "C:\\dell\\", "C:\\Intel\\", "C:\\MSOCache\\", "C:\\Program Files\\", "C:\\Program Files (x86)\\", "C:\\Games\\", "C:\\Windows.old\\", "D:\\Users\\%username%\\AppData\\Roaming\\", "D:\\Users\\%username%\\AppData\\Local\\", "D:\\Windows\\", "D:\\PerfLogs\\", "D:\\ProgramData\\Desktop\\", "D:\\ProgramData\\Microsoft\\", "D:\\ProgramData\\Package Cache\\", "D:\\Users\\Public\\", "D:\\$Recycle.Bin\\", "D:\\$WINDOWS.~BT\\", "D:\\dell\\", "D:\\Intel\\", "D:\\MSOCache\\", "D:\\Program Files\\", "D:\\Program Files (x86)\\", "D:\\Games\\", "E:\\Users\\%username%\\AppData\\Roaming\\", "E:\\Users\\%username%\\AppData\\Local\\", "E:\\Windows\\", "E:\\PerfLogs\\", "E:\\ProgramData\\Desktop\\", "E:\\ProgramData\\Microsoft\\", "E:\\ProgramData\\Package Cache\\", "E:\\Users\\Public\\", "E:\\$Recycle.Bin\\", "E:\\$WINDOWS.~BT\\", "E:\\dell\\", "E:\\Intel\\", "E:\\MSOCache\\", "E:\\Program Files\\", "E:\\Program Files (x86)\\", "E:\\Games\\", "F:\\Users\\%username%\\AppData\\Roaming\\", "F:\\Users\\%username%\\AppData\\Local\\", "F:\\Windows\\", "F:\\PerfLogs\\", "F:\\ProgramData\\Desktop\\", "F:\\ProgramData\\Microsoft\\", "F:\\Users\\Public\\", "F:\\$Recycle.Bin\\", "F:\\$WINDOWS.~BT\\", "F:\\dell\\", "F:\\Intel\\"], "Public Key": "-----BEGIN PUBLIC KEY-----\\\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwWZ7difN4\\/w6uP6dgqG6\\\\nvftez3eaEgDMUWG64EFNomZk\\/aGagJUZNATseVKViU3SRhi\\/imDMtG6Kd0LzCs0Q\\\\nAqErh4UFa\\/yCKZqYcwV\\/9ubI\\/9lwSfhXyDiJ7Erz3GXu4uCZ2llrOvQQo3EjLKMd\\\\nfDs3N5nABcM0JOzt2lH3ErNF+I+LbRkCEhevBBMlmLVLGn02ynpSOz3ZMFdPUX+T\\\\nCsF54KacWKK5HKQ7LOZmsO61suDKNhMdGlSbRELZzmlBPrlGeOK1Ve0GQQzGi+ns\\\\nzWUqS1a35FJvwUlL7aLbYmlgIOLkrg2nnq5epbuQC0TZMKetJq\\/OVJHsZ7xbthII\\\\nlwIDAQAB\\\\n-----END PUBLIC KEY-----"}

Threatname: SmokeLoader

{"C2 list": ["http://zdauctions.com/tmp/", "http://mordo.ru/tmp/"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
0000001A.00000003.526622172.0000000000B10000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000000F.00000000.485672401.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000027.00000002.601597228.00000000009F1000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000027.00000002.601597228.00000000009F1000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x3d4:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
0000001B.00000002.739912367.0000000002BF5000.00000040.00000800.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000002B.00000003.595564014.00000156B6AE0000.00000004.00000001.00020000.00000000.sdmp	SUSP_XORed_MSDOS_Stub_Message	Detects suspicious XORed MSDOS stub message	Florian Roth	0x6506e:$xo1: \x19%$>m=?"*?, m.,##"9m/(m?8#m$#m\x09\x02\x1Em ")(
0000002B.00000003.595564014.00000156B6AE0000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_ManusCrypt	Yara detected ManusCrypt	Joe Security
0000002B.00000003.595564014.00000156B6AE0000.00000004.00000001.00020000.00000000.sdmp	Windows_Trojan_Generic_a681f24a	unknown	unknown	0x576f0:$a: _kasssperskdy 0x5861e:$c: {SDTB8HQ9-96HV-S78H-Z3GI-J7UCTY784HHC}
0000001A.00000002.544780175.0000000000B10000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000001A.00000002.544780175.0000000000B10000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x7d4:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
0000000F.00000000.490507253.0000000000400000.00000040.00000400.00020000.00000000.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
0000000F.00000000.490507253.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0000000F.00000000.490507253.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
0000000F.00000000.490507253.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000000F.00000002.503363757.0000000000400000.00000040.00000400.00020000.00000000.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
0000000F.00000002.503363757.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0000000F.00000002.503363757.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
0000000F.00000002.503363757.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000027.00000002.601012575.0000000000930000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000002.387378506.0000000000C29000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x4746:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000007.00000002.441430475.0000000002491000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000007.00000002.441430475.0000000002491000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x414:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
0000001A.00000002.544740114.0000000000B00000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
0000000F.00000000.490001086.0000000000400000.00000040.00000400.00020000.00000000.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
0000000F.00000000.490001086.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0000000F.00000000.490001086.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
0000000F.00000000.490001086.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000001F.00000002.652754688.0000000004D44000.00000040.00001000.00020000.00000000.sdmp	SUSP_XORed_MSDOS_Stub_Message	Detects suspicious XORed MSDOS stub message	Florian Roth	0x10d66:$xo1: \x19%$>m=?"*?, m.,##"9m/(m?8#m$#m\x09\x02\x1Em ")(
0000001F.00000002.652754688.0000000004D44000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_ManusCrypt	Yara detected ManusCrypt	Joe Security
0000001F.00000002.652754688.0000000004D44000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Generic_a681f24a	unknown	unknown	0xa4ec:$a: _kasssperskdy 0xb0ae:$c: {SDTB8HQ9-96HV-S78H-Z3GI-J7UCTY784HHC}
00000024.00000003.573535906.000002F31BF40000.00000004.00000001.00020000.00000000.sdmp	SUSP_XORed_MSDOS_Stub_Message	Detects suspicious XORed MSDOS stub message	Florian Roth	0x6506e:$xo1: \x19%$>m=?"*?, m.,##"9m/(m?8#m$#m\x09\x02\x1Em ")(
00000024.00000003.573535906.000002F31BF40000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_ManusCrypt	Yara detected ManusCrypt	Joe Security
00000024.00000003.573535906.000002F31BF40000.00000004.00000001.00020000.00000000.sdmp	Windows_Trojan_Generic_a681f24a	unknown	unknown	0x576f0:$a: _kasssperskdy 0x5861e:$c: {SDTB8HQ9-96HV-S78H-Z3GI-J7UCTY784HHC}
00000027.00000002.601073617.0000000000940000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000027.00000002.601073617.0000000000940000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x7d4:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
0000000F.00000000.492226078.0000000000400000.00000040.00000400.00020000.00000000.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
0000000F.00000000.492226078.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0000000F.00000000.492226078.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
0000000F.00000000.492226078.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000000.00000002.387173781.00000000009E1000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000000.00000002.387173781.00000000009E1000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x414:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000001.00000000.367270038.0000000004611000.00000020.80000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000001.00000000.367270038.0000000004611000.00000020.80000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x414:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000000.00000002.387108841.00000000009C0000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000000.00000002.387108841.00000000009C0000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x814:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000007.00000002.441371767.0000000002470000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000007.00000002.441371767.0000000002470000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x814:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000007.00000002.440994734.00000000009C0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000027.00000002.602802862.0000000000A29000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x4b4f:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000000F.00000000.491102942.0000000000400000.00000040.00000400.00020000.00000000.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
0000000F.00000000.491102942.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0000000F.00000000.491102942.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
0000000F.00000000.491102942.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000000.00000002.387065611.00000000009B0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
0000001A.00000002.545414239.0000000000B89000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x4c67:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000001B.00000003.552567063.0000000003860000.00000004.00001000.00020000.00000000.sdmp	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x36d645:$x1: https://cdn.discordapp.com/attachments/ 0x36e115:$x1: https://cdn.discordapp.com/attachments/
0000000F.00000000.488104570.0000000000400000.00000040.00000400.00020000.00000000.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
0000000F.00000000.488104570.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0000000F.00000000.488104570.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
0000000F.00000000.488104570.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000007.00000002.441147746.00000000009E8000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x51b6:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000001F.00000002.643002638.0000000001130000.00000004.00001000.00020000.00000000.sdmp	SUSP_XORed_MSDOS_Stub_Message	Detects suspicious XORed MSDOS stub message	Florian Roth	0x53366:$xo1: \x19%$>m=?"*?, m.,##"9m/(m?8#m$#m\x09\x02\x1Em ")(
0000001F.00000002.643002638.0000000001130000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_ManusCrypt	Yara detected ManusCrypt	Joe Security
0000001F.00000002.643002638.0000000001130000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_Fabookie	Detects Fabookie / ElysiumStealer	ditekSHen	0x4c6e6:$s1: rwinssyslog 0x4caec:$s2: _kasssperskdy 0x4ca88:$s3: [Title:%s] 0x4cbfc:$s4: [Execute] 0x4cc10:$s5: [Snapshot] 0x4d484:$s6: Mozilla/4.0 (compatible) 0x4de3c:$s9: CUdpClient::Start
0000001F.00000002.643002638.0000000001130000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Generic_a681f24a	unknown	unknown	0x4caec:$a: _kasssperskdy 0x4d6ae:$c: {SDTB8HQ9-96HV-S78H-Z3GI-J7UCTY784HHC}
00000027.00000003.584704076.0000000000940000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000001A.00000002.545012487.0000000000B31000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000001A.00000002.545012487.0000000000B31000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x3d4:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
0000000E.00000002.495843293.00000000026F0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0000000E.00000002.495843293.00000000026F0000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000000E.00000002.494725828.0000000002545000.00000040.00000800.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000002B.00000000.600713527.00000156B6B50000.00000040.00000001.00020000.00000000.sdmp	SUSP_XORed_MSDOS_Stub_Message	Detects suspicious XORed MSDOS stub message	Florian Roth	0x6646e:$xo1: \x19%$>m=?"*?, m.,##"9m/(m?8#m$#m\x09\x02\x1Em ")(
0000002B.00000000.600713527.00000156B6B50000.00000040.00000001.00020000.00000000.sdmp	JoeSecurity_ManusCrypt	Yara detected ManusCrypt	Joe Security
0000002B.00000000.600713527.00000156B6B50000.00000040.00000001.00020000.00000000.sdmp	MALWARE_Win_Chebka	Detects Chebka	ditekSHen	0x59e08:$s1: -k netsvcs 0x595c8:$s3: Mozilla/4.0 (compatible) 0x588f0:$s4: _kasssperskdy 0x57f88:$s5: winssyslog 0x59b50:$s6: LoaderDll%d 0x57e60:$s7: cmd.exe /c rundll32.exe shell32.dll, 0x57a90:$s8: cmd.exe /c start chrome.exe 0x57bf0:$s8: cmd.exe /c start msedge.exe 0x57dd0:$s8: cmd.exe /c start firefox.exe 0x682f0:$f1: .?AVCHVncManager@@ 0x686d8:$f2: .?AVCNetstatManager@@ 0x68748:$f3: .?AVCTcpAgentListener@@ 0x685c8:$f4: .?AVIUdpClientListener@@ 0x68978:$f5: .?AVCShellManager@@ 0x68928:$f6: .?AVCScreenSpy@@
0000002B.00000000.600713527.00000156B6B50000.00000040.00000001.00020000.00000000.sdmp	Windows_Trojan_Generic_a681f24a	unknown	unknown	0x588f0:$a: _kasssperskdy 0x5981e:$c: {SDTB8HQ9-96HV-S78H-Z3GI-J7UCTY784HHC}
00000024.00000000.584962257.000002F31BFB0000.00000040.00000001.00020000.00000000.sdmp	SUSP_XORed_MSDOS_Stub_Message	Detects suspicious XORed MSDOS stub message	Florian Roth	0x6646e:$xo1: \x19%$>m=?"*?, m.,##"9m/(m?8#m$#m\x09\x02\x1Em ")(
00000024.00000000.584962257.000002F31BFB0000.00000040.00000001.00020000.00000000.sdmp	JoeSecurity_ManusCrypt	Yara detected ManusCrypt	Joe Security
00000024.00000000.584962257.000002F31BFB0000.00000040.00000001.00020000.00000000.sdmp	MALWARE_Win_Chebka	Detects Chebka	ditekSHen	0x59e08:$s1: -k netsvcs 0x595c8:$s3: Mozilla/4.0 (compatible) 0x588f0:$s4: _kasssperskdy 0x57f88:$s5: winssyslog 0x59b50:$s6: LoaderDll%d 0x57e60:$s7: cmd.exe /c rundll32.exe shell32.dll, 0x57a90:$s8: cmd.exe /c start chrome.exe 0x57bf0:$s8: cmd.exe /c start msedge.exe 0x57dd0:$s8: cmd.exe /c start firefox.exe 0x682f0:$f1: .?AVCHVncManager@@ 0x686d8:$f2: .?AVCNetstatManager@@ 0x68748:$f3: .?AVCTcpAgentListener@@ 0x685c8:$f4: .?AVIUdpClientListener@@ 0x68978:$f5: .?AVCShellManager@@ 0x68928:$f6: .?AVCScreenSpy@@
00000024.00000000.584962257.000002F31BFB0000.00000040.00000001.00020000.00000000.sdmp	Windows_Trojan_Generic_a681f24a	unknown	unknown	0x588f0:$a: _kasssperskdy 0x5981e:$c: {SDTB8HQ9-96HV-S78H-Z3GI-J7UCTY784HHC}
0000001B.00000002.865037113.0000000002FE0000.00000040.00000001.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
Process Memory Space: 87B9.exe PID: 5612	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: 87B9.exe PID: 5612	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x41f58:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: 87B9.exe PID: 4652	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: 87B9.exe PID: 4652	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x4a6ed:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0x7d711:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xb3c84:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: A024.exe PID: 3064	JoeSecurity_Fabookie	Yara detected Fabookie	Joe Security
Process Memory Space: svchost.exe PID: 2200	JoeSecurity_ManusCrypt	Yara detected ManusCrypt	Joe Security
Click to see the 81 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
26.2.D86C.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
31.2.rundll32.exe.4d00000.0.unpack	SUSP_XORed_MSDOS_Stub_Message	Detects suspicious XORed MSDOS stub message	Florian Roth	0x53366:$xo1: \x19%$>m=?"*?, m.,##"9m/(m?8#m$#m\x09\x02\x1Em ")(
31.2.rundll32.exe.4d00000.0.unpack	JoeSecurity_ManusCrypt	Yara detected ManusCrypt	Joe Security
31.2.rundll32.exe.4d00000.0.unpack	MALWARE_Win_Fabookie	Detects Fabookie / ElysiumStealer	ditekSHen	0x4c6e6:$s1: rwinssyslog 0x4caec:$s2: _kasssperskdy 0x4ca88:$s3: [Title:%s] 0x4cbfc:$s4: [Execute] 0x4cc10:$s5: [Snapshot] 0x4d484:$s6: Mozilla/4.0 (compatible) 0x4de3c:$s9: CUdpClient::Start
31.2.rundll32.exe.4d00000.0.unpack	MALWARE_Win_Chebka	Detects Chebka	ditekSHen	0x4dcf4:$s1: -k netsvcs 0x4d484:$s3: Mozilla/4.0 (compatible) 0x4caec:$s4: _kasssperskdy 0x4c6e8:$s5: winssyslog 0x4da4c:$s6: LoaderDll%d 0x4c4c8:$s7: cmd.exe /c rundll32.exe shell32.dll, 0x4c110:$s8: cmd.exe /c start chrome.exe 0x4c270:$s8: cmd.exe /c start msedge.exe 0x4c440:$s8: cmd.exe /c start firefox.exe 0x54f08:$f1: .?AVCHVncManager@@ 0x55204:$f2: .?AVCNetstatManager@@ 0x5525c:$f3: .?AVCTcpAgentListener@@ 0x54ffc:$f4: .?AVIUdpClientListener@@ 0x5541c:$f5: .?AVCShellManager@@ 0x553e0:$f6: .?AVCScreenSpy@@
31.2.rundll32.exe.4d00000.0.unpack	Windows_Trojan_Generic_a681f24a	unknown	unknown	0x4caec:$a: _kasssperskdy 0x4d6ae:$c: {SDTB8HQ9-96HV-S78H-Z3GI-J7UCTY784HHC}
15.0.87B9.exe.400000.3.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
15.0.87B9.exe.400000.9.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
15.0.87B9.exe.400000.9.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
15.0.87B9.exe.400000.9.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
15.0.87B9.exe.400000.9.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
15.0.87B9.exe.400000.8.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
15.0.87B9.exe.400000.8.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
15.0.87B9.exe.400000.8.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
15.0.87B9.exe.400000.8.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
14.2.87B9.exe.26f15a0.1.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xdf7ea:$s1: http:// 0xfd898:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xfdf28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xfdf4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101b2b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xffa26:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xdf7ea:$f1: http://
14.2.87B9.exe.26f15a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
14.2.87B9.exe.26f15a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
14.2.87B9.exe.26f15a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
15.0.87B9.exe.400000.6.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
15.0.87B9.exe.400000.6.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
15.0.87B9.exe.400000.6.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
15.0.87B9.exe.400000.6.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
15.0.87B9.exe.400000.7.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
15.0.87B9.exe.400000.7.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
15.0.87B9.exe.400000.7.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
15.0.87B9.exe.400000.7.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
15.0.87B9.exe.400000.5.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
15.0.87B9.exe.400000.5.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
15.0.87B9.exe.400000.5.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
15.0.87B9.exe.400000.5.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
15.0.87B9.exe.400000.9.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
15.0.87B9.exe.400000.9.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
15.0.87B9.exe.400000.9.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
15.0.87B9.exe.400000.9.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
26.3.D86C.exe.b10000.0.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
15.0.87B9.exe.400000.8.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
15.0.87B9.exe.400000.8.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
15.0.87B9.exe.400000.8.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
15.0.87B9.exe.400000.8.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
15.0.87B9.exe.400000.10.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
15.0.87B9.exe.400000.10.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
15.0.87B9.exe.400000.10.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
15.0.87B9.exe.400000.10.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
39.3.C39A.exe.940000.0.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
26.2.D86C.exe.b00e67.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
15.2.87B9.exe.400000.0.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
15.2.87B9.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
15.2.87B9.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
15.2.87B9.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
14.2.87B9.exe.26f15a0.1.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
14.2.87B9.exe.26f15a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
14.2.87B9.exe.26f15a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
14.2.87B9.exe.26f15a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
39.2.C39A.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
15.0.87B9.exe.400000.2.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
27.2.E9D3.exe.9dab40.2.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x31a58:$s2: The Magic Word! 0x3db98:$s2: The Magic Word! 0x31db8:$s3: Software\Oracle\VirtualBox 0x31a47:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
27.2.E9D3.exe.9d86a0.3.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x33ef8:$s2: The Magic Word! 0x40038:$s2: The Magic Word! 0x34258:$s3: Software\Oracle\VirtualBox 0x33ee7:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
27.2.E9D3.exe.9d2d00.0.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x39898:$s2: The Magic Word! 0x459d8:$s2: The Magic Word! 0x39bf8:$s3: Software\Oracle\VirtualBox 0x39887:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
27.3.E9D3.exe.3e36ca0.1.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x33ef8:$s2: The Magic Word! 0x40038:$s2: The Magic Word! 0x34258:$s3: Software\Oracle\VirtualBox 0x33ee7:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
15.0.87B9.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
27.3.E9D3.exe.3e31300.3.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x39898:$s2: The Magic Word! 0x459d8:$s2: The Magic Word! 0x39bf8:$s3: Software\Oracle\VirtualBox 0x39887:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
15.0.87B9.exe.400000.6.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
15.0.87B9.exe.400000.6.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
15.0.87B9.exe.400000.6.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
15.0.87B9.exe.400000.6.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
36.0.svchost.exe.2f31bfb0000.0.unpack	SUSP_XORed_MSDOS_Stub_Message	Detects suspicious XORed MSDOS stub message	Florian Roth	0x6506e:$xo1: \x19%$>m=?"*?, m.,##"9m/(m?8#m$#m\x09\x02\x1Em ")(
36.0.svchost.exe.2f31bfb0000.0.unpack	JoeSecurity_ManusCrypt	Yara detected ManusCrypt	Joe Security
36.0.svchost.exe.2f31bfb0000.0.unpack	MALWARE_Win_Chebka	Detects Chebka	ditekSHen	0x58c08:$s1: -k netsvcs 0x583c8:$s3: Mozilla/4.0 (compatible) 0x576f0:$s4: _kasssperskdy 0x56d88:$s5: winssyslog 0x58950:$s6: LoaderDll%d 0x56c60:$s7: cmd.exe /c rundll32.exe shell32.dll, 0x56890:$s8: cmd.exe /c start chrome.exe 0x569f0:$s8: cmd.exe /c start msedge.exe 0x56bd0:$s8: cmd.exe /c start firefox.exe 0x66ef0:$f1: .?AVCHVncManager@@ 0x672d8:$f2: .?AVCNetstatManager@@ 0x67348:$f3: .?AVCTcpAgentListener@@ 0x671c8:$f4: .?AVIUdpClientListener@@ 0x67578:$f5: .?AVCShellManager@@ 0x67528:$f6: .?AVCScreenSpy@@
36.0.svchost.exe.2f31bfb0000.0.unpack	Windows_Trojan_Generic_a681f24a	unknown	unknown	0x576f0:$a: _kasssperskdy 0x5861e:$c: {SDTB8HQ9-96HV-S78H-Z3GI-J7UCTY784HHC}
15.0.87B9.exe.400000.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
39.2.C39A.exe.930e67.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
15.0.87B9.exe.400000.7.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
15.0.87B9.exe.400000.7.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
15.0.87B9.exe.400000.7.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
15.0.87B9.exe.400000.7.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
15.0.87B9.exe.400000.4.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
15.0.87B9.exe.400000.4.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
15.0.87B9.exe.400000.4.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
15.0.87B9.exe.400000.4.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
15.2.87B9.exe.400000.0.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
15.2.87B9.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
15.2.87B9.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
15.2.87B9.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
27.3.E9D3.exe.3e39140.2.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x31a58:$s2: The Magic Word! 0x3db98:$s2: The Magic Word! 0x31db8:$s3: Software\Oracle\VirtualBox 0x31a47:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
15.0.87B9.exe.400000.10.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
15.0.87B9.exe.400000.10.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
15.0.87B9.exe.400000.10.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
15.0.87B9.exe.400000.10.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
15.0.87B9.exe.400000.5.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
43.0.svchost.exe.156b6b50000.0.unpack	SUSP_XORed_MSDOS_Stub_Message	Detects suspicious XORed MSDOS stub message	Florian Roth	0x6506e:$xo1: \x19%$>m=?"*?, m.,##"9m/(m?8#m$#m\x09\x02\x1Em ")(
43.0.svchost.exe.156b6b50000.0.unpack	JoeSecurity_ManusCrypt	Yara detected ManusCrypt	Joe Security
43.0.svchost.exe.156b6b50000.0.unpack	MALWARE_Win_Chebka	Detects Chebka	ditekSHen	0x58c08:$s1: -k netsvcs 0x583c8:$s3: Mozilla/4.0 (compatible) 0x576f0:$s4: _kasssperskdy 0x56d88:$s5: winssyslog 0x58950:$s6: LoaderDll%d 0x56c60:$s7: cmd.exe /c rundll32.exe shell32.dll, 0x56890:$s8: cmd.exe /c start chrome.exe 0x569f0:$s8: cmd.exe /c start msedge.exe 0x56bd0:$s8: cmd.exe /c start firefox.exe 0x66ef0:$f1: .?AVCHVncManager@@ 0x672d8:$f2: .?AVCNetstatManager@@ 0x67348:$f3: .?AVCTcpAgentListener@@ 0x671c8:$f4: .?AVIUdpClientListener@@ 0x67578:$f5: .?AVCShellManager@@ 0x67528:$f6: .?AVCScreenSpy@@
43.0.svchost.exe.156b6b50000.0.unpack	Windows_Trojan_Generic_a681f24a	unknown	unknown	0x576f0:$a: _kasssperskdy 0x5861e:$c: {SDTB8HQ9-96HV-S78H-Z3GI-J7UCTY784HHC}
36.0.svchost.exe.2f31bfb0000.0.raw.unpack	SUSP_XORed_MSDOS_Stub_Message	Detects suspicious XORed MSDOS stub message	Florian Roth	0x6646e:$xo1: \x19%$>m=?"*?, m.,##"9m/(m?8#m$#m\x09\x02\x1Em ")(
36.0.svchost.exe.2f31bfb0000.0.raw.unpack	JoeSecurity_ManusCrypt	Yara detected ManusCrypt	Joe Security
36.0.svchost.exe.2f31bfb0000.0.raw.unpack	MALWARE_Win_Chebka	Detects Chebka	ditekSHen	0x59e08:$s1: -k netsvcs 0x595c8:$s3: Mozilla/4.0 (compatible) 0x588f0:$s4: _kasssperskdy 0x57f88:$s5: winssyslog 0x59b50:$s6: LoaderDll%d 0x57e60:$s7: cmd.exe /c rundll32.exe shell32.dll, 0x57a90:$s8: cmd.exe /c start chrome.exe 0x57bf0:$s8: cmd.exe /c start msedge.exe 0x57dd0:$s8: cmd.exe /c start firefox.exe 0x682f0:$f1: .?AVCHVncManager@@ 0x686d8:$f2: .?AVCNetstatManager@@ 0x68748:$f3: .?AVCTcpAgentListener@@ 0x685c8:$f4: .?AVIUdpClientListener@@ 0x68978:$f5: .?AVCShellManager@@ 0x68928:$f6: .?AVCScreenSpy@@
36.0.svchost.exe.2f31bfb0000.0.raw.unpack	Windows_Trojan_Generic_a681f24a	unknown	unknown	0x588f0:$a: _kasssperskdy 0x5981e:$c: {SDTB8HQ9-96HV-S78H-Z3GI-J7UCTY784HHC}
43.0.svchost.exe.156b6b50000.0.raw.unpack	SUSP_XORed_MSDOS_Stub_Message	Detects suspicious XORed MSDOS stub message	Florian Roth	0x6646e:$xo1: \x19%$>m=?"*?, m.,##"9m/(m?8#m$#m\x09\x02\x1Em ")(
43.0.svchost.exe.156b6b50000.0.raw.unpack	JoeSecurity_ManusCrypt	Yara detected ManusCrypt	Joe Security
43.0.svchost.exe.156b6b50000.0.raw.unpack	MALWARE_Win_Chebka	Detects Chebka	ditekSHen	0x59e08:$s1: -k netsvcs 0x595c8:$s3: Mozilla/4.0 (compatible) 0x588f0:$s4: _kasssperskdy 0x57f88:$s5: winssyslog 0x59b50:$s6: LoaderDll%d 0x57e60:$s7: cmd.exe /c rundll32.exe shell32.dll, 0x57a90:$s8: cmd.exe /c start chrome.exe 0x57bf0:$s8: cmd.exe /c start msedge.exe 0x57dd0:$s8: cmd.exe /c start firefox.exe 0x682f0:$f1: .?AVCHVncManager@@ 0x686d8:$f2: .?AVCNetstatManager@@ 0x68748:$f3: .?AVCTcpAgentListener@@ 0x685c8:$f4: .?AVIUdpClientListener@@ 0x68978:$f5: .?AVCShellManager@@ 0x68928:$f6: .?AVCScreenSpy@@
43.0.svchost.exe.156b6b50000.0.raw.unpack	Windows_Trojan_Generic_a681f24a	unknown	unknown	0x588f0:$a: _kasssperskdy 0x5981e:$c: {SDTB8HQ9-96HV-S78H-Z3GI-J7UCTY784HHC}
27.3.E9D3.exe.3860000.0.raw.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x36d645:$x1: https://cdn.discordapp.com/attachments/ 0x36e115:$x1: https://cdn.discordapp.com/attachments/
Click to see the 98 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://acacaca.org/lancer/get.php	Avira URL Cloud: Label: malware
Source: http://www.hhiuew33.com/	URL Reputation: Label: malware
Source: http://www.hhiuew33.com/check/safe	Avira URL Cloud: Label: malware
Source: https://blockstream.info/apihttps://sofolisk.com/api/loginvalid	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\964B.exe	Avira: detection malicious, Label: HEUR/AGEN.1249525
Source: C:\Users\user\AppData\Local\Temp\A024.exe	Avira: detection malicious, Label: HEUR/AGEN.1249525

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 41%

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\4A99.exe	ReversingLabs: Detection: 32%
Source: C:\Users\user\AppData\Local\Temp\87B9.exe	Metadefender: Detection: 58%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\87B9.exe	ReversingLabs: Detection: 80%
Source: C:\Users\user\AppData\Local\Temp\964B.exe	ReversingLabs: Detection: 57%
Source: C:\Users\user\AppData\Local\Temp\A024.exe	ReversingLabs: Detection: 57%
Source: C:\Users\user\AppData\Local\Temp\ACE4.exe	Metadefender: Detection: 53%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\ACE4.exe	ReversingLabs: Detection: 76%
Source: C:\Users\user\AppData\Local\Temp\C05F.exe	Metadefender: Detection: 53%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\C05F.exe	ReversingLabs: Detection: 76%

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\964B.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\D86C.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\254.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\C39A.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\erhuush	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\4A99.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\E9D3.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\bchuush	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\519F.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\87B9.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\A024.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\70E4.dll	Joe Sandbox ML: detected

Source: 31.2.rundll32.exe.4d00000.0.unpack	Avira: Label: TR/ATRAPS.Gen2
Source: 36.0.svchost.exe.2f31bfb0000.0.unpack	Avira: Label: TR/ATRAPS.Gen2
Source: 43.0.svchost.exe.156b6b50000.0.unpack	Avira: Label: TR/ATRAPS.Gen2

Source: 00000027.00000002.601597228.00000000009F1000.00000004.10000000.00040000.00000000.sdmp	Malware Configuration Extractor: SmokeLoader {"C2 list": ["http://zdauctions.com/tmp/", "http://mordo.ru/tmp/"]}
Source: 15.0.87B9.exe.400000.7.unpack	Malware Configuration Extractor: Djvu {"Download URLs": ["http://rgyui.top/dl/build2.exe", "http://acacaca.org/files/1/build3.exe"], "C2 url": "http://acacaca.org/lancer/get.php", "Ransom note file": "_readme.txt", "Ransom note": "ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-lFoTUDc1Fx\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nsupport@bestyourmail.ch\r\n\r\nReserve e-mail address to contact us:\r\ndatarestorehelp@airmail.cc\r\n\r\nYour personal ID:\r\n0549Jhyjd", "Ignore Files": ["ntuser.dat", "ntuser.dat.LOG1", "ntuser.dat.LOG2", "ntuser.pol", ".sys", ".ini", ".DLL", ".dll", ".blf", ".bat", ".lnk", ".regtrans-ms", "C:\\SystemID\\", "C:\\Users\\Default User\\", "C:\\Users\\Public\\", "C:\\Users\\All Users\\", "C:\\Users\\Default\\", "C:\\Documents and Settings\\", "C:\\ProgramData\\", "C:\\Recovery\\", "C:\\System Volume Information\\", "C:\\Users\\%username%\\AppData\\Roaming\\", "C:\\Users\\%username%\\AppData\\Local\\", "C:\\Windows\\", "C:\\PerfLogs\\", "C:\\ProgramData\\Microsoft\\", "C:\\ProgramData\\Package Cache\\", "C:\\Users\\Public\\", "C:\\$Recycle.Bin\\", "C:\\$WINDOWS.~BT\\", "C:\\dell\\", "C:\\Intel\\", "C:\\MSOCache\\", "C:\\Program Files\\", "C:\\Program Files (x86)\\", "C:\\Games\\", "C:\\Windows.old\\", "D:\\Users\\%username%\\AppData\\Roaming\\", "D:\\Users\\%username%\\AppData\\Local\\", "D:\\Windows\\", "D:\\PerfLogs\\", "D:\\ProgramData\\Desktop\\", "D:\\ProgramData\\Microsoft\\", "D:\\ProgramData\\Package Cache\\", "D:\\Users\\Public\\", "D:\\$Recycle.Bin\\", "D:\\$WINDOWS.~BT\\", "D:\\dell\\", "D:\\Intel\\", "D:\\MSOCache\\", "D:\\Program Files\\", "D:\\Program Files (x86)\\", "D:\\Games\\", "E:\\Users\\%username%\\AppData\\Roaming\\", "E:\\Users\\%username%\\AppData\\Local\\", "E:\\Windows\\", "E:\\PerfLogs\\", "E:\\ProgramData\\Desktop\\", "E:\\ProgramData\\Microsoft\\", "E:\\ProgramData\\Package Cache\\", "E:\\Users\\Public\\", "E:\\$Recycle.Bin\\", "E:\\$WINDOWS.~BT\\", "E:\\dell\\", "E:\\Intel\\", "E:\\MSOCache\\", "E:\\Program Files\\", "E:\\Program Files (x86)\\", "E:\\Games\\", "F:\\Users\\%username%\\AppData\\Roaming\\", "F:\\Users\\%username%\\AppData\\Local\\", "F:\\

Source: file.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb source: 87B9.exe, 87B9.exe, 0000000E.00000002.495843293.00000000026F0000.00000040.00001000.00020000.00000000.sdmp, 87B9.exe, 0000000F.00000000.490507253.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 87B9.exe, 0000000F.00000002.503363757.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 87B9.exe, 0000000F.00000000.488104570.0000000000400000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: EfiGuardDxe.pdb7 source: E9D3.exe, 0000001B.00000002.739912367.0000000002BF5000.00000040.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\hototapeges\jof14 godedoraga vihidi69\puwu.pdb source: 87B9.exe, 0000000E.00000000.477984877.0000000000401000.00000020.00000001.01000000.00000008.sdmp, 87B9.exe, 0000000E.00000002.493613078.0000000000401000.00000020.00000001.01000000.00000008.sdmp, 87B9.exe, 0000000F.00000000.484261191.0000000000401000.00000020.00000001.01000000.00000008.sdmp
Source:	Binary string: symsrv.pdbGCTL source: E9D3.exe, 0000001B.00000003.600314128.0000000004088000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: symsrv.pdb source: E9D3.exe, 0000001B.00000003.600314128.0000000004088000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\verumaxebi\sunaw\gewimovucajaf_hitojubare-hewohazap\kifobiv.pdb source: file.exe, file.exe, 00000000.00000002.386662790.0000000000409000.00000020.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000000.302664627.0000000000401000.00000020.00000001.01000000.00000003.sdmp, erhuush, erhuush, 00000007.00000000.423450379.0000000000401000.00000020.00000001.01000000.00000006.sdmp, erhuush, 00000007.00000002.440706921.0000000000409000.00000020.00000001.01000000.00000006.sdmp
Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdbI source: 87B9.exe, 0000000E.00000002.495843293.00000000026F0000.00000040.00001000.00020000.00000000.sdmp, 87B9.exe, 0000000F.00000000.490507253.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 87B9.exe, 0000000F.00000002.503363757.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 87B9.exe, 0000000F.00000000.488104570.0000000000400000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: C:\wuzoyobumo\xisiw.pdb source: E9D3.exe, 0000001B.00000000.542959704.0000000000401000.00000020.00000001.01000000.0000000D.sdmp
Source:	Binary string: CC:\hototapeges\jof14 godedoraga vihidi69\puwu.pdb source: 87B9.exe, 0000000E.00000000.477984877.0000000000401000.00000020.00000001.01000000.00000008.sdmp, 87B9.exe, 0000000E.00000002.493613078.0000000000401000.00000020.00000001.01000000.00000008.sdmp, 87B9.exe, 0000000F.00000000.484261191.0000000000401000.00000020.00000001.01000000.00000008.sdmp
Source:	Binary string: NC:\verumaxebi\sunaw\gewimovucajaf_hitojubare-hewohazap\kifobiv.pdb source: file.exe, 00000000.00000000.302664627.0000000000401000.00000020.00000001.01000000.00000003.sdmp, erhuush, 00000007.00000000.423450379.0000000000401000.00000020.00000001.01000000.00000006.sdmp
Source:	Binary string: C:\rad_linuv\poniyoy\vixejuni\kugum.pdb source: D86C.exe, 0000001A.00000000.523009146.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, D86C.exe, 0000001A.00000002.544319484.0000000000409000.00000020.00000001.01000000.0000000C.sdmp

Networking

Found Tor onion address

Source: E9D3.exe, 0000001B.00000003.552567063.0000000003860000.00000004.00001000.00020000.00000000.sdmp

String found in binary or memory: Pakistan Standard TimeParaguay Standard TimeRoGetActivationFactoryRtlDeleteFunctionTableRtlGetNtVersionNumbersSafeArrayGetRecordInfoSafeArraySetRecordInfoSakhalin Standard TimeSeImpersonatePrivilegeSetupDiEnumDriverInfoWSetupDiGetClassDevsExWTasmania Standard TimeTor bootstrap progressTor service is runningUnsupported Media TypeWSAGetOverlappedResultWaitForMultipleObjectsWget/1.12 (freebsd8.1)Xenu Link Sleuth/1.3.8address already in useadvapi32.dll not foundapplication/javascriptargument list too longassembly checks failedbad g->status in readybad sweepgen in refillbitcoin3nqy3db7c.onionbody closed by handlercannot allocate memoryclient not initializedcouldn't create devicecouldn't get file infocouldn't start servicecoulnd't write to filecreate main window: %wdecode and decrypt: %wdownloading obfs4proxydriver: bad connectionelectrum.leblancnet.uselectrum3.hodlister.coelectrum5.hodlister.coelectrumxhqdsmlu.onionencrypt and encode: %werror decoding messageerror parsing regexp: expected multiple of 2failed to get UUID: %wfailed to hide app: %wfailed to open key: %wfailed to open src: %wfailed to register: %wfailed to set UUID: %wfreeIndex is not validgenerate challenge: %wgetenv before env initgzip: invalid checksumheader field %q = %q%shpack: string too longhsmiths4fyqlw5xw.onionhsmiths5mjk6uijs.onionhttp2: frame too largehttp://localhost:3433/idna: invalid label %qinappropriate fallbackinteger divide by zerointegrity check failedinterface conversion: internal inconsistencyinvalid address familyinvalid number base %djson: unknown field %qkernel32.dll not foundmalformed HTTP versionminpc or maxpc invalidmissing ']' in addressndndword5lpb7eex.onionnetwork is unreachableno connection providednon-Go function at pc=oldoverflow is not niloperation was canceledozahtqwp25chjdjd.onionprotocol not availableprotocol not supportedqtornadoklbgdyww.onionread response body: %wreflect.Value.MapIndexreflect.Value.SetFloatreflectlite.Value.Elemreflectlite.Value.Typeremote address changedruntime.main not on m0runtime: t.span= runtime: physPageSize=runtime: work.nwait = runtime:scanstack: gp=s.freeindex > s.nelemss7clinmo4cazmhul.onionscanstack - bad statussecure boot is enabledsend on closed channelserver.peers.subscribeservice does not existservice is not runningset Tor mode to %s: %wspan has no free spacestack not a power of 2status/bootstrap-phasetimer goroutine (idle)trace reader (blocked)trace: alloc too largetransaction is stoppedtransaction not existsunexpected length codewirep: invalid p statewrite on closed bufferzero length BIT STRINGzlib: invalid checksum into Go value of type ) must be a power of 2

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://acacaca.org/lancer/get.php
Source: Malware configuration extractor	URLs: http://zdauctions.com/tmp/
Source: Malware configuration extractor	URLs: http://mordo.ru/tmp/

Source: Joe Sandbox View	IP Address: 85.209.157.230 85.209.157.230
Source: Joe Sandbox View	IP Address: 85.209.157.230 85.209.157.230

Source: unknown

Network traffic detected: IP country count 15

Source: A024.exe, 00000011.00000003.924299314.00000000005FC000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.925282553.00000000005FC000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.917214347.00000000005FC000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.906851773.00000000005FC000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.915984441.00000000005FC000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.922262527.00000000005FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apcotex.com/
Source: A024.exe, 00000011.00000003.881509308.00000000005FC000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.882065466.00000000005FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://atbauk.P
Source: E9D3.exe, 0000001B.00000002.739912367.0000000002BF5000.00000040.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.g
Source: E9D3.exe, 0000001B.00000003.588921874.0000000003E7A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/ObjectSign.crl0
Source: E9D3.exe, 0000001B.00000003.588921874.0000000003E7A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/Root.crl0
Source: E9D3.exe, 0000001B.00000003.588921874.0000000003E7A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/primobject.crl0
Source: 87B9.exe, 0000000F.00000002.505793782.0000000000813000.00000004.00000020.00020000.00000000.sdmp, 87B9.exe, 0000000F.00000003.495972512.0000000000813000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: E9D3.exe, 0000001B.00000003.552567063.0000000003860000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://devlog.gregarius.net/docs/ua)Links
Source: A024.exe, 00000011.00000003.875583192.00000000005FC000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.881509308.00000000005FC000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.882065466.00000000005FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://gbm.hhiuew33.com/check/safe
Source: 87B9.exe, 0000000E.00000002.495843293.00000000026F0000.00000040.00001000.00020000.00000000.sdmp, 87B9.exe, 0000000F.00000000.490507253.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 87B9.exe, 0000000F.00000002.503363757.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 87B9.exe, 0000000F.00000000.488104570.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://https://ns1.kriston.ugns2.chalekin.ugns3.unalelath.ugns4.andromath.ug/Error
Source: E9D3.exe, 0000001B.00000003.552567063.0000000003860000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://invalidlog.txtlookup
Source: A024.exe, 00000011.00000003.888609376.00000000005FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pro-fa.com/
Source: E9D3.exe, 0000001B.00000003.552567063.0000000003860000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://search.msn.com/msnbot.htm)msnbot/1.1
Source: E9D3.exe, 0000001B.00000003.552567063.0000000003860000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://search.msn.com/msnbot.htm)net/http:
Source: E9D3.exe, 0000001B.00000003.552567063.0000000003860000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://search.msn.com/msnbot.htm)pkcs7:
Source: A024.exe, 00000011.00000003.924357065.00000000005CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://usadig.com/
Source: E9D3.exe, 0000001B.00000003.552567063.0000000003860000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.avantbrowser.com)MOT-V9mm/00.62
Source: E9D3.exe, 0000001B.00000003.552567063.0000000003860000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.baidu.com/search/spider.htm)MobileSafari/600.1.4
Source: A024.exe, 00000011.00000003.517949411.00000000005FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.coH
Source: A024.exe, 00000011.00000003.547616617.0000000000606000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.924299314.00000000005FC000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.925282553.00000000005FC000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.546820577.0000000000606000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.917214347.00000000005FC000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.548588817.0000000000606000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.888609376.00000000005FC000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.906851773.00000000005FC000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.545474727.0000000000606000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.924357065.00000000005CA000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.915984441.00000000005FC000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.922262527.00000000005FC000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.546061583.0000000000606000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.886216752.00000000005FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/
Source: A024.exe, 00000011.00000003.509503649.00000000005A9000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.508626394.00000000005AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2015239&key=8072fcd4732872d904f5d23b03531d08
Source: A024.exe, 00000011.00000003.517537044.00000000005A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2015377&key=70dd7a55c597dd230199469c3c3d32b6
Source: A024.exe, 00000011.00000003.516669178.0000000000608000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.517476053.0000000000608000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.518341797.000000000060C000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.518053404.0000000000607000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2015377&key=70dd7a55c597dd230199469c3c3d32b69-90CE-806E6F6E6963
Source: A024.exe, 00000011.00000003.523460921.0000000000615000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.526919336.0000000000628000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.520500191.0000000000628000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.524368517.0000000000615000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.524413971.0000000000619000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.526287413.0000000000628000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.524817915.0000000000628000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2015443&key=6fbc9ea36028e7a7aef47e3f25de14479-90CE-806E6F6E6963
Source: A024.exe, 00000011.00000003.527158732.0000000000606000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2015571&key=4db054c96026ef6dad1828790e5c30ce
Source: A024.exe, 00000011.00000003.527158732.0000000000606000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2015571&key=4db054c96026ef6dad1828790e5c30ce(
Source: A024.exe, 00000011.00000003.527158732.0000000000606000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2015571&key=4db054c96026ef6dad1828790e5c30ce13305129961782216
Source: A024.exe, 00000011.00000003.526919336.0000000000628000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.526287413.0000000000628000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2015571&key=4db054c96026ef6dad1828790e5c30ce9-90CE-806E6F6E6963
Source: A024.exe, 00000011.00000003.527158732.0000000000606000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2015571&key=4db054c96026ef6dad1828790e5c30ce:
Source: A024.exe, 00000011.00000003.527158732.0000000000606000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2015571&key=4db054c96026ef6dad1828790e5c30cesafe_see?~:
Source: A024.exe, 00000011.00000003.534285456.0000000000615000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2015661&key=253379595e8709edaa7459e6261ab76f
Source: A024.exe, 00000011.00000003.532604795.00000000005D0000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.533629250.00000000005CB000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.543036109.00000000005D0000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.542736341.00000000005D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2015661&key=253379595e8709edaa7459e6261ab76fE9-90CE-806E6F6E6963
Source: A024.exe, 00000011.00000003.534167479.0000000000606000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2015661&key=253379595e8709edaa7459e6261ab76fatio
Source: A024.exe, 00000011.00000003.545927414.000000000060D000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.544149773.000000000060D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2015891&key=b779f07443cbe91981cfefc8943025f0
Source: A024.exe, 00000011.00000003.545244186.00000000005D4000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.544526983.00000000005CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2015891&key=b779f07443cbe91981cfefc8943025f09-90CE-806E6F6E6963
Source: A024.exe, 00000011.00000003.545533996.000000000060D000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.545927414.000000000060D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2015891&key=b779f07443cbe91981cfefc8943025f0nal
Source: A024.exe, 00000011.00000003.554398119.0000000000615000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.557376459.0000000000615000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.557673507.0000000000608000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.550845431.0000000000607000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.554435845.000000000060A000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.551602096.0000000000608000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.552783679.000000000060A000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.556736628.00000000005FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2016031&key=7e1ca779d9bf4e17f6d764045bd141cf
Source: A024.exe, 00000011.00000003.574706830.00000000005E4000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.583968460.00000000005E4000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.559657315.00000000005CF000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.577092251.00000000005E4000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.559976733.00000000005E3000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.561248557.00000000005E4000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.564250091.00000000005E4000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.558452855.00000000005CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2016031&key=7e1ca779d9bf4e17f6d764045bd141cf9-90CE-806E6F6E6963
Source: A024.exe, 00000011.00000003.552783679.000000000060A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2016031&key=7e1ca779d9bf4e17f6d764045bd141cfa001-6
Source: A024.exe, 00000011.00000003.554435845.000000000060A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2016031&key=7e1ca779d9bf4e17f6d764045bd141cfl2~7
Source: A024.exe, 00000011.00000003.554435845.000000000060A000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.552783679.000000000060A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2016031&key=7e1ca779d9bf4e17f6d764045bd141cfnalU~
Source: A024.exe, 00000011.00000003.568208161.0000000000606000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.570943693.0000000000608000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.571506563.0000000000609000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2016345&key=1cb93d6dec2bc745d06457ef77da4779
Source: A024.exe, 00000011.00000003.568208161.0000000000606000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.570943693.0000000000608000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.571506563.0000000000609000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2016345&key=1cb93d6dec2bc745d06457ef77da4779nal
Source: A024.exe, 00000011.00000003.568208161.0000000000606000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.570943693.0000000000608000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.571506563.0000000000609000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2016345&key=1cb93d6dec2bc745d06457ef77da4779safe_see?~:
Source: A024.exe, 00000011.00000003.589560082.0000000000607000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.594896934.000000000060D000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.594939303.0000000000615000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.589735478.0000000000615000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2016829&key=3a7045f6ec37d43997a6260b6182f08e
Source: A024.exe, 00000011.00000003.591381087.00000000005C8000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.588363720.00000000005C8000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.593992131.00000000005C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2016829&key=3a7045f6ec37d43997a6260b6182f08e85-A1ED-B2838757AE1B
Source: A024.exe, 00000011.00000003.587651978.000000000060A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2016829&key=3a7045f6ec37d43997a6260b6182f08e_see?~:
Source: A024.exe, 00000011.00000003.587651978.000000000060A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2016829&key=3a7045f6ec37d43997a6260b6182f08eal
Source: A024.exe, 00000011.00000003.587651978.000000000060A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2016829&key=3a7045f6ec37d43997a6260b6182f08enal
Source: A024.exe, 00000011.00000003.598496754.0000000000605000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.597481454.00000000005FC000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.598830142.00000000005A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2016991&key=d06a0819802fb9b8bfa3f83cec712889
Source: A024.exe, 00000011.00000003.599358977.00000000005BD000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.609649183.00000000005BD000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.605981971.00000000005BD000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.602536365.00000000005BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2016991&key=d06a0819802fb9b8bfa3f83cec71288985-A1ED-B2838757AE1B
Source: A024.exe, 00000011.00000003.598496754.0000000000605000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.597481454.00000000005FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2016991&key=d06a0819802fb9b8bfa3f83cec712889al
Source: A024.exe, 00000011.00000003.598496754.0000000000605000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.597481454.00000000005FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2016991&key=d06a0819802fb9b8bfa3f83cec712889nal
Source: A024.exe, 00000011.00000003.598496754.0000000000605000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.597481454.00000000005FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2016991&key=d06a0819802fb9b8bfa3f83cec712889nalU~
Source: A024.exe, 00000011.00000003.622282517.00000000005BD000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.613334781.000000000060D000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.622558054.0000000000615000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.622537055.000000000060B000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.613761354.000000000060D000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.612951482.00000000005BD000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.621642097.00000000005FC000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.615628201.00000000005BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2017297&key=50a768fcc44c2ec36a174f09d26cbb12
Source: A024.exe, 00000011.00000003.613334781.000000000060D000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.612508450.000000000060D000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.613761354.000000000060D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2017297&key=50a768fcc44c2ec36a174f09d26cbb12nal
Source: A024.exe, 00000011.00000003.625014209.0000000000604000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2017683&key=2ae600ecd082beb1eedd2a00077025c0
Source: A024.exe, 00000011.00000003.625297785.00000000005BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2017683&key=2ae600ecd082beb1eedd2a00077025c085-A1ED-B2838757AE1B
Source: A024.exe, 00000011.00000003.627283501.00000000005FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2017683&key=2ae600ecd082beb1eedd2a00077025c0961782216
Source: A024.exe, 00000011.00000003.704521200.0000000000615000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.667878458.0000000000615000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.685584153.0000000000615000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.660801597.0000000000615000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.715848614.0000000000615000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.722927599.0000000000615000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.635485775.0000000000615000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.678649642.0000000000615000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.643595978.0000000000615000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.673144821.0000000000615000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.649938670.0000000000615000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.662725732.0000000000615000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.632680017.00000000005FC000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.630275020.00000000005FC000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.701495973.0000000000615000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.639684625.0000000000615000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.651676419.0000000000615000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.633527727.0000000000615000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.723828395.0000000000615000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.719104693.0000000000615000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.687471126.0000000000615000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2017807&key=656ed5c4260156c137520047500fcb5a
Source: A024.exe, 00000011.00000003.630275020.00000000005FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2017807&key=656ed5c4260156c137520047500fcb5anal2~7
Source: A024.exe, 00000011.00000003.650371810.0000000000605000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.649505481.0000000000602000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.641826184.00000000005FC000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.650989626.00000000005E9000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.643110136.0000000000605000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.652530312.00000000005E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2018035&key=6fe006e1a6ee76909784c1c112d40fa7
Source: A024.exe, 00000011.00000003.643638138.00000000005CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2018035&key=6fe006e1a6ee76909784c1c112d40fa785-A1ED-B2838757AE1B
Source: A024.exe, 00000011.00000003.650371810.0000000000605000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.649505481.0000000000602000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.641826184.00000000005FC000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.643110136.0000000000605000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2018035&key=6fe006e1a6ee76909784c1c112d40fa7961782216
Source: A024.exe, 00000011.00000003.650371810.0000000000605000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.651580919.0000000000608000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.649505481.0000000000602000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.641826184.00000000005FC000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.643110136.0000000000605000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2018035&key=6fe006e1a6ee76909784c1c112d40fa7=
Source: A024.exe, 00000011.00000003.663381798.00000000005E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2018303&key=1193b4e4de5655538ccc58c723ed2ff8
Source: A024.exe, 00000011.00000003.660658555.0000000000607000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2018303&key=1193b4e4de5655538ccc58c723ed2ff8961782216
Source: A024.exe, 00000011.00000003.660658555.0000000000607000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2018303&key=1193b4e4de5655538ccc58c723ed2ff8_see?~:
Source: A024.exe, 00000011.00000003.662594874.0000000000607000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2018303&key=1193b4e4de5655538ccc58c723ed2ff8al2~7
Source: A024.exe, 00000011.00000003.660658555.0000000000607000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2018303&key=1193b4e4de5655538ccc58c723ed2ff8lU~
Source: A024.exe, 00000011.00000003.671761218.00000000005E3000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.666899275.0000000000607000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2018477&key=54f4c00d5b523edeb0b1a231aabf7866
Source: A024.exe, 00000011.00000003.727725399.00000000005D7000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.748899296.00000000005D8000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.720945359.00000000005D0000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.716149610.000000000063C000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.702826706.000000000063C000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.730565018.00000000005D7000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.719463404.000000000063C000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.723724601.00000000005D4000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.712109883.00000000005CD000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.707156985.00000000005DC000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.719569853.00000000005D0000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.704285105.0000000000607000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.692188238.00000000005FD000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.692141628.000000000063C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2018981&key=44df1fe76965627ca5f86e0117faa672
Source: A024.exe, 00000011.00000003.704285105.0000000000607000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.692188238.00000000005FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2018981&key=44df1fe76965627ca5f86e0117faa672_see?~:
Source: A024.exe, 00000011.00000003.692188238.00000000005FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2018981&key=44df1fe76965627ca5f86e0117faa672l(~
Source: A024.exe, 00000011.00000003.704285105.0000000000607000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2018981&key=44df1fe76965627ca5f86e0117faa672nal961782216
Source: A024.exe, 00000011.00000003.728847971.00000000005A6000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.745415146.00000000005A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2019659&key=1247ed064225139f8d54ea20b7f4308d
Source: A024.exe, 00000011.00000003.728175494.00000000005FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2019659&key=1247ed064225139f8d54ea20b7f4308dl2~7
Source: A024.exe, 00000011.00000003.728175494.00000000005FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2019659&key=1247ed064225139f8d54ea20b7f4308dnal
Source: A024.exe, 00000011.00000003.808584855.0000000000607000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2021009&key=fed594bb4f69b903f7a0afd5144b280a
Source: A024.exe, 00000011.00000003.808584855.0000000000607000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.836509333.0000000000605000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2021009&key=fed594bb4f69b903f7a0afd5144b280aal
Source: A024.exe, 00000011.00000003.857712036.00000000005FC000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.861375673.000000000060A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2022081&key=732a544087b3e9ff829e7663084700c0
Source: A024.exe, 00000011.00000003.865979392.00000000005FC000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.867253468.000000000060F000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.857712036.00000000005FC000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.861375673.000000000060A000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.866853290.000000000060C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2022081&key=732a544087b3e9ff829e7663084700c09-90CE-806E6F6E6963
Source: A024.exe, 00000011.00000003.857712036.00000000005FC000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.861375673.000000000060A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2022081&key=732a544087b3e9ff829e7663084700c0_see?~:
Source: A024.exe, 00000011.00000003.857712036.00000000005FC000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.861375673.000000000060A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2022081&key=732a544087b3e9ff829e7663084700c0al961782216
Source: A024.exe, 00000011.00000003.861375673.000000000060A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2022081&key=732a544087b3e9ff829e7663084700c0l
Source: A024.exe, 00000011.00000003.876584578.000000000060D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2022523&key=489967a14be7e798a418ec88203e5295
Source: A024.exe, 00000011.00000003.876584578.000000000060D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2022523&key=489967a14be7e798a418ec88203e5295961782216
Source: A024.exe, 00000011.00000003.874060381.00000000005D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2022523&key=489967a14be7e798a418ec88203e5295XQ
Source: A024.exe, 00000011.00000003.885741788.00000000005D7000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.889359323.00000000005D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2022763&key=3ecacc048d1ccf52ee18d6088a38deba9-90CE-806E6F6E6963
Source: A024.exe, 00000011.00000003.886216752.00000000005FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2022763&key=3ecacc048d1ccf52ee18d6088a38deba_see?~:
Source: A024.exe, 00000011.00000003.886216752.00000000005FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2022763&key=3ecacc048d1ccf52ee18d6088a38debal
Source: A024.exe, 00000011.00000003.886216752.00000000005FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2022763&key=3ecacc048d1ccf52ee18d6088a38debanalU~
Source: A024.exe, 00000011.00000003.895949373.000000000060A000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.902751656.000000000060B000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.906851773.00000000005FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2022899&key=2e1c6e2a11a5fbaa14f06bb550215b6f
Source: A024.exe, 00000011.00000003.895949373.000000000060A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2022899&key=2e1c6e2a11a5fbaa14f06bb550215b6f961782216
Source: A024.exe, 00000011.00000003.895949373.000000000060A000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.902751656.000000000060B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2022899&key=2e1c6e2a11a5fbaa14f06bb550215b6fU~
Source: A024.exe, 00000011.00000003.895949373.000000000060A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2022899&key=2e1c6e2a11a5fbaa14f06bb550215b6fl2~7
Source: A024.exe, 00000011.00000003.895949373.000000000060A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2022899&key=2e1c6e2a11a5fbaa14f06bb550215b6fnal
Source: A024.exe, 00000011.00000003.921541921.000000000060D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2023623&key=9dd0f4a37d9727289100679ff4679313
Source: A024.exe, 00000011.00000003.923816270.000000000063A000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.925921836.000000000063A000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.919462666.0000000000639000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2023623&key=9dd0f4a37d9727289100679ff46793139-90CE-806E6F6E6963
Source: A024.exe, 00000011.00000003.921541921.000000000060D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2023623&key=9dd0f4a37d9727289100679ff4679313_see?~:
Source: A024.exe, 00000011.00000003.923445203.000000000060D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2023623&key=9dd0f4a37d9727289100679ff4679313l(~
Source: A024.exe, 00000011.00000003.587954388.00000000005A8000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.524886511.00000000005A6000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.608953979.00000000005A6000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.917555901.000000000063A000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.508626394.00000000005AA000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.919462666.0000000000639000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.627283501.00000000005FC000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.845942642.00000000005D6000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.507033348.00000000005BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/safe
Source: A024.exe, 00000011.00000003.506991069.00000000005AB000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.508315763.00000000005A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/safe&
Source: A024.exe, 00000011.00000003.531837026.0000000000627000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.532518816.0000000000627000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.534285456.0000000000615000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/safeEKYn49oSDm
Source: A024.exe, 00000011.00000003.544493765.0000000000628000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.544055476.0000000000627000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/safeG
Source: A024.exe, 00000011.00000003.518868120.000000000060E000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.520923982.000000000060E000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.523403934.0000000000607000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/safeGMkM9e
Source: A024.exe, 00000011.00000003.527158732.0000000000606000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.517537044.00000000005A6000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.615057053.00000000005A6000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.612816385.00000000005A6000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.608953979.00000000005A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/safeP
Source: A024.exe, 00000011.00000003.622282517.00000000005BD000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.612951482.00000000005BD000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.615628201.00000000005BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/safea
Source: A024.exe, 00000011.00000003.728847971.00000000005A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/safee
Source: A024.exe, 00000011.00000003.507033348.00000000005BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/safele
Source: A024.exe, 00000011.00000003.508375288.00000000005BD000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.507033348.00000000005BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/safeown
Source: A024.exe, 00000011.00000003.581737900.0000000002733000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.coww.hhiuew33.com/
Source: A024.exe, 00000011.00000003.581709317.0000000002730000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.coww.hhiuew33.com/check/?sid=2016345&key=1cb93d6dec2bc745d06457ef77da4779
Source: 87B9.exe, 0000000F.00000000.488104570.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: 87B9.exe, 0000000F.00000002.505580671.00000000007E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/
Source: 87B9.exe, 87B9.exe, 0000000E.00000002.495843293.00000000026F0000.00000040.00001000.00020000.00000000.sdmp, 87B9.exe, 0000000F.00000002.505696844.00000000007F6000.00000004.00000020.00020000.00000000.sdmp, 87B9.exe, 0000000F.00000000.490507253.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 87B9.exe, 0000000F.00000002.503363757.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 87B9.exe, 0000000F.00000000.488104570.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.json
Source: 87B9.exe, 0000000F.00000002.505793782.0000000000813000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsond
Source: 87B9.exe, 0000000F.00000002.505793782.0000000000813000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsont
Source: 87B9.exe, 0000000F.00000002.505580671.00000000007E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/j
Source: E9D3.exe, 0000001B.00000003.552567063.0000000003860000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://blockchain.infoindex
Source: E9D3.exe, 0000001B.00000003.552567063.0000000003860000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://blockstream.info/apihttps://sofolisk.com/api/loginvalid
Source: E9D3.exe, 0000001B.00000003.552567063.0000000003860000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://turnitin.com/robot/crawlerinfo.html)gentraceback

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected SmokeLoader

Source: Yara match	File source: 26.2.D86C.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.3.D86C.exe.b10000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 39.3.C39A.exe.940000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.D86C.exe.b00e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 39.2.C39A.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 39.2.C39A.exe.930e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001A.00000003.526622172.0000000000B10000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000002.601597228.00000000009F1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.544780175.0000000000B10000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.441430475.0000000002491000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000002.601073617.0000000000940000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.387173781.00000000009E1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.367270038.0000000004611000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.387108841.00000000009C0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.441371767.0000000002470000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000003.584704076.0000000000940000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.545012487.0000000000B31000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY

Source: file.exe, 00000000.00000002.387321713.0000000000C18000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Spam, unwanted Advertisements and Ransom Demands

Yara detected Djvu Ransomware

Source: Yara match	File source: 15.0.87B9.exe.400000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.0.87B9.exe.400000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.87B9.exe.26f15a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.0.87B9.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.0.87B9.exe.400000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.0.87B9.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.0.87B9.exe.400000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.0.87B9.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.0.87B9.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.87B9.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.87B9.exe.26f15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.0.87B9.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.0.87B9.exe.400000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.0.87B9.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.87B9.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.0.87B9.exe.400000.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000F.00000000.490507253.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.503363757.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000000.490001086.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000000.492226078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000000.491102942.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000000.488104570.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.495843293.00000000026F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 87B9.exe PID: 5612, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 87B9.exe PID: 4652, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: 31.2.rundll32.exe.4d00000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Fabookie / ElysiumStealer Author: ditekSHen
Source: 31.2.rundll32.exe.4d00000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Chebka Author: ditekSHen
Source: 31.2.rundll32.exe.4d00000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Generic_a681f24a Author: unknown
Source: 15.0.87B9.exe.400000.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 15.0.87B9.exe.400000.9.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 15.0.87B9.exe.400000.9.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 15.0.87B9.exe.400000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 15.0.87B9.exe.400000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 14.2.87B9.exe.26f15a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 14.2.87B9.exe.26f15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 15.0.87B9.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 15.0.87B9.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 15.0.87B9.exe.400000.7.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 15.0.87B9.exe.400000.7.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 15.0.87B9.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 15.0.87B9.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 15.0.87B9.exe.400000.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 15.0.87B9.exe.400000.9.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 15.0.87B9.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 15.0.87B9.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 15.0.87B9.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 15.0.87B9.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 15.2.87B9.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 15.2.87B9.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 14.2.87B9.exe.26f15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 14.2.87B9.exe.26f15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 15.0.87B9.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 15.0.87B9.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 15.0.87B9.exe.400000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 15.0.87B9.exe.400000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 36.0.svchost.exe.2f31bfb0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Chebka Author: ditekSHen
Source: 36.0.svchost.exe.2f31bfb0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Generic_a681f24a Author: unknown
Source: 15.0.87B9.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 15.0.87B9.exe.400000.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 15.0.87B9.exe.400000.7.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 15.0.87B9.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 15.0.87B9.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 15.2.87B9.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 15.2.87B9.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 15.0.87B9.exe.400000.10.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 15.0.87B9.exe.400000.10.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 15.0.87B9.exe.400000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 43.0.svchost.exe.156b6b50000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Chebka Author: ditekSHen
Source: 43.0.svchost.exe.156b6b50000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Generic_a681f24a Author: unknown
Source: 36.0.svchost.exe.2f31bfb0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Chebka Author: ditekSHen
Source: 36.0.svchost.exe.2f31bfb0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Generic_a681f24a Author: unknown
Source: 43.0.svchost.exe.156b6b50000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Chebka Author: ditekSHen
Source: 43.0.svchost.exe.156b6b50000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Generic_a681f24a Author: unknown
Source: 0000000F.00000000.485672401.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000027.00000002.601597228.00000000009F1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 0000001B.00000002.739912367.0000000002BF5000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000002B.00000003.595564014.00000156B6AE0000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Generic_a681f24a Author: unknown
Source: 0000001A.00000002.544780175.0000000000B10000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 0000000F.00000000.490507253.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 0000000F.00000000.490507253.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000000F.00000002.503363757.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 0000000F.00000002.503363757.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000027.00000002.601012575.0000000000930000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000002.387378506.0000000000C29000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000007.00000002.441430475.0000000002491000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 0000001A.00000002.544740114.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 0000000F.00000000.490001086.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 0000000F.00000000.490001086.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000001F.00000002.652754688.0000000004D44000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Generic_a681f24a Author: unknown
Source: 00000024.00000003.573535906.000002F31BF40000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Generic_a681f24a Author: unknown
Source: 00000027.00000002.601073617.0000000000940000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 0000000F.00000000.492226078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 0000000F.00000000.492226078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000000.00000002.387173781.00000000009E1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000001.00000000.367270038.0000000004611000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000000.00000002.387108841.00000000009C0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000007.00000002.441371767.0000000002470000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000007.00000002.440994734.00000000009C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000027.00000002.602802862.0000000000A29000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000000F.00000000.491102942.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 0000000F.00000000.491102942.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000000.00000002.387065611.00000000009B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 0000001A.00000002.545414239.0000000000B89000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000000F.00000000.488104570.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 0000000F.00000000.488104570.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000007.00000002.441147746.00000000009E8000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000001F.00000002.643002638.0000000001130000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Fabookie / ElysiumStealer Author: ditekSHen
Source: 0000001F.00000002.643002638.0000000001130000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Generic_a681f24a Author: unknown
Source: 0000001A.00000002.545012487.0000000000B31000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 0000000E.00000002.495843293.00000000026F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000000E.00000002.494725828.0000000002545000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000002B.00000000.600713527.00000156B6B50000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Chebka Author: ditekSHen
Source: 0000002B.00000000.600713527.00000156B6B50000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Generic_a681f24a Author: unknown
Source: 00000024.00000000.584962257.000002F31BFB0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Chebka Author: ditekSHen
Source: 00000024.00000000.584962257.000002F31BFB0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Generic_a681f24a Author: unknown
Source: 0000001B.00000002.865037113.0000000002FE0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: Process Memory Space: 87B9.exe PID: 5612, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: 87B9.exe PID: 4652, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown

Yara detected ManusCrypt

Source: Yara match	File source: 31.2.rundll32.exe.4d00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 36.0.svchost.exe.2f31bfb0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 43.0.svchost.exe.156b6b50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 36.0.svchost.exe.2f31bfb0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 43.0.svchost.exe.156b6b50000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000002B.00000003.595564014.00000156B6AE0000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.652754688.0000000004D44000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000003.573535906.000002F31BF40000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.643002638.0000000001130000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002B.00000000.600713527.00000156B6B50000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000000.584962257.000002F31BFB0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 2200, type: MEMORYSTR

Detected VMProtect packer

Source: A024.exe.1.dr

Static PE information: .vmp0 and .vmp1 section names

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0041B4F0	0_2_0041B4F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00412EF0	0_2_00412EF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0041A710	0_2_0041A710
Source: C:\Users\user\AppData\Roaming\erhuush	Code function: 7_2_0041B4F0	7_2_0041B4F0
Source: C:\Users\user\AppData\Roaming\erhuush	Code function: 7_2_00412EF0	7_2_00412EF0
Source: C:\Users\user\AppData\Roaming\erhuush	Code function: 7_2_0041A710	7_2_0041A710
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 13_2_05082B6C	13_2_05082B6C
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 13_2_05081000	13_2_05081000
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 13_2_05081EC0	13_2_05081EC0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 13_2_05082510	13_2_05082510
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 13_2_05083354	13_2_05083354
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 13_2_050849E0	13_2_050849E0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 13_2_05083778	13_2_05083778
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 13_2_05082B71	13_2_05082B71
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 13_2_05154418	13_2_05154418
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 13_2_05151000	13_2_05151000
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 13_2_05151F20	13_2_05151F20
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 13_2_051539A0	13_2_051539A0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 13_2_051519DD	13_2_051519DD
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 13_2_05152AC0	13_2_05152AC0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 13_2_05151C00	13_2_05151C00
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 13_2_05152440	13_2_05152440
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 13_2_051528B0	13_2_051528B0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 13_2_051515A0	13_2_051515A0
Source: C:\Users\user\AppData\Local\Temp\87B9.exe	Code function: 14_2_0041A5C0	14_2_0041A5C0
Source: C:\Users\user\AppData\Local\Temp\87B9.exe	Code function: 14_2_026FCA10	14_2_026FCA10
Source: C:\Users\user\AppData\Local\Temp\87B9.exe	Code function: 14_2_02700B00	14_2_02700B00
Source: C:\Users\user\AppData\Local\Temp\87B9.exe	Code function: 14_2_026FDBE0	14_2_026FDBE0
Source: C:\Users\user\AppData\Local\Temp\87B9.exe	Code function: 14_2_026FB000	14_2_026FB000
Source: C:\Users\user\AppData\Local\Temp\87B9.exe	Code function: 14_2_026F30EE	14_2_026F30EE
Source: C:\Users\user\AppData\Local\Temp\87B9.exe	Code function: 14_2_027000D0	14_2_027000D0
Source: C:\Users\user\AppData\Local\Temp\87B9.exe	Code function: 14_2_027118D0	14_2_027118D0
Source: C:\Users\user\AppData\Local\Temp\87B9.exe	Code function: 14_2_026FB0B0	14_2_026FB0B0
Source: C:\Users\user\AppData\Local\Temp\87B9.exe	Code function: 14_2_0271F9B0	14_2_0271F9B0
Source: C:\Users\user\AppData\Local\Temp\87B9.exe	Code function: 14_2_0271E9A3	14_2_0271E9A3
Source: C:\Users\user\AppData\Local\Temp\87B9.exe	Code function: 14_2_026FE6E0	14_2_026FE6E0
Source: C:\Users\user\AppData\Local\Temp\87B9.exe	Code function: 14_2_026FC760	14_2_026FC760

Source: file.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: file.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: file.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: file.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: D86C.exe.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: D86C.exe.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: D86C.exe.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: D86C.exe.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: E9D3.exe.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: E9D3.exe.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: E9D3.exe.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: E9D3.exe.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: ACE4.exe.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: ACE4.exe.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: ACE4.exe.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: C39A.exe.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: C39A.exe.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: C39A.exe.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: C39A.exe.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 254.exe.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 254.exe.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 254.exe.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 254.exe.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 4A99.exe.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 4A99.exe.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 4A99.exe.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 4A99.exe.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 519F.exe.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 519F.exe.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 519F.exe.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 519F.exe.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 87B9.exe.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 87B9.exe.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 87B9.exe.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 87B9.exe.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: C05F.exe.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: C05F.exe.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: C05F.exe.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: bchuush.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: bchuush.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: bchuush.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: bchuush.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: erhuush.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: erhuush.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: erhuush.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: erhuush.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: C:\Windows\explorer.exe	Section loaded: windows.globalization.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: capabilityaccessmanagerclient.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ndfapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wdi.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc.dll	Jump to behavior

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\4A99.exe 8A859913B508241B9C2843BD988A5DC64795EE59C553013663D9B9D5C58589D8
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\87B9.exe 2FC9C8FFBA226D56755019591DE180CF29000B797350C7291AA8DC447A9A1BBB

Source: file.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 31.2.rundll32.exe.4d00000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, score = , reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings
Source: 31.2.rundll32.exe.4d00000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Fabookie author = ditekSHen, description = Detects Fabookie / ElysiumStealer
Source: 31.2.rundll32.exe.4d00000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Chebka author = ditekSHen, description = Detects Chebka
Source: 31.2.rundll32.exe.4d00000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Generic_a681f24a reference_sample = a796f316b1ed7fa809d9ad5e9b25bd780db76001345ea83f5035a33618f927fa, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Generic, fingerprint = 6323ed5b60e728297de19c878cd96b429bfd6d82157b4cf3475f3a3123921ae0, id = a681f24a-7054-4525-bcf8-3ee64a1d8413, last_modified = 2021-08-23
Source: 15.0.87B9.exe.400000.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 15.0.87B9.exe.400000.9.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 15.0.87B9.exe.400000.9.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 15.0.87B9.exe.400000.9.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 15.0.87B9.exe.400000.8.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 15.0.87B9.exe.400000.8.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 15.0.87B9.exe.400000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 14.2.87B9.exe.26f15a0.1.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 14.2.87B9.exe.26f15a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 14.2.87B9.exe.26f15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 15.0.87B9.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 15.0.87B9.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 15.0.87B9.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 15.0.87B9.exe.400000.7.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 15.0.87B9.exe.400000.7.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 15.0.87B9.exe.400000.7.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 15.0.87B9.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 15.0.87B9.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 15.0.87B9.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 15.0.87B9.exe.400000.9.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 15.0.87B9.exe.400000.9.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 15.0.87B9.exe.400000.9.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 15.0.87B9.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 15.0.87B9.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 15.0.87B9.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 15.0.87B9.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 15.0.87B9.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 15.0.87B9.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 15.2.87B9.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 15.2.87B9.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 15.2.87B9.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 14.2.87B9.exe.26f15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 14.2.87B9.exe.26f15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 14.2.87B9.exe.26f15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 15.0.87B9.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 27.2.E9D3.exe.9dab40.2.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 27.2.E9D3.exe.9d86a0.3.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 27.2.E9D3.exe.9d2d00.0.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 27.3.E9D3.exe.3e36ca0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 15.0.87B9.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 27.3.E9D3.exe.3e31300.3.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 15.0.87B9.exe.400000.6.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 15.0.87B9.exe.400000.6.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 15.0.87B9.exe.400000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 36.0.svchost.exe.2f31bfb0000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, score = , reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings
Source: 36.0.svchost.exe.2f31bfb0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Chebka author = ditekSHen, description = Detects Chebka
Source: 36.0.svchost.exe.2f31bfb0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Generic_a681f24a reference_sample = a796f316b1ed7fa809d9ad5e9b25bd780db76001345ea83f5035a33618f927fa, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Generic, fingerprint = 6323ed5b60e728297de19c878cd96b429bfd6d82157b4cf3475f3a3123921ae0, id = a681f24a-7054-4525-bcf8-3ee64a1d8413, last_modified = 2021-08-23
Source: 15.0.87B9.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 15.0.87B9.exe.400000.7.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 15.0.87B9.exe.400000.7.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 15.0.87B9.exe.400000.7.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 15.0.87B9.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 15.0.87B9.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 15.0.87B9.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 15.2.87B9.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 15.2.87B9.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 15.2.87B9.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 27.3.E9D3.exe.3e39140.2.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 15.0.87B9.exe.400000.10.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 15.0.87B9.exe.400000.10.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 15.0.87B9.exe.400000.10.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 15.0.87B9.exe.400000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 43.0.svchost.exe.156b6b50000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, score = , reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings
Source: 43.0.svchost.exe.156b6b50000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Chebka author = ditekSHen, description = Detects Chebka
Source: 43.0.svchost.exe.156b6b50000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Generic_a681f24a reference_sample = a796f316b1ed7fa809d9ad5e9b25bd780db76001345ea83f5035a33618f927fa, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Generic, fingerprint = 6323ed5b60e728297de19c878cd96b429bfd6d82157b4cf3475f3a3123921ae0, id = a681f24a-7054-4525-bcf8-3ee64a1d8413, last_modified = 2021-08-23
Source: 36.0.svchost.exe.2f31bfb0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, score = , reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings
Source: 36.0.svchost.exe.2f31bfb0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Chebka author = ditekSHen, description = Detects Chebka
Source: 36.0.svchost.exe.2f31bfb0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Generic_a681f24a reference_sample = a796f316b1ed7fa809d9ad5e9b25bd780db76001345ea83f5035a33618f927fa, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Generic, fingerprint = 6323ed5b60e728297de19c878cd96b429bfd6d82157b4cf3475f3a3123921ae0, id = a681f24a-7054-4525-bcf8-3ee64a1d8413, last_modified = 2021-08-23
Source: 43.0.svchost.exe.156b6b50000.0.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, score = , reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings
Source: 43.0.svchost.exe.156b6b50000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Chebka author = ditekSHen, description = Detects Chebka
Source: 43.0.svchost.exe.156b6b50000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Generic_a681f24a reference_sample = a796f316b1ed7fa809d9ad5e9b25bd780db76001345ea83f5035a33618f927fa, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Generic, fingerprint = 6323ed5b60e728297de19c878cd96b429bfd6d82157b4cf3475f3a3123921ae0, id = a681f24a-7054-4525-bcf8-3ee64a1d8413, last_modified = 2021-08-23
Source: 27.3.E9D3.exe.3860000.0.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), score = , reference = Internal Research
Source: 0000000F.00000000.485672401.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000027.00000002.601597228.00000000009F1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 0000001B.00000002.739912367.0000000002BF5000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000002B.00000003.595564014.00000156B6AE0000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, score = , reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings
Source: 0000002B.00000003.595564014.00000156B6AE0000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Generic_a681f24a reference_sample = a796f316b1ed7fa809d9ad5e9b25bd780db76001345ea83f5035a33618f927fa, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Generic, fingerprint = 6323ed5b60e728297de19c878cd96b429bfd6d82157b4cf3475f3a3123921ae0, id = a681f24a-7054-4525-bcf8-3ee64a1d8413, last_modified = 2021-08-23
Source: 0000001A.00000002.544780175.0000000000B10000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 0000000F.00000000.490507253.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 0000000F.00000000.490507253.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 0000000F.00000000.490507253.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000000F.00000002.503363757.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 0000000F.00000002.503363757.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 0000000F.00000002.503363757.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000027.00000002.601012575.0000000000930000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000002.387378506.0000000000C29000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000007.00000002.441430475.0000000002491000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 0000001A.00000002.544740114.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 0000000F.00000000.490001086.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 0000000F.00000000.490001086.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 0000000F.00000000.490001086.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000001F.00000002.652754688.0000000004D44000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, score = , reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings
Source: 0000001F.00000002.652754688.0000000004D44000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Generic_a681f24a reference_sample = a796f316b1ed7fa809d9ad5e9b25bd780db76001345ea83f5035a33618f927fa, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Generic, fingerprint = 6323ed5b60e728297de19c878cd96b429bfd6d82157b4cf3475f3a3123921ae0, id = a681f24a-7054-4525-bcf8-3ee64a1d8413, last_modified = 2021-08-23
Source: 00000024.00000003.573535906.000002F31BF40000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, score = , reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings
Source: 00000024.00000003.573535906.000002F31BF40000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Generic_a681f24a reference_sample = a796f316b1ed7fa809d9ad5e9b25bd780db76001345ea83f5035a33618f927fa, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Generic, fingerprint = 6323ed5b60e728297de19c878cd96b429bfd6d82157b4cf3475f3a3123921ae0, id = a681f24a-7054-4525-bcf8-3ee64a1d8413, last_modified = 2021-08-23
Source: 00000027.00000002.601073617.0000000000940000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 0000000F.00000000.492226078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 0000000F.00000000.492226078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 0000000F.00000000.492226078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000000.00000002.387173781.00000000009E1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000001.00000000.367270038.0000000004611000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000000.00000002.387108841.00000000009C0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000007.00000002.441371767.0000000002470000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000007.00000002.440994734.00000000009C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000027.00000002.602802862.0000000000A29000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000000F.00000000.491102942.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 0000000F.00000000.491102942.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 0000000F.00000000.491102942.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000000.00000002.387065611.00000000009B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 0000001A.00000002.545414239.0000000000B89000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000001B.00000003.552567063.0000000003860000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), score = , reference = Internal Research
Source: 0000000F.00000000.488104570.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 0000000F.00000000.488104570.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 0000000F.00000000.488104570.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000007.00000002.441147746.00000000009E8000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000001F.00000002.643002638.0000000001130000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, score = , reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings
Source: 0000001F.00000002.643002638.0000000001130000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Fabookie author = ditekSHen, description = Detects Fabookie / ElysiumStealer
Source: 0000001F.00000002.643002638.0000000001130000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Generic_a681f24a reference_sample = a796f316b1ed7fa809d9ad5e9b25bd780db76001345ea83f5035a33618f927fa, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Generic, fingerprint = 6323ed5b60e728297de19c878cd96b429bfd6d82157b4cf3475f3a3123921ae0, id = a681f24a-7054-4525-bcf8-3ee64a1d8413, last_modified = 2021-08-23
Source: 0000001A.00000002.545012487.0000000000B31000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 0000000E.00000002.495843293.00000000026F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000000E.00000002.494725828.0000000002545000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000002B.00000000.600713527.00000156B6B50000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, score = , reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings
Source: 0000002B.00000000.600713527.00000156B6B50000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Chebka author = ditekSHen, description = Detects Chebka
Source: 0000002B.00000000.600713527.00000156B6B50000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Generic_a681f24a reference_sample = a796f316b1ed7fa809d9ad5e9b25bd780db76001345ea83f5035a33618f927fa, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Generic, fingerprint = 6323ed5b60e728297de19c878cd96b429bfd6d82157b4cf3475f3a3123921ae0, id = a681f24a-7054-4525-bcf8-3ee64a1d8413, last_modified = 2021-08-23
Source: 00000024.00000000.584962257.000002F31BFB0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, score = , reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings
Source: 00000024.00000000.584962257.000002F31BFB0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Chebka author = ditekSHen, description = Detects Chebka
Source: 00000024.00000000.584962257.000002F31BFB0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Generic_a681f24a reference_sample = a796f316b1ed7fa809d9ad5e9b25bd780db76001345ea83f5035a33618f927fa, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Generic, fingerprint = 6323ed5b60e728297de19c878cd96b429bfd6d82157b4cf3475f3a3123921ae0, id = a681f24a-7054-4525-bcf8-3ee64a1d8413, last_modified = 2021-08-23
Source: 0000001B.00000002.865037113.0000000002FE0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: Process Memory Space: 87B9.exe PID: 5612, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: 87B9.exe PID: 4652, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 0040DF50 appears 31 times
Source: C:\Users\user\AppData\Local\Temp\87B9.exe	Code function: String function: 02718EC0 appears 38 times
Source: C:\Users\user\AppData\Local\Temp\87B9.exe	Code function: String function: 02720160 appears 31 times
Source: C:\Users\user\AppData\Roaming\erhuush	Code function: String function: 0040DF50 appears 31 times

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004017E3 Sleep,NtTerminateProcess,	0_2_004017E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00402351 NtOpenKey,NtEnumerateKey,NtEnumerateKey,	0_2_00402351
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00402072 NtQuerySystemInformation,	0_2_00402072
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00401807 Sleep,NtTerminateProcess,	0_2_00401807
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004014DF NtMapViewOfSection,NtMapViewOfSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_004014DF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004017E2 Sleep,NtTerminateProcess,	0_2_004017E2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004017EE Sleep,NtTerminateProcess,	0_2_004017EE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00401EFD NtQuerySystemInformation,	0_2_00401EFD
Source: C:\Users\user\AppData\Roaming\erhuush	Code function: 7_2_004017E3 Sleep,NtTerminateProcess,	7_2_004017E3
Source: C:\Users\user\AppData\Roaming\erhuush	Code function: 7_2_00402351 NtOpenKey,NtEnumerateKey,NtEnumerateKey,	7_2_00402351
Source: C:\Users\user\AppData\Roaming\erhuush	Code function: 7_2_00402072 NtQuerySystemInformation,	7_2_00402072
Source: C:\Users\user\AppData\Roaming\erhuush	Code function: 7_2_00401807 Sleep,NtTerminateProcess,	7_2_00401807
Source: C:\Users\user\AppData\Roaming\erhuush	Code function: 7_2_004014DF NtMapViewOfSection,NtMapViewOfSection,NtMapViewOfSection,NtMapViewOfSection,	7_2_004014DF
Source: C:\Users\user\AppData\Roaming\erhuush	Code function: 7_2_004017E2 Sleep,NtTerminateProcess,	7_2_004017E2
Source: C:\Users\user\AppData\Roaming\erhuush	Code function: 7_2_004017EE Sleep,NtTerminateProcess,	7_2_004017EE
Source: C:\Users\user\AppData\Roaming\erhuush	Code function: 7_2_00401EFD NtQuerySystemInformation,	7_2_00401EFD
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 13_2_05151000 NtCreateThreadEx,	13_2_05151000
Source: C:\Users\user\AppData\Local\Temp\87B9.exe	Code function: 14_2_026F0110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,SetThreadContext,ResumeThread,ExitProcess,	14_2_026F0110

Source: file.exe	Static PE information: Resource name: RT_VERSION type: MIPSEB-LE MIPS-III ECOFF executable not stripped - version 0.79
Source: D86C.exe.1.dr	Static PE information: Resource name: RT_VERSION type: MIPSEB-LE MIPS-III ECOFF executable not stripped - version 0.79
Source: E9D3.exe.1.dr	Static PE information: Resource name: RT_VERSION type: MIPSEB-LE MIPS-III ECOFF executable not stripped - version 0.79
Source: C39A.exe.1.dr	Static PE information: Resource name: RT_VERSION type: MIPSEB-LE MIPS-III ECOFF executable not stripped - version 0.79
Source: 254.exe.1.dr	Static PE information: Resource name: RT_VERSION type: MIPSEB-LE MIPS-III ECOFF executable not stripped - version 0.79
Source: 4A99.exe.1.dr	Static PE information: Resource name: RT_VERSION type: MIPSEB-LE MIPS-III ECOFF executable not stripped - version 0.79
Source: 519F.exe.1.dr	Static PE information: Resource name: RT_VERSION type: MIPSEB-LE MIPS-III ECOFF executable not stripped - version 0.79
Source: 87B9.exe.1.dr	Static PE information: Resource name: RT_VERSION type: MIPSEB-LE MIPS-III ECOFF executable not stripped - version 0.79
Source: bchuush.1.dr	Static PE information: Resource name: RT_VERSION type: MIPSEB-LE MIPS-III ECOFF executable not stripped - version 0.79
Source: erhuush.1.dr	Static PE information: Resource name: RT_VERSION type: MIPSEB-LE MIPS-III ECOFF executable not stripped - version 0.79

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\erhuush

Jump to behavior

Source: classification engine

Classification label: mal100.rans.troj.spyw.evad.winEXE@48/21@0/27

Source: C:\Windows\explorer.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: file.exe

ReversingLabs: Detection: 41%

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\erhuush C:\Users\user\AppData\Roaming\erhuush
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\regsvr32.exe regsvr32 /s C:\Users\user\AppData\Local\Temp\70E4.dll
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe /s C:\Users\user\AppData\Local\Temp\70E4.dll
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\87B9.exe C:\Users\user\AppData\Local\Temp\87B9.exe
Source: C:\Users\user\AppData\Local\Temp\87B9.exe	Process created: C:\Users\user\AppData\Local\Temp\87B9.exe C:\Users\user\AppData\Local\Temp\87B9.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\A024.exe C:\Users\user\AppData\Local\Temp\A024.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\C05F.exe C:\Users\user\AppData\Local\Temp\C05F.exe
Source: C:\Users\user\AppData\Local\Temp\C05F.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\C05F.exe	Process created: C:\Users\user\AppData\Local\Temp\C05F.exe "C:\Users\user\AppData\Local\Temp\C05F.exe" -h
Source: C:\Users\user\AppData\Local\Temp\C05F.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\D86C.exe C:\Users\user\AppData\Local\Temp\D86C.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\E9D3.exe C:\Users\user\AppData\Local\Temp\E9D3.exe
Source: unknown	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\AppData\Local\Temp\db.dll",open
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\AppData\Local\Temp\db.dll",open
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\ACE4.exe C:\Users\user\AppData\Local\Temp\ACE4.exe
Source: C:\Users\user\AppData\Local\Temp\ACE4.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\C39A.exe C:\Users\user\AppData\Local\Temp\C39A.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\system32\DllHost.exe /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\regsvr32.exe regsvr32 /s C:\Users\user\AppData\Local\Temp\70E4.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\87B9.exe C:\Users\user\AppData\Local\Temp\87B9.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\A024.exe C:\Users\user\AppData\Local\Temp\A024.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\C05F.exe C:\Users\user\AppData\Local\Temp\C05F.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\D86C.exe C:\Users\user\AppData\Local\Temp\D86C.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\E9D3.exe C:\Users\user\AppData\Local\Temp\E9D3.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\ACE4.exe C:\Users\user\AppData\Local\Temp\ACE4.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\C39A.exe C:\Users\user\AppData\Local\Temp\C39A.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe /s C:\Users\user\AppData\Local\Temp\70E4.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\87B9.exe	Process created: C:\Users\user\AppData\Local\Temp\87B9.exe C:\Users\user\AppData\Local\Temp\87B9.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E9D3.exe	Process created: unknown unknown
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\AppData\Local\Temp\db.dll",open
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Process created: unknown unknown
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\AppData\Local\Temp\db.dll",open

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\C05F.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Local\Temp\E9D3.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Name FROM Win32_Processor

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Local\Temp\70E4.tmp

Jump to behavior

Source: A024.exe, 00000011.00000003.579297798.000000000063B000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.575889606.0000000000637000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.589304762.000000000062B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT origin_url,action_url,username_element,username_value,password_element,hex(password_value) password_value,submit_element,signon_realm,date_created,blacklisted_by_user,scheme,password_type,times_used,form_data,display_name,icon_url,federation_url,skip_zero_click,generation_upload_status,possible_username_pairs,id,date_last_used,moving_blocked_for FROM logins;
Source: A024.exe, 00000011.00000003.715444032.00000000005FC000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.630107749.00000000005E3000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.679902596.00000000005E2000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.644269904.00000000005E3000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.639278241.00000000005E3000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.727725399.00000000005D7000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.558335213.00000000005EB000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.671761218.00000000005E3000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.505928263.00000000005A9000.00000004.00000001.00020000.00000000.sdmp, A024.exe, 00000011.00000003.664303308.00000000005E2000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.748899296.00000000005D8000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.720945359.00000000005D0000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.702202064.00000000005CF000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.865979392.00000000005FC000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.523910118.0000000000631000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.924299314.00000000005FC000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.649017987.00000000005E2000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.628472370.00000000005E5000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.728175494.00000000005FC000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.925282553.00000000005FC000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.612039610.00000000005E5000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.912851900.000000000273D000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.917214347.00000000005FC000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.721698554.00000000005FC000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.634715825.00000000005E9000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.861975918.00000000005FC000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.575889606.0000000000637000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.730565018.00000000005D7000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.641455008.00000000005E9000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.888609376.00000000005FC000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.875583192.00000000005FC000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.592140152.00000000005FF000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.881509308.00000000005FC000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.912820894.000000000273A000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.518341797.000000000060C000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.906851773.00000000005FC000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.548196639.00000000005CD000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.518053404.0000000000607000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.627164817.00000000005E5000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.650989626.00000000005E9000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.723724601.00000000005D4000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.712109883.00000000005CD000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.638714650.00000000005E9000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.707156985.00000000005DC000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.719569853.00000000005D0000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.882065466.00000000005FC000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.915984441.00000000005FC000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.857712036.00000000005FC000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.765470643.00000000005FC000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.922262527.00000000005FC000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.868205325.00000000005FC000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.663381798.00000000005E1000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.886216752.00000000005FC000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.515135801.00000000005E9000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.764984429.00000000005E3000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.510924967.000000000063C000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.534960284.0000000000637000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.719624084.00000000005FC000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.793943037.00000000005FC000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.652530312.00000000005E1000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.731235866.00000000005FC000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.631746103.00000000005DC000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.510980177.000000000063D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: A024.exe, 00000011.00000003.579297798.000000000063B000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.575889606.0000000000637000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.589304762.000000000062B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT origin_url,action_url,username_element,username_value,password_element,hex(password_value) password_value,submit_element,signon_realm,date_created,blacklisted_by_user,scheme,password_type,times_used,form_data,display_name,icon_url,federation_url,skip_zero_click,generation_upload_status,possible_username_pairs,id,date_last_used,moving_blocked_for FROM logins;ty INTEG

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00C2D774 CreateToolhelp32Snapshot,Module32First,

0_2_00C2D774

Source: C:\Windows\System32\wbem\WmiPrvSE.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\AppData\Local\Temp\db.dll",open

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2220:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4560:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4216:120:WilError_01

Source: C:\Users\user\Desktop\file.exe	Command line argument: msimg32.dll	0_2_00409B11
Source: C:\Users\user\Desktop\file.exe	Command line argument: msimg32.dll	0_2_00409B11
Source: C:\Users\user\AppData\Roaming\erhuush	Command line argument: msimg32.dll	7_2_00409B11
Source: C:\Users\user\AppData\Roaming\erhuush	Command line argument: msimg32.dll	7_2_00409B11

Source: 87B9.exe	String found in binary or memory: set-addPolicy
Source: 87B9.exe	String found in binary or memory: id-cmc-addExtensions

Source: C:\Users\user\AppData\Local\Temp\87B9.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\87B9.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A024.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A024.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C05F.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C05F.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb source: 87B9.exe, 87B9.exe, 0000000E.00000002.495843293.00000000026F0000.00000040.00001000.00020000.00000000.sdmp, 87B9.exe, 0000000F.00000000.490507253.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 87B9.exe, 0000000F.00000002.503363757.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 87B9.exe, 0000000F.00000000.488104570.0000000000400000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: EfiGuardDxe.pdb7 source: E9D3.exe, 0000001B.00000002.739912367.0000000002BF5000.00000040.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\hototapeges\jof14 godedoraga vihidi69\puwu.pdb source: 87B9.exe, 0000000E.00000000.477984877.0000000000401000.00000020.00000001.01000000.00000008.sdmp, 87B9.exe, 0000000E.00000002.493613078.0000000000401000.00000020.00000001.01000000.00000008.sdmp, 87B9.exe, 0000000F.00000000.484261191.0000000000401000.00000020.00000001.01000000.00000008.sdmp
Source:	Binary string: symsrv.pdbGCTL source: E9D3.exe, 0000001B.00000003.600314128.0000000004088000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: symsrv.pdb source: E9D3.exe, 0000001B.00000003.600314128.0000000004088000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\verumaxebi\sunaw\gewimovucajaf_hitojubare-hewohazap\kifobiv.pdb source: file.exe, file.exe, 00000000.00000002.386662790.0000000000409000.00000020.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000000.302664627.0000000000401000.00000020.00000001.01000000.00000003.sdmp, erhuush, erhuush, 00000007.00000000.423450379.0000000000401000.00000020.00000001.01000000.00000006.sdmp, erhuush, 00000007.00000002.440706921.0000000000409000.00000020.00000001.01000000.00000006.sdmp
Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdbI source: 87B9.exe, 0000000E.00000002.495843293.00000000026F0000.00000040.00001000.00020000.00000000.sdmp, 87B9.exe, 0000000F.00000000.490507253.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 87B9.exe, 0000000F.00000002.503363757.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 87B9.exe, 0000000F.00000000.488104570.0000000000400000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: C:\wuzoyobumo\xisiw.pdb source: E9D3.exe, 0000001B.00000000.542959704.0000000000401000.00000020.00000001.01000000.0000000D.sdmp
Source:	Binary string: CC:\hototapeges\jof14 godedoraga vihidi69\puwu.pdb source: 87B9.exe, 0000000E.00000000.477984877.0000000000401000.00000020.00000001.01000000.00000008.sdmp, 87B9.exe, 0000000E.00000002.493613078.0000000000401000.00000020.00000001.01000000.00000008.sdmp, 87B9.exe, 0000000F.00000000.484261191.0000000000401000.00000020.00000001.01000000.00000008.sdmp
Source:	Binary string: NC:\verumaxebi\sunaw\gewimovucajaf_hitojubare-hewohazap\kifobiv.pdb source: file.exe, 00000000.00000000.302664627.0000000000401000.00000020.00000001.01000000.00000003.sdmp, erhuush, 00000007.00000000.423450379.0000000000401000.00000020.00000001.01000000.00000006.sdmp
Source:	Binary string: C:\rad_linuv\poniyoy\vixejuni\kugum.pdb source: D86C.exe, 0000001A.00000000.523009146.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, D86C.exe, 0000001A.00000002.544319484.0000000000409000.00000020.00000001.01000000.0000000C.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R; vs .text:EW;
Source: C:\Users\user\AppData\Roaming\erhuush	Unpacked PE file: 7.2.erhuush.400000.0.unpack .text:ER;.data:W;.rsrc:R; vs .text:EW;
Source: C:\Users\user\AppData\Local\Temp\D86C.exe	Unpacked PE file: 26.2.D86C.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R; vs .text:EW;
Source: C:\Users\user\AppData\Local\Temp\C39A.exe	Unpacked PE file: 39.2.C39A.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R; vs .text:EW;

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00402847 push ebp; ret	0_2_00402848
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00402E56 push eax; ret	0_2_00402EBF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00402E5E push eax; ret	0_2_00402EBF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00402E6A push eax; ret	0_2_00402EBF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00402E70 push eax; ret	0_2_00402EBF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00402E05 push eax; ret	0_2_00402EBF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00402E1F push eax; ret	0_2_00402EBF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00402E88 push eax; ret	0_2_00402EBF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00402E8F push eax; ret	0_2_00402EBF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00402E96 push eax; ret	0_2_00402EBF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00402EA4 push eax; ret	0_2_00402EBF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00401AAC push edi; iretd	0_2_00401AAD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00402DB7 push eax; ret	0_2_00402EBF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00411C1A push 840F0044h; retf 0000h	0_2_00411C35
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C330D7 push esi; retf	0_2_00C330D8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C330FD push edx; retf	0_2_00C330FF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C33098 push edx; ret	0_2_00C330A3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C33040 push edx; ret	0_2_00C330A3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C2F999 push eax; ret	0_2_00C2F9A1
Source: C:\Users\user\AppData\Roaming\erhuush	Code function: 7_2_00402847 push ebp; ret	7_2_00402848
Source: C:\Users\user\AppData\Roaming\erhuush	Code function: 7_2_00402E56 push eax; ret	7_2_00402EBF
Source: C:\Users\user\AppData\Roaming\erhuush	Code function: 7_2_00402E5E push eax; ret	7_2_00402EBF
Source: C:\Users\user\AppData\Roaming\erhuush	Code function: 7_2_00402E6A push eax; ret	7_2_00402EBF
Source: C:\Users\user\AppData\Roaming\erhuush	Code function: 7_2_00402E70 push eax; ret	7_2_00402EBF
Source: C:\Users\user\AppData\Roaming\erhuush	Code function: 7_2_00402E05 push eax; ret	7_2_00402EBF
Source: C:\Users\user\AppData\Roaming\erhuush	Code function: 7_2_00402E1F push eax; ret	7_2_00402EBF
Source: C:\Users\user\AppData\Roaming\erhuush	Code function: 7_2_00402E88 push eax; ret	7_2_00402EBF
Source: C:\Users\user\AppData\Roaming\erhuush	Code function: 7_2_00402E8F push eax; ret	7_2_00402EBF
Source: C:\Users\user\AppData\Roaming\erhuush	Code function: 7_2_00402E96 push eax; ret	7_2_00402EBF
Source: C:\Users\user\AppData\Roaming\erhuush	Code function: 7_2_00402EA4 push eax; ret	7_2_00402EBF
Source: C:\Users\user\AppData\Roaming\erhuush	Code function: 7_2_00401AAC push edi; iretd	7_2_00401AAD

Source: C:\Users\user\AppData\Local\Temp\87B9.exe

Code function: 14_2_00422760 LoadLibraryA,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,__encode_pointer,__encode_pointer,__encode_pointer,__encode_pointer,__encode_pointer,

14_2_00422760

Source: C:\Windows\explorer.exe

Process created: C:\Windows\System32\regsvr32.exe regsvr32 /s C:\Users\user\AppData\Local\Temp\70E4.dll

Source: 964B.exe.1.dr	Static PE information: section name: _RDATA
Source: 964B.exe.1.dr	Static PE information: section name: .vmp0
Source: 964B.exe.1.dr	Static PE information: section name: .vmp1
Source: A024.exe.1.dr	Static PE information: section name: _RDATA
Source: A024.exe.1.dr	Static PE information: section name: .vmp0
Source: A024.exe.1.dr	Static PE information: section name: .vmp1

Source: initial sample

Static PE information: section where entry point is pointing to: .vmp1

Source: 519F.exe.1.dr	Static PE information: real checksum: 0x42de80 should be: 0x426efa
Source: 964B.exe.1.dr	Static PE information: real checksum: 0x0 should be: 0x3c92b7
Source: 70E4.dll.1.dr	Static PE information: real checksum: 0x0 should be: 0x18ae51
Source: E9D3.exe.1.dr	Static PE information: real checksum: 0x42de80 should be: 0x426efa
Source: A024.exe.1.dr	Static PE information: real checksum: 0x0 should be: 0x3c92b7
Source: C05F.exe.1.dr	Static PE information: real checksum: 0x2e80e should be: 0x3c696
Source: ACE4.exe.1.dr	Static PE information: real checksum: 0x2e80e should be: 0x3c696

Persistence and Installation Behavior

Creates processes via WMI

Source: C:\Users\user\AppData\Local\Temp\C05F.exe

WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create

Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\bchuush			Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\erhuush			Jump to dropped file

Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\254.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\A024.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\ACE4.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\bchuush	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\87B9.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\E9D3.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\C39A.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\4A99.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\erhuush	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\964B.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\519F.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\D86C.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\C05F.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\C05F.exe	File created: C:\Users\user\AppData\Local\Temp\db.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\70E4.dll	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Deletes itself after installation

Source: C:\Windows\explorer.exe

File deleted: c:\users\user\desktop\file.exe

Jump to behavior

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Roaming\erhuush:Zone.Identifier read attributes \| delete			Jump to behavior
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Roaming\bchuush:Zone.Identifier read attributes \| delete			Jump to behavior

Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C05F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E9D3.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\E9D3.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ACE4.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: E9D3.exe, 0000001B.00000003.552567063.0000000003860000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: RTP.EXESYSTEMROOT=SETFILETIMESIGNWRITINGSOFT_DOTTEDSYSTEMDRIVETESTING KEYTTL EXPIREDUNINSTALLERVBOXSERVICEVMUSRVC.EXEVT_RESERVEDVARIANTINITVIRTUALFREEVIRTUALLOCKWSARECVFROMWARANG_CITIWHITE_SPACEWINDEFENDER[:^XDIGIT:]\DSEFIX.EXEALARM CLOCKAPPLICATIONBAD ADDRESSBAD MESSAGEBAD TIMEDIVBITCOINS.SKBROKEN PIPECAMPAIGN_IDCGOCALL NILCLOBBERFREECLOSESOCKETCOMBASE.DLLCOMPAIGN_IDCREATED BY CRYPT32.DLLDNSMESSAGE.E2.KEFF.ORGEMBEDDED/%SEXTERNAL IPFILE EXISTSFINAL TOKENFLOAT32NAN2FLOAT64NAN2FLOAT64NAN3GCCHECKMARKGENERALIZEDGET CDN: %WGETPEERNAMEGETSOCKNAMEHTTPS_PROXYI/O TIMEOUTLOCAL ERRORLOST MCACHEMSPANMANUALMETHODARGS(MICROSECONDMILLISECONDMOVE %S: %WMSWSOCK.DLLNEXT SERVERNIL CONTEXTOPERA-PROXYORANNIS.COMOUT OF SYNCPARSE ERRORPROCESS: %SRAW-CONTROLREFLECT.SETRETRY-AFTERRUNTIME: P RUNTIME: P SCHEDDETAILSECHOST.DLLSECUR32.DLLSERVICE: %SSHELL32.DLLSHORT WRITESTART PROXYTASKMGR.EXETLS: ALERT(TRACEALLOC(TRAFFIC UPDUNREACHABLEUSERENV.DLLVERSION.DLLVERSION=190WININET.DLLWUP_PROCESS (SENSITIVE) [RECOVERED] ALLOCCOUNT FOUND AT *( GCSCANDONE M->GSIGNAL= MINTRIGGER= NDATAROOTS= NSPANROOTS= PAGES/BYTE
Source: D86C.exe, 0000001A.00000002.545246986.0000000000B7A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ASWHOOK
Source: E9D3.exe, 0000001B.00000003.552567063.0000000003860000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: ... OMITTING ACCEPT-CHARSETAFTER EFIGUARDALLOCFREETRACEBAD ALLOCCOUNTBAD RECORD MACBAD SPAN STATEBAD STACK SIZEBTC.USEBSV.COMCERT INSTALLEDCHECKSUM ERRORCONTENT-LENGTHCOULDN'T PATCHDATA TRUNCATEDDISTRIBUTOR_IDDRIVER REMOVEDERROR RESPONSEEXIT STATUS -1FILE TOO LARGEFINALIZER WAITGCSTOPTHEWORLDGET UPTIME: %WGETPROTOBYNAMEGOT SYSTEM PIDINITIAL SERVERINTERNAL ERRORINVALID SYNTAXIS A DIRECTORYKEY SIZE WRONGLEVEL 2 HALTEDLEVEL 3 HALTEDMEMPROFILERATENEED MORE DATANIL ELEM TYPE!NO MODULE DATANO SUCH DEVICEOBFS4PROXY.EXEOPEN EVENT: %WPARSE CERT: %WPROTOCOL ERRORREAD CERTS: %WREMOVE APP: %WRUNTIME: BASE=RUNTIME: FULL=S.ALLOCCOUNT= SEMAROOT QUEUESERVER.VERSIONSTACK OVERFLOWSTOPM SPINNINGSTORE64 FAILEDSYNC.COND.WAITTEXT FILE BUSYTIMEENDPERIODTOO MANY LINKSTOO MANY USERSTORRC FILENAMEUNEXPECTED EOFUNKNOWN CODE: UNKNOWN ERROR UNKNOWN METHODUNKNOWN MODE: UNREACHABLE: UNSAFE.POINTERVIRTUALBOX: %WVMWARETRAY.EXEVMWAREUSER.EXEWII LIBNUP/1.0WINAPI ERROR #WINDOW CREATEDWORK.FULL != 0X509IGNORECN=1XENSERVICE.EXEZERO PARAMETER WITH GC PROG
Source: E9D3.exe, 0000001B.00000003.552567063.0000000003860000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: TOO MANY LINKSTOO MANY USERSTORRC FILENAMEUNEXPECTED EOFUNKNOWN CODE: UNKNOWN ERROR UNKNOWN METHODUNKNOWN MODE: UNREACHABLE: UNSAFE.POINTERVIRTUALBOX: %WVMWARETRAY.EXEVMWAREUSER.EXEWII LIBNUP/1.0WINAPI ERROR #WINDOW CREATEDWORK.FULL != 0X509IGNORECN=1XENSERVICE.EXEZERO PARAMETER WITH GC PROG

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\AppData\Local\Temp\A024.exe	RDTSC instruction interceptor: First address: 000000014022773B second address: 00000001401C3B0C instructions: 0x00000000 rdtsc 0x00000002 dec esp 0x00000003 arpl dx, bp 0x00000005 jmp 00007FF66CDB3073h 0x0000000a inc ecx 0x0000000b pop ebp 0x0000000c dec ecx 0x0000000d or edi, 4743259Eh 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\A024.exe	RDTSC instruction interceptor: First address: 000000014021CEEB second address: 000000014021CEF9 instructions: 0x00000000 rdtsc 0x00000002 inc ecx 0x00000003 pop edx 0x00000004 inc ecx 0x00000005 rcl bh, cl 0x00000007 rcr al, cl 0x00000009 inc ecx 0x0000000a sal cl, cl 0x0000000c inc ecx 0x0000000d pop esi 0x0000000e rdtsc

Checks if the current machine is a virtual machine (disk enumeration)

Source: C:\Users\user\Desktop\file.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\erhuush	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\erhuush	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\erhuush	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\erhuush	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\erhuush	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\erhuush	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D86C.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\D86C.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\D86C.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\D86C.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\D86C.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\D86C.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\C39A.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\C39A.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\C39A.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\C39A.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\C39A.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\C39A.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI

Source: C:\Windows\explorer.exe TID: 4948	Thread sleep time: -65300s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 5276	Thread sleep time: -50600s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 5832	Thread sleep time: -51000s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 1128	Thread sleep time: -42800s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 5336	Thread sleep time: -40600s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A024.exe TID: 3004	Thread sleep time: -420000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A024.exe TID: 5952	Thread sleep time: -420000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C05F.exe TID: 5484	Thread sleep time: -60000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 5292	Thread sleep time: -180000s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\87B9.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep

graph_14-16667

Source: C:\Users\user\AppData\Local\Temp\A024.exe

Thread delayed: delay time: 420000

Jump to behavior

Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 662	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 653	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 506	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 533	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 510	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 428	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 404	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 406	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 358	Jump to behavior

Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\254.exe			Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\4A99.exe			Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\87B9.exe

Code function: 14_2_0254671C rdtsc

14_2_0254671C

Source: C:\Users\user\AppData\Local\Temp\E9D3.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Name FROM Win32_Processor

Source: C:\Users\user\AppData\Local\Temp\A024.exe

Thread delayed: delay time: 420000

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\87B9.exe

API call chain: ExitProcess graph end node

graph_14-16835

Source: E9D3.exe, 0000001B.00000003.552567063.0000000003860000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: entersyscallexit status failed to %wfound av: %sgcpacertracegetaddrinfowgot TI tokenguid_machinehost is downhttp2debug=1http2debug=2illegal seekinjector.exeinstall_dateinvalid baseinvalid portinvalid slotiphlpapi.dllkernel32.dllmachine_guidmadvdontneedmax-forwardsmsftedit.dllnetapi32.dllno such hostnon-existentnot pollableoleaut32.dllout of rangeparse PE: %wpointtopointproxyconnectreflect.Copyreleasep: m=remote errorremoving appruntime: f= runtime: gp=s ap traffics hs trafficsetupapi.dllshort buffertraffic/readtransmitfileulrichard.chunexpected )unknown portunknown typevmacthlp.exevmtoolsd.exewatchdog.exewinlogon.exewintrust.dllwirep: p->m=wtsapi32.dll != sweepgen (default %q) (default %v) MB released
Source: explorer.exe, 00000001.00000000.355092872.000000000830B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
Source: E9D3.exe, 0000001B.00000003.552567063.0000000003860000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: DSA-SHA1DecemberDefenderDeleteDCDuployanEULA.txtEqualSidEthiopicExtenderFebruaryFirewallFullPathGeorgianGetOEMCPGoStringGujaratiGurmukhiHTTP/1.1HTTP/2.0HiraganaInstFailInstRuneJavaneseKatakanaKayah_LiLIFETIMELinear_ALinear_BLocationLsaCloseMahajaniNO_ERRORNO_PROXYNovemberOl_ChikiPRIORITYPROGRESSParseIntPersoconPhags_PaQuestionReadFileReceivedSETTINGSSHA1-RSASOFTWARESaturdaySetEventSystem32TagbanwaTai_ThamTai_VietThursdayTifinaghTypeAAAATypeAXFRUSERHASHUSERNAMEUgariticVBoxWddmVT_ARRAYVT_BYREFWSAIoctlWinmonFSWmiPrvSE[:word:][signal \\.\HGFS\\.\vmcistack=[_NewEnumacceptexaddress bad instcgocheckcs default:dial: %wdnsquerydurationeax ebp ebx ecx edi edx eflags eip embeddedesi esp exporterf is nilfinishedfs go1.13.3gs hijackedhttp/1.1https://if-matchif-rangeinfinityinjectorinvalid locationloopbackmac_addrmountvolmsvmmoufno anodeno-cacheno_proxyopPseudoraw-readreadfromrecvfromrunnableruntime.scavengeshutdownstrconv.taskkilltor_modeunixgramunknown(usernamevmmemctlvmx_svgawalk: %wwsaioctlwuauservyuio.top (forced) blocked= defersc= in use)
Source: E9D3.exe, 0000001B.00000003.552567063.0000000003860000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: m=] n=archasn1avx2basebindbmi1bmi2boolcallcap cas1cas2cas3cas4cas5cas6chandatedeaddialdoneermsetagfailfilefromftpsfuncgziphosthourhttpicmpidleigmpint8jsonkindlinknonenullopenpathpipepop3quitreadsbrkseeksid=smtpsse2sse3tag:tcp4tcp6texttruetypeudp4udp6uintunixuuidvaryvmcixn-- -%s ...
Source: E9D3.exe, 0000001B.00000003.552567063.0000000003860000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 100-continue127.0.0.1:%d152587890625762939453125AUTHENTICATEBidi_ControlCIDR addressCONTINUATIONCfgMgr32.dllCoCreateGuidCoInitializeContent TypeContent-TypeCookie.ValueCreateEventWCreateMutexWDeleteObjectECDSA-SHA256ECDSA-SHA384ECDSA-SHA512ErrUnknownPCFindNextFileGetAddrInfoWGetConsoleCPGetLastErrorGetLengthSidGetProcessIdGetStdHandleGetTempPathWGetUserGeoIDGlobalUnlockGlobal\csrssI'm a teapotInstAltMatchJoin_ControlLittleEndianLoadLibraryWLoadResourceLockResourceMax-ForwardsMeetei_MayekMime-VersionMulti-StatusNot ExtendedNot ModifiedNtCreateFileOpenServiceWPUSH_PROMISEPahawh_HmongRCodeRefusedRCodeSuccessReadConsoleWReleaseMutexReportEventWResumeThreadRevertToSelfRoInitializeS-1-5-32-544SERIALNUMBERSelectObjectServer ErrorSetEndOfFileSetErrorModeSetStdHandleSora_SompengSyloti_NagriSysStringLenThread32NextTor mode setTransitionalTransmitFileUnauthorizedUnlockFileExVBoxTray.exeVariantClearVirtualAllocVirtualQueryWinmon32.sysWinmon64.sysWintrust.dllX-ImforwardsX-Powered-By[[:^ascii:]]\/(\d+)-(.*)\\.\WinMonFSabi mismatchadvapi32.dllaltmatch -> anynotnl -> bad flushGenbad g statusbad g0 stackbad recoverybad value %dbootmgfw.efibuild_numberc ap trafficc hs trafficcaller errorcan't happencas64 failedcdn is emptychan receiveclose notifycontent-typecontext.TODOcountry_codedse disableddumping heapend tracegc
Source: E9D3.exe, 0000001B.00000003.552567063.0000000003860000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: DnsRecordListFreeENHANCE_YOUR_CALMEnumThreadWindowsFLE Standard TimeFailed DependencyGC assist markingGMT Standard TimeGTB Standard TimeGetCurrentProcessGetShortPathNameWHEADER_TABLE_SIZEHKEY_CLASSES_ROOTHKEY_CURRENT_USERHTTP_1_1_REQUIREDIf-Modified-SinceIsTokenRestrictedLookupAccountSidWMESSAGE-INTEGRITYMoved PermanentlyOld_North_ArabianOld_South_ArabianOther_ID_ContinuePython-urllib/2.5QueryWorkingSetExRESERVATION-TOKENReadProcessMemoryRegLoadMUIStringWSafeArrayCopyDataSafeArrayCreateExSentence_TerminalSysAllocStringLenToo Many RequestsTransfer-EncodingUnexpected escapeUnified_IdeographUnknown AttributeVGAuthService.exeWSAEnumProtocolsWWTSQueryUserTokenWrite after CloseWrong CredentialsX-Idempotency-Key\System32\drivers\\.\VBoxMiniRdrDNbad TinySizeClasscouldn't dial: %wcouldn't find pidcouldn't get UUIDcouldn't get pidscouldn't hide PIDcpu name is emptycreate window: %wdecryption faileddownloading proxyelectrumx.soon.itembedded/%s32.sysembedded/%s64.sysembedded/EULA.txtentersyscallblockexec format errorexec: not startedexponent overflowfile URL is emptyfractional secondgp.waiting != nilhandshake failureif-modified-sinceillegal parameterimpersonation: %win string literalindex > windowEndinteger too largeinvalid bit size invalid stream IDkey align too biglibwww-perl/5.820locked m0 woke upmark - bad statusmarkBits overflowmissing closing )missing closing ]missing extensionnil resource bodyno data availablenotetsleepg on g0permission deniedpseudo-device: %sread revision: %wreflect.Value.Capreflect.Value.Intreflect.Value.Lenreflect: New(nil)reflect: call of removing watchdogruntime.newosprocruntime: a.base= runtime: b.base= runtime: nameOff runtime: next_gc=runtime: pointer runtime: textOff runtime: typeOff s.callback is nilscanobject n == 0seek at 0x%0x: %wseeker can't seekselect (no cases)stack: frame={sp:start service: %wthread exhaustiontransfer-encodingtruncated headersunknown caller pcvalidate hash: %wwait for GC cyclewine_get_version
Source: explorer.exe, 00000001.00000000.355092872.000000000830B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: E9D3.exe, 0000001B.00000003.552567063.0000000003860000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: IP addressIsValidSidKeep-AliveKharoshthiLocalAllocLockFileExLogonUserWManichaeanMessage-IdNo ContentOld_ItalicOld_PermicOld_TurkicOpenEventWOpenMutexWOpenThreadOther_MathPOSTALCODEParseFloatPhoenicianProcessingPulseEventRST_STREAMResetEventSHA256-RSASHA384-RSASHA512-RSASYSTEMROOTSaurashtraSecureBootSet-CookieShowWindowTor uptimeUseBridgesUser-AgentVMSrvc.exeVT_ILLEGALWSACleanupWSASocketWWSAStartupWget/1.9.1Windows 10Windows 11[:^alnum:][:^alpha:][:^ascii:][:^blank:][:^cntrl:][:^digit:][:^graph:][:^lower:][:^print:][:^punct:][:^space:][:^upper:][:xdigit:]\\.\WinMon\patch.exe^{[\w-]+}$app_%d.txtatomicand8attr%d=%s casgstatuscmd is nilcomplex128connectiondnsapi.dlldsefix.exedwarf.Attre.keff.orgexitThreadexp mastergetsockoptgoroutine http_proxyimage/jpegimage/webpindicationinvalidptrkeep-alivemSpanInUsenanosecondno resultsnot a boolnot signedowner diedprl_cc.exeres binderres masterresumptionrune <nil>runtime: gschedtracesemacquiresend stateset-cookiesetsockoptsocks bindterminatedtracefree(tracegc()
Source: E9D3.exe, 0000001B.00000003.552567063.0000000003860000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: unixpacketunknown pcuser-agentuser32.dllvmusbmousevmware: %wws2_32.dll of size (targetpc= ErrCode=%v a.npages= b.npages= bytes ...
Source: E9D3.exe, 0000001B.00000003.552567063.0000000003860000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: , not , val -BEFV--DYOR--FMLD--FZTA--IRXC--JFQI--JQGP--JSKV--JZUF--KGQJ--KSFO--MKND--MOHU--NSFS--PFQJ--PLND--RTMD--VRSM--XQVL-.onion/%d-%d370000390625:31461<-chanAcceptAnswerArabicAugustBUTTONBasic BitBltBrahmiBridgeCANCELCancelCarianChakmaClass(CommonCookieCopticDELETEExpectFltMgrFormatFridayGOAWAYGOROOTGetACPGothicHangulHatranHebrewHyphenKaithiKhojkiLepchaLockedLycianLydianMondayPADDEDPcaSvcPragmaRejangSCHED STREETServerStringSundaySyriacTai_LeTangutTeluguThaanaTypeMXTypeNSUTC+12UTC+13UTC-02UTC-08UTC-09UTC-11VBoxSFVT(%d)WINDIRWinMonWinmon[]byte\??\%s\csrss\ufffd
Source: E9D3.exe, 0000001B.00000003.552567063.0000000003860000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Value is nullVirtualUnlockWINDOW_UPDATEWTSFreeMemoryWriteConsoleW[FrameHeader \\.\VBoxGuestaccept-rangesaccess deniedadvapi32.dllauthorizationbad flushGen bad map statebtc.cihar.combtc.xskyx.netcache-controlcontent-rangecouldn't polldalTLDpSugct?data is emptyemail addressempty integerexchange fullfatal error: gethostbynamegetservbynamegzip, deflatehttp2client=0if-none-matchimage/svg+xmlinvalid UTF-8invalid base kernel32.dllkey expansionlast-modifiedlevel 3 resetload64 failedmaster secretname is emptynil stackbasenot a Float32open file: %wout of memoryparallels: %wparsing time powrprof.dllprl_tools.exeread EULA: %wrebooting nowscvg: inuse: service stateset event: %wsigner is nilsocks connectsrmount errorstill in listtimer expiredtrailing datatriggerRatio=unimplementedunsupported: user canceledvalue method virtualpc: %wxadd64 failedxchg64 failed}
Source: E9D3.exe, 0000001B.00000003.552567063.0000000003860000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: to unallocated span$WINDIR\watchdog.exe%%!%c(*big.Float=%s)%s\Sysnative\cmd.exe37252902984619140625Arabic Standard TimeAzores Standard TimeCertFindChainInStoreCertOpenSystemStoreWChangeServiceConfigWCheckTokenMembershipCreateProcessAsUserWCryptAcquireContextWEgyptian_HieroglyphsEnumProcessModulesExFileTimeToSystemTimeGetAcceptExSockaddrsGetAdaptersAddressesGetCurrentDirectoryWGetFileAttributesExWGetModuleFileNameExWGetModuleInformationGetProcessMemoryInfoGetWindowsDirectoryWIDS_Trinary_OperatorInsufficient StorageIsrael Standard TimeJordan Standard TimeMAX_HEADER_LIST_SIZEMalformed JSON errorMediapartners-GoogleMeroitic_HieroglyphsNtSetInformationFileNtUnmapViewOfSectionNtWriteVirtualMemoryOffline Explorer/2.5ProcessIdToSessionIdQueryServiceConfig2WQueryServiceStatusExRegisterEventSourceWRequest URI Too LongRtlInitUnicodeStringSHGetKnownFolderPathSafeArrayDestroyDataSafeArrayGetElemsizeSeek: invalid offsetSeek: invalid whenceSetCurrentDirectoryWSetHandleInformationSetVolumeMountPointWSetupDiOpenDevRegKeyTaipei Standard TimeTerminal_PunctuationTurkey Standard TimeUnprocessable EntityWinmonProcessMonitor[invalid char class]\\.\pipe\VBoxTrayIPCasn1: syntax error: bad defer size classbad font file formatbad system page sizebad use of bucket.bpbad use of bucket.mpchan send (nil chan)close of nil channelconnection error: %sconnection timed outcouldn't disable DSEcouldn't get IsAdmincouldn't get serverscouldn't run servicecouldn't set IsAdmincouldn't set serverscouldn't stop PsaSvccouldn't write patchcreate proxy dir: %wcreate text edit: %wdecode siganture: %wdecode signature: %welectrum.bitkoins.nlelectrum.hsmiths.comelectrum.taborsky.czelectrum.villocq.comevent message is nilflag: help requestedfloating point errorforcegc: phase errorgc_trigger underflowget transactions: %wgetadaptersaddressesgo of nil func valuegopark: bad g statusgzip: invalid headerheader line too longhttp2: stream closedinvalid repeat countinvalid request codeis a named type filejson: Unmarshal(nil json: Unmarshal(nil)key has been revokedmSpanList.insertBackmalformed ciphertextmalloc during signalmove GeoIP files: %wmove Tor GeoIP filesno such struct fieldnon-empty swept listnorm: invalid whencenot an integer classnotetsleep not on g0number has no digitsp mcache not flushedpacer: assist ratio=pad length too largepreempt off reason: reflect.Value.SetIntreflect.makeFuncStubrequest file CDN: %wroot\SecurityCenter2runtime: casgstatus runtime: double waitruntime: unknown pc semaRoot rotateRightstun.ipfire.org:3478systemdrive is emptytime: invalid numbertrace: out of memoryunexpected network: unknown address typeunsupported arch: %suser is not an adminvalue is not presentwirep: already in goworkbuf is not emptywrite of Go pointer ws2_32.dll not foundzlib: invalid header gp.gcscanvalid=true
Source: 87B9.exe, 0000000F.00000002.505696844.00000000007F6000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.505479395.00000000005BD000.00000004.00000001.00020000.00000000.sdmp, A024.exe, 00000011.00000003.509547209.00000000005BD000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.508679972.00000000005BD000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.511743264.00000000005BD000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.599358977.00000000005BD000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.609649183.00000000005BD000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.622282517.00000000005BD000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.747776894.00000000005BD000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.591165080.00000000005BD000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.729186181.00000000005BD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: explorer.exe, 00000001.00000000.355092872.000000000830B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&0000000
Source: E9D3.exe, 0000001B.00000002.739912367.0000000002BF5000.00000040.00000800.00020000.00000000.sdmp	Binary or memory string: 11VBoxSFVT(%d)WINDIRWibx@
Source: E9D3.exe, 0000001B.00000003.552567063.0000000003860000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: ... omitting accept-charsetafter EfiGuardallocfreetracebad allocCountbad record MACbad span statebad stack sizebtc.usebsv.comcert installedchecksum errorcontent-lengthcouldn't patchdata truncateddistributor_iddriver removederror responseexit status -1file too largefinalizer waitgcstoptheworldget uptime: %wgetprotobynamegot system PIDinitial serverinternal errorinvalid syntaxis a directorykey size wronglevel 2 haltedlevel 3 haltedmemprofilerateneed more datanil elem type!no module datano such deviceobfs4proxy.exeopen event: %wparse cert: %wprotocol errorread certs: %wremove app: %wruntime: base=runtime: full=s.allocCount= semaRoot queueserver.versionstack overflowstopm spinningstore64 failedsync.Cond.Waittext file busytimeEndPeriodtoo many linkstoo many userstorrc filenameunexpected EOFunknown code: unknown error unknown methodunknown mode: unreachable: unsafe.Pointervirtualbox: %wvmwaretray.exevmwareuser.exewii libnup/1.0winapi error #window createdwork.full != 0x509ignoreCN=1xenservice.exezero parameter with GC prog
Source: E9D3.exe, 0000001B.00000003.552567063.0000000003860000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: NonTransitionalNot ImplementedNtSuspendThreadOpenThreadTokenOther_LowercaseOther_UppercasePartial ContentPostQuitMessageProcess32FirstWPsalter_PahlaviQueryDosDeviceWRegCreateKeyExWRegDeleteValueWRequest TimeoutRtlDefaultNpAclSafeArrayCreateSafeArrayGetDimSafeArrayGetIIDSafeArrayUnlockScheduledUpdateSetCommTimeoutsSetSecurityInfoSetVolumeLabelWShellExecuteExWStringFromCLSIDStringFromGUID2TerminateThreadUnescaped quoteUninstallStringUnmapViewOfFileVBoxService.exeVPS.hsmiths.comWinsta0\DefaultX-Forwarded-For\\.\VBoxTrayIPC]
Source: E9D3.exe, 0000001B.00000003.552567063.0000000003860000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Value is nullVirtualUnlockWINDOW_UPDATEWTSFreeMemoryWriteConsoleW[FrameHeader \\.\VBoxGuestaccept-rangesaccess deniedadvapi32.dll
Source: E9D3.exe, 0000001B.00000003.552567063.0000000003860000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: ><'\'') = ) m=+Inf+inf, n -Inf-inf.bat.cmd.com.css.exe.gif.htm.jpg.mjs.pdf.png.svg.sys.xml0x%x1.1110803125: p=ACDTACSTAEDTAESTAKDTAKSTAWSTAhomAtoiCDN=CESTChamDATADashDataDateEESTEULAEtagFromGOGCGoneHEADHKCCHKLMHostJulyJuneLisuMiaoModiNZDTNZSTNewaPINGPOSTQEMUROOTSASTSendStatTempThaiUUIDWEST"%s"\rss\smb\u00
Source: E9D3.exe, 0000001B.00000002.739912367.0000000002BF5000.00000040.00000800.00020000.00000000.sdmp	Binary or memory string: \\.\HGFS`
Source: E9D3.exe, 0000001B.00000003.552567063.0000000003860000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VersionVirtualWSARecvWSASend"%s" %stypes value=abortedalt -> any -> booleancharsetchunkedcmd.execonnectconsolecpu: %sderiveddriversexpiresfloat32float64gctracehttp://invalidlog.txtlookup max-agemessagenil keynop -> number panic: refererrefreshrequestrunningserial:server=signal svc_versyscalltor.exetraileruintptrunknownupgradeversionvmmousevpcuhubwaitingwsarecvwsasendwup_verxen: %wxennet6 data=%q etypes goal
Source: explorer.exe, 00000001.00000000.355254062.000000000834F000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&0000006
Source: explorer.exe, 00000001.00000000.320840062.00000000059F0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}b
Source: E9D3.exe, 0000001B.00000003.552567063.0000000003860000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: underflowunhandledunzip Torunzip: %ww3m/0.5.1websocketxenevtchn} stack=[ MB goal, actual
Source: explorer.exe, 00000001.00000000.355509727.0000000008394000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: E9D3.exe, 0000001B.00000002.739912367.0000000002BF5000.00000040.00000800.00020000.00000000.sdmp	Binary or memory string: ewaPINGPOSTQEMUROOTG
Source: E9D3.exe, 0000001B.00000003.552567063.0000000003860000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: GetActiveObjectGetAdaptersInfoGetCommTimeoutsGetCommandLineWGetFirmwareTypeGetProcessTimesGetSecurityInfoGetStartupInfoWGlobal\qtxp9g8wHanifi_RohingyaICE-CONTROLLINGIdempotency-KeyImpersonateSelfInstall failureIsWow64Process2Length RequiredLoadLibraryExALoadLibraryExWNonTransitionalNot ImplementedNtSuspendThreadOpenThreadTokenOther_LowercaseOther_UppercasePartial ContentPostQuitMessageProcess32FirstWPsalter_PahlaviQueryDosDeviceWRegCreateKeyExWRegDeleteValueWRequest TimeoutRtlDefaultNpAclSafeArrayCreateSafeArrayGetDimSafeArrayGetIIDSafeArrayUnlockScheduledUpdateSetCommTimeoutsSetSecurityInfoSetVolumeLabelWShellExecuteExWStringFromCLSIDStringFromGUID2TerminateThreadUnescaped quoteUninstallStringUnmapViewOfFileVBoxService.exeVPS.hsmiths.comWinsta0\DefaultX-Forwarded-For\\.\VBoxTrayIPC]
Source: E9D3.exe, 0000001B.00000003.552567063.0000000003860000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: DnsRecordListFreeENHANCE_YOUR_CALMEnumThreadWindowsFLE Standard TimeFailed DependencyGC assist markingGMT Standard TimeGTB Standard TimeGetCurrentProcessGetShortPathNameWHEADER_TABLE_SIZEHKEY_CLASSES_ROOTHKEY_CURRENT_USERHTTP_1_1_REQUIREDIf-Modified-SinceIsTokenRestrictedLookupAccountSidWMESSAGE-INTEGRITYMoved PermanentlyOld_North_ArabianOld_South_ArabianOther_ID_ContinuePython-urllib/2.5QueryWorkingSetExRESERVATION-TOKENReadProcessMemoryRegLoadMUIStringWSafeArrayCopyDataSafeArrayCreateExSentence_TerminalSysAllocStringLenToo Many RequestsTransfer-EncodingUnexpected escapeUnified_IdeographUnknown AttributeVGAuthService.exeWSAEnumProtocolsWWTSQueryUserTokenWrite after CloseWrong CredentialsX-Idempotency-Key\System32\drivers\\.\VBoxMiniRdrDNbad TinySizeClasscouldn't dial: %wcouldn't find pidcouldn't get UUIDcouldn't get pidscouldn't hide PIDcpu name is emptycreate window: %wdecryption faileddownloading proxyelectrumx.soon.itembedded/%s32.sysembedded/%s64.sysembedded/EULA.txtentersyscallblockexec format errorexec: not startedexponent overflowfile URL is emptyfractional secondgp.waiting != nilhandshake failureif-modified-sinceillegal parameterimpersonation: %win string literalindex > windowEndinteger too largeinvalid bit size invalid stream IDkey align too biglibwww-perl/5.820locked m0 woke upmark - bad statusmarkBits overflowmissing closing )missing closing ]missing extensionnil resource bodyno data availablenotetsleepg on g0permission deniedpseudo-device: %sread revision: %wreflect.Value.Capreflect.Value.Intreflect.Value.Lenreflect: New(nil)reflect: call of removing watchdogruntime.newosprocruntime: a.base= runtime: b.base= runtime: nameOff runtime: next_gc=runtime: pointer runtime: textOff runtime: typeOff s.callback is nilscanobject n == 0seek at 0x%0x: %wseeker can't seekselect (no cases)stack: frame={sp:start service: %wthread exhaustiontransfer-encodingtruncated headersunknown caller pcvalidate hash: %wwait for GC cyclewine_get_versionwrong medium type but memory size because dotdotdot to non-Go memory $SYSTEMDRIVE\Users, locked to thread298023223876953125: day out of rangeArab Standard TimeAsset %s not foundCM_MapCrToWin32ErrCaucasian_AlbanianCertGetNameStringWCloseServiceHandleCommandLineToArgvWCreateCompatibleDCCreateDispTypeInfoCreateFileMappingWCreateRemoteThreadCreateWellKnownSidCryptUnprotectDataCuba Standard TimeELinks/0.12~pre5-4EnumProcessModulesExpectation FailedFLOW_CONTROL_ERRORFiji Standard TimeGetBestInterfaceExGetComputerNameExWGetCurrentThreadIdGetExitCodeProcessGetFileAttributesWGetModuleBaseNameWGetModuleFileNameWGetModuleHandleExWGetSidSubAuthorityGetUserDefaultLCIDGetVolumePathNameWGo-http-client/1.1Go-http-client/2.0HKEY_LOCAL_MACHINEInternetSetOptionWIran Standard TimeKey path not foundLookupAccountNameWMakeSelfRelativeSDMethod Not AllowedNtSetContextThreadOmsk Standard TimePASSWORD-ALGORITHMPFXImportCertStorePermanent RedirectProxy-AuthenticateQueryServiceStatusRCodeServerFailureRFS specific errorRegional_IndicatorRoAc
Source: E9D3.exe, 0000001B.00000002.739912367.0000000002BF5000.00000040.00000800.00020000.00000000.sdmp	Binary or memory string: hgfsO
Source: E9D3.exe, 0000001B.00000003.552567063.0000000003860000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: and h_a= h_g= h_t= max= ptr siz= tab= top= u_a= u_g=%s %q%s %s%s%d%s/%s%s:%d%s=%s"'&+0330+0430+0530+0545+0630+0845+1030+1245+1345, ..., fp:-0930.html.jpeg.wasm.webp1.4.2156253.2.250001500025000350004500055000650512560015600278125:**@:path<nil>AdlamAprilAttr(BamumBatakBuhidCall CountDograECDSAErrorFlagsFoundGetDCGreekHTTP/KhmerLatinLimbuLocalLstatMarchNONCENushuOghamOriyaOsageP-224P-256P-384P-521PGDSEREALMRangeRealmRunicSTermTakriTamilTypeAUUID=\u202allowarraybad nchdirclosecsrssfalsefaultfloatgcinggeoiphttpsimap2imap3imapsint16int32int64matchmkdirmonthntohsobfs4panicparsepgdsepop3sproxyrangermdirrouterune sdsetsleepslicesockssse41sse42ssse3text/tls13tls: torrctotaluint8usageuser=utf-8valuevmusbvmx86write (MB)
Source: E9D3.exe, 0000001B.00000003.552567063.0000000003860000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: acceptactivechan<-closedcookiedirectdomaindwarf.efenceempty exec: expectfamilygeoip6gopherhangupheaderip+netkilledlistenminutenumberobjectpopcntreadatreasonremoverenamerun-v3rune1 scvg: secondsecureselectsendtoserversocketsocks socks5statusstringstructsweep telnetuint16uint32uint64unuseduptimevmhgfsvmxnetvpc-s3wup_hsxennetxensvcxenvdb %v=%v, (conn) (scan (scan) MB in Value> dying= flags= len=%d locks= m->g0= nmsys= s=nil
Source: explorer.exe, 00000001.00000000.357720554.000000000CDC8000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: _VMware_SATA_CD00#5&
Source: E9D3.exe, 0000001B.00000003.552567063.0000000003860000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: (MISSING)(unknown)+infinity, newval=, oldval=-07:00:00-infinity/api/cdn?/api/poll127.0.0.1244140625: status=; Domain=Accuracy(AuthorityBassa_VahBhaiksukiClassINETCuneiformDiacriticEVEN-PORTExecQueryFindCloseForbiddenGetDIBitsHex_DigitInheritedInstMatchInstRune1InterfaceKhudawadiLocalFreeMalayalamMongolianMoveFileWNabataeanNot FoundOP_RETURNOSCaptionPalmyreneParseUintPatchTimePublisherReleaseDCRemoveAllSTUN addrSamaritanSee OtherSeptemberSundaneseSysnativeToo EarlyTrailer: TypeCNAMETypeHINFOTypeMINFOUse ProxyVBoxGuestVBoxMouseVBoxVideoWSASendToWednesdayWindows 7WriteFileZ07:00:00[%v = %d][:^word:][:alnum:][:alpha:][:ascii:][:blank:][:cntrl:][:digit:][:graph:][:lower:][:print:][:punct:][:space:][:upper:]atomicor8attributeb.ooze.ccbad indirbroadcastbus errorchallengechan sendcomplex64connectexcopystackcsrss.exectxt != 0d.nx != 0ecdsa.netempty urlfn.48.orgfodhelperfork/execfuncargs(gdi32.dllimage/gifimage/pnginterfaceinterruptipv6-icmplocalhostmSpanDeadmSpanFreemulticastnew tokennil errorntdll.dllole32.dllomitemptyop_returnpanicwaitpatch.exepclmulqdqprintableprotocol proxy.exepsapi.dllraw-writereboot inrecover: reflect: rwxrwxrwxscheduledsucceededtask %+v
Source: explorer.exe, 00000001.00000000.384543601.00000000085A9000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: #CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: E9D3.exe, 0000001B.00000002.739912367.0000000002BF5000.00000040.00000800.00020000.00000000.sdmp	Binary or memory string: yvmcixn-Re-
Source: E9D3.exe, 0000001B.00000003.552567063.0000000003860000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: too many linkstoo many userstorrc filenameunexpected EOFunknown code: unknown error unknown methodunknown mode: unreachable: unsafe.Pointervirtualbox: %wvmwaretray.exevmwareuser.exewii libnup/1.0winapi error #window createdwork.full != 0x509ignoreCN=1xenservice.exezero parameter with GC prog
Source: 87B9.exe, 0000000F.00000002.505696844.00000000007F6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWps
Source: E9D3.exe, 0000001B.00000003.552567063.0000000003860000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: RTP.exeSYSTEMROOT=SetFileTimeSignWritingSoft_DottedSystemDriveTESTING KEYTTL expiredUninstallerVBoxServiceVMUSrvc.exeVT_RESERVEDVariantInitVirtualFreeVirtualLockWSARecvFromWarang_CitiWhite_SpaceWinDefender[:^xdigit:]\dsefix.exealarm clockapplicationbad addressbad messagebad timedivbitcoins.skbroken pipecampaign_idcgocall nilclobberfreeclosesocketcombase.dllcompaign_idcreated by crypt32.dlldnsmessage.e2.keff.orgembedded/%sexternal IPfile existsfinal tokenfloat32nan2float64nan2float64nan3gccheckmarkgeneralizedget CDN: %wgetpeernamegetsocknamehttps_proxyi/o timeoutlocal errorlost mcachemSpanManualmethodargs(microsecondmillisecondmove %s: %wmswsock.dllnext servernil contextopera-proxyorannis.comout of syncparse errorprocess: %sraw-controlreflect.Setretry-afterruntime: P runtime: p scheddetailsechost.dllsecur32.dllservice: %sshell32.dllshort writestart proxytaskmgr.exetls: alert(tracealloc(traffic updunreachableuserenv.dllversion.dllversion=190wininet.dllwup_process (sensitive) [recovered] allocCount found at *( gcscandone m->gsignal= minTrigger= nDataRoots= nSpanRoots= pages/byte

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Anti Debugging

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Source: C:\Users\user\Desktop\file.exe	System information queried: CodeIntegrityInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\erhuush	System information queried: CodeIntegrityInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D86C.exe	System information queried: CodeIntegrityInformation
Source: C:\Users\user\AppData\Local\Temp\C39A.exe	System information queried: CodeIntegrityInformation

Source: C:\Users\user\AppData\Local\Temp\87B9.exe

14_2_00422760

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C2D051 push dword ptr fs:[00000030h]	0_2_00C2D051
Source: C:\Users\user\AppData\Local\Temp\87B9.exe	Code function: 14_2_025450A3 push dword ptr fs:[00000030h]	14_2_025450A3
Source: C:\Users\user\AppData\Local\Temp\87B9.exe	Code function: 14_2_026F0042 push dword ptr fs:[00000030h]	14_2_026F0042

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Roaming\erhuush	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D86C.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\C39A.exe	Process queried: DebugPort

Source: C:\Windows\System32\wbem\WmiPrvSE.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\AppData\Local\Temp\db.dll",open

Source: C:\Users\user\AppData\Local\Temp\87B9.exe

Code function: 14_2_00414FF0 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

14_2_00414FF0

Source: C:\Users\user\AppData\Local\Temp\87B9.exe

Code function: 14_2_0254671C rdtsc

14_2_0254671C

Source: C:\Users\user\AppData\Local\Temp\87B9.exe	Code function: 14_2_00414FF0 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	14_2_00414FF0
Source: C:\Users\user\AppData\Local\Temp\87B9.exe	Code function: 14_2_00410A90 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	14_2_00410A90
Source: C:\Users\user\AppData\Local\Temp\87B9.exe	Code function: 14_2_0040A7A0 _memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	14_2_0040A7A0

HIPS / PFW / Operating System Protection Evasion

Benign windows process drops PE files

Source: C:\Windows\explorer.exe

File created: D86C.exe.1.dr

Jump to dropped file

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\file.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Roaming\erhuush	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\erhuush	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D86C.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write
Source: C:\Users\user\AppData\Local\Temp\D86C.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read
Source: C:\Users\user\AppData\Local\Temp\C39A.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write
Source: C:\Users\user\AppData\Local\Temp\C39A.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read

Allocates memory in foreign processes

Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2C847FA0000 protect: page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2F31B9A0000 protect: page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 156B6A90000 protect: page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1F64A270000 protect: page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 25205F70000 protect: page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 22CCE7A0000 protect: page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 20983C80000 protect: page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 17AF5440000 protect: page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2D56CF90000 protect: page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 21C8C3A0000 protect: page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 251E8270000 protect: page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1FCB35B0000 protect: page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 19987D90000 protect: page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 17685D00000 protect: page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 27ADFBB0000 protect: page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 24FF52B0000 protect: page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 23F9E9B0000 protect: page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1DFFC5B0000 protect: page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 29EED760000 protect: page execute and read and write

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Local\Temp\87B9.exe

Memory written: C:\Users\user\AppData\Local\Temp\87B9.exe base: 400000 value starts with: 4D5A

Jump to behavior

Contains functionality to inject code into remote processes

Source: C:\Users\user\AppData\Local\Temp\87B9.exe

Code function: 14_2_026F0110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,SetThreadContext,ResumeThread,ExitProcess,

14_2_026F0110

Creates a thread in another existing process (thread injection)

Source: C:\Users\user\Desktop\file.exe	Thread created: C:\Windows\explorer.exe EIP: 4611B44	Jump to behavior
Source: C:\Users\user\AppData\Roaming\erhuush	Thread created: unknown EIP: 47B1B44	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D86C.exe	Thread created: unknown EIP: 4A91A50
Source: C:\Windows\SysWOW64\rundll32.exe	Thread created: unknown EIP: 47FA0000
Source: C:\Windows\SysWOW64\rundll32.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 1B9A0000
Source: C:\Windows\SysWOW64\rundll32.exe	Thread created: C:\Windows\System32\svchost.exe EIP: B6A90000
Source: C:\Windows\SysWOW64\rundll32.exe	Thread created: unknown EIP: 4A270000
Source: C:\Windows\SysWOW64\rundll32.exe	Thread created: unknown EIP: 5F70000
Source: C:\Windows\SysWOW64\rundll32.exe	Thread created: unknown EIP: CE7A0000
Source: C:\Windows\SysWOW64\rundll32.exe	Thread created: unknown EIP: 83C80000
Source: C:\Windows\SysWOW64\rundll32.exe	Thread created: unknown EIP: F5440000
Source: C:\Windows\SysWOW64\rundll32.exe	Thread created: unknown EIP: 6CF90000
Source: C:\Windows\SysWOW64\rundll32.exe	Thread created: unknown EIP: 8C3A0000
Source: C:\Windows\SysWOW64\rundll32.exe	Thread created: unknown EIP: E8270000
Source: C:\Windows\SysWOW64\rundll32.exe	Thread created: unknown EIP: B35B0000
Source: C:\Windows\SysWOW64\rundll32.exe	Thread created: unknown EIP: 87D90000
Source: C:\Windows\SysWOW64\rundll32.exe	Thread created: unknown EIP: 85D00000
Source: C:\Windows\SysWOW64\rundll32.exe	Thread created: unknown EIP: DFBB0000
Source: C:\Windows\SysWOW64\rundll32.exe	Thread created: unknown EIP: F52B0000
Source: C:\Windows\SysWOW64\rundll32.exe	Thread created: unknown EIP: 9E9B0000
Source: C:\Windows\SysWOW64\rundll32.exe	Thread created: unknown EIP: FC5B0000
Source: C:\Windows\SysWOW64\rundll32.exe	Thread created: unknown EIP: ED760000
Source: C:\Users\user\AppData\Local\Temp\C39A.exe	Thread created: unknown EIP: 2B41A50

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 2C847FA0000
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 2F31B9A0000
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 156B6A90000
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 1F64A270000
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 25205F70000
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 22CCE7A0000
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 20983C80000
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 17AF5440000
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 2D56CF90000
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 21C8C3A0000
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 251E8270000
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 1FCB35B0000
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 19987D90000
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 17685D00000
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 27ADFBB0000
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 24FF52B0000
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 23F9E9B0000
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 1DFFC5B0000
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 29EED760000

Source: C:\Users\user\AppData\Local\Temp\87B9.exe	Process created: C:\Users\user\AppData\Local\Temp\87B9.exe C:\Users\user\AppData\Local\Temp\87B9.exe			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E9D3.exe	Process created: unknown unknown

Source: explorer.exe, 00000001.00000000.365223626.0000000000E50000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.317296713.0000000000E50000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.346592082.0000000000E50000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: EProgram Managerzx
Source: explorer.exe, 00000001.00000000.321431487.0000000005C70000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.326833001.000000000834F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.365223626.0000000000E50000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000001.00000000.365223626.0000000000E50000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.317296713.0000000000E50000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.346592082.0000000000E50000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000001.00000000.317144370.00000000009C8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.346300056.00000000009C8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.364699986.00000000009C8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Progmanath
Source: explorer.exe, 00000001.00000000.365223626.0000000000E50000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.317296713.0000000000E50000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.346592082.0000000000E50000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\87B9.exe

Code function: 14_2_00418370 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

14_2_00418370

Source: C:\Users\user\AppData\Local\Temp\E9D3.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT displayName FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected SmokeLoader

Source: Yara match	File source: 26.2.D86C.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.3.D86C.exe.b10000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 39.3.C39A.exe.940000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.D86C.exe.b00e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 39.2.C39A.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 39.2.C39A.exe.930e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001A.00000003.526622172.0000000000B10000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000002.601597228.00000000009F1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.544780175.0000000000B10000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.441430475.0000000002491000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000002.601073617.0000000000940000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.387173781.00000000009E1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.367270038.0000000004611000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.387108841.00000000009C0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.441371767.0000000002470000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000003.584704076.0000000000940000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.545012487.0000000000B31000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY

Yara detected Fabookie

Source: Yara match

File source: Process Memory Space: A024.exe PID: 3064, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\A024.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A024.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior

Remote Access Functionality

Yara detected SmokeLoader

Source: Yara match	File source: 26.2.D86C.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.3.D86C.exe.b10000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 39.3.C39A.exe.940000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.D86C.exe.b00e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 39.2.C39A.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 39.2.C39A.exe.930e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001A.00000003.526622172.0000000000B10000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000002.601597228.00000000009F1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.544780175.0000000000B10000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.441430475.0000000002491000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000002.601073617.0000000000940000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.387173781.00000000009E1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.367270038.0000000004611000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.387108841.00000000009C0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.441371767.0000000002470000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000003.584704076.0000000000940000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.545012487.0000000000B31000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY

Yara detected Fabookie

Source: Yara match

File source: Process Memory Space: A024.exe PID: 3064, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	1 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	2 Native API	Boot or Logon Initialization Scripts	612 Process Injection	1 Deobfuscate/Decode Files or Information	1 Input Capture	1 File and Directory Discovery	Remote Desktop Protocol	1 Data from Local System	Exfiltration Over Bluetooth	1 Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	2 Obfuscated Files or Information	Security Account Manager	15 System Information Discovery	SMB/Windows Admin Shares	1 Input Capture	Automated Exfiltration	1 Proxy	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	3 Command and Scripting Interpreter	Logon Script (Mac)	Logon Script (Mac)	11 Software Packing	NTDS	551 Security Software Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	141 Virtualization/Sandbox Evasion	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	1 File Deletion	Cached Domain Credentials	3 Process Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	11 Masquerading	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	141 Virtualization/Sandbox Evasion	Proc Filesystem	1 Remote System Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	612 Process Injection	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	1 Hidden Files and Directories	Network Sniffing	Process Discovery	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact
Compromise Software Dependencies and Development Tools	Windows Command Shell	Cron	Cron	1 Regsvr32	Input Capture	Permission Groups Discovery	Replication Through Removable Media	Remote Data Staging	Exfiltration Over Physical Medium	Mail Protocols			Service Stop
Compromise Software Supply Chain	Unix Shell	Launchd	Launchd	1 Rundll32	Keylogging	Local Groups	Component Object Model and Distributed COM	Screen Capture	Exfiltration over USB	DNS			Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
file.exe	41%	ReversingLabs	Win32.Ransomware.Stop
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\964B.exe	100%	Avira	HEUR/AGEN.1249525
C:\Users\user\AppData\Local\Temp\A024.exe	100%	Avira	HEUR/AGEN.1249525
C:\Users\user\AppData\Local\Temp\964B.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\D86C.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\254.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\C39A.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\erhuush	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\4A99.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\E9D3.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\bchuush	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\519F.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\87B9.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\A024.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\70E4.dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\4A99.exe	32%	ReversingLabs	Win32.Trojan.Cutwail
C:\Users\user\AppData\Local\Temp\87B9.exe	59%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\87B9.exe	81%	ReversingLabs	Win32.Ransomware.Stop
C:\Users\user\AppData\Local\Temp\964B.exe	58%	ReversingLabs	Win64.Trojan.Fabookie
C:\Users\user\AppData\Local\Temp\A024.exe	58%	ReversingLabs	Win64.Trojan.Fabookie
C:\Users\user\AppData\Local\Temp\ACE4.exe	54%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\ACE4.exe	77%	ReversingLabs	Win32.Backdoor.Manuscrypt
C:\Users\user\AppData\Local\Temp\C05F.exe	54%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\C05F.exe	77%	ReversingLabs	Win32.Backdoor.Manuscrypt

Unpacked PE Files

Source	Detection	Scanner	Label	Download
0.2.file.exe.9b0e67.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
39.3.C39A.exe.940000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
15.0.87B9.exe.400000.7.unpack	100%	Avira	HEUR/AGEN.1223627	Download File
7.3.erhuush.2470000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
15.0.87B9.exe.400000.5.unpack	100%	Avira	HEUR/AGEN.1223627	Download File
26.2.D86C.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
15.0.87B9.exe.400000.6.unpack	100%	Avira	HEUR/AGEN.1223627	Download File
7.2.erhuush.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
15.0.87B9.exe.400000.9.unpack	100%	Avira	HEUR/AGEN.1223627	Download File
0.3.file.exe.9c0000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
31.2.rundll32.exe.4d00000.0.unpack	100%	Avira	TR/ATRAPS.Gen2	Download File
15.0.87B9.exe.400000.10.unpack	100%	Avira	HEUR/AGEN.1223627	Download File
15.0.87B9.exe.400000.8.unpack	100%	Avira	HEUR/AGEN.1223627	Download File
39.2.C39A.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
26.2.D86C.exe.b00e67.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
0.2.file.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
15.2.87B9.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1223627	Download File
15.0.87B9.exe.400000.4.unpack	100%	Avira	HEUR/AGEN.1223627	Download File
39.2.C39A.exe.930e67.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
36.0.svchost.exe.2f31bfb0000.0.unpack	100%	Avira	TR/ATRAPS.Gen2	Download File
7.2.erhuush.9c0e67.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
43.0.svchost.exe.156b6b50000.0.unpack	100%	Avira	TR/ATRAPS.Gen2	Download File
26.3.D86C.exe.b10000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://gbm.hhiuew33.com/check/safe	0%	Avira URL Cloud	safe
http://www.hhiuew33.com/check/?sid=2022523&key=489967a14be7e798a418ec88203e5295XQ	0%	Avira URL Cloud	safe
http://www.hhiuew33.com/check/?sid=2015891&key=b779f07443cbe91981cfefc8943025f09-90CE-806E6F6E6963	0%	Avira URL Cloud	safe
http://www.hhiuew33.com/check/safeP	0%	Avira URL Cloud	safe
http://www.hhiuew33.com/check/?sid=2016345&key=1cb93d6dec2bc745d06457ef77da4779nal	0%	Avira URL Cloud	safe
http://www.hhiuew33.com/check/?sid=2017683&key=2ae600ecd082beb1eedd2a00077025c0	0%	Avira URL Cloud	safe
http://www.hhiuew33.com/check/?sid=2021009&key=fed594bb4f69b903f7a0afd5144b280a	0%	Avira URL Cloud	safe
http://www.hhiuew33.com/check/?sid=2023623&key=9dd0f4a37d9727289100679ff4679313	0%	Avira URL Cloud	safe
http://www.hhiuew33.com/check/?sid=2018303&key=1193b4e4de5655538ccc58c723ed2ff8al2~7	0%	Avira URL Cloud	safe
http://www.hhiuew33.com/check/?sid=2015443&key=6fbc9ea36028e7a7aef47e3f25de14479-90CE-806E6F6E6963	0%	Avira URL Cloud	safe
http://invalidlog.txtlookup	0%	Avira URL Cloud	safe
http://www.hhiuew33.com/check/?sid=2017807&key=656ed5c4260156c137520047500fcb5a	0%	Avira URL Cloud	safe
http://www.hhiuew33.com/check/?sid=2022081&key=732a544087b3e9ff829e7663084700c0l	0%	Avira URL Cloud	safe
http://acacaca.org/lancer/get.php	100%	Avira URL Cloud	malware
http://www.hhiuew33.com/check/?sid=2015891&key=b779f07443cbe91981cfefc8943025f0nal	0%	Avira URL Cloud	safe
http://www.hhiuew33.coH	0%	Avira URL Cloud	safe
http://www.hhiuew33.com/check/?sid=2015571&key=4db054c96026ef6dad1828790e5c30ce	0%	Avira URL Cloud	safe
http://www.hhiuew33.com/	100%	URL Reputation	malware
http://www.hhiuew33.com/check/?sid=2016829&key=3a7045f6ec37d43997a6260b6182f08eal	0%	Avira URL Cloud	safe
http://www.hhiuew33.com/check/?sid=2017683&key=2ae600ecd082beb1eedd2a00077025c0961782216	0%	Avira URL Cloud	safe
http://www.hhiuew33.com/check/safee	0%	Avira URL Cloud	safe
http://www.hhiuew33.com/check/?sid=2015661&key=253379595e8709edaa7459e6261ab76fE9-90CE-806E6F6E6963	0%	Avira URL Cloud	safe
http://www.hhiuew33.com/check/safea	0%	Avira URL Cloud	safe
http://www.hhiuew33.com/check/?sid=2015571&key=4db054c96026ef6dad1828790e5c30ce9-90CE-806E6F6E6963	0%	Avira URL Cloud	safe
http://www.hhiuew33.com/check/?sid=2016991&key=d06a0819802fb9b8bfa3f83cec712889nal	0%	Avira URL Cloud	safe
http://www.hhiuew33.com/check/safe	100%	Avira URL Cloud	malware
http://www.hhiuew33.com/check/?sid=2022523&key=489967a14be7e798a418ec88203e5295	0%	Avira URL Cloud	safe
http://www.hhiuew33.com/check/?sid=2019659&key=1247ed064225139f8d54ea20b7f4308dl2~7	0%	Avira URL Cloud	safe
http://www.hhiuew33.com/check/?sid=2015891&key=b779f07443cbe91981cfefc8943025f0	0%	Avira URL Cloud	safe
http://www.hhiuew33.com/check/?sid=2016991&key=d06a0819802fb9b8bfa3f83cec712889	0%	Avira URL Cloud	safe
http://www.hhiuew33.com/check/?sid=2022763&key=3ecacc048d1ccf52ee18d6088a38deba9-90CE-806E6F6E6963	0%	Avira URL Cloud	safe
http://www.hhiuew33.com/check/?sid=2017807&key=656ed5c4260156c137520047500fcb5anal2~7	0%	Avira URL Cloud	safe
http://www.hhiuew33.com/check/?sid=2015239&key=8072fcd4732872d904f5d23b03531d08	0%	Avira URL Cloud	safe
http://www.hhiuew33.com/check/?sid=2016031&key=7e1ca779d9bf4e17f6d764045bd141cf9-90CE-806E6F6E6963	0%	Avira URL Cloud	safe
http://www.hhiuew33.com/check/?sid=2017297&key=50a768fcc44c2ec36a174f09d26cbb12	0%	Avira URL Cloud	safe
http://www.hhiuew33.com/check/?sid=2019659&key=1247ed064225139f8d54ea20b7f4308dnal	0%	Avira URL Cloud	safe
http://www.hhiuew33.com/check/safeG	0%	Avira URL Cloud	safe
http://www.hhiuew33.com/check/?sid=2018477&key=54f4c00d5b523edeb0b1a231aabf7866	0%	Avira URL Cloud	safe
http://www.hhiuew33.com/check/?sid=2018035&key=6fe006e1a6ee76909784c1c112d40fa7	0%	Avira URL Cloud	safe
http://www.hhiuew33.com/check/?sid=2018981&key=44df1fe76965627ca5f86e0117faa672nal961782216	0%	Avira URL Cloud	safe
http://apcotex.com/	0%	Avira URL Cloud	safe
http://www.hhiuew33.com/check/?sid=2023623&key=9dd0f4a37d9727289100679ff46793139-90CE-806E6F6E6963	0%	Avira URL Cloud	safe
http://www.hhiuew33.com/check/?sid=2015377&key=70dd7a55c597dd230199469c3c3d32b6	0%	Avira URL Cloud	safe
http://www.hhiuew33.com/check/?sid=2022899&key=2e1c6e2a11a5fbaa14f06bb550215b6fU~	0%	Avira URL Cloud	safe
http://www.hhiuew33.com/check/?sid=2016031&key=7e1ca779d9bf4e17f6d764045bd141cfa001-6	0%	Avira URL Cloud	safe
http://www.hhiuew33.com/check/?sid=2016829&key=3a7045f6ec37d43997a6260b6182f08e	0%	Avira URL Cloud	safe
http://www.hhiuew33.com/check/?sid=2016829&key=3a7045f6ec37d43997a6260b6182f08e85-A1ED-B2838757AE1B	0%	Avira URL Cloud	safe
http://www.hhiuew33.com/check/safe&	0%	Avira URL Cloud	safe
http://www.hhiuew33.com/check/?sid=2018035&key=6fe006e1a6ee76909784c1c112d40fa7961782216	0%	Avira URL Cloud	safe
http://www.hhiuew33.com/check/safele	0%	Avira URL Cloud	safe
http://usadig.com/	0%	Avira URL Cloud	safe
http://www.hhiuew33.com/check/?sid=2022899&key=2e1c6e2a11a5fbaa14f06bb550215b6fnal	0%	Avira URL Cloud	safe
http://www.hhiuew33.com/check/?sid=2017683&key=2ae600ecd082beb1eedd2a00077025c085-A1ED-B2838757AE1B	0%	Avira URL Cloud	safe
http://www.hhiuew33.com/check/?sid=2022899&key=2e1c6e2a11a5fbaa14f06bb550215b6fl2~7	0%	Avira URL Cloud	safe
http://www.hhiuew33.com/check/?sid=2018035&key=6fe006e1a6ee76909784c1c112d40fa785-A1ED-B2838757AE1B	0%	Avira URL Cloud	safe
http://zdauctions.com/tmp/	0%	Avira URL Cloud	safe
https://blockstream.info/apihttps://sofolisk.com/api/loginvalid	100%	Avira URL Cloud	malware
https://blockchain.infoindex	0%	URL Reputation	safe
http://www.hhiuew33.com/check/?sid=2019659&key=1247ed064225139f8d54ea20b7f4308d	0%	Avira URL Cloud	safe
http://www.hhiuew33.com/check/?sid=2018035&key=6fe006e1a6ee76909784c1c112d40fa7=	0%	Avira URL Cloud	safe
http://www.avantbrowser.com)MOT-V9mm/00.62	0%	Avira URL Cloud	safe
http://www.hhiuew33.com/check/?sid=2016991&key=d06a0819802fb9b8bfa3f83cec712889nalU~	0%	Avira URL Cloud	safe
http://www.hhiuew33.com/check/?sid=2016345&key=1cb93d6dec2bc745d06457ef77da4779safe_see?~:	0%	Avira URL Cloud	safe
http://www.hhiuew33.com/check/?sid=2018981&key=44df1fe76965627ca5f86e0117faa672_see?~:	0%	Avira URL Cloud	safe
http://www.hhiuew33.com/check/?sid=2016829&key=3a7045f6ec37d43997a6260b6182f08enal	0%	Avira URL Cloud	safe
http://www.hhiuew33.com/check/?sid=2015571&key=4db054c96026ef6dad1828790e5c30ce(	0%	Avira URL Cloud	safe
http://www.hhiuew33.com/check/?sid=2016031&key=7e1ca779d9bf4e17f6d764045bd141cf	0%	Avira URL Cloud	safe
http://www.hhiuew33.com/check/?sid=2018303&key=1193b4e4de5655538ccc58c723ed2ff8_see?~:	0%	Avira URL Cloud	safe
http://www.hhiuew33.com/check/?sid=2015377&key=70dd7a55c597dd230199469c3c3d32b69-90CE-806E6F6E6963	0%	Avira URL Cloud	safe
http://www.hhiuew33.com/check/?sid=2015571&key=4db054c96026ef6dad1828790e5c30ce:	0%	Avira URL Cloud	safe
http://www.hhiuew33.com/check/?sid=2022081&key=732a544087b3e9ff829e7663084700c0	0%	Avira URL Cloud	safe
http://pro-fa.com/	0%	Avira URL Cloud	safe
http://www.hhiuew33.coww.hhiuew33.com/check/?sid=2016345&key=1cb93d6dec2bc745d06457ef77da4779	0%	Avira URL Cloud	safe
http://www.hhiuew33.com/check/?sid=2016031&key=7e1ca779d9bf4e17f6d764045bd141cfl2~7	0%	Avira URL Cloud	safe
http://www.hhiuew33.com/check/?sid=2018303&key=1193b4e4de5655538ccc58c723ed2ff8	0%	Avira URL Cloud	safe
http://www.hhiuew33.com/check/?sid=2022081&key=732a544087b3e9ff829e7663084700c0_see?~:	0%	Avira URL Cloud	safe
http://www.hhiuew33.coww.hhiuew33.com/	0%	Avira URL Cloud	safe
http://www.hhiuew33.com/check/safeown	0%	Avira URL Cloud	safe
http://devlog.gregarius.net/docs/ua)Links	0%	URL Reputation	safe
http://www.hhiuew33.com/check/?sid=2021009&key=fed594bb4f69b903f7a0afd5144b280aal	0%	Avira URL Cloud	safe
http://https://ns1.kriston.ugns2.chalekin.ugns3.unalelath.ugns4.andromath.ug/Error	0%	Avira URL Cloud	safe
http://www.hhiuew33.com/check/?sid=2018981&key=44df1fe76965627ca5f86e0117faa672l(~	0%	Avira URL Cloud	safe
http://www.hhiuew33.com/check/?sid=2022763&key=3ecacc048d1ccf52ee18d6088a38debanalU~	0%	Avira URL Cloud	safe
http://www.hhiuew33.com/check/?sid=2016031&key=7e1ca779d9bf4e17f6d764045bd141cfnalU~	0%	Avira URL Cloud	safe
http://www.hhiuew33.com/check/?sid=2017297&key=50a768fcc44c2ec36a174f09d26cbb12nal	0%	Avira URL Cloud	safe
http://www.hhiuew33.com/check/?sid=2016991&key=d06a0819802fb9b8bfa3f83cec71288985-A1ED-B2838757AE1B	0%	Avira URL Cloud	safe
http://www.hhiuew33.com/check/?sid=2022081&key=732a544087b3e9ff829e7663084700c0al961782216	0%	Avira URL Cloud	safe
http://www.hhiuew33.com/check/?sid=2022081&key=732a544087b3e9ff829e7663084700c09-90CE-806E6F6E6963	0%	Avira URL Cloud	safe
http://www.hhiuew33.com/check/?sid=2018981&key=44df1fe76965627ca5f86e0117faa672	0%	Avira URL Cloud	safe
http://www.hhiuew33.com/check/?sid=2022523&key=489967a14be7e798a418ec88203e5295961782216	0%	Avira URL Cloud	safe
http://www.hhiuew33.com/check/?sid=2016991&key=d06a0819802fb9b8bfa3f83cec712889al	0%	Avira URL Cloud	safe
http://www.hhiuew33.com/check/?sid=2022899&key=2e1c6e2a11a5fbaa14f06bb550215b6f961782216	0%	Avira URL Cloud	safe
http://www.hhiuew33.com/check/safeEKYn49oSDm	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

⊘No contacted domains info

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://acacaca.org/lancer/get.php	true	Avira URL Cloud: malware	unknown
http://zdauctions.com/tmp/	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://gbm.hhiuew33.com/check/safe	A024.exe, 00000011.00000003.875583192.00000000005FC000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.881509308.00000000005FC000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.882065466.00000000005FC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.hhiuew33.com/check/?sid=2022523&key=489967a14be7e798a418ec88203e5295XQ	A024.exe, 00000011.00000003.874060381.00000000005D5000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.hhiuew33.com/check/?sid=2015891&key=b779f07443cbe91981cfefc8943025f09-90CE-806E6F6E6963	A024.exe, 00000011.00000003.545244186.00000000005D4000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.544526983.00000000005CA000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.hhiuew33.com/check/safeP	A024.exe, 00000011.00000003.527158732.0000000000606000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.517537044.00000000005A6000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.615057053.00000000005A6000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.612816385.00000000005A6000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.608953979.00000000005A6000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.hhiuew33.com/check/?sid=2016345&key=1cb93d6dec2bc745d06457ef77da4779nal	A024.exe, 00000011.00000003.568208161.0000000000606000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.570943693.0000000000608000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.571506563.0000000000609000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.hhiuew33.com/check/?sid=2017683&key=2ae600ecd082beb1eedd2a00077025c0	A024.exe, 00000011.00000003.625014209.0000000000604000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.hhiuew33.com/check/?sid=2021009&key=fed594bb4f69b903f7a0afd5144b280a	A024.exe, 00000011.00000003.808584855.0000000000607000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.hhiuew33.com/check/?sid=2023623&key=9dd0f4a37d9727289100679ff4679313	A024.exe, 00000011.00000003.921541921.000000000060D000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.hhiuew33.com/check/?sid=2018303&key=1193b4e4de5655538ccc58c723ed2ff8al2~7	A024.exe, 00000011.00000003.662594874.0000000000607000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.hhiuew33.com/check/?sid=2015443&key=6fbc9ea36028e7a7aef47e3f25de14479-90CE-806E6F6E6963	A024.exe, 00000011.00000003.523460921.0000000000615000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.526919336.0000000000628000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.520500191.0000000000628000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.524368517.0000000000615000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.524413971.0000000000619000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.526287413.0000000000628000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.524817915.0000000000628000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://invalidlog.txtlookup	E9D3.exe, 0000001B.00000003.552567063.0000000003860000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.hhiuew33.com/check/?sid=2017807&key=656ed5c4260156c137520047500fcb5a	A024.exe, 00000011.00000003.704521200.0000000000615000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.667878458.0000000000615000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.685584153.0000000000615000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.660801597.0000000000615000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.715848614.0000000000615000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.722927599.0000000000615000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.635485775.0000000000615000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.678649642.0000000000615000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.643595978.0000000000615000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.673144821.0000000000615000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.649938670.0000000000615000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.662725732.0000000000615000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.632680017.00000000005FC000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.630275020.00000000005FC000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.701495973.0000000000615000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.639684625.0000000000615000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.651676419.0000000000615000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.633527727.0000000000615000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.723828395.0000000000615000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.719104693.0000000000615000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.687471126.0000000000615000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.hhiuew33.com/check/?sid=2022081&key=732a544087b3e9ff829e7663084700c0l	A024.exe, 00000011.00000003.861375673.000000000060A000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.hhiuew33.com/check/?sid=2015891&key=b779f07443cbe91981cfefc8943025f0nal	A024.exe, 00000011.00000003.545533996.000000000060D000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.545927414.000000000060D000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.hhiuew33.coH	A024.exe, 00000011.00000003.517949411.00000000005FC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.hhiuew33.com/check/?sid=2015571&key=4db054c96026ef6dad1828790e5c30ce	A024.exe, 00000011.00000003.527158732.0000000000606000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.hhiuew33.com/	A024.exe, 00000011.00000003.547616617.0000000000606000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.924299314.00000000005FC000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.925282553.00000000005FC000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.546820577.0000000000606000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.917214347.00000000005FC000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.548588817.0000000000606000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.888609376.00000000005FC000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.906851773.00000000005FC000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.545474727.0000000000606000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.924357065.00000000005CA000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.915984441.00000000005FC000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.922262527.00000000005FC000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.546061583.0000000000606000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.886216752.00000000005FC000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://www.hhiuew33.com/check/?sid=2016829&key=3a7045f6ec37d43997a6260b6182f08eal	A024.exe, 00000011.00000003.587651978.000000000060A000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.hhiuew33.com/check/?sid=2017683&key=2ae600ecd082beb1eedd2a00077025c0961782216	A024.exe, 00000011.00000003.627283501.00000000005FC000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.hhiuew33.com/check/safee	A024.exe, 00000011.00000003.728847971.00000000005A6000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.hhiuew33.com/check/?sid=2015661&key=253379595e8709edaa7459e6261ab76fE9-90CE-806E6F6E6963	A024.exe, 00000011.00000003.532604795.00000000005D0000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.533629250.00000000005CB000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.543036109.00000000005D0000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.542736341.00000000005D0000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.hhiuew33.com/check/safea	A024.exe, 00000011.00000003.622282517.00000000005BD000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.612951482.00000000005BD000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.615628201.00000000005BD000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.hhiuew33.com/check/?sid=2015571&key=4db054c96026ef6dad1828790e5c30ce9-90CE-806E6F6E6963	A024.exe, 00000011.00000003.526919336.0000000000628000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.526287413.0000000000628000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.hhiuew33.com/check/?sid=2016991&key=d06a0819802fb9b8bfa3f83cec712889nal	A024.exe, 00000011.00000003.598496754.0000000000605000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.597481454.00000000005FC000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.hhiuew33.com/check/safe	A024.exe, 00000011.00000003.587954388.00000000005A8000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.524886511.00000000005A6000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.608953979.00000000005A6000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.917555901.000000000063A000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.508626394.00000000005AA000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.919462666.0000000000639000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.627283501.00000000005FC000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.845942642.00000000005D6000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.507033348.00000000005BD000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://www.hhiuew33.com/check/?sid=2022523&key=489967a14be7e798a418ec88203e5295	A024.exe, 00000011.00000003.876584578.000000000060D000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.hhiuew33.com/check/?sid=2019659&key=1247ed064225139f8d54ea20b7f4308dl2~7	A024.exe, 00000011.00000003.728175494.00000000005FC000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.hhiuew33.com/check/?sid=2015891&key=b779f07443cbe91981cfefc8943025f0	A024.exe, 00000011.00000003.545927414.000000000060D000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.544149773.000000000060D000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.hhiuew33.com/check/?sid=2016991&key=d06a0819802fb9b8bfa3f83cec712889	A024.exe, 00000011.00000003.598496754.0000000000605000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.597481454.00000000005FC000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.598830142.00000000005A9000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.hhiuew33.com/check/?sid=2022763&key=3ecacc048d1ccf52ee18d6088a38deba9-90CE-806E6F6E6963	A024.exe, 00000011.00000003.885741788.00000000005D7000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.889359323.00000000005D7000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.hhiuew33.com/check/?sid=2017807&key=656ed5c4260156c137520047500fcb5anal2~7	A024.exe, 00000011.00000003.630275020.00000000005FC000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.hhiuew33.com/check/?sid=2015239&key=8072fcd4732872d904f5d23b03531d08	A024.exe, 00000011.00000003.509503649.00000000005A9000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.508626394.00000000005AA000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.hhiuew33.com/check/?sid=2016031&key=7e1ca779d9bf4e17f6d764045bd141cf9-90CE-806E6F6E6963	A024.exe, 00000011.00000003.574706830.00000000005E4000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.583968460.00000000005E4000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.559657315.00000000005CF000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.577092251.00000000005E4000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.559976733.00000000005E3000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.561248557.00000000005E4000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.564250091.00000000005E4000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.558452855.00000000005CE000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.hhiuew33.com/check/?sid=2017297&key=50a768fcc44c2ec36a174f09d26cbb12	A024.exe, 00000011.00000003.622282517.00000000005BD000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.613334781.000000000060D000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.622558054.0000000000615000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.622537055.000000000060B000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.613761354.000000000060D000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.612951482.00000000005BD000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.621642097.00000000005FC000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.615628201.00000000005BD000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.hhiuew33.com/check/?sid=2019659&key=1247ed064225139f8d54ea20b7f4308dnal	A024.exe, 00000011.00000003.728175494.00000000005FC000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.hhiuew33.com/check/safeG	A024.exe, 00000011.00000003.544493765.0000000000628000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.544055476.0000000000627000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.hhiuew33.com/check/?sid=2018477&key=54f4c00d5b523edeb0b1a231aabf7866	A024.exe, 00000011.00000003.671761218.00000000005E3000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.666899275.0000000000607000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.hhiuew33.com/check/?sid=2018035&key=6fe006e1a6ee76909784c1c112d40fa7	A024.exe, 00000011.00000003.650371810.0000000000605000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.649505481.0000000000602000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.641826184.00000000005FC000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.650989626.00000000005E9000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.643110136.0000000000605000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.652530312.00000000005E1000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.hhiuew33.com/check/?sid=2018981&key=44df1fe76965627ca5f86e0117faa672nal961782216	A024.exe, 00000011.00000003.704285105.0000000000607000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://apcotex.com/	A024.exe, 00000011.00000003.924299314.00000000005FC000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.925282553.00000000005FC000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.917214347.00000000005FC000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.906851773.00000000005FC000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.915984441.00000000005FC000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.922262527.00000000005FC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.hhiuew33.com/check/?sid=2023623&key=9dd0f4a37d9727289100679ff46793139-90CE-806E6F6E6963	A024.exe, 00000011.00000003.923816270.000000000063A000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.925921836.000000000063A000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.919462666.0000000000639000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.hhiuew33.com/check/?sid=2015377&key=70dd7a55c597dd230199469c3c3d32b6	A024.exe, 00000011.00000003.517537044.00000000005A6000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.hhiuew33.com/check/?sid=2022899&key=2e1c6e2a11a5fbaa14f06bb550215b6fU~	A024.exe, 00000011.00000003.895949373.000000000060A000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.902751656.000000000060B000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://api.2ip.ua/j	87B9.exe, 0000000F.00000002.505580671.00000000007E1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.baidu.com/search/spider.htm)MobileSafari/600.1.4	E9D3.exe, 0000001B.00000003.552567063.0000000003860000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.hhiuew33.com/check/?sid=2016031&key=7e1ca779d9bf4e17f6d764045bd141cfa001-6	A024.exe, 00000011.00000003.552783679.000000000060A000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.hhiuew33.com/check/?sid=2016829&key=3a7045f6ec37d43997a6260b6182f08e	A024.exe, 00000011.00000003.589560082.0000000000607000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.594896934.000000000060D000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.594939303.0000000000615000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.589735478.0000000000615000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.hhiuew33.com/check/?sid=2016829&key=3a7045f6ec37d43997a6260b6182f08e85-A1ED-B2838757AE1B	A024.exe, 00000011.00000003.591381087.00000000005C8000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.588363720.00000000005C8000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.593992131.00000000005C8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.hhiuew33.com/check/safe&	A024.exe, 00000011.00000003.506991069.00000000005AB000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.508315763.00000000005A9000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://api.2ip.ua/geo.jsond	87B9.exe, 0000000F.00000002.505793782.0000000000813000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.hhiuew33.com/check/?sid=2018035&key=6fe006e1a6ee76909784c1c112d40fa7961782216	A024.exe, 00000011.00000003.650371810.0000000000605000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.649505481.0000000000602000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.641826184.00000000005FC000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.643110136.0000000000605000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.hhiuew33.com/check/safele	A024.exe, 00000011.00000003.507033348.00000000005BD000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://usadig.com/	A024.exe, 00000011.00000003.924357065.00000000005CA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.hhiuew33.com/check/?sid=2022899&key=2e1c6e2a11a5fbaa14f06bb550215b6fnal	A024.exe, 00000011.00000003.895949373.000000000060A000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.hhiuew33.com/check/?sid=2017683&key=2ae600ecd082beb1eedd2a00077025c085-A1ED-B2838757AE1B	A024.exe, 00000011.00000003.625297785.00000000005BD000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.hhiuew33.com/check/?sid=2022899&key=2e1c6e2a11a5fbaa14f06bb550215b6fl2~7	A024.exe, 00000011.00000003.895949373.000000000060A000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.hhiuew33.com/check/?sid=2018035&key=6fe006e1a6ee76909784c1c112d40fa785-A1ED-B2838757AE1B	A024.exe, 00000011.00000003.643638138.00000000005CA000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://blockstream.info/apihttps://sofolisk.com/api/loginvalid	E9D3.exe, 0000001B.00000003.552567063.0000000003860000.00000004.00001000.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://blockchain.infoindex	E9D3.exe, 0000001B.00000003.552567063.0000000003860000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.hhiuew33.com/check/?sid=2019659&key=1247ed064225139f8d54ea20b7f4308d	A024.exe, 00000011.00000003.728847971.00000000005A6000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.745415146.00000000005A8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.hhiuew33.com/check/?sid=2018035&key=6fe006e1a6ee76909784c1c112d40fa7=	A024.exe, 00000011.00000003.650371810.0000000000605000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.651580919.0000000000608000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.649505481.0000000000602000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.641826184.00000000005FC000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.643110136.0000000000605000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.avantbrowser.com)MOT-V9mm/00.62	E9D3.exe, 0000001B.00000003.552567063.0000000003860000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://www.hhiuew33.com/check/?sid=2016991&key=d06a0819802fb9b8bfa3f83cec712889nalU~	A024.exe, 00000011.00000003.598496754.0000000000605000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.597481454.00000000005FC000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://search.msn.com/msnbot.htm)pkcs7:	E9D3.exe, 0000001B.00000003.552567063.0000000003860000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.hhiuew33.com/check/?sid=2016345&key=1cb93d6dec2bc745d06457ef77da4779safe_see?~:	A024.exe, 00000011.00000003.568208161.0000000000606000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.570943693.0000000000608000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.571506563.0000000000609000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.hhiuew33.com/check/?sid=2018981&key=44df1fe76965627ca5f86e0117faa672_see?~:	A024.exe, 00000011.00000003.704285105.0000000000607000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.692188238.00000000005FD000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.hhiuew33.com/check/?sid=2016829&key=3a7045f6ec37d43997a6260b6182f08enal	A024.exe, 00000011.00000003.587651978.000000000060A000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.hhiuew33.com/check/?sid=2015571&key=4db054c96026ef6dad1828790e5c30ce(	A024.exe, 00000011.00000003.527158732.0000000000606000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.hhiuew33.com/check/?sid=2016031&key=7e1ca779d9bf4e17f6d764045bd141cf	A024.exe, 00000011.00000003.554398119.0000000000615000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.557376459.0000000000615000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.557673507.0000000000608000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.550845431.0000000000607000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.554435845.000000000060A000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.551602096.0000000000608000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.552783679.000000000060A000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.556736628.00000000005FF000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.hhiuew33.com/check/?sid=2018303&key=1193b4e4de5655538ccc58c723ed2ff8_see?~:	A024.exe, 00000011.00000003.660658555.0000000000607000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.hhiuew33.com/check/?sid=2015377&key=70dd7a55c597dd230199469c3c3d32b69-90CE-806E6F6E6963	A024.exe, 00000011.00000003.516669178.0000000000608000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.517476053.0000000000608000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.518341797.000000000060C000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.518053404.0000000000607000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.hhiuew33.com/check/?sid=2015571&key=4db054c96026ef6dad1828790e5c30ce:	A024.exe, 00000011.00000003.527158732.0000000000606000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.hhiuew33.com/check/?sid=2022081&key=732a544087b3e9ff829e7663084700c0	A024.exe, 00000011.00000003.857712036.00000000005FC000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.861375673.000000000060A000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://pro-fa.com/	A024.exe, 00000011.00000003.888609376.00000000005FC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.hhiuew33.coww.hhiuew33.com/check/?sid=2016345&key=1cb93d6dec2bc745d06457ef77da4779	A024.exe, 00000011.00000003.581709317.0000000002730000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.hhiuew33.com/check/?sid=2016031&key=7e1ca779d9bf4e17f6d764045bd141cfl2~7	A024.exe, 00000011.00000003.554435845.000000000060A000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.hhiuew33.com/check/?sid=2018303&key=1193b4e4de5655538ccc58c723ed2ff8	A024.exe, 00000011.00000003.663381798.00000000005E1000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.hhiuew33.com/check/?sid=2022081&key=732a544087b3e9ff829e7663084700c0_see?~:	A024.exe, 00000011.00000003.857712036.00000000005FC000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.861375673.000000000060A000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.hhiuew33.coww.hhiuew33.com/	A024.exe, 00000011.00000003.581737900.0000000002733000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.hhiuew33.com/check/safeown	A024.exe, 00000011.00000003.508375288.00000000005BD000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.507033348.00000000005BD000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.openssl.org/support/faq.html	87B9.exe, 0000000F.00000000.488104570.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false		high
http://devlog.gregarius.net/docs/ua)Links	E9D3.exe, 0000001B.00000003.552567063.0000000003860000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.hhiuew33.com/check/?sid=2021009&key=fed594bb4f69b903f7a0afd5144b280aal	A024.exe, 00000011.00000003.808584855.0000000000607000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.836509333.0000000000605000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://https://ns1.kriston.ugns2.chalekin.ugns3.unalelath.ugns4.andromath.ug/Error	87B9.exe, 0000000E.00000002.495843293.00000000026F0000.00000040.00001000.00020000.00000000.sdmp, 87B9.exe, 0000000F.00000000.490507253.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 87B9.exe, 0000000F.00000002.503363757.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 87B9.exe, 0000000F.00000000.488104570.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://www.hhiuew33.com/check/?sid=2018981&key=44df1fe76965627ca5f86e0117faa672l(~	A024.exe, 00000011.00000003.692188238.00000000005FD000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.hhiuew33.com/check/?sid=2022763&key=3ecacc048d1ccf52ee18d6088a38debanalU~	A024.exe, 00000011.00000003.886216752.00000000005FC000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.hhiuew33.com/check/?sid=2016031&key=7e1ca779d9bf4e17f6d764045bd141cfnalU~	A024.exe, 00000011.00000003.554435845.000000000060A000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.552783679.000000000060A000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.hhiuew33.com/check/?sid=2017297&key=50a768fcc44c2ec36a174f09d26cbb12nal	A024.exe, 00000011.00000003.613334781.000000000060D000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.612508450.000000000060D000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.613761354.000000000060D000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://api.2ip.ua/geo.jsont	87B9.exe, 0000000F.00000002.505793782.0000000000813000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.hhiuew33.com/check/?sid=2016991&key=d06a0819802fb9b8bfa3f83cec71288985-A1ED-B2838757AE1B	A024.exe, 00000011.00000003.599358977.00000000005BD000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.609649183.00000000005BD000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.605981971.00000000005BD000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.602536365.00000000005BD000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://turnitin.com/robot/crawlerinfo.html)gentraceback	E9D3.exe, 0000001B.00000003.552567063.0000000003860000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.hhiuew33.com/check/?sid=2022081&key=732a544087b3e9ff829e7663084700c0al961782216	A024.exe, 00000011.00000003.857712036.00000000005FC000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.861375673.000000000060A000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.hhiuew33.com/check/?sid=2022081&key=732a544087b3e9ff829e7663084700c09-90CE-806E6F6E6963	A024.exe, 00000011.00000003.865979392.00000000005FC000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.867253468.000000000060F000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.857712036.00000000005FC000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.861375673.000000000060A000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.866853290.000000000060C000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.hhiuew33.com/check/?sid=2018981&key=44df1fe76965627ca5f86e0117faa672	A024.exe, 00000011.00000003.727725399.00000000005D7000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.748899296.00000000005D8000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.720945359.00000000005D0000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.716149610.000000000063C000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.702826706.000000000063C000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.730565018.00000000005D7000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.719463404.000000000063C000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.723724601.00000000005D4000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.712109883.00000000005CD000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.707156985.00000000005DC000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.719569853.00000000005D0000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.704285105.0000000000607000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.692188238.00000000005FD000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.692141628.000000000063C000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.hhiuew33.com/check/?sid=2022523&key=489967a14be7e798a418ec88203e5295961782216	A024.exe, 00000011.00000003.876584578.000000000060D000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.hhiuew33.com/check/?sid=2016991&key=d06a0819802fb9b8bfa3f83cec712889al	A024.exe, 00000011.00000003.598496754.0000000000605000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.597481454.00000000005FC000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.hhiuew33.com/check/?sid=2022899&key=2e1c6e2a11a5fbaa14f06bb550215b6f961782216	A024.exe, 00000011.00000003.895949373.000000000060A000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.hhiuew33.com/check/safeEKYn49oSDm	A024.exe, 00000011.00000003.531837026.0000000000627000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.532518816.0000000000627000.00000004.00000020.00020000.00000000.sdmp, A024.exe, 00000011.00000003.534285456.0000000000615000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
85.209.157.230	unknown	Netherlands	18978	ENZUINC-US	false
185.237.206.60	unknown	Ukraine	21100	ITLDC-NLUA	false
8.8.8.8	unknown	United States	15169	GOOGLEUS	false
104.21.1.91	unknown	United States	13335	CLOUDFLARENETUS	false
210.182.29.70	unknown	Korea Republic of	3786	LGDACOMLGDACOMCorporationKR	false
162.0.217.254	unknown	Canada	35893	ACPCA	false
20.82.154.241	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
91.227.16.12	unknown	Russian Federation	207027	EXIMIUS-ASRU	false
175.120.254.9	unknown	Korea Republic of	9318	SKB-ASSKBroadbandCoLtdKR	false
115.88.24.202	unknown	Korea Republic of	3786	LGDACOMLGDACOMCorporationKR	false
189.156.116.190	unknown	Mexico	8151	UninetSAdeCVMX	false
104.21.86.228	unknown	United States	13335	CLOUDFLARENETUS	false
196.200.111.5	unknown	Eritrea	30987	ERITEL-ASER	false
104.21.40.196	unknown	United States	13335	CLOUDFLARENETUS	false
208.95.112.1	unknown	United States	53334	TUT-ASUS	false
46.194.108.30	unknown	Sweden	2119	TELENOR-NEXTELTelenorNorgeASNO	false
20.82.228.9	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
188.114.97.3	unknown	European Union	13335	CLOUDFLARENETUS	false
172.67.188.70	unknown	United States	13335	CLOUDFLARENETUS	false
5.204.145.65	unknown	Hungary	8448	PGSM-HUTorokbalintHungaryHU	false
206.221.182.74	unknown	United States	23470	RELIABLESITEUS	false
222.232.238.243	unknown	Korea Republic of	9318	SKB-ASSKBroadbandCoLtdKR	false
45.136.151.102	unknown	Latvia	18978	ENZUINC-US	false
104.21.14.22	unknown	United States	13335	CLOUDFLARENETUS	false
151.251.24.5	unknown	Bulgaria	13124	IBGCBG	false
188.48.64.249	unknown	Saudi Arabia	25019	SAUDINETSTC-ASSA	false

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	35.0.0 Citrine
Analysis ID:	694011
Start date and time:	2022-08-31 12:52:58 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 14m 45s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	file.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	46
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	4
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.rans.troj.spyw.evad.winEXE@48/21@0/27
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 10.1% (good quality ratio 7.2%) Quality average: 44.8% Quality standard deviation: 37.2%
HCA Information:	Successful, ratio: 85% Number of executed functions: 47 Number of non-executed functions: 99
Cookbook Comments:	Found application associated with file extension: .exe Adjust boot time Enable AMSI Override analysis time to 240s for rundll32

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, Conhost.exe, dllhost.exe, audiodg.exe, BackgroundTransferHost.exe, consent.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
12:54:45	Task Scheduler	Run new task: Firefox Default Browser Agent 57A696630F5C4D61 path: C:\Users\user\AppData\Roaming\erhuush
12:55:26	API Interceptor	25x Sleep call for process: A024.exe modified
12:55:38	API Interceptor	4x Sleep call for process: C05F.exe modified
12:56:02	API Interceptor	4x Sleep call for process: svchost.exe modified
12:56:03	API Interceptor	1x Sleep call for process: dllhost.exe modified
12:56:12	Task Scheduler	Run new task: Firefox Default Browser Agent C1918AB4B2B16CD7 path: C:\Users\user\AppData\Roaming\bchuush
12:56:31	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run csrss "C:\Windows\rss\csrss.exe"
12:56:35	Task Scheduler	Run new task: csrss path: C:\Windows\rss\csrss.exe
12:56:42	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run csrss "C:\Windows\rss\csrss.exe"
12:57:17	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run tibqanobatib C:\Users\user\tibqanobatib.exe
12:57:28	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Regedit32 C:\Windows\system32\regedit.exe
12:57:40	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run tibqanobatib C:\Users\user\tibqanobatib.exe
12:57:56	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Regedit32 C:\Windows\system32\regedit.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
85.209.157.230	file.exe	Get hash	malicious	Browse	stylesheet.faseaegasdfase.com/hp8/g1/rtst1051.exe
	file.exe	Get hash	malicious	Browse	stylesheet.faseaegasdfase.com/hp8/g1/rtst1051.exe
	file.exe	Get hash	malicious	Browse	stylesheet.faseaegasdfase.com/hp8/g1/rtst1051.exe
	file.exe	Get hash	malicious	Browse	stylesheet.faseaegasdfase.com/hp8/g1/rtst1051.exe
	file.exe	Get hash	malicious	Browse	stylesheet.faseaegasdfase.com/hp8/g1/rtst1051.exe
	file.exe	Get hash	malicious	Browse	stylesheet.faseaegasdfase.com/hp8/g1/rtst1051.exe
	file.exe	Get hash	malicious	Browse	stylesheet.faseaegasdfase.com/hp8/g1/rtst1051.exe
	file.exe	Get hash	malicious	Browse	stylesheet.faseaegasdfase.com/hp8/g1/rtst1051.exe
	file.exe	Get hash	malicious	Browse	stylesheet.faseaegasdfase.com/hp8/g1/rtst1051.exe
	file.exe	Get hash	malicious	Browse	stylesheet.faseaegasdfase.com/hp8/g1/rtst1051.exe
	file.exe	Get hash	malicious	Browse	stylesheet.faseaegasdfase.com/hp8/g1/rtst1051.exe
	file.exe	Get hash	malicious	Browse	stylesheet.faseaegasdfase.com/hp8/g1/rtst1051.exe
	file.exe	Get hash	malicious	Browse	stylesheet.faseaegasdfase.com/hp8/g1/rtst1051.exe
	file.exe	Get hash	malicious	Browse	stylesheet.faseaegasdfase.com/hp8/g1/rtst1083.exe
	wu2Z96cOb9.exe	Get hash	malicious	Browse	stylesheet.faseaegasdfase.com/hp8/g1/rtst1083.exe
	GFXTXvWhyQ.exe	Get hash	malicious	Browse	stylesheet.faseaegasdfase.com/hp8/g1/rtst1083.exe
	p23HEjyysu.exe	Get hash	malicious	Browse	stylesheet.faseaegasdfase.com/hp8/g1/rtst1083.exe
	NJUODEI1fC.exe	Get hash	malicious	Browse	stylesheet.faseaegasdfase.com/hp8/g1/rtst1083.exe
	M61ridRaIr.exe	Get hash	malicious	Browse	stylesheet.faseaegasdfase.com/hp8/g1/rtst1083.exe
	Ikd3EuXME8.exe	Get hash	malicious	Browse	stylesheet.faseaegasdfase.com/hp8/g1/rtst1083.exe

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
ENZUINC-US	file.exe	Get hash	malicious	Browse	45.136.151.102
	file.exe	Get hash	malicious	Browse	45.136.151.102
	file.exe	Get hash	malicious	Browse	45.136.151.102
	CBBsLdgEAZ.elf	Get hash	malicious	Browse	23.245.1.238
	file.exe	Get hash	malicious	Browse	85.209.157.230
	file.exe	Get hash	malicious	Browse	85.209.157.230
	file.exe	Get hash	malicious	Browse	85.209.157.230
	file.exe	Get hash	malicious	Browse	85.209.157.230
	file.exe	Get hash	malicious	Browse	85.209.157.230
	file.exe	Get hash	malicious	Browse	85.209.157.230
	file.exe	Get hash	malicious	Browse	45.136.151.102
	file.exe	Get hash	malicious	Browse	45.136.151.102
	SecuriteInfo.com.Suspicious.Win32.Save.a.22935.12419.exe	Get hash	malicious	Browse	45.136.151.102
	file.exe	Get hash	malicious	Browse	45.136.151.102
	file.exe	Get hash	malicious	Browse	85.209.157.230
	https://tamilblasters.casa/	Get hash	malicious	Browse	23.88.0.234
	file.exe	Get hash	malicious	Browse	45.136.151.102
	file.exe	Get hash	malicious	Browse	45.136.151.102
	file.exe	Get hash	malicious	Browse	85.209.157.230
	file.exe	Get hash	malicious	Browse	45.136.151.102
ITLDC-NLUA	file.exe	Get hash	malicious	Browse	185.237.206.60
	file.exe	Get hash	malicious	Browse	185.237.206.60
	file.exe	Get hash	malicious	Browse	185.237.206.60
	file.exe	Get hash	malicious	Browse	185.237.206.60
	file.exe	Get hash	malicious	Browse	185.237.206.60
	file.exe	Get hash	malicious	Browse	185.237.206.60
	file.exe	Get hash	malicious	Browse	185.237.206.60
	file.exe	Get hash	malicious	Browse	185.237.206.60
	file.exe	Get hash	malicious	Browse	185.237.206.60
	file.exe	Get hash	malicious	Browse	185.237.206.60
	file.exe	Get hash	malicious	Browse	185.237.206.60
	file.exe	Get hash	malicious	Browse	185.237.206.60
	file.exe	Get hash	malicious	Browse	185.237.206.60
	file.exe	Get hash	malicious	Browse	185.237.206.60
	file.exe	Get hash	malicious	Browse	185.237.206.60
	file.exe	Get hash	malicious	Browse	185.237.206.60
	file.exe	Get hash	malicious	Browse	185.237.206.60
	file.exe	Get hash	malicious	Browse	185.237.206.60
	file.exe	Get hash	malicious	Browse	185.237.206.60
	file.exe	Get hash	malicious	Browse	185.237.206.60

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link
C:\Users\user\AppData\Local\Temp\87B9.exe	file.exe	Get hash	malicious	Browse
C:\Users\user\AppData\Local\Temp\87B9.exe	file.exe	Get hash	malicious	Browse
C:\Users\user\AppData\Local\Temp\4A99.exe	file.exe	Get hash	malicious	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\geo[1].json

Download File

Process:	C:\Users\user\AppData\Local\Temp\87B9.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	500
Entropy (8bit):	4.506396506853555
Encrypted:	false
SSDEEP:	12:YZIW67kt/QVFRbIm/QVAY9QVFRHQVFRRaZRQVFRQQVFRUm62jOH4:YrFQVFRbI0QVAY9QVFRHQVFRGRQVFRQ+
MD5:	5A28E5DBBA508DE227FFA80021CAEC1C
SHA1:	317C8045C34B60034850C1A0FF0BEF53F4BC4E09
SHA-256:	E8457A2D4838AF8EFE1FA83FC689A55D25992A101616733CA26171AEA5B8D0AB
SHA-512:	EA3283645E38EB004D49B3ADCECE8E7A7C8A00044CA536FB6170C469838A31D96ED204470E66EF48E6FE3C0DD48B1D09BE163415E063695D113EAAE1380C11F1
Malicious:	false
Preview:	{"ip":"102.129.143.57","country_code":"CH","country":"Switzerland","country_rus":"\u0428\u0432\u0435\u0439\u0446\u0430\u0440\u0438\u044f","country_ua":"\u0428\u0432\u0435\u0439\u0446\u0430\u0440\u0456\u044f","region":"Zurich","region_rus":"\u0426\u044e\u0440\u0438\u0445","region_ua":"\u0426\u044e\u0440\u0438\u0445","city":"Zurich","city_rus":"\u0426\u044e\u0440\u0438\u0445","city_ua":"\u0426\u044e\u0440\u0438\u0445","latitude":"47.36667","longitude":"8.55","zip_code":"8099","time_zone":"+02:00"}

C:\Users\user\AppData\Local\Temp\254.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	634368
Entropy (8bit):	7.488233708412827
Encrypted:	false
SSDEEP:	12288:UtQGowt81HWeMtebAESjb3bNrjY7wkJRKiHhr6G8nMURe+y:+nKHwt4NU2HhrV8MUy
MD5:	0B0D2F57CAC71D113C2B65A16E252CF7
SHA1:	547E251995AEBD577C51E8680B01F1302D2A202C
SHA-256:	D24D27209363F5A42C1BA673B5E73EC6DB1620E6CC3430ADA0F630EB7C95E718
SHA-512:	4662B6BF8511E63F10D6B121F0C7B1F27F747E25DFF32931D25EA564529E4678B35FBAB3F43E1DED178E536DA7659D3A3AD02C5CA17564F6C929D303A67DCB9B
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........IE...E...E...[.u.R...[.c....bE..B...E......[.d.x...[.t.D...[.q.D...RichE...........................PE..L....]n`......................G..............0....@...........................I.............................................d...P.....I.@Q..............................................................@............................................text............................... ..`.data....OF..0...D..................@....rsrc...@Q....I..R...\..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\4A99.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	305664
Entropy (8bit):	6.490009058493718
Encrypted:	false
SSDEEP:	6144:+UfeUgusPhAWvTslMS/cj358WCJl04AuJJcDdSJy1z:reUIPqo4aS/cj35eJ64A2JSgwZ
MD5:	AF25BD810507B72F444C8160F2042128
SHA1:	4F78665E6BB2C828F7A373281A858265AFEF07CC
SHA-256:	8A859913B508241B9C2843BD988A5DC64795EE59C553013663D9B9D5C58589D8
SHA-512:	8FCE25BB9680C5F5F37D896FC056FF9A051BD698D39F01EAC183367B89DA31A17CE338E0C480B83BFA724789BEF23A158FB4C203D9FAC456BB42FC2BEE379893
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 32%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........IE...E...E...[.u.R...[.c....bE..B...E......[.d.x...[.t.D...[.q.D...RichE...........................PE..L....;G`......................B..............0................................D.............................................t...P.....D.@Q..............................................................@............................................text............................... ..`.data...(KA..0...@..................@....rsrc...@Q....D..R...X..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\519F.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	4342824
Entropy (8bit):	7.973827881148146
Encrypted:	false
SSDEEP:	98304:wj6B1pLc2N6462cb9OlDJHXl5QjJZvlLGXkFl6:wj6B1pLcU6F2kOlKTtLK2Y
MD5:	3191DB3E8A8BD2AA891786059AC8636B
SHA1:	560D1DD65F8A4E8E558846002E939B66153C8819
SHA-256:	A0DA88CED95EE51493D34218890B7E950B1842CED8A1A8F7D464AA5F2397C8F1
SHA-512:	20984D87B49B1DA21A2D86A6B8A58FB84EDC3F94F8DCDB1DE0F3EB2669C6CF5200039E0040198EC0E2FF59B2F6CE3F6AA86EED92C7392EB04CB9B8D51DA1CE25
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........IE...E...E...[.u.R...[.c....bE..B...E......[.d.x...[.t.D...[.q.D...RichE...........................PE..L.../..a.....................................0....@...................................B.....................................t...P.......@Q...........<B.(...............................................@............................................text............................... ..`.data.....~..0....>.................@....rsrc...@........R....A.............@..@................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\70E4.dll

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1597440
Entropy (8bit):	7.06170844167196
Encrypted:	false
SSDEEP:	24576:xJ/kttVCipK1QNyLNhJP4asXuomkJqe+gdVRxTmRG0:T/ktOn1CyLN21JdDT
MD5:	343FF03A8AD7E42A3818D0031B854EA6
SHA1:	D85B34C560AEAD9B7E1E74BA24D0C42E6506EFA6
SHA-256:	2756A9CBC8EBC2B00CB513EEF1A3D898003644452351FD47FC929959741B6C51
SHA-512:	86B0C76A7B70E97F1E7AC7BE107633328FFD382E6B31DA0E6AE8DFB4F2A0A9B8C5293C522CDEC5C3564BB600B75FB8D6526CE3B347C47C7CF1F726009E11F674
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........).KIH..IH..IH../.#.(H..'....H...."..I..D.3.oH..'....H.......I..n.!.@H...!.*I......gI..W.k..H..413.GI..IH...H..@0\|..I..l?..bI......eH..W.z..H.......I..&>r..I..l?1..I..J0..sH..n. ..I..&>u.\H..J03..H..R.D..I..RichIH..............................................................PE..L...z..c...........!................#.............@..........................`.............@....................................................................Lm...................................................................................text...@........................... ..`.rdata.............................@..@.data...C........ ..................@....idata..............................@....rsrc..................................@.reloc..............................@..B............................................................................................................

C:\Users\user\AppData\Local\Temp\87B9.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	828928
Entropy (8bit):	7.686085587439098
Encrypted:	false
SSDEEP:	24576:z3EpsCnU+h+6gVij9dfL3EiFoCKpY3LHyYCoIuxN7lEGAzzs:z3EpsU+6gVij9dfL3EiFoCKpY3LHf/xY
MD5:	E990ACDB640F13969C55C38E857AB4AB
SHA1:	84F63D8051BE02F40B6EEC7604C7EB3992527D9A
SHA-256:	2FC9C8FFBA226D56755019591DE180CF29000B797350C7291AA8DC447A9A1BBB
SHA-512:	E10B6B0F73783C5FD44085C5F7B49D780CB49EE0E10B242AAEB97369E2E9C2F0AFCE9159BDFD65A596C5072CD57FF1A6F58E4F4D882191C2A9F5286411232E49
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 59%, Browse Antivirus: ReversingLabs, Detection: 81%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Q.I..............u.......c.....2E................d.(.....t.......q.....Rich............PE..L......a......................J.....@........0....@...........................L......V..........................................P.....L..4..........................................................x...@............................................text...Z........................... ..`.data...HdI..0...X..................@....rsrc....4....L..6...p..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\964B.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3923456
Entropy (8bit):	7.824160991100444
Encrypted:	false
SSDEEP:	98304:Ihq+oEPXzLUV3HDX3vxp+Btu6VXeiFHPzvgcB8LsTR:iVoyXzLC3vuDu6RXhP2
MD5:	2679869D7C3C730553BDB94848DDEEA5
SHA1:	EE8DA34EC12A1F27E32BCEE4365B0B34462A22F6
SHA-256:	D982560420D121513BBA42F5D0C6007B874D84AB754E3736D1CD0F2251E90B5D
SHA-512:	C9191F09AB26624F484EBEE05CB880EA6DB50FEFC8A152F6CFD5BED53E17604AFF243F008366E2EE9B4A76927D1F92F484724B06ECE22AD6F5044C45932338EB
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 58%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...`..c..........#..................+M........@.............................`i........... ................................................. .O......Pi.......h. ............................................=S.0.....h.8............p7..............................text.............................. ..`.rdata...U..........................@..@.data........0......................@....pdata.............................@..@_RDATA.......`......................@..@.vmp0...#....p......................`..`.vmp1.....;..p-...;.................`..h.rsrc........Pi.......;.............@..@................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\A024.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3923456
Entropy (8bit):	7.824160991100444
Encrypted:	false
SSDEEP:	98304:Ihq+oEPXzLUV3HDX3vxp+Btu6VXeiFHPzvgcB8LsTR:iVoyXzLC3vuDu6RXhP2
MD5:	2679869D7C3C730553BDB94848DDEEA5
SHA1:	EE8DA34EC12A1F27E32BCEE4365B0B34462A22F6
SHA-256:	D982560420D121513BBA42F5D0C6007B874D84AB754E3736D1CD0F2251E90B5D
SHA-512:	C9191F09AB26624F484EBEE05CB880EA6DB50FEFC8A152F6CFD5BED53E17604AFF243F008366E2EE9B4A76927D1F92F484724B06ECE22AD6F5044C45932338EB
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 58%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...`..c..........#..................+M........@.............................`i........... ................................................. .O......Pi.......h. ............................................=S.0.....h.8............p7..............................text.............................. ..`.rdata...U..........................@..@.data........0......................@....pdata.............................@..@_RDATA.......`......................@..@.vmp0...#....p......................`..`.vmp1.....;..p-...;.................`..h.rsrc........Pi.......;.............@..@................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ACE4.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	188416
Entropy (8bit):	6.933168679739018
Encrypted:	false
SSDEEP:	3072:DBu/booFZs+4oOYcmtbRkF/pstBaDqwONnct43EpstBaDqwONnct43rBl3N2UR:DBu/boGUoOciF/p/uwONct43Ep/uwON/
MD5:	AE9E2CE4CF9B092A5BBFD1D5A609166E
SHA1:	00C12EC16B5116403AE1A9923B114451880B741D
SHA-256:	CA5795709AF3BC2E03EC02C7307D5C85A844C421E36AFE30EB0F571E79342E87
SHA-512:	54727C7931293B6498E20B602DA13FF48498F2F52ABDE5CB79A412C128CDA203DB11F616F22D70F37CAD51D8642F5DDC8E3E761A2300545DA8A0F379612F15DA
Malicious:	true
Antivirus:	Antivirus: Metadefender, Detection: 54%, Browse Antivirus: ReversingLabs, Detection: 77%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........'d..F...F...F..=IU..F...w..F...d..F...g..F..=IW..F...F...F...x..F...r..F..Rich.F..........PE..L...q..c..........................................@.........................................................................L...d....P..(...............................................................@............................................text............................... ..`.rdata..,+.......0..................@..@.data...D4....... ..................@....rsrc........P.......0..............@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\C05F.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	188416
Entropy (8bit):	6.933168679739018
Encrypted:	false
SSDEEP:	3072:DBu/booFZs+4oOYcmtbRkF/pstBaDqwONnct43EpstBaDqwONnct43rBl3N2UR:DBu/boGUoOciF/p/uwONct43Ep/uwON/
MD5:	AE9E2CE4CF9B092A5BBFD1D5A609166E
SHA1:	00C12EC16B5116403AE1A9923B114451880B741D
SHA-256:	CA5795709AF3BC2E03EC02C7307D5C85A844C421E36AFE30EB0F571E79342E87
SHA-512:	54727C7931293B6498E20B602DA13FF48498F2F52ABDE5CB79A412C128CDA203DB11F616F22D70F37CAD51D8642F5DDC8E3E761A2300545DA8A0F379612F15DA
Malicious:	true
Antivirus:	Antivirus: Metadefender, Detection: 54%, Browse Antivirus: ReversingLabs, Detection: 77%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........'d..F...F...F..=IU..F...w..F...d..F...g..F..=IW..F...F...F...x..F...r..F..Rich.F..........PE..L...q..c..........................................@.........................................................................L...d....P..(...............................................................@............................................text............................... ..`.rdata..,+.......0..................@..@.data...D4....... ..................@....rsrc........P.......0..............@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\C39A.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	305152
Entropy (8bit):	6.478886954913614
Encrypted:	false
SSDEEP:	6144:B5ZndmaltrW7h0HRhnWbgg3GsMRfYII57QwzBx:ZnflBYixhnWbgg3IRfo7QwT
MD5:	1A86A0186CC8ABD0BE2907E9ED681756
SHA1:	4CA3CEFD0216A01D5C960DEEBD953E91A32F093D
SHA-256:	6B3493D3F489D5717E9DC889D17C0BC08FB4C117AD6A4E060D9D9A28D35A7A62
SHA-512:	C64D2B6632B47C39FE3F62F093AC9E1DEAD54D2736E89EC2434BB1FBEE85A67324B48E1601504112E13A5AC961DAF07A076ABC65E7862CE4822B7136CE9C46A0
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........IE...E...E...[.u.R...[.c....bE..B...E......[.d.x...[.t.D...[.q.D...RichE...........................PE..L......a......................B..............0....@...........................D......y......................................d...P.....D.@Q..............................................................@............................................text............................... ..`.data....HA..0...>..................@....rsrc...@Q....D..R...V..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\D86C.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	305152
Entropy (8bit):	6.478886954913614
Encrypted:	false
SSDEEP:	6144:B5ZndmaltrW7h0HRhnWbgg3GsMRfYII57QwzBx:ZnflBYixhnWbgg3IRfo7QwT
MD5:	1A86A0186CC8ABD0BE2907E9ED681756
SHA1:	4CA3CEFD0216A01D5C960DEEBD953E91A32F093D
SHA-256:	6B3493D3F489D5717E9DC889D17C0BC08FB4C117AD6A4E060D9D9A28D35A7A62
SHA-512:	C64D2B6632B47C39FE3F62F093AC9E1DEAD54D2736E89EC2434BB1FBEE85A67324B48E1601504112E13A5AC961DAF07A076ABC65E7862CE4822B7136CE9C46A0
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........IE...E...E...[.u.R...[.c....bE..B...E......[.d.x...[.t.D...[.q.D...RichE...........................PE..L......a......................B..............0....@...........................D......y......................................d...P.....D.@Q..............................................................@............................................text............................... ..`.data....HA..0...>..................@....rsrc...@Q....D..R...V..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\E9D3.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4342824
Entropy (8bit):	7.973827881148146
Encrypted:	false
SSDEEP:	98304:wj6B1pLc2N6462cb9OlDJHXl5QjJZvlLGXkFl6:wj6B1pLcU6F2kOlKTtLK2Y
MD5:	3191DB3E8A8BD2AA891786059AC8636B
SHA1:	560D1DD65F8A4E8E558846002E939B66153C8819
SHA-256:	A0DA88CED95EE51493D34218890B7E950B1842CED8A1A8F7D464AA5F2397C8F1
SHA-512:	20984D87B49B1DA21A2D86A6B8A58FB84EDC3F94F8DCDB1DE0F3EB2669C6CF5200039E0040198EC0E2FF59B2F6CE3F6AA86EED92C7392EB04CB9B8D51DA1CE25
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........IE...E...E...[.u.R...[.c....bE..B...E......[.d.x...[.t.D...[.q.D...RichE...........................PE..L.../..a.....................................0....@...................................B.....................................t...P.......@Q...........<B.(...............................................@............................................text............................... ..`.data.....~..0....>.................@....rsrc...@........R....A.............@..@................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\db.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\C05F.exe
File Type:	data
Category:	dropped
Size (bytes):	571228
Entropy (8bit):	7.964552033972383
Encrypted:	false
SSDEEP:	12288:+V1e0UgkVT6ZT+3JCnoxgLQImxuCXwbePLJrH8fwpY4SG:+V1edgkV8T0Cnox5f4ePLJTMwpYA
MD5:	2A03E19D5AF7606E8E9A5C86A5A78880
SHA1:	93945D1E473713D83316AAA9A297A417FB302DB7
SHA-256:	15DEA69E1EF7F927CDF56B7B6A31189B825B0CEF06EECA4811006E7BF9D02C9A
SHA-512:	F263945AF96CB0040D521832038862BFA05F4C9EFD0EDA0AE511DC1AB0CED179E0E64A3054DE42BDC159DB2520FF45F2B56AC08A7AC59BD01B74BBDF4B013F93
Malicious:	false
Preview:	O,..Hh.j...?...O}3..8v,)cml.T/.....V.r.....n.?y..oz#V......N.{.....!....Y."..)v.T.........Ub.V...)..8..,.%.{4.yWrA.a36&..,...V...l9.y....39.y...wW.j.ox.....I..;..%..p.b..>..j.....j..awT..r...j....o./.7...,=uk..i../h..jj.P.j..?.-X.k..R}.j.5.b-F.k..c........j...j..Q?...).qe......,o'k.....j.J..))O.......k..\.....u,..k...,..k....k...tOT.X.jXe-.k..7.k...83U.......%..o.....Y%.....7.F.(j...KP..I..j..y...o..no......z......u/..DJP.e+.Dj..Z....k.......j$T.X.j[..`....o....k{..2\|6...H.....c%..........z......~^..j.-s.....o.-........6.L.`.j.-s.....i\|..y.Q'....k...}FT.X.jY..Y....o......y..=\|6..%..z/........s....>.j.-s.k../.:..........>\|/...h...2/..R..-......k....9.y.....j.6Z.j.o....l&..%.UD..`....&..t>".6g..j,..../W=..5...n.......X..h>.k..'...\|/h..jfDX.S...`&...Y....)U]bc[......'(..l..+....b.i....[...If!S...r......i.....Q^.......aeddT.`.'....*.[.h....e...?>....n....5......-..j..T..ow......k....-...k16.+i(~..L....j,...c.L./w=j...~./

C:\Users\user\AppData\Local\Temp\db.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\C05F.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	61440
Entropy (8bit):	5.463972317214072
Encrypted:	false
SSDEEP:	768:WDKKrolwgA7W2cz1Pii4A1yZHtVtQg0eBU:KKPi2Fii4TrtQg0e
MD5:	4D11BD6F3172584B3FDA0E9EFCAF0DDB
SHA1:	0581C7F087F6538A1B6D4F05D928C1DF24236944
SHA-256:	73314490C80E5EB09F586E12C1F035C44F11AEAA41D2F4B08ACA476132578930
SHA-512:	6A023496E7EE03C2FF8E3BA445C7D7D5BFE6A1E1E1BAE5C17DCF41E78EDE84A166966579BF8CC7BE7450D2516F869713907775E863670B10EB60C092492D2D04
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........)a..H..H..H..r.H..a.H..b..H..oGR.H..H...H..}.H..u.H..w.H..Rich.H..........PE..L....^.c...........!.....p...p..........................................................................................b.......(........&.......................................................... ...@............................................text....g.......p.................. ..`.rdata........... ..................@..@.data...............................@....rsrc....0.......0..................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\bchuush

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	305152
Entropy (8bit):	6.478886954913614
Encrypted:	false
SSDEEP:	6144:B5ZndmaltrW7h0HRhnWbgg3GsMRfYII57QwzBx:ZnflBYixhnWbgg3IRfo7QwT
MD5:	1A86A0186CC8ABD0BE2907E9ED681756
SHA1:	4CA3CEFD0216A01D5C960DEEBD953E91A32F093D
SHA-256:	6B3493D3F489D5717E9DC889D17C0BC08FB4C117AD6A4E060D9D9A28D35A7A62
SHA-512:	C64D2B6632B47C39FE3F62F093AC9E1DEAD54D2736E89EC2434BB1FBEE85A67324B48E1601504112E13A5AC961DAF07A076ABC65E7862CE4822B7136CE9C46A0
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........IE...E...E...[.u.R...[.c....bE..B...E......[.d.x...[.t.D...[.q.D...RichE...........................PE..L......a......................B..............0....@...........................D......y......................................d...P.....D.@Q..............................................................@............................................text............................... ..`.data....HA..0...>..................@....rsrc...@Q....D..R...V..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\erhuush

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	305152
Entropy (8bit):	6.483208092265872
Encrypted:	false
SSDEEP:	6144:45ENjjrw08WQ80GY9zq8IkE1ZgSaV9EzRs5dv:bN7wtjrT9zq8IkEwSazam51
MD5:	1611DB9A8C67F61CE0760633EDD43C48
SHA1:	D2BA3EFE05C12CFE47B84241E00FAE494B2A1E0D
SHA-256:	9808D6A6B9AE7BAEF6715E6440988055682A88D1B5B1096148ACDDDC371ECFD2
SHA-512:	EE3C91EC327A9D4CE80FACD6C44EE590A30953C194ACDDED35350E2176233E28A0B9A15A7C5D6866048AB5909C55EF912AE7015C270B83A6731CE55D17EB1873
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........IE...E...E...[.u.R...[.c....bE..B...E......[.d.x...[.t.D...[.q.D...RichE...........................PE..L....w.a......................B..............0....@...........................D.....zf......................................d...P.....D.@Q..............................................................@............................................text............................... ..`.data...(JA..0...>..................@....rsrc...@Q....D..R...V..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\erhuush:Zone.Identifier

Download File

Process:	C:\Windows\explorer.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Roaming\fhrgjgg

Download File

Process:	C:\Windows\explorer.exe
File Type:	data
Category:	dropped
Size (bytes):	248375
Entropy (8bit):	7.99938074693999
Encrypted:	true
SSDEEP:	6144:YdMpwBsE++doOge0+m+jERKXOhZRJM4WSlofRFD+y5jRkvJLpow:YdMGBsYmOW1+gJbRJg7Sy5j2xuw
MD5:	C17ED231E6F77F5D1AFAF1E0AAF42E45
SHA1:	947847555ECD87F0182E51E7D2ECCE4192D5F180
SHA-256:	C34BAAA2A58C7FD745EED09DDB6F72F45F026A7A077004E45CFAAB0BADFFC21A
SHA-512:	CB543B859E6ECF8524C814C144FB939542C3C8FD80FCDD1B0770C0A83E0C52A38F7790BC01D5CCB165F760B6C2CBBF28D32461B1B82F80C1FDB28EF806F03310
Malicious:	false
Preview:	-.a...K.P..Q(...W3...di.......QPA..E..W...v.S.....K.....H.....3...WH..[.....>..^\c..,......F..{LT....".!.....#C... .b...I....&......]...5....X-U..:.b.q...>h...JI.]..L.)j.>...z;.Q.LZsQeV.~.T.a....H....M.W^wY.s.._......s..$..x.\}...).....d......l.?...2%0.H..>...;.W..j.G...{.....6.t.-?w.@P...0.4.T.L...tZ...<....}.-KY...#.r...>....+\....."...+...v...f...6.9w....5..!.R1. ...k..+.a....D........P[.AYTvi...t.8.Z..t.&......@...j.=.iQ.6.O.V............uJkie...k..AL.Z.A\|....s_Rf..........Qu.._)}..(....0mI0.6.(...........3y..VY....v^7...l...-#...U.....(@..._.N.}..O.qD.\|...<P^LX...:.AO.....x.[.....CD....X.<....~sb......L...;..4...V<[_3A....O....\|.......<..".Z.wS`.q.8j....7..Z.1.K....{4:j.W.\|..:...3!.R....$..&....M.k.:.6T..J.m"..-.+...f....6.h.?.q~{/W....y....#i~"G.B>.I.-t........W.3.t.L......)./..y.0....2..T........V.....9..=.O...x.......#.yd.....l...A..:....K........(....8Ev..f...{*.!p.Rv.:.b...4#oI..zKYS._5..q.2p+..a.xxTM9..vd..[(._...!b

\Device\ConDrv

Download File

Process:	C:\Users\user\AppData\Local\Temp\ACE4.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:y:y
MD5:	81051BCC2CF1BEDF378224B0A93E2877
SHA1:	BA8AB5A0280B953AA97435FF8946CBCBB2755A27
SHA-256:	7EB70257593DA06F682A3DDDA54A9D260D4FC514F645237F5CA74B08F8DA61A6
SHA-512:	1B302A2F1E624A5FB5AD94DDC4E5F8BFD74D26FA37512D0E5FACE303D8C40EEE0D0FFA3649F5DA43F439914D128166CB6C4774A7CAA3B174D7535451EB697B5D
Malicious:	false
Preview:	..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.483208092265872
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	305152
MD5:	1611db9a8c67f61ce0760633edd43c48
SHA1:	d2ba3efe05c12cfe47b84241e00fae494b2a1e0d
SHA256:	9808d6a6b9ae7baef6715e6440988055682a88d1b5b1096148acdddc371ecfd2
SHA512:	ee3c91ec327a9d4ce80facd6c44ee590a30953c194acdded35350e2176233e28a0b9a15a7c5d6866048ab5909c55ef912ae7015c270b83a6731ce55d17eb1873
SSDEEP:	6144:45ENjjrw08WQ80GY9zq8IkE1ZgSaV9EzRs5dv:bN7wtjrT9zq8IkEwSazam51
TLSH:	08547C00BB50D435E0B716F8467A83ACB53E7EE1A72450CB62D52AEE67346E1EC3174B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........IE...E...E...[.u.R...[.c.....bE..B...E.......[.d.x...[.t.D...[.q.D...RichE...........................PE..L....w.a...........

File Icon


Icon Hash:	c8d0d8e0f0e0f0e8

Static PE Info

General

Entrypoint:	0x40ae90
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x61837702 [Thu Nov 4 06:00:34 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	4e4ac8ce1e119b957e1ec71265bc4120

Entrypoint Preview

Instruction
mov edi, edi
push ebp
mov ebp, esp
call 00007FF66CB4E4DBh
call 00007FF66CB40EC6h
pop ebp
ret
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
mov edi, edi
push ebp
mov ebp, esp
push FFFFFFFEh
push 00430CF0h
push 0040E3E0h
mov eax, dword ptr fs:[00000000h]
push eax
add esp, FFFFFF94h
push ebx
push esi
push edi
mov eax, dword ptr [00445A94h]
xor dword ptr [ebp-08h], eax
xor eax, ebp
push eax
lea eax, dword ptr [ebp-10h]
mov dword ptr fs:[00000000h], eax
mov dword ptr [ebp-18h], esp
mov dword ptr [ebp-70h], 00000000h
mov dword ptr [ebp-04h], 00000000h
lea eax, dword ptr [ebp-60h]
push eax
call dword ptr [004011A0h]
mov dword ptr [ebp-04h], FFFFFFFEh
jmp 00007FF66CB40ED8h
mov eax, 00000001h
ret
mov esp, dword ptr [ebp-18h]
mov dword ptr [ebp-78h], 000000FFh
mov dword ptr [ebp-04h], FFFFFFFEh
mov eax, dword ptr [ebp-78h]
jmp 00007FF66CB41008h
mov dword ptr [ebp-04h], FFFFFFFEh
call 00007FF66CB41044h
mov dword ptr [ebp-6Ch], eax
push 00000001h
call 00007FF66CB4F58Ah
add esp, 04h
test eax, eax
jne 00007FF66CB40EBCh
push 0000001Ch
call 00007FF66CB40FFCh
add esp, 04h
call 00007FF66CB48484h
test eax, eax
jne 00007FF66CB40EBCh
push 00000010h

Rich Headers

Programming Language:

[ASM] VS2008 build 21022
[ C ] VS2008 build 21022
[IMP] VS2005 build 50727
[C++] VS2008 build 21022
[RES] VS2008 build 21022
[LNK] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x31464	0x50	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x448000	0x5140	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x12f0	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x8f88	0x40	.text
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x2a0	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x313c6	0x31400	False	0.41850412436548223	data	6.1342347567019395	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x33000	0x414a28	0x13e00	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x448000	0x5140	0x5200	False	0.4879954268292683	data	4.8397497268874865	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
AFX_DIALOG_LAYOUT	0x44b0f0	0x2	data
AFX_DIALOG_LAYOUT	0x44b0e8	0x2	data
AFX_DIALOG_LAYOUT	0x44b0f8	0x2	data
AFX_DIALOG_LAYOUT	0x44b100	0x2	data
AFX_DIALOG_LAYOUT	0x44b108	0x2	data
RT_CURSOR	0x44b110	0x130	data
RT_CURSOR	0x44b240	0xf0	data
RT_CURSOR	0x44b330	0x10a8	dBase III DBT, version number 0, next free block index 40
RT_CURSOR	0x44c408	0x8a8	dBase III DBT, version number 0, next free block index 40, 1st item "\251\317"
RT_ICON	0x448520	0x6c8	data	Korean	North Korea
RT_ICON	0x448520	0x6c8	data	Korean	South Korea
RT_ICON	0x448be8	0x568	GLS_BINARY_LSB_FIRST	Korean	North Korea
RT_ICON	0x448be8	0x568	GLS_BINARY_LSB_FIRST	Korean	South Korea
RT_ICON	0x449150	0x10a8	data	Korean	North Korea
RT_ICON	0x449150	0x10a8	data	Korean	South Korea
RT_ICON	0x44a1f8	0x988	dBase III DBT, version number 0, next free block index 40	Korean	North Korea
RT_ICON	0x44a1f8	0x988	dBase III DBT, version number 0, next free block index 40	Korean	South Korea
RT_ICON	0x44ab80	0x468	GLS_BINARY_LSB_FIRST	Korean	North Korea
RT_ICON	0x44ab80	0x468	GLS_BINARY_LSB_FIRST	Korean	South Korea
RT_STRING	0x44ce08	0x156	data	Korean	North Korea
RT_STRING	0x44ce08	0x156	data	Korean	South Korea
RT_STRING	0x44cf60	0x1e0	data	Korean	North Korea
RT_STRING	0x44cf60	0x1e0	data	Korean	South Korea
RT_ACCELERATOR	0x44b098	0x50	data	Korean	North Korea
RT_ACCELERATOR	0x44b098	0x50	data	Korean	South Korea
RT_ACCELERATOR	0x44b038	0x60	data	Korean	North Korea
RT_ACCELERATOR	0x44b038	0x60	data	Korean	South Korea
RT_GROUP_CURSOR	0x44c3d8	0x30	data
RT_GROUP_CURSOR	0x44ccb0	0x14	data
RT_GROUP_ICON	0x44afe8	0x4c	data	Korean	North Korea
RT_GROUP_ICON	0x44afe8	0x4c	data	Korean	South Korea
RT_VERSION	0x44ccc8	0x140	MIPSEB-LE MIPS-III ECOFF executable not stripped - version 0.79

Imports

DLL	Import
KERNEL32.dll	QueryDosDeviceA, LocalFree, SetProcessPriorityBoost, VirtualQuery, GlobalGetAtomNameW, FindResourceA, GetComputerNameExW, GetModuleHandleA, GetTempPathA, BuildCommDCBAndTimeoutsW, GetProcAddress, VirtualProtect, OpenJobObjectW, _lwrite, UnlockFile, GetPrivateProfileStructA, GetDiskFreeSpaceExW, DefineDosDeviceA, SetVolumeMountPointW, GetAtomNameA, FlushConsoleInputBuffer, EnumResourceLanguagesA, GetCPInfoExW, GetThreadContext, lstrlenW, GetProcessAffinityMask, SetConsoleWindowInfo, CreateJobSet, CopyFileW, lstrcpynA, WriteConsoleA, GetCommandLineA, GetLastError, GetCommandLineW, InterlockedIncrement, CreateJobObjectW, InitializeCriticalSection, GetConsoleFontSize, FindNextVolumeA, GlobalFlags, SetConsoleCursorInfo, LoadLibraryW, VerifyVersionInfoA, WriteProfileSectionW, AddAtomW, InterlockedDecrement, LoadLibraryA, FoldStringA, GetDefaultCommConfigW, GetConsoleAliasesLengthA, lstrcpyA, TerminateThread, HeapFree, SetCriticalSectionSpinCount, GetComputerNameA, EnumSystemLocalesW, DisableThreadLibraryCalls, OpenMutexA, LocalFileTimeToFileTime, SearchPathA, SetProcessShutdownParameters, CreateMutexA, FormatMessageA, InterlockedCompareExchange, EnumDateFormatsW, GetConsoleScreenBufferInfo, LocalAlloc, SetFileShortNameA, EnumCalendarInfoExW, GetFileAttributesA, GetSystemWindowsDirectoryA, GetAtomNameW, ReadConsoleInputA, EnumDateFormatsA, _hwrite, GetConsoleAliasA, GetQueuedCompletionStatus, lstrcatW, GetDefaultCommConfigA, GetFullPathNameW, DebugBreakProcess, AddAtomA, SetCurrentDirectoryW, SetCalendarInfoW, FindNextFileA, GetProfileSectionW, SetHandleCount, MoveFileWithProgressW, ReadConsoleOutputCharacterW, CopyFileExW, GetConsoleAliasesLengthW, WideCharToMultiByte, UnhandledExceptionFilter, SetUnhandledExceptionFilter, MoveFileA, DeleteFileA, RaiseException, GetStartupInfoA, HeapValidate, IsBadReadPtr, DeleteCriticalSection, EnterCriticalSection, LeaveCriticalSection, GetModuleFileNameW, TerminateProcess, GetCurrentProcess, IsDebuggerPresent, GetACP, GetOEMCP, GetCPInfo, IsValidCodePage, TlsGetValue, GetModuleHandleW, TlsAlloc, TlsSetValue, GetCurrentThreadId, TlsFree, SetLastError, Sleep, ExitProcess, GetModuleFileNameA, WriteFile, GetStdHandle, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetFileType, HeapDestroy, HeapCreate, VirtualFree, HeapAlloc, HeapSize, HeapReAlloc, VirtualAlloc, RtlUnwind, InitializeCriticalSectionAndSpinCount, DebugBreak, OutputDebugStringA, WriteConsoleW, OutputDebugStringW, MultiByteToWideChar, LCMapStringA, LCMapStringW, GetStringTypeA, GetStringTypeW, GetLocaleInfoA, FlushFileBuffers, GetConsoleCP, GetConsoleMode, ReadFile, SetFilePointer, CloseHandle, SetStdHandle, GetConsoleOutputCP, CreateFileA
GDI32.dll	GetCharWidth32A, GetBoundsRect, SelectObject, GetCharWidthW
ADVAPI32.dll	RevertToSelf

Possible Origin

Language of compilation system	Country where language is spoken	Map
Korean	North Korea
Korean	South Korea

Network Behavior

⊘No network behavior found

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: file.exePID: 2904, Parent PID: 2448

General

Target ID:	0
Start time:	12:53:51
Start date:	31/08/2022
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x400000
File size:	305152 bytes
MD5 hash:	1611DB9A8C67F61CE0760633EDD43C48
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.387378506.0000000000C29000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000000.00000002.387173781.00000000009E1000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000000.00000002.387173781.00000000009E1000.00000004.10000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000000.00000002.387108841.00000000009C0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000000.00000002.387108841.00000000009C0000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.387065611.00000000009B0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: explorer.exePID: 3528, Parent PID: 2904

General

Target ID:	1
Start time:	12:53:58
Start date:	31/08/2022
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff618f60000
File size:	3933184 bytes
MD5 hash:	AD5296B280E8F522A8A897C96BAB0E1D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000001.00000000.367270038.0000000004611000.00000020.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000001.00000000.367270038.0000000004611000.00000020.80000000.00040000.00000000.sdmp, Author: unknown
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: erhuushPID: 2344, Parent PID: 1088

General

Target ID:	7
Start time:	12:54:45
Start date:	31/08/2022
Path:	C:\Users\user\AppData\Roaming\erhuush
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\erhuush
Imagebase:	0x400000
File size:	305152 bytes
MD5 hash:	1611DB9A8C67F61CE0760633EDD43C48
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000007.00000002.441430475.0000000002491000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000007.00000002.441430475.0000000002491000.00000004.10000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000007.00000002.441371767.0000000002470000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000007.00000002.441371767.0000000002470000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000007.00000002.440994734.00000000009C0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000007.00000002.441147746.00000000009E8000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 1900, Parent PID: 576

General

Target ID:	11
Start time:	12:54:56
Start date:	31/08/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff61e220000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: regsvr32.exePID: 3328, Parent PID: 3528

General

Target ID:	12
Start time:	12:55:07
Start date:	31/08/2022
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	regsvr32 /s C:\Users\user\AppData\Local\Temp\70E4.dll
Imagebase:	0x7ff6f0980000
File size:	24064 bytes
MD5 hash:	D78B75FC68247E8A63ACBA846182740E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: regsvr32.exePID: 4712, Parent PID: 3328

General

Target ID:	13
Start time:	12:55:08
Start date:	31/08/2022
Path:	C:\Windows\SysWOW64\regsvr32.exe
Wow64 process (32bit):	true
Commandline:	/s C:\Users\user\AppData\Local\Temp\70E4.dll
Imagebase:	0xbf0000
File size:	20992 bytes
MD5 hash:	426E7499F6A7346F0410DEAD0805586B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: 87B9.exePID: 5612, Parent PID: 3528

General

Target ID:	14
Start time:	12:55:13
Start date:	31/08/2022
Path:	C:\Users\user\AppData\Local\Temp\87B9.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\87B9.exe
Imagebase:	0x400000
File size:	828928 bytes
MD5 hash:	E990ACDB640F13969C55C38E857AB4AB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 0000000E.00000002.495843293.00000000026F0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 0000000E.00000002.495843293.00000000026F0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000E.00000002.494725828.0000000002545000.00000040.00000800.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 59%, Metadefender, Browse Detection: 81%, ReversingLabs
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: 87B9.exePID: 4652, Parent PID: 5612

General

Target ID:	15
Start time:	12:55:16
Start date:	31/08/2022
Path:	C:\Users\user\AppData\Local\Temp\87B9.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\87B9.exe
Imagebase:	0x400000
File size:	828928 bytes
MD5 hash:	E990ACDB640F13969C55C38E857AB4AB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 0000000F.00000000.485672401.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: 0000000F.00000000.490507253.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 0000000F.00000000.490507253.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 0000000F.00000000.490507253.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 0000000F.00000000.490507253.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: 0000000F.00000002.503363757.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 0000000F.00000002.503363757.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 0000000F.00000002.503363757.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 0000000F.00000002.503363757.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: 0000000F.00000000.490001086.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 0000000F.00000000.490001086.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 0000000F.00000000.490001086.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 0000000F.00000000.490001086.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: 0000000F.00000000.492226078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 0000000F.00000000.492226078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 0000000F.00000000.492226078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 0000000F.00000000.492226078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: 0000000F.00000000.491102942.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 0000000F.00000000.491102942.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 0000000F.00000000.491102942.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 0000000F.00000000.491102942.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: 0000000F.00000000.488104570.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 0000000F.00000000.488104570.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 0000000F.00000000.488104570.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 0000000F.00000000.488104570.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 4632, Parent PID: 576

General

Target ID:	16
Start time:	12:55:17
Start date:	31/08/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff61e220000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: A024.exePID: 3064, Parent PID: 3528

General

Target ID:	17
Start time:	12:55:19
Start date:	31/08/2022
Path:	C:\Users\user\AppData\Local\Temp\A024.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\Temp\A024.exe
Imagebase:	0x140000000
File size:	3923456 bytes
MD5 hash:	2679869D7C3C730553BDB94848DDEEA5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 58%, ReversingLabs
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: C05F.exePID: 2484, Parent PID: 3528

General

Target ID:	18
Start time:	12:55:27
Start date:	31/08/2022
Path:	C:\Users\user\AppData\Local\Temp\C05F.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\C05F.exe
Imagebase:	0x400000
File size:	188416 bytes
MD5 hash:	AE9E2CE4CF9B092A5BBFD1D5A609166E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 54%, Metadefender, Browse Detection: 77%, ReversingLabs

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 2220, Parent PID: 2484

General

Target ID:	19
Start time:	12:55:28
Start date:	31/08/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7c72c0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: C05F.exePID: 4936, Parent PID: 2484

General

Target ID:	24
Start time:	12:55:33
Start date:	31/08/2022
Path:	C:\Users\user\AppData\Local\Temp\C05F.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\C05F.exe" -h
Imagebase:	0x400000
File size:	188416 bytes
MD5 hash:	AE9E2CE4CF9B092A5BBFD1D5A609166E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 4560, Parent PID: 4936

General

Target ID:	25
Start time:	12:55:33
Start date:	31/08/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7c72c0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: D86C.exePID: 5068, Parent PID: 3528

General

Target ID:	26
Start time:	12:55:34
Start date:	31/08/2022
Path:	C:\Users\user\AppData\Local\Temp\D86C.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\D86C.exe
Imagebase:	0x400000
File size:	305152 bytes
MD5 hash:	1A86A0186CC8ABD0BE2907E9ED681756
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000001A.00000003.526622172.0000000000B10000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000001A.00000002.544780175.0000000000B10000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 0000001A.00000002.544780175.0000000000B10000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 0000001A.00000002.544740114.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000001A.00000002.545414239.0000000000B89000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000001A.00000002.545012487.0000000000B31000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 0000001A.00000002.545012487.0000000000B31000.00000004.10000000.00040000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Joe Sandbox ML

Show Windows behavior

Chronological Activities

Analysis Process: E9D3.exePID: 5264, Parent PID: 3528

General

Target ID:	27
Start time:	12:55:38
Start date:	31/08/2022
Path:	C:\Users\user\AppData\Local\Temp\E9D3.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\E9D3.exe
Imagebase:	0x7ff756d70000
File size:	4342824 bytes
MD5 hash:	3191DB3E8A8BD2AA891786059AC8636B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000001B.00000002.739912367.0000000002BF5000.00000040.00000800.00020000.00000000.sdmp, Author: unknown Rule: SUSP_PE_Discord_Attachment_Oct21_1, Description: Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), Source: 0000001B.00000003.552567063.0000000003860000.00000004.00001000.00020000.00000000.sdmp, Author: Florian Roth Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 0000001B.00000002.865037113.0000000002FE0000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Joe Sandbox ML

Show Windows behavior

Chronological Activities

Analysis Process: WmiPrvSE.exePID: 5656, Parent PID: 796

General

Target ID:	29
Start time:	12:55:44
Start date:	31/08/2022
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff6ac650000
File size:	488448 bytes
MD5 hash:	A782A4ED336750D10B3CAF776AFE8E70
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: rundll32.exePID: 3720, Parent PID: 5656

General

Target ID:	30
Start time:	12:55:45
Start date:	31/08/2022
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\AppData\Local\Temp\db.dll",open
Imagebase:	0x7ff70d330000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: rundll32.exePID: 6052, Parent PID: 3720

General

Target ID:	31
Start time:	12:55:45
Start date:	31/08/2022
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\AppData\Local\Temp\db.dll",open
Imagebase:	0x1310000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: SUSP_XORed_MSDOS_Stub_Message, Description: Detects suspicious XORed MSDOS stub message, Source: 0000001F.00000002.652754688.0000000004D44000.00000040.00001000.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_ManusCrypt, Description: Yara detected ManusCrypt, Source: 0000001F.00000002.652754688.0000000004D44000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Generic_a681f24a, Description: unknown, Source: 0000001F.00000002.652754688.0000000004D44000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: SUSP_XORed_MSDOS_Stub_Message, Description: Detects suspicious XORed MSDOS stub message, Source: 0000001F.00000002.643002638.0000000001130000.00000004.00001000.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_ManusCrypt, Description: Yara detected ManusCrypt, Source: 0000001F.00000002.643002638.0000000001130000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_Fabookie, Description: Detects Fabookie / ElysiumStealer, Source: 0000001F.00000002.643002638.0000000001130000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Trojan_Generic_a681f24a, Description: unknown, Source: 0000001F.00000002.643002638.0000000001130000.00000004.00001000.00020000.00000000.sdmp, Author: unknown

Show Windows behavior

Chronological Activities

Analysis Process: ACE4.exePID: 1028, Parent PID: 3528

General

Target ID:	33
Start time:	12:55:50
Start date:	31/08/2022
Path:	C:\Users\user\AppData\Local\Temp\ACE4.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\ACE4.exe
Imagebase:	0x400000
File size:	188416 bytes
MD5 hash:	AE9E2CE4CF9B092A5BBFD1D5A609166E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 54%, Metadefender, Browse Detection: 77%, ReversingLabs

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 4216, Parent PID: 1028

General

Target ID:	35
Start time:	12:55:52
Start date:	31/08/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7c72c0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 332, Parent PID: 6052

General

Target ID:	36
Start time:	12:55:53
Start date:	31/08/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k netsvcs -p -s gpsvc
Imagebase:	0x7ff61e220000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: SUSP_XORed_MSDOS_Stub_Message, Description: Detects suspicious XORed MSDOS stub message, Source: 00000024.00000003.573535906.000002F31BF40000.00000004.00000001.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_ManusCrypt, Description: Yara detected ManusCrypt, Source: 00000024.00000003.573535906.000002F31BF40000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Generic_a681f24a, Description: unknown, Source: 00000024.00000003.573535906.000002F31BF40000.00000004.00000001.00020000.00000000.sdmp, Author: unknown Rule: SUSP_XORed_MSDOS_Stub_Message, Description: Detects suspicious XORed MSDOS stub message, Source: 00000024.00000000.584962257.000002F31BFB0000.00000040.00000001.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_ManusCrypt, Description: Yara detected ManusCrypt, Source: 00000024.00000000.584962257.000002F31BFB0000.00000040.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_Chebka, Description: Detects Chebka, Source: 00000024.00000000.584962257.000002F31BFB0000.00000040.00000001.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Trojan_Generic_a681f24a, Description: unknown, Source: 00000024.00000000.584962257.000002F31BFB0000.00000040.00000001.00020000.00000000.sdmp, Author: unknown

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 5360, Parent PID: 576

General

Target ID:	38
Start time:	12:55:56
Start date:	31/08/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff61e220000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: C39A.exePID: 1700, Parent PID: 3528

General

Target ID:	39
Start time:	12:55:57
Start date:	31/08/2022
Path:	C:\Users\user\AppData\Local\Temp\C39A.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\C39A.exe
Imagebase:	0x400000
File size:	305152 bytes
MD5 hash:	1A86A0186CC8ABD0BE2907E9ED681756
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000027.00000002.601597228.00000000009F1000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000027.00000002.601597228.00000000009F1000.00000004.10000000.00040000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000027.00000002.601012575.0000000000930000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000027.00000002.601073617.0000000000940000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000027.00000002.601073617.0000000000940000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000027.00000002.602802862.0000000000A29000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000027.00000003.584704076.0000000000940000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML

Show Windows behavior

Chronological Activities

Analysis Process: dllhost.exePID: 2484, Parent PID: 796

General

Target ID:	42
Start time:	12:56:03
Start date:	31/08/2022
Path:	C:\Windows\System32\dllhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\DllHost.exe /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}
Imagebase:	0x7ff689080000
File size:	20888 bytes
MD5 hash:	2528137C6745C4EADD87817A1909677E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 2200, Parent PID: 6052

General

Target ID:	43
Start time:	12:56:05
Start date:	31/08/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
Imagebase:	0x7ff61e220000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: SUSP_XORed_MSDOS_Stub_Message, Description: Detects suspicious XORed MSDOS stub message, Source: 0000002B.00000003.595564014.00000156B6AE0000.00000004.00000001.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_ManusCrypt, Description: Yara detected ManusCrypt, Source: 0000002B.00000003.595564014.00000156B6AE0000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Generic_a681f24a, Description: unknown, Source: 0000002B.00000003.595564014.00000156B6AE0000.00000004.00000001.00020000.00000000.sdmp, Author: unknown Rule: SUSP_XORed_MSDOS_Stub_Message, Description: Detects suspicious XORed MSDOS stub message, Source: 0000002B.00000000.600713527.00000156B6B50000.00000040.00000001.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_ManusCrypt, Description: Yara detected ManusCrypt, Source: 0000002B.00000000.600713527.00000156B6B50000.00000040.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_Chebka, Description: Detects Chebka, Source: 0000002B.00000000.600713527.00000156B6B50000.00000040.00000001.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Trojan_Generic_a681f24a, Description: unknown, Source: 0000002B.00000000.600713527.00000156B6B50000.00000040.00000001.00020000.00000000.sdmp, Author: unknown

Show Windows behavior

Chronological Activities

Analysis Process: Conhost.exePID: 2176, Parent PID: 2160

General

Target ID:	66
Start time:	12:56:22
Start date:	31/08/2022
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ac650000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: file.exePID: 2904, Parent PID: 2448COMMON

Execution Graph

Execution Coverage:	1.9%
Dynamic/Decrypted Code Coverage:	23.9%
Signature Coverage:	19.3%
Total number of Nodes:	88
Total number of Limit Nodes:	5

Executed Functions

Function 00409B11 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 185
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 00409B72
_wprintf.LIBCMTD ref: 00409CA1
_wscanf.LIBCMTD ref: 00409CAA
_wscanf.LIBCMTD ref: 00409CB7
__wremove.LIBCMTD ref: 00409CBD
__wrename.LIBCMTD ref: 00409CC4
_labs.LIBCMTD ref: 00409CE1
_abort.LIBCMTD ref: 00409CE6
_realloc.LIBCMTD ref: 00409D0D

Part of subcall function 0040A7B0: __realloc_dbg.LIBCMTD ref: 0040A7C4

_malloc.LIBCMTD ref: 00409D13

Part of subcall function 0040A780: __nh_malloc_dbg.LIBCMTD ref: 0040A796

__wctomb_s_l.LIBCMTD ref: 00409D1D

Strings

msimg32.dll, xrefs: 00409CB2

Memory Dump Source

Source File: 00000000.00000002.386662790.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: _wscanf$__nh_malloc_dbg__realloc_dbg__wctomb_s_l__wremove__wrename_abort_labs_malloc_memset_realloc_wprintf
String ID: msimg32.dll
API String ID: 2019212891-3287713914
Opcode ID: 2ad864a010214a7997f26c51bd4d6d42cc7d3a8671068fa2767f1c33c8d9b0d1
Instruction ID: e422161b7b5bbf4efaa1130811f3b2fcb5ec8ed0f934f484f65b9b74cbfb9347
Opcode Fuzzy Hash: 2ad864a010214a7997f26c51bd4d6d42cc7d3a8671068fa2767f1c33c8d9b0d1
Instruction Fuzzy Hash: AE517EB2902524BBD7156BA29D0DDDF3B6CEF0A355B000076F606B50A1D73C5A45CBBE

Uniqueness

Uniqueness Score: -1.00%

Function 004017E2 Relevance: 3.1, APIs: 2, Instructions: 53
sleepnativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E004017E2(void* __edx) {
				void* _t4;

				 *((intOrPtr*)(_t4 - 0x77)) =  *((intOrPtr*)(_t4 - 0x77)) + __edx;
			}

0x004017e2

APIs

Sleep.KERNELBASE(00001388), ref: 00401823
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 0040184B

Memory Dump Source

Source File: 00000000.00000002.386623017.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 4dede37128b39f4f7e7a4df5dc33f26b0f76fbcd4aaa8ffb007c11c557e31b11
Instruction ID: ddaf0562df841adfab300f0276baae716c17d25714fd681a3a6e16616d485b4c
Opcode Fuzzy Hash: 4dede37128b39f4f7e7a4df5dc33f26b0f76fbcd4aaa8ffb007c11c557e31b11
Instruction Fuzzy Hash: EC015233148208EBDB017AA59C41DA97729AB45754F30C537FA03791F1D67D8713A72B

Uniqueness

Uniqueness Score: -1.00%

Function 004017E3 Relevance: 3.1, APIs: 2, Instructions: 53
sleepnativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 18%

			E004017E3(intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t8;
				char* _t9;
				void* _t11;
				void* _t13;
				intOrPtr* _t14;
				intOrPtr _t16;
				void* _t17;
				void* _t18;
				void* _t19;
				void* _t20;
				intOrPtr* _t21;
				intOrPtr* _t22;
				void* _t24;
				void* _t26;

				_push(0x181b);
				_t8 =  *_t21;
				_t22 = _t21 + 4;
				L00401118(_t8, _t13, 0x61, _t19, _t20, _t24);
				_t14 = _a4;
				Sleep(0x1388);
				_t3 =  &_v8; // 0x1b68f34d
				_t9 = _t3;
				_push(_t9);
				_push(_a12);
				_push(_a8);
				_push(_t14); // executed
				L00401360(); // executed
				_t25 = _t9;
				if(_t9 != 0) {
					_push(_a16);
					_push(_v8);
					_push(_t9);
					_push(_t14); // executed
					E00401432(_t14, _t17, _t18, _t19, _t26); // executed
				}
				 *_t14(0xffffffff, 0); // executed
				_t11 = 0x181b;
				_push(0x61);
				_t16 =  *_t22;
				L00401118(_t11, _t14, _t16, _t19, _t20, _t25);
				return _t11;
			}

0x004017f1
0x004017f6
0x004017f9
0x00401816
0x0040181b
0x00401823
0x00401826
0x00401826
0x00401829
0x0040182a
0x0040182d
0x00401830
0x00401831
0x00401836
0x00401838
0x0040183a
0x0040183d
0x00401840
0x00401841
0x00401842
0x00401842
0x0040184b
0x00401858
0x00401868
0x0040186a
0x00401877
0x00401880

APIs

Sleep.KERNELBASE(00001388), ref: 00401823
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 0040184B

Memory Dump Source

Source File: 00000000.00000002.386623017.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: eed50f69cd3fa7174ad76653e673f5296f9ebb16c169d6494c900a5425ffe511
Instruction ID: 1d0556d2ce3487287f662705d53e2785c513140bae9e3f24436a296874fe77da
Opcode Fuzzy Hash: eed50f69cd3fa7174ad76653e673f5296f9ebb16c169d6494c900a5425ffe511
Instruction Fuzzy Hash: 15017533108208F7D7017A958C42DAA3628AB45754F30C437BA03790F1D57DDB12676B

Uniqueness

Uniqueness Score: -1.00%

Function 004017EE Relevance: 3.0, APIs: 2, Instructions: 47
sleepnativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 20%

			E004017EE(void* __edi, void* __esi) {
				intOrPtr _t8;
				intOrPtr* _t9;
				void* _t11;
				void* _t13;
				intOrPtr* _t14;
				intOrPtr _t17;
				void* _t18;
				void* _t19;
				intOrPtr* _t25;
				intOrPtr* _t26;
				void* _t29;
				void* _t31;

				_t21 = __esi;
				_t19 = __edi;
				_push(0x181b);
				_t8 =  *_t25;
				_t26 = _t25 + 4;
				L00401118(_t8, _t13, 0x61, __esi, 0x1b68f351, _t29);
				_t14 =  *((intOrPtr*)(0x1b68f359));
				Sleep(0x1388);
				_t9 = 0x1b68f34d;
				_push(_t9);
				_push( *0x1B68F361);
				_push( *0x1B68F35D);
				_push(_t14); // executed
				L00401360(); // executed
				_t30 = _t9;
				if(_t9 != 0) {
					_push( *0x1B68F365);
					_push( *((intOrPtr*)(0x1b68f34d)));
					_push(_t9);
					_push(_t14); // executed
					E00401432(_t14, _t18, _t19, _t21, _t31); // executed
				}
				 *_t14(0xffffffff, 0); // executed
				_t11 = 0x181b;
				_push(0x61);
				_t17 =  *_t26;
				L00401118(_t11, _t14, _t17, _t21, 0x1b68f351, _t30);
				return _t11;
			}

0x004017ee
0x004017ee
0x004017f1
0x004017f6
0x004017f9
0x00401816
0x0040181b
0x00401823
0x00401826
0x00401829
0x0040182a
0x0040182d
0x00401830
0x00401831
0x00401836
0x00401838
0x0040183a
0x0040183d
0x00401840
0x00401841
0x00401842
0x00401842
0x0040184b
0x00401858
0x00401868
0x0040186a
0x00401877
0x00401880

APIs

Sleep.KERNELBASE(00001388), ref: 00401823
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 0040184B

Memory Dump Source

Source File: 00000000.00000002.386623017.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 0a9656e0e1b5f21b45c9f82a7808bfe019579950b80e51e68eaabb0023cd3f01
Instruction ID: 6a2648c31bf342f80e2744bc490c75df06b0a743f4722301b2fbabc3dba0a0aa
Opcode Fuzzy Hash: 0a9656e0e1b5f21b45c9f82a7808bfe019579950b80e51e68eaabb0023cd3f01
Instruction Fuzzy Hash: 54016733508304ABDB017AA18C42EA937289B45754F24C577BB13790F2D57DCB12A72B

Uniqueness

Uniqueness Score: -1.00%

Function 00C2D774 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 00C2D79C
Module32First.KERNEL32(00000000,00000224), ref: 00C2D7BC

Memory Dump Source

Source File: 00000000.00000002.387378506.0000000000C29000.00000040.00000020.00020000.00000000.sdmp, Offset: 00C29000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c29000_file.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: c1748467ad12143ef9350e9dee1750b0800ec6872a71a0b080b5f15551a7a10a
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: F3F0F6321003216FD7203BF8B88CBAE72E8AF68B29F100528E653D18C0DB74ED454660

Uniqueness

Uniqueness Score: -1.00%

Function 00401807 Relevance: 3.0, APIs: 2, Instructions: 40
sleepnativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 24%

			E00401807(signed int __edx, void* __edi, void* __esi) {
				void* _t9;
				void* _t10;
				void* _t12;
				void* _t14;
				intOrPtr* _t15;
				intOrPtr _t18;
				void* _t21;
				void* _t25;
				intOrPtr* _t27;
				signed char _t30;
				void* _t32;

				_t23 = __esi;
				_t21 = __edi;
				_t20 = __edx |  *(_t25 + 0x7b);
				_t30 = __edx |  *(_t25 + 0x7b);
				L00401118(_t9, _t14, 0x61, __esi, _t25, _t30);
				_t15 =  *((intOrPtr*)(_t25 + 8));
				Sleep(0x1388);
				_t4 = _t25 - 4; // 0x1b68f34d
				_t10 = _t4;
				_push(_t10);
				_push( *((intOrPtr*)(_t25 + 0x10)));
				_push( *((intOrPtr*)(_t25 + 0xc)));
				_push(_t15); // executed
				L00401360(); // executed
				_t31 = _t10;
				if(_t10 != 0) {
					_push( *((intOrPtr*)(_t25 + 0x14)));
					_push( *((intOrPtr*)(_t25 - 4)));
					_push(_t10);
					_push(_t15); // executed
					E00401432(_t15, _t20, _t21, _t23, _t32); // executed
				}
				 *_t15(0xffffffff, 0); // executed
				_t12 = 0x181b;
				_push(0x61);
				_t18 =  *_t27;
				L00401118(_t12, _t15, _t18, _t23, _t25, _t31);
				return _t12;
			}

0x00401807
0x00401807
0x00401807
0x00401807
0x00401816
0x0040181b
0x00401823
0x00401826
0x00401826
0x00401829
0x0040182a
0x0040182d
0x00401830
0x00401831
0x00401836
0x00401838
0x0040183a
0x0040183d
0x00401840
0x00401841
0x00401842
0x00401842
0x0040184b
0x00401858
0x00401868
0x0040186a
0x00401877
0x00401880

APIs

Sleep.KERNELBASE(00001388), ref: 00401823
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 0040184B

Memory Dump Source

Source File: 00000000.00000002.386623017.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: fa61b3bfe6e1efcc42a3172324d87a3747898b17389843dd474e8030b106d628
Instruction ID: d1e85a843a3bf15b3ffbd62fd2fe31d474754e63a526ee7ed21e8696c92682af
Opcode Fuzzy Hash: fa61b3bfe6e1efcc42a3172324d87a3747898b17389843dd474e8030b106d628
Instruction Fuzzy Hash: 2FF04F33204208FBDB007BA18C42EAD3729AB45754F20C537BA13790F2D679CA12A72B

Uniqueness

Uniqueness Score: -1.00%

Function 0040AEB0 Relevance: 16.6, APIs: 11, Instructions: 114
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_check_managed_app.LIBCMTD ref: 0040AF2C
__heap_init.LIBCMTD ref: 0040AF36

Part of subcall function 00419610: HeapCreate.KERNELBASE(00000000,00001000,00000000,?,0040AF3B,00000001), ref: 00419626

_fast_error_exit.LIBCMTD ref: 0040AF44

Part of subcall function 0040B090: ___crtExitProcess.LIBCMTD ref: 0040B0B4

__mtinit.LIBCMTD ref: 0040AF4C
_fast_error_exit.LIBCMTD ref: 0040AF57
__RTC_Initialize.LIBCMTD ref: 0040AF69
___crtGetEnvironmentStringsA.LIBCMTD ref: 0040AF93
___setargv.LIBCMTD ref: 0040AF9D
__setenvp.LIBCMTD ref: 0040AFB0
__cinit.LIBCMTD ref: 0040AFC5
__wincmdln.LIBCMTD ref: 0040AFE2

Memory Dump Source

Source File: 00000000.00000002.386662790.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: ___crt_fast_error_exit$CreateEnvironmentExitHeapInitializeProcessStrings___setargv__cinit__heap_init__mtinit__setenvp__wincmdln_check_managed_app
String ID:
API String ID: 2258361453-0
Opcode ID: 4086065ac970038e79a776750f7548aa05e0e09ea29f0b4c0b31f8981395e636
Instruction ID: a7ddb7468b00b09513485c08426ead2e5ea3c26d69e3af7857e19453d79bf949
Opcode Fuzzy Hash: 4086065ac970038e79a776750f7548aa05e0e09ea29f0b4c0b31f8981395e636
Instruction Fuzzy Hash: 6B41B3F1D003099BDB00ABB2AC0679E76B4AF54748F10013EE515AB2C2EB799540CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 0040AF25 Relevance: 16.6, APIs: 11, Instructions: 88
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_check_managed_app.LIBCMTD ref: 0040AF2C
__heap_init.LIBCMTD ref: 0040AF36

Part of subcall function 00419610: HeapCreate.KERNELBASE(00000000,00001000,00000000,?,0040AF3B,00000001), ref: 00419626

_fast_error_exit.LIBCMTD ref: 0040AF44

Part of subcall function 0040B090: ___crtExitProcess.LIBCMTD ref: 0040B0B4

__mtinit.LIBCMTD ref: 0040AF4C
_fast_error_exit.LIBCMTD ref: 0040AF57
__RTC_Initialize.LIBCMTD ref: 0040AF69
___crtGetEnvironmentStringsA.LIBCMTD ref: 0040AF93
___setargv.LIBCMTD ref: 0040AF9D
__setenvp.LIBCMTD ref: 0040AFB0
__cinit.LIBCMTD ref: 0040AFC5
__wincmdln.LIBCMTD ref: 0040AFE2

Memory Dump Source

Source File: 00000000.00000002.386662790.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: ___crt_fast_error_exit$CreateEnvironmentExitHeapInitializeProcessStrings___setargv__cinit__heap_init__mtinit__setenvp__wincmdln_check_managed_app
String ID:
API String ID: 2258361453-0
Opcode ID: b4164f6d4685f9dc647e4ff3c01fe10f2011dd5ecc3773d6662f2e0acad5b2fb
Instruction ID: 9f0ef44384bb957edc35c3b29ca9c2b5aa09c4f6599d807b4947cf27e1b66438
Opcode Fuzzy Hash: b4164f6d4685f9dc647e4ff3c01fe10f2011dd5ecc3773d6662f2e0acad5b2fb
Instruction Fuzzy Hash: CF3173F1D003059AEB10BBB2AD067DE7660AF5434CF10013FE9196B2C2FB799954CA9B

Uniqueness

Uniqueness Score: -1.00%

Function 0040B4D7 Relevance: 7.8, APIs: 5, Instructions: 252
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__CrtCheckMemory.LIBCMTD ref: 0040B4FA
__heap_alloc_base.LIBCMTD ref: 0040B681
_memset.LIBCMT ref: 0040B7C9
_memset.LIBCMT ref: 0040B7E6
_memset.LIBCMT ref: 0040B801

Memory Dump Source

Source File: 00000000.00000002.386662790.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: _memset$CheckMemory__heap_alloc_base
String ID:
API String ID: 4254127243-0
Opcode ID: 782c486867dbfdf79707c8b7b84721dc0e730895fb2ba11e1fecccc80f7ba8a3
Instruction ID: 10aa9e1e72f509eec9c2030512bc02d8ab3a9285472f538c0d3528d51176eff9
Opcode Fuzzy Hash: 782c486867dbfdf79707c8b7b84721dc0e730895fb2ba11e1fecccc80f7ba8a3
Instruction Fuzzy Hash: 59A14A79A002049FDB14DF44DC85BAE77B1FB89314F20826AE9056B3D2D379AD40CF99

Uniqueness

Uniqueness Score: -1.00%

Function 00409630 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 421
memorylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LocalAlloc.KERNELBASE(00000000), ref: 00409649
_memset.LIBCMT ref: 004097B4
LoadLibraryW.KERNELBASE(00844200), ref: 00409966

Strings

msimg32.dll, xrefs: 00409741, 00409753, 00409838, 0040984D, 00409854

Memory Dump Source

Source File: 00000000.00000002.386662790.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: AllocLibraryLoadLocal_memset
String ID: msimg32.dll
API String ID: 3001991562-3287713914
Opcode ID: 3c6d298495194a7d43d133cce53dba0bfa3f0cc23cecebb99af27589142207ee
Instruction ID: 4bbf95d1d07f5b793a551445cec3f97fb7520ad9971ce6f5d0ca53ce5d14d8fc
Opcode Fuzzy Hash: 3c6d298495194a7d43d133cce53dba0bfa3f0cc23cecebb99af27589142207ee
Instruction Fuzzy Hash: A4D1E1B6800258BFE7016BB0EDC8EAB776CFB19349B005436F646E1572D6788D85CB78

Uniqueness

Uniqueness Score: -1.00%

Function 004190F0 Relevance: 6.3, APIs: 4, Instructions: 326
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__nh_malloc_dbg.LIBCMTD ref: 0041917B
__nh_malloc_dbg.LIBCMTD ref: 004192A7

Memory Dump Source

Source File: 00000000.00000002.386662790.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: __nh_malloc_dbg
String ID:
API String ID: 2526938719-0
Opcode ID: 1dedd40c212b86d737cc42a500783f936d07058c4a6aec1a18194dda0f85cf9a
Instruction ID: 7fdf9e2f47d08c1cdaf3c05fa1e569e8f274e39fd4e0f730588c364ff7165eea
Opcode Fuzzy Hash: 1dedd40c212b86d737cc42a500783f936d07058c4a6aec1a18194dda0f85cf9a
Instruction Fuzzy Hash: 8FE11B74E04249DFDB24CFA8C894BADFBB1BB49314F24825ED8656B392C7349886CF45

Uniqueness

Uniqueness Score: -1.00%

Function 0040952F Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 50
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(00000040,?), ref: 0040962A

Strings

msimg32.dll, xrefs: 00409536, 0040953B, 0040959D

Memory Dump Source

Source File: 00000000.00000002.386662790.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: ProtectVirtual
String ID: msimg32.dll
API String ID: 544645111-3287713914
Opcode ID: 17b0aac0a531702174b7c65180c391707bf38b3425d045184fdffbf97c0d013b
Instruction ID: 9b7cfc5e17716be782b59f166dd39e07db881f3a278859cfbeeeb5f88a7b37f4
Opcode Fuzzy Hash: 17b0aac0a531702174b7c65180c391707bf38b3425d045184fdffbf97c0d013b
Instruction Fuzzy Hash: F7219A98E08AC1DAF306C768ED08B913E965723749F0A00BD91954A2B2E7FB5158C77F

Uniqueness

Uniqueness Score: -1.00%

Function 00409531 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 49
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(00000040,?), ref: 0040962A

Strings

msimg32.dll, xrefs: 00409536, 0040953B, 0040959D

Memory Dump Source

Source File: 00000000.00000002.386662790.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: ProtectVirtual
String ID: msimg32.dll
API String ID: 544645111-3287713914
Opcode ID: 86775875dd883554000b779353b5ca5ef6f1083c8ec8bb8f7521579d1f137b51
Instruction ID: 07589be915f535defbfa72ec759fc0598ce49b4d87d3ca622b32015d16d1199b
Opcode Fuzzy Hash: 86775875dd883554000b779353b5ca5ef6f1083c8ec8bb8f7521579d1f137b51
Instruction Fuzzy Hash: 6521A998E0CAC1DAF306C768ED08B913E965723749F0A00BD91954A2B2E7FB5158C77F

Uniqueness

Uniqueness Score: -1.00%

Function 0040B43F Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

QQ, xrefs: 0040B439

Memory Dump Source

Source File: 00000000.00000002.386662790.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID:
String ID: QQ
API String ID: 0-3460843698
Opcode ID: 75285a33f3e3a8226227495b54544be31729fa98091c7b21b9d872baf7ad745d
Instruction ID: 8ebcda0000eecf523cbd085e01e090e350d6b15ac35dbad072ca10934f5ebcd5
Opcode Fuzzy Hash: 75285a33f3e3a8226227495b54544be31729fa98091c7b21b9d872baf7ad745d
Instruction Fuzzy Hash: D301FBB5A00109EBDB04DF54D840BAE73B4EB48304F10816AFD09A7382D339DB51DB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040B84E Relevance: 3.1, APIs: 2, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__invalid_parameter.LIBCMTD ref: 0040B8AD
_memset.LIBCMT ref: 0040B8F9

Memory Dump Source

Source File: 00000000.00000002.386662790.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: __invalid_parameter_memset
String ID:
API String ID: 3961059608-0
Opcode ID: 05b10813307af71d25597e47c8649d7a6d084c0bb43746682a81a9517d95371d
Instruction ID: 1324000d97abd66836b031af892333075081cfb50ad0cef0dc97aef94c640520
Opcode Fuzzy Hash: 05b10813307af71d25597e47c8649d7a6d084c0bb43746682a81a9517d95371d
Instruction Fuzzy Hash: DC1166B1A40208BBDB04DF94CC82F9E3375EB54704F10856AF908BB3D1E778EA508799

Uniqueness

Uniqueness Score: -1.00%

Function 00419164 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

__nh_malloc_dbg.LIBCMTD ref: 0041917B
__nh_malloc_dbg.LIBCMTD ref: 004192A7

Memory Dump Source

Source File: 00000000.00000002.386662790.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: __nh_malloc_dbg
String ID:
API String ID: 2526938719-0
Opcode ID: f9bf8707853167085b66593613993b00e5ed86952c72447d674ae544adeca308
Instruction ID: c4f57cec82e4bd0dba32cc6c1f0b5ad598e6c7fbc5f644fcfa7b04f801fa35e6
Opcode Fuzzy Hash: f9bf8707853167085b66593613993b00e5ed86952c72447d674ae544adeca308
Instruction Fuzzy Hash: 95E020B1E84308A9E7309AA5580775C7720E744B31F20472FE235362C2D77504404F09

Uniqueness

Uniqueness Score: -1.00%

Function 00412400 Relevance: 1.5, APIs: 1, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

__encode_pointer.LIBCMTD ref: 00412407

Part of subcall function 00412330: __crt_wait_module_handle.LIBCMTD ref: 0041237C
Part of subcall function 00412330: RtlEncodePointer.NTDLL(?), ref: 004123B7

Memory Dump Source

Source File: 00000000.00000002.386662790.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: EncodePointer__crt_wait_module_handle__encode_pointer
String ID:
API String ID: 2010845264-0
Opcode ID: f00befe9f6ce37f0a9e0ee05923ac5330ac6df44ba7645856ef0dc2498812e42
Instruction ID: 017c5cb46a1c4d55b1340ad0c3270c38816836f5326e70259e7eaab19cdf7902
Opcode Fuzzy Hash: f00befe9f6ce37f0a9e0ee05923ac5330ac6df44ba7645856ef0dc2498812e42
Instruction Fuzzy Hash: 13A0127244420C23E00020933903B03750C43C0638F080021F91C051422886B5604097

Uniqueness

Uniqueness Score: -1.00%

Function 0040AE90 Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

___security_init_cookie.LIBCMTD ref: 0040AE95

Part of subcall function 0040AEB0: _check_managed_app.LIBCMTD ref: 0040AF2C
Part of subcall function 0040AEB0: __heap_init.LIBCMTD ref: 0040AF36
Part of subcall function 0040AEB0: _fast_error_exit.LIBCMTD ref: 0040AF44
Part of subcall function 0040AEB0: __mtinit.LIBCMTD ref: 0040AF4C
Part of subcall function 0040AEB0: _fast_error_exit.LIBCMTD ref: 0040AF57
Part of subcall function 0040AEB0: __RTC_Initialize.LIBCMTD ref: 0040AF69
Part of subcall function 0040AEB0: ___crtGetEnvironmentStringsA.LIBCMTD ref: 0040AF93
Part of subcall function 0040AEB0: ___setargv.LIBCMTD ref: 0040AF9D
Part of subcall function 0040AEB0: __setenvp.LIBCMTD ref: 0040AFB0
Part of subcall function 0040AEB0: __cinit.LIBCMTD ref: 0040AFC5
Part of subcall function 0040AEB0: __wincmdln.LIBCMTD ref: 0040AFE2

Memory Dump Source

Source File: 00000000.00000002.386662790.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: _fast_error_exit$EnvironmentInitializeStrings___crt___security_init_cookie___setargv__cinit__heap_init__mtinit__setenvp__wincmdln_check_managed_app
String ID:
API String ID: 2731678867-0
Opcode ID: ee8f2d7c38ba407090a88614530fa8bfefe5418cda479201f07807e08c8461eb
Instruction ID: 4163ddfda7dbc0b273293bbe506c37d36eb456cb6e14ae8899fefb7f074ccf43
Opcode Fuzzy Hash: ee8f2d7c38ba407090a88614530fa8bfefe5418cda479201f07807e08c8461eb
Instruction Fuzzy Hash: DCA02232080B0C02020033E3200B80B320E08C032C382002FBA0C022032C3CB8A000EF

Uniqueness

Uniqueness Score: -1.00%

Function 00C2D433 Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 00C2D484

Memory Dump Source

Source File: 00000000.00000002.387378506.0000000000C29000.00000040.00000020.00020000.00000000.sdmp, Offset: 00C29000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c29000_file.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: cfc63c62d0c90ba13af681c36c5d70acb37e439cc15c3841b02a59110d57d969
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: E2113C79A00208EFDB01DF98C985E98BBF5AF08751F158094F9489B362D375EA50EF80

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 004014DF Relevance: 1.4, Strings: 1, Instructions: 139COMMON

Download Yara Rule

Strings

PPPP, xrefs: 004015E9

Memory Dump Source

Source File: 00000000.00000002.386623017.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID: PPPP
API String ID: 0-1462104750
Opcode ID: c9c0241cd0afcbd3fd31c594775fe31887d42f61bb82ab006a020ba5247fe7de
Instruction ID: 42034d581ce3fc54d6be9e219e9e8320d81d709d73c932a33cf25b948e6a08f8
Opcode Fuzzy Hash: c9c0241cd0afcbd3fd31c594775fe31887d42f61bb82ab006a020ba5247fe7de
Instruction Fuzzy Hash: 38418EF2019A827FE3124F20DC5ACFB7B7DD94921130886CAF894DB952C6595895C7F3

Uniqueness

Uniqueness Score: -1.00%

Function 00402351 Relevance: .1, Instructions: 144
COMMON

Download Yara Rule

C-Code - Quality: 22%

			E00402351(void* __eax, intOrPtr* __ebx, signed int __ecx, void* __edx, void* __edi, void* __esi) {
				void* _t36;
				void* _t37;
				void* _t38;
				void* _t39;
				void* _t41;
				void* _t42;
				signed int _t43;
				signed int _t44;
				signed int _t45;
				signed int _t46;
				signed char _t47;
				signed int _t50;
				signed int _t51;
				signed int _t52;
				signed int _t53;
				signed char _t54;
				void* _t70;
				void* _t72;
				void* _t77;
				void* _t79;
				void* _t81;
				void* _t82;

				_t79 = __esi;
				_t70 = __edx;
				_pop(_t84);
				asm("fst qword [0x9c2ddd94]");
				_t72 = __eax + 0x3af0294;
				_push(_t72);
				_t36 = __edi - 1;
				_push(_t36);
				_push(_t36);
				_t37 = _t72;
				ss = _t36;
				_push(_t37);
				_push(_t37);
				asm("fst dword [edi]");
				_t38 = _t37;
				_t39 = _t36;
				ss = _t37;
				asm("adc [eax+0x50], dl");
				ss = _t39;
				_t41 = _t38 + 1;
				_push(_t41);
				_push(_t41);
				_push(_t41);
				_t42 = _t39;
				ss = _t41;
				_push(_t42);
				_push(_t42);
				_push(_t42);
				es = _t42;
				_t43 = _t42 + 0xc3af02b4;
				asm("fcom qword [eax+0x50]");
				asm("aad 0x90");
				_t77 = _t43;
				asm("aad 0x96");
				_push(_t43);
				_push(_t43);
				_push(_t43);
				_push(__edx);
				asm("scasd");
				_t44 = _t43 & 0xc0c3afb4;
				_push(_t44);
				_push(_t44);
				_push(_t44);
				 *0xd45f50bc =  *0xd45f50bc >> __ecx;
				asm("repe push eax");
				_push(_t44);
				_push(_t44);
				asm("scasd");
				_t45 = _t44 & 0xaf103abc;
				_t82 = _t81 +  *((intOrPtr*)(_t45 - 0x27));
				asm("adc eax, 0xbc05dda4");
				asm("movsb");
				_t46 = _t45 & 0xc0c3afb4;
				_push(_t46);
				_push(_t46);
				_push(_t46);
				asm("aad 0x90");
				_t47 = _t46 & 0xbc2dd329;
				_push(_t47);
				asm("fist dword [0x4410dba4]");
				asm("fst dword [0x6baf61a8]");
				_t50 = (_t47 & 0x00000023) - 0xdd3323a8 + 0x503a02bc;
				es = _t50;
				asm("scasd");
				_t51 = _t50 & 0xc4c3afb4;
				_push(_t51);
				_push(_t51);
				_push(_t51);
				 *0x162450bc =  *0x162450bc >> __ecx +  *((intOrPtr*)(_t77 + 0x25afbc25));
				asm("rcl dword [0x25af52bc], cl");
				_push(0xdda015d9);
				_t52 = _t51 + 0x25af02bc;
				es = _t52;
				asm("scasd");
				_t53 = _t52 & 0xc4c3afb4;
				_push(_t53);
				_push(_t53);
				_push(_t53);
				asm("aad 0x90");
				_t54 = _t53 & 0xbc2dd347;
				asm("fist dword [0x4010dda0]");
				 *__ebx =  *__ebx + (_t54 & 0x00000041);
				asm("aad 0x90");
				asm("scasd");
				ss = _t54;
				goto L1;
			}

0x00402351
0x00402351
0x00402356
0x00402357
0x0040235d
0x0040235e
0x0040235f
0x00402360
0x00402361
0x00402363
0x00402364
0x00402366
0x00402367
0x0040236a
0x0040236c
0x0040236d
0x0040236e
0x00402370
0x00402375
0x00402376
0x00402377
0x00402378
0x00402379
0x0040237b
0x0040237c
0x0040237e
0x0040237f
0x00402380
0x00402382
0x00402386
0x0040238b
0x0040238f
0x00402391
0x00402392
0x00402394
0x00402395
0x00402396
0x004023a0
0x004023a1
0x004023a2
0x004023a7
0x004023a8
0x004023a9
0x004023aa
0x004023b0
0x004023b2
0x004023b3
0x004023b4
0x004023b5
0x004023ba
0x004023bd
0x004023c8
0x004023cc
0x004023d1
0x004023d2
0x004023d3
0x004023d4
0x004023d6
0x004023db
0x004023de
0x004023e4
0x004023ef
0x004023f8
0x004023f9
0x004023fa
0x004023ff
0x00402400
0x00402401
0x00402402
0x00402408
0x00402413
0x00402418
0x00402423
0x00402424
0x00402425
0x0040242a
0x0040242b
0x0040242c
0x0040242d
0x0040242f
0x00402437
0x0040243d
0x00402444
0x00402448
0x0040244e
0x0040244f

Memory Dump Source

Source File: 00000000.00000002.386623017.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb95eb28c3ea5ceec2e3033c146810c6e2f5aab3d7c853bbb481ccd21ba1313a
Instruction ID: c5558df752f303d9b12da3b49636c5f29c6388f54a3b64fc1eef45c3947951cf
Opcode Fuzzy Hash: cb95eb28c3ea5ceec2e3033c146810c6e2f5aab3d7c853bbb481ccd21ba1313a
Instruction Fuzzy Hash: 63417AF311AA857FF3118A94EC4ADFB7B2CD5681393084485FD40DB403C268C8A18BB1

Uniqueness

Uniqueness Score: -1.00%

Function 00C2D051 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.387378506.0000000000C29000.00000040.00000020.00020000.00000000.sdmp, Offset: 00C29000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c29000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 1f6a2f75c2e6e93589fcf906e85326adb32d419ce6d942cbeb874e38180baec2
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 9311C2723401109FD700DF55EC81FA273EAEB98320B298055ED05CB722D675EC02C760

Uniqueness

Uniqueness Score: -1.00%

Function 00402072 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.386623017.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13551ef71cb1a6f447fbd5480a6cb103b1654af51dbb33939e4de5ef2e619886
Instruction ID: 1d2253bcee00caf847626527a2ca008675ce4aadaffea8765609509fba5c1da7
Opcode Fuzzy Hash: 13551ef71cb1a6f447fbd5480a6cb103b1654af51dbb33939e4de5ef2e619886
Instruction Fuzzy Hash: 80D022B2864CA0AFEB006210CC1896B7FAC8C15210708C080B801E9119C30810218BB1

Uniqueness

Uniqueness Score: -1.00%

Function 00401EFD Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.386623017.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c4fbf70458648bca6f8a21e4b213d349669eb636f4c34a3048d8fef98564362
Instruction ID: 19ab161c9d805c9666a3c863c0cbb36cd8fc6fea7ed9fd7909dadc4bd56c9e04
Opcode Fuzzy Hash: 2c4fbf70458648bca6f8a21e4b213d349669eb636f4c34a3048d8fef98564362
Instruction Fuzzy Hash: 48D022B2804CA4AFEB006600CC149AB7FAD8C14310B08C040B801E5119C3091026CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 0041C68E Relevance: 51.2, APIs: 25, Strings: 4, Instructions: 431COMMON

Download Yara Rule

APIs

__invoke_watson_if_error.LIBCMTD ref: 0041C6D2
_wcscat_s.LIBCMTD ref: 0041C8EA

Part of subcall function 00421870: __invalid_parameter.LIBCMTD ref: 004218E2

__invoke_watson_if_error.LIBCMTD ref: 0041C8F3

Part of subcall function 0040DBB0: __invoke_watson.LIBCMTD ref: 0040DBD1

_wcscat_s.LIBCMTD ref: 0041C922

Part of subcall function 00421870: _memset.LIBCMT ref: 0042194B
Part of subcall function 00421870: __invalid_parameter.LIBCMTD ref: 004219A7

__invoke_watson_if_error.LIBCMTD ref: 0041C92B
__snwprintf_s.LIBCMTD ref: 0041C984

Part of subcall function 0041BFE0: __vsnprintf_s_l.LIBCMTD ref: 0041C002

__invoke_watson_if_oneof.LIBCMTD ref: 0041C9BD
_wcscpy_s.LIBCMTD ref: 0041CA02
__invoke_watson_if_error.LIBCMTD ref: 0041CA0B
__cftoe.LIBCMTD ref: 0041CA7F
__invoke_watson_if_oneof.LIBCMTD ref: 0041CAAE
_wcscpy_s.LIBCMTD ref: 0041CAE6
__invoke_watson_if_error.LIBCMTD ref: 0041CAEF
__itow_s.LIBCMTD ref: 0041C6C9

Part of subcall function 00426280: _xtow_s@20.LIBCMTD ref: 004262AB

__strftime_l.LIBCMTD ref: 0041C789
__invoke_watson_if_oneof.LIBCMTD ref: 0041C7C2
_wcscpy_s.LIBCMTD ref: 0041C807
__invoke_watson_if_error.LIBCMTD ref: 0041C810
_wcscpy_s.LIBCMTD ref: 0041C863
__invoke_watson_if_error.LIBCMTD ref: 0041C86C
_wcscat_s.LIBCMTD ref: 0041C89D
__invoke_watson_if_error.LIBCMTD ref: 0041C8A6

Strings

t9j, xrefs: 0041CD15
t8j, xrefs: 0041CABD
D\@, xrefs: 0041C850, 0041C856
h8[@, xrefs: 0041C885

Memory Dump Source

Source File: 00000000.00000002.386662790.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: __invoke_watson_if_error$_wcscpy_s$__invoke_watson_if_oneof_wcscat_s$__invalid_parameter$__cftoe__invoke_watson__itow_s__snwprintf_s__strftime_l__vsnprintf_s_l_memset_xtow_s@20
String ID: D\@$h8[@$t8j$t9j
API String ID: 2582952045-1301031898
Opcode ID: 8c649d36ace655ee30945a0357195b502b76c5f9a91b9f55d6bee1a9a8e625e2
Instruction ID: 02178abfe23e56a54a67b4c7eb7c84d33cb54055c7f1e4f72fd57db3d001e6e7
Opcode Fuzzy Hash: 8c649d36ace655ee30945a0357195b502b76c5f9a91b9f55d6bee1a9a8e625e2
Instruction Fuzzy Hash: 660293B4A80714AADB20EF50DC8ABDF7374AB44745F5440AAF608762C1D7B89AC4CF99

Uniqueness

Uniqueness Score: -1.00%

Function 00416507 Relevance: 35.4, APIs: 19, Strings: 1, Instructions: 382COMMON

Download Yara Rule

APIs

__inc.LIBCMTD ref: 0041654C
_isdigit.LIBCMTD ref: 00416572
___check_float_string.LIBCMTD ref: 004165D2
__inc.LIBCMTD ref: 004165F0
_isdigit.LIBCMTD ref: 004166A2
___check_float_string.LIBCMTD ref: 00416702
___check_float_string.LIBCMTD ref: 00416689

Part of subcall function 00416C60: __nh_malloc_dbg.LIBCMTD ref: 00416CBD

__inc.LIBCMTD ref: 0041664D

Part of subcall function 00416DC0: __filbuf.LIBCMTD ref: 00416E01

___check_float_string.LIBCMTD ref: 00416796
__inc.LIBCMTD ref: 004167B4
___check_float_string.LIBCMTD ref: 004167F7
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00416B66

Strings

+, xrefs: 0041680C

Memory Dump Source

Source File: 00000000.00000002.386662790.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: ___check_float_string$__inc$Locale_isdigit$UpdateUpdate::~___filbuf__nh_malloc_dbg
String ID: +
API String ID: 1483831053-2126386893
Opcode ID: 3f1cdc535125063f7d7ef7ae872c682c660c3678df03c0684fb82a37ac454917
Instruction ID: 45a2f262c5410c48cc6ad1d3327226c1787b0f07e4967d97fcea125fd92b63d4
Opcode Fuzzy Hash: 3f1cdc535125063f7d7ef7ae872c682c660c3678df03c0684fb82a37ac454917
Instruction Fuzzy Hash: 26F16FB1D042199BCF14CF99C894AEEBB75AF44308F1482AED819A7342D739EA84CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00415FAF Relevance: 30.1, APIs: 15, Strings: 2, Instructions: 387COMMON

Download Yara Rule

APIs

__inc.LIBCMTD ref: 00416001
__inc.LIBCMTD ref: 00416029
__inc.LIBCMTD ref: 0041605C
__un_inc.LIBCMTD ref: 004160E3
_isxdigit.LIBCMTD ref: 0041617D
__hextodec.LIBCMTD ref: 004161B0

Strings

8, xrefs: 00416395
F, xrefs: 0041647B

Memory Dump Source

Source File: 00000000.00000002.386662790.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: __inc$__hextodec__un_inc_isxdigit
String ID: 8$F
API String ID: 3652663768-3144575033
Opcode ID: c694fde765daef34fe86b015504b5841358a78d6cc7151bbf1d403a4172b6c69
Instruction ID: 4e8990ed9834d67cabe5cdc1a52b903055c43b73c622471bf65cd64a9ca038d8
Opcode Fuzzy Hash: c694fde765daef34fe86b015504b5841358a78d6cc7151bbf1d403a4172b6c69
Instruction Fuzzy Hash: 1B028EB0D052698BCF25CF64C8943EEBBB1AF15308F1481DAD8196B342D33A9AC5CF49

Uniqueness

Uniqueness Score: -1.00%

Function 004247F9 Relevance: 30.1, APIs: 15, Strings: 2, Instructions: 368COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00424888
_get_int64_arg.LIBCMTD ref: 004248B0
__aullrem.LIBCMT ref: 00424A55
__aulldiv.LIBCMT ref: 00424A77
_write_multi_char.LIBCMTD ref: 00424B7E
_write_string.LIBCMTD ref: 00424B99
_write_multi_char.LIBCMTD ref: 00424BC5
_wctomb_s.LIBCMTD ref: 00424C42

Strings

9, xrefs: 00424A88
-, xrefs: 00424B1E

Memory Dump Source

Source File: 00000000.00000002.386662790.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: _get_int64_arg_write_multi_char$__aulldiv__aullrem_wctomb_s_write_string
String ID: -$9
API String ID: 3451365851-1631151375
Opcode ID: 73748dadc7ea5df593242549316a037bffe645614e081454c675fba9bebad1a7
Instruction ID: a721a5725b6536229582cc34f6c4b56e6aafc0d91daa9a2dae563fcae3e2e464
Opcode Fuzzy Hash: 73748dadc7ea5df593242549316a037bffe645614e081454c675fba9bebad1a7
Instruction Fuzzy Hash: 9BF14BB1E012298FDB24CF58DC99BAEB7B1FB84304F5481DAD419A7281D7789E80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0042D3BB Relevance: 28.4, APIs: 15, Strings: 1, Instructions: 365COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0042D450
_get_int64_arg.LIBCMTD ref: 0042D478
__aullrem.LIBCMT ref: 0042D620
__aulldiv.LIBCMT ref: 0042D642
_write_multi_char.LIBCMTD ref: 0042D75B
_write_string.LIBCMTD ref: 0042D776
_write_multi_char.LIBCMTD ref: 0042D7A2
__mbtowc_l.LIBCMTD ref: 0042D811

Strings

9, xrefs: 0042D653

Memory Dump Source

Source File: 00000000.00000002.386662790.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: _get_int64_arg_write_multi_char$__aulldiv__aullrem__mbtowc_l_write_string
String ID: 9
API String ID: 3455034128-2366072709
Opcode ID: 530e62bac20449fc3ef16af2ea562a2331bce4f960ca9bf1045f95520d08cb73
Instruction ID: 87f28a10b6e7806872ac3917b900aa704c7eb3b4201bc77d767262b33af21855
Opcode Fuzzy Hash: 530e62bac20449fc3ef16af2ea562a2331bce4f960ca9bf1045f95520d08cb73
Instruction Fuzzy Hash: FDF16CB1E002299FDF24DF58DC81BAEB7B1BF85304F54419AE109A7241D778AE84CF59

Uniqueness

Uniqueness Score: -1.00%

Function 004266F3 Relevance: 25.8, APIs: 17, Instructions: 296COMMON

Download Yara Rule

APIs

_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0042673B
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00426771
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00426792
wcsncnt.LIBCMTD ref: 004267C9
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0042682F
_wcslen.LIBCMTD ref: 00426A3F
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00426A4D

Memory Dump Source

Source File: 00000000.00000002.386662790.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$_wcslenwcsncnt
String ID:
API String ID: 1043867012-0
Opcode ID: fc4f0b37faa7f4946a6c5e9665ee82d9b71174bf5f156293fab80b3a31791081
Instruction ID: 7f75a814af551cf217c73b50f5ce39038cad51a7708300b5ccdc52a67e21c884
Opcode Fuzzy Hash: fc4f0b37faa7f4946a6c5e9665ee82d9b71174bf5f156293fab80b3a31791081
Instruction Fuzzy Hash: 84D12775A00218DFCB08DF94D894BEEB7B1FF85304F60C55AE4126B290DB38AE86DB55

Uniqueness

Uniqueness Score: -1.00%

Function 00424557 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 241COMMON

Download Yara Rule

APIs

_get_int_arg.LIBCMTD ref: 0042455B
__get_printf_count_output.LIBCMTD ref: 00424569
__invalid_parameter.LIBCMTD ref: 004245F0
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00424605
_write_multi_char.LIBCMTD ref: 00424B7E
_write_string.LIBCMTD ref: 00424B99
_write_multi_char.LIBCMTD ref: 00424BC5
_wctomb_s.LIBCMTD ref: 00424C42

Strings

-, xrefs: 00424B1E

Memory Dump Source

Source File: 00000000.00000002.386662790.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: Locale_write_multi_char$UpdateUpdate::~___get_printf_count_output__invalid_parameter_get_int_arg_wctomb_s_write_string
String ID: -
API String ID: 2357813345-2547889144
Opcode ID: d2fd1506c183ec86f59f6aee48fb561d843edaa370c390d2ac749d9266cd7004
Instruction ID: 09383132ef6e3c52153bc865bd17f4b6936478b15fe0a08a49ab86f91775dfed
Opcode Fuzzy Hash: d2fd1506c183ec86f59f6aee48fb561d843edaa370c390d2ac749d9266cd7004
Instruction Fuzzy Hash: F8A18C70E012298BDB24DF59DC49BAEB7B0EB84305F5481DAE1197B281D778AEC0CF59

Uniqueness

Uniqueness Score: -1.00%

Function 004243A5 Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 225COMMON

Download Yara Rule

APIs

_get_int_arg.LIBCMTD ref: 004243A9
_strlen.LIBCMT ref: 004243D9
_write_multi_char.LIBCMTD ref: 00424B7E
_write_string.LIBCMTD ref: 00424B99
_write_multi_char.LIBCMTD ref: 00424BC5
_wctomb_s.LIBCMTD ref: 00424C42

Strings

I@, xrefs: 004243CC
-, xrefs: 00424B1E

Memory Dump Source

Source File: 00000000.00000002.386662790.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: _write_multi_char$_get_int_arg_strlen_wctomb_s_write_string
String ID: -$I@
API String ID: 2232461714-3662616159
Opcode ID: c4d7bbb1e4a35970b1e2731a79c68ebfb12efde7635d023d49e88d8b318ebf39
Instruction ID: 504cf34f6a1f140e24b7c590ea058f5024a33f02ea29967f28fa7e95d4e844db
Opcode Fuzzy Hash: c4d7bbb1e4a35970b1e2731a79c68ebfb12efde7635d023d49e88d8b318ebf39
Instruction Fuzzy Hash: 7EA18F74E012298FDB24CF55DC49BEEB7B0EB88305F5481DAD0196B291D778AE80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00415C3C Relevance: 17.8, APIs: 6, Strings: 4, Instructions: 256COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00415C84
__un_inc.LIBCMTD ref: 00415DD8
__inc.LIBCMTD ref: 00415E0A
__inc.LIBCMTD ref: 00415EC9
__mbtowc_l.LIBCMTD ref: 00415F0B
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00416B66

Strings

, xrefs: 00415E43
{, xrefs: 00415E4C
{, xrefs: 00415DB2
], xrefs: 00415C9D

Memory Dump Source

Source File: 00000000.00000002.386662790.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: Locale__inc$UpdateUpdate::~___mbtowc_l__un_inc_memset
String ID: $]${${
API String ID: 2643002128-1336171634
Opcode ID: a0d6f3a7a88c6dea91ec17ea94e745941b8181ae169e3f2fdeed4f4618f4c2ce
Instruction ID: 733e9da3a28c0a21848e95e8901b80b5ba50e6ecae14809abc89287093d81474
Opcode Fuzzy Hash: a0d6f3a7a88c6dea91ec17ea94e745941b8181ae169e3f2fdeed4f4618f4c2ce
Instruction Fuzzy Hash: A6B1D670D09798CBCF15CBA9D4946EDBBB1AF46304F14C19FE869AB342C2389A81CF15

Uniqueness

Uniqueness Score: -1.00%

Function 0042CF44 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 222COMMON

Download Yara Rule

APIs

_get_int_arg.LIBCMTD ref: 0042CF48
_strlen.LIBCMT ref: 0042CF78
_write_multi_char.LIBCMTD ref: 0042D75B
_write_string.LIBCMTD ref: 0042D776
_write_multi_char.LIBCMTD ref: 0042D7A2
__mbtowc_l.LIBCMTD ref: 0042D811

Strings

I@, xrefs: 0042CF6B

Memory Dump Source

Source File: 00000000.00000002.386662790.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: _write_multi_char$__mbtowc_l_get_int_arg_strlen_write_string
String ID: I@
API String ID: 909868375-3008766272
Opcode ID: 5160bf8aaf3c93fb7daea3ac61722fa4b3b9303f281fa05acda3142a6fb74e5b
Instruction ID: aeb1a302864e0295b61b224f0f41cef40e82057aba0da1d2740614cba2eebc2e
Opcode Fuzzy Hash: 5160bf8aaf3c93fb7daea3ac61722fa4b3b9303f281fa05acda3142a6fb74e5b
Instruction Fuzzy Hash: 1AA181B0E002289FDB24DF55DC81BAEB7B5BF44304F54819AE61967282D738AE84CF5D

Uniqueness

Uniqueness Score: -1.00%

Function 0042D11A Relevance: 16.7, APIs: 11, Instructions: 238COMMON

Download Yara Rule

APIs

_get_int_arg.LIBCMTD ref: 0042D11E
__get_printf_count_output.LIBCMTD ref: 0042D12C
__invalid_parameter.LIBCMTD ref: 0042D1B3
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0042D1C8
_write_multi_char.LIBCMTD ref: 0042D75B
_write_string.LIBCMTD ref: 0042D776
_write_multi_char.LIBCMTD ref: 0042D7A2
__mbtowc_l.LIBCMTD ref: 0042D811

Memory Dump Source

Source File: 00000000.00000002.386662790.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: Locale_write_multi_char$UpdateUpdate::~___get_printf_count_output__invalid_parameter__mbtowc_l_get_int_arg_write_string
String ID:
API String ID: 2386203720-0
Opcode ID: f607765c8f2682145a9edb787064b82d444e2ed9b0f04ad2e4101b47de9843e8
Instruction ID: 08d3cf6121706dbf829b6d05311f1c81cf8396b18442ce7c14708cc00a2cbdda
Opcode Fuzzy Hash: f607765c8f2682145a9edb787064b82d444e2ed9b0f04ad2e4101b47de9843e8
Instruction Fuzzy Hash: 61A1AFF0E002289BDB24DF55DC85BAEB774AF84304F50419AE6197B282D778AE84CF5D

Uniqueness

Uniqueness Score: -1.00%

Function 00415BEA Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 205COMMON

Download Yara Rule

APIs

__un_inc.LIBCMTD ref: 00415DD8
__inc.LIBCMTD ref: 00415E0A
__inc.LIBCMTD ref: 00415EC9
__mbtowc_l.LIBCMTD ref: 00415F0B

Strings

, xrefs: 00415E43
c, xrefs: 00415F85

Memory Dump Source

Source File: 00000000.00000002.386662790.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: __inc$__mbtowc_l__un_inc
String ID: $c
API String ID: 579247601-3797896886
Opcode ID: 98046de7fd322e1f917b2e6fd8048b3892d2d27587e911f3b1c5c2ec91a3c4cd
Instruction ID: 7ecbc0b786a77850220586fe59660f87f2dbd110734eb0342331823304e5aa8a
Opcode Fuzzy Hash: 98046de7fd322e1f917b2e6fd8048b3892d2d27587e911f3b1c5c2ec91a3c4cd
Instruction Fuzzy Hash: B8918F70D05758DBCF24CF95D8946EEBB71AF85308F14819AE829AB342D7389AC1CF09

Uniqueness

Uniqueness Score: -1.00%

Function 00419BB7 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 100windowCOMMON

Download Yara Rule

APIs

__snwprintf_s.LIBCMTD ref: 00419C5B
__invoke_watson_if_oneof.LIBCMTD ref: 00419C8E
_wcscpy_s.LIBCMTD ref: 00419CD0
__invoke_watson_if_error.LIBCMTD ref: 00419CD9
___crtMessageBoxW.LIBCMTD ref: 00419CF2
_raise.LIBCMTD ref: 00419D0B

Strings

`D@, xrefs: 00419C28, 00419C2E
^9@, xrefs: 00419BDF

Memory Dump Source

Source File: 00000000.00000002.386662790.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: Message___crt__invoke_watson_if_error__invoke_watson_if_oneof__snwprintf_s_raise_wcscpy_s
String ID: ^9@$`D@
API String ID: 1485069716-273578848
Opcode ID: 61b2dbe9ec1f8faa36acc654127eec5d54c4783b504d953776bc1184599c36c0
Instruction ID: c0e6340a1cda6ef02aac5938a198a3969f3bcb851ff0069ec62fe23309543b73
Opcode Fuzzy Hash: 61b2dbe9ec1f8faa36acc654127eec5d54c4783b504d953776bc1184599c36c0
Instruction Fuzzy Hash: 7C316AB5A40218ABDB24DB91DC46FDA73B5BB58744F0041EAF308762C1D6B85EC08F99

Uniqueness

Uniqueness Score: -1.00%

Function 0040C205 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 264memoryCOMMON

Download Yara Rule

APIs

_CheckBytes.LIBCMTD ref: 0040C219
__CrtIsValidHeapPointer.LIBCMTD ref: 0040C2A5
_CheckBytes.LIBCMTD ref: 0040C350
_CheckBytes.LIBCMTD ref: 0040C40A
_memset.LIBCMT ref: 0040C501
__free_base.LIBCMTD ref: 0040C50D

Strings

tDj, xrefs: 0040C25B

Memory Dump Source

Source File: 00000000.00000002.386662790.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: BytesCheck$HeapPointerValid__free_base_memset
String ID: tDj
API String ID: 25084783-2513116121
Opcode ID: b9adceee1fe61f2cee6d43c756ee87a5a7a58a641edfea7588e9ec640f752860
Instruction ID: faefe7da996400bbef58c54e5170c74f93222f4de7125747aeed027e64bc3a06
Opcode Fuzzy Hash: b9adceee1fe61f2cee6d43c756ee87a5a7a58a641edfea7588e9ec640f752860
Instruction Fuzzy Hash: C591B175A40204EBEB28DB84DDC2F6A7375AB44708F344269F604BB2C2D279EE41D79D

Uniqueness

Uniqueness Score: -1.00%

Function 00415C24 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 108COMMON

Download Yara Rule

APIs

__un_inc.LIBCMTD ref: 00415DD8
__inc.LIBCMTD ref: 00415E0A
__inc.LIBCMTD ref: 00415EC9
__mbtowc_l.LIBCMTD ref: 00415F0B

Strings

, xrefs: 00415E43
{, xrefs: 00415E4C

Memory Dump Source

Source File: 00000000.00000002.386662790.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: __inc$__mbtowc_l__un_inc
String ID: ${
API String ID: 579247601-4046706400
Opcode ID: c4822b5e9e88f4911f299a29db30f343fa9385594b584e860edcc568e7ba0c09
Instruction ID: f8bebf5dfd94e6c9dc363e16e45155c9ab91aad30fd5ed40b4ee189f875d7f82
Opcode Fuzzy Hash: c4822b5e9e88f4911f299a29db30f343fa9385594b584e860edcc568e7ba0c09
Instruction Fuzzy Hash: C54190B4D05758DBCF24CB95D8446EEBB71AF85305F14C1AEE429A7202D7389AC5CF09

Uniqueness

Uniqueness Score: -1.00%

Function 00424827 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 104COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00424888
__aullrem.LIBCMT ref: 00424A55
__aulldiv.LIBCMT ref: 00424A77

Strings

9, xrefs: 00424A88
', xrefs: 00424827
0, xrefs: 00424843

Memory Dump Source

Source File: 00000000.00000002.386662790.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: '$0$9
API String ID: 3120068967-269856862
Opcode ID: 61ff73877e2c891499c3fb64a8486ea2c305938b2ba7b0e0e707b528870ff651
Instruction ID: 26c336a9f065971cb0d320951b209e2e278aa466309384de1234029c3de788cf
Opcode Fuzzy Hash: 61ff73877e2c891499c3fb64a8486ea2c305938b2ba7b0e0e707b528870ff651
Instruction Fuzzy Hash: B941F4B1E15229DFDB24CF58E899BAEB7B5FB84304F5481DAD448A7240C7389E81CF49

Uniqueness

Uniqueness Score: -1.00%

Function 00417D28 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 104COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00417D89
__aullrem.LIBCMT ref: 00417F56
__aulldiv.LIBCMT ref: 00417F78

Strings

', xrefs: 00417D28
9, xrefs: 00417F89
0, xrefs: 00417D44

Memory Dump Source

Source File: 00000000.00000002.386662790.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: '$0$9
API String ID: 3120068967-269856862
Opcode ID: 0685f91b45cbdf0ca138cdfba6d584006a9b8105de1a8e68d10636028a782ff3
Instruction ID: 66da96a2bac71dcb13fa53c53b410c2ec7dc3b67ccd4c81c7949b8dad1257f88
Opcode Fuzzy Hash: 0685f91b45cbdf0ca138cdfba6d584006a9b8105de1a8e68d10636028a782ff3
Instruction Fuzzy Hash: AE41D3719082299FDB64CF58C989BEEB7B5BB84304F1445DAE409AB241C7389EC1CF45

Uniqueness

Uniqueness Score: -1.00%

Function 00415FCA Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 92COMMON

Download Yara Rule

APIs

__inc.LIBCMTD ref: 00416029
__inc.LIBCMTD ref: 0041605C
_isxdigit.LIBCMTD ref: 0041617D
__hextodec.LIBCMTD ref: 004161B0
_isdigit.LIBCMTD ref: 004161D6
__inc.LIBCMTD ref: 004162C0
__un_inc.LIBCMTD ref: 004162E4

Strings

0, xrefs: 0041600F
p, xrefs: 0041616F

Memory Dump Source

Source File: 00000000.00000002.386662790.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: __inc$__hextodec__un_inc_isdigit_isxdigit
String ID: 0$p
API String ID: 500523077-2059906072
Opcode ID: 04da5069397b075e653506d4188bde8c25525b423427e154921d5491573031cb
Instruction ID: 6b59d60e470b2688df4fca62ab249f9125279fcdb80552354e7482094790bb3c
Opcode Fuzzy Hash: 04da5069397b075e653506d4188bde8c25525b423427e154921d5491573031cb
Instruction Fuzzy Hash: 75414CB1D042A99ACF25CF65C8942EEBB71AF05308F2581EFD81966302D239DAC5CF49

Uniqueness

Uniqueness Score: -1.00%

Function 00424814 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 106COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00424888
__aullrem.LIBCMT ref: 00424A55
__aulldiv.LIBCMT ref: 00424A77

Strings

9, xrefs: 00424A88
0, xrefs: 00424843

Memory Dump Source

Source File: 00000000.00000002.386662790.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 0$9
API String ID: 3120068967-1975997740
Opcode ID: adf89d3c19f081dca0014650f750430d885a7cf6bbcb9a16a6fa2b3a43d07e97
Instruction ID: 74cb3aa1fb84b278cd05ca6ea8a4370dc3a41d3c72b4f31d23988da057b4ed0c
Opcode Fuzzy Hash: adf89d3c19f081dca0014650f750430d885a7cf6bbcb9a16a6fa2b3a43d07e97
Instruction Fuzzy Hash: 114105B1E15228DFDB24CF58E889BAEBBB5FB84304F50819AD448A7240C7385E81CF49

Uniqueness

Uniqueness Score: -1.00%

Function 00417D15 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 106COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00417D89
__aullrem.LIBCMT ref: 00417F56
__aulldiv.LIBCMT ref: 00417F78

Strings

9, xrefs: 00417F89
0, xrefs: 00417D44

Memory Dump Source

Source File: 00000000.00000002.386662790.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 0$9
API String ID: 3120068967-1975997740
Opcode ID: 65d4fb54393684fd377d7b0f3d77692b0563070c7f279eb9e5d07005dacc9ba6
Instruction ID: e675631b09abcb4a3db81451e5924fefa61cd99c30674d547d3908986f46349b
Opcode Fuzzy Hash: 65d4fb54393684fd377d7b0f3d77692b0563070c7f279eb9e5d07005dacc9ba6
Instruction Fuzzy Hash: 5041E2B1D082299FDB64CF48C989BEEB7B5BB84304F1445DAE449AB241C7389EC1CF49

Uniqueness

Uniqueness Score: -1.00%

Function 0042D3E9 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 105COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0042D450
__aullrem.LIBCMT ref: 0042D620
__aulldiv.LIBCMT ref: 0042D642

Strings

', xrefs: 0042D3E9
9, xrefs: 0042D653

Memory Dump Source

Source File: 00000000.00000002.386662790.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: '$9
API String ID: 3120068967-1823400153
Opcode ID: b53842285cc36683f1c6ce8fb90574166aff5df858b6c8ef311ad64556746230
Instruction ID: 88a54ba87f90a9f5b032cfd84d745c94e298abe8153fd9a8b2ffa27ed5e4d3c8
Opcode Fuzzy Hash: b53842285cc36683f1c6ce8fb90574166aff5df858b6c8ef311ad64556746230
Instruction Fuzzy Hash: 994107B1E10129AFDF24CF48D981BAEB7B5FF85318F50409AD148AB241D7789E81CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 004160F7 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 81COMMON

Download Yara Rule

APIs

__inc.LIBCMTD ref: 00416145
_isxdigit.LIBCMTD ref: 0041617D
__hextodec.LIBCMTD ref: 004161B0

Strings

+, xrefs: 00416110
p, xrefs: 0041616F

Memory Dump Source

Source File: 00000000.00000002.386662790.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: __hextodec__inc_isxdigit
String ID: +$p
API String ID: 3003077261-1790238857
Opcode ID: f8efa3abca31849c5592b86eeb0e740c30bf76091945ac1854910c1bafb44064
Instruction ID: adce234988b22d8bd5ae00344cc608b77643e63ba8c088d33e61c2c02cac5546
Opcode Fuzzy Hash: f8efa3abca31849c5592b86eeb0e740c30bf76091945ac1854910c1bafb44064
Instruction Fuzzy Hash: 33317E70D042999BCF25CFA8C8553EEBB71AF05308F1581EBD85966303D2399AC5CF49

Uniqueness

Uniqueness Score: -1.00%

Function 00414FA1 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

__set_error_mode.LIBCMTD ref: 00415008
__set_error_mode.LIBCMTD ref: 00415017
_strlen.LIBCMT ref: 00415054

Strings

jjj, xrefs: 00414FF0
t/j, xrefs: 00415041

Memory Dump Source

Source File: 00000000.00000002.386662790.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: __set_error_mode$_strlen
String ID: jjj$t/j
API String ID: 3008368703-194299851
Opcode ID: 5237a7f9a8c83429df2317257b9317bfec3c0575f1e6d1d1950fffdc02ce5e66
Instruction ID: 6db5c2610d0dec12d3da948c66cac38ab562fe90bf1a157d35b76242cbf996f9
Opcode Fuzzy Hash: 5237a7f9a8c83429df2317257b9317bfec3c0575f1e6d1d1950fffdc02ce5e66
Instruction Fuzzy Hash: 0A21C174904208FBDB20DB94DD45BEE3770EB89314F2082AAE40567391D3799E91DF8A

Uniqueness

Uniqueness Score: -1.00%

Function 0041E210 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 62COMMON

Download Yara Rule

APIs

__raise_exc.LIBCMTD ref: 0041E231

Part of subcall function 0041E800: __raise_exc_ex.LIBCMTD ref: 0041E81F

__umatherr.LIBCMTD ref: 0041E286

Part of subcall function 0041EB40: __ctrlfp.LIBCMTD ref: 0041EB90

__ctrlfp.LIBCMTD ref: 0041E2AA

Strings

Q., xrefs: 0041E23C
RB, xrefs: 0041E298

Memory Dump Source

Source File: 00000000.00000002.386662790.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: __ctrlfp$__raise_exc__raise_exc_ex__umatherr
String ID: Q.$RB
API String ID: 3448981373-1859500299
Opcode ID: 79aa403e752d0bb788226e970f0c201ec913c65f09f5babb0604909f941a5acb
Instruction ID: 65805f5889b076a55894a1ab3ee9b8424b6840a77c5e5b563534fe767c40347b
Opcode Fuzzy Hash: 79aa403e752d0bb788226e970f0c201ec913c65f09f5babb0604909f941a5acb
Instruction Fuzzy Hash: 9A11A5FA800104DBCF14EF95ECC6ADA7374BF48304F0446DDED454A14AEA35D9A8CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040A0AD Relevance: 7.6, APIs: 5, Instructions: 127COMMON

Download Yara Rule

APIs

___libm_error_support.LIBCMTD ref: 0040A155

Part of subcall function 0040E600: __encode_pointer.LIBCMTD ref: 0040E6E1

Memory Dump Source

Source File: 00000000.00000002.386662790.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: ___libm_error_support__encode_pointer
String ID:
API String ID: 3390238661-0
Opcode ID: f2b5aa644959d262cfab37b3245a945c98fff48b4c57d48cb8fde3180fc3fbeb
Instruction ID: 7b92bbdbbb07480f0aed9223c0c225ba86dfd7bf963a0cba62cf58ff75b82bfd
Opcode Fuzzy Hash: f2b5aa644959d262cfab37b3245a945c98fff48b4c57d48cb8fde3180fc3fbeb
Instruction Fuzzy Hash: 98412935C04704D6CB21AF79DA4516E77B0EF85344F10CB7AF88876291EB348959D34B

Uniqueness

Uniqueness Score: -1.00%

Function 00423881 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 123COMMON

Download Yara Rule

APIs

__isatty.LIBCMTD ref: 00423963
__getbuf.LIBCMTD ref: 00423973
__write.LIBCMTD ref: 004239FB

Strings

8uA, xrefs: 004239F7, 0042395F, 00423962, 004239FA

Memory Dump Source

Source File: 00000000.00000002.386662790.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: __getbuf__isatty__write
String ID: 8uA
API String ID: 2861569966-2259325327
Opcode ID: cc1b0abdc2988826ec5a43669376b69e5abb6e32c2e8dc166d42234ab6b96b39
Instruction ID: 0dd3b1d60e5f64f8659b5d50802fca4c560dc3e1392e070fed4939187e0a6d64
Opcode Fuzzy Hash: cc1b0abdc2988826ec5a43669376b69e5abb6e32c2e8dc166d42234ab6b96b39
Instruction Fuzzy Hash: 87510874A00208EFDB04CF94D491AADFBB1FF89324F548299E8856B391C739EA81CF44

Uniqueness

Uniqueness Score: -1.00%

Function 00426CE4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00426D43
_memset.LIBCMT ref: 00426DCC
__invalid_parameter.LIBCMTD ref: 00426E2B

Strings

P, xrefs: 00426E40

Memory Dump Source

Source File: 00000000.00000002.386662790.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: _memset$__invalid_parameter
String ID: P
API String ID: 2178901135-3110715001
Opcode ID: c1c4b16355b8126a1f74390666c0cf54e97bcb35e05dabf74a386e16d8580c85
Instruction ID: 246fb221c4c39f57b5f0615587a7835857ec6ffcce735e185f1bf46c02527c7d
Opcode Fuzzy Hash: c1c4b16355b8126a1f74390666c0cf54e97bcb35e05dabf74a386e16d8580c85
Instruction Fuzzy Hash: AB418974B04319EBCF24CF58D8857AE7771FB41328F21866AE8252A3C0D3799995CF89

Uniqueness

Uniqueness Score: -1.00%

Function 0042D3D6 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 107COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0042D450
__aullrem.LIBCMT ref: 0042D620
__aulldiv.LIBCMT ref: 0042D642

Strings

9, xrefs: 0042D653

Memory Dump Source

Source File: 00000000.00000002.386662790.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: a9d99888770cab9d7e0f0c34f27cf5cecb2e14e8e89c15b6abf3e2c8dcae7157
Instruction ID: 0f748674789098517c81c6bfd64f9e761f8b5fa2f9a4a8db8edf5eac7631dedc
Opcode Fuzzy Hash: a9d99888770cab9d7e0f0c34f27cf5cecb2e14e8e89c15b6abf3e2c8dcae7157
Instruction Fuzzy Hash: F04117B1E10129AFDF24CF48D881BAEB7B4FF85318F50409AD148AB241D7789E85CF4A

Uniqueness

Uniqueness Score: -1.00%

Function 0042485C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00424888
__aullrem.LIBCMT ref: 00424A55
__aulldiv.LIBCMT ref: 00424A77

Strings

9, xrefs: 00424A88

Memory Dump Source

Source File: 00000000.00000002.386662790.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: 71fc9a78994e6d16d0c1169087281eb279d550b6d0d5854cb0eb6f4c469db18a
Instruction ID: 7d622ab20ed276f116396610c0aec0db95fc003ade2d99466f96e2832dab4621
Opcode Fuzzy Hash: 71fc9a78994e6d16d0c1169087281eb279d550b6d0d5854cb0eb6f4c469db18a
Instruction Fuzzy Hash: 2041E4B1E15229DFEB24CF58EC99BAEB7B5FB84300F50859AD449A7240D7385E81CF48

Uniqueness

Uniqueness Score: -1.00%

Function 0042D424 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0042D450
__aullrem.LIBCMT ref: 0042D620
__aulldiv.LIBCMT ref: 0042D642

Strings

9, xrefs: 0042D653

Memory Dump Source

Source File: 00000000.00000002.386662790.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: d9517b125610d09cf6686e9e1e60e3f7890620e4f9ac7ed4a8b95ee4aad8908b
Instruction ID: c5f49ca03594f23acbc4f4cd6f5b4d54cf19c5277b46b3f938c6ca43fe85ffb3
Opcode Fuzzy Hash: d9517b125610d09cf6686e9e1e60e3f7890620e4f9ac7ed4a8b95ee4aad8908b
Instruction Fuzzy Hash: F54106B1E10129AFDB24CF48DD81BAEB7B5FF85314F508199D148AB241D7789E80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00417D5D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00417D89
__aullrem.LIBCMT ref: 00417F56
__aulldiv.LIBCMT ref: 00417F78

Strings

9, xrefs: 00417F89

Memory Dump Source

Source File: 00000000.00000002.386662790.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: 20673bb0dd0d476465353f81658d8a072f6559d7ea614f6567867374e6f90a8a
Instruction ID: a4f503f4a05c619a2cb2715f3afc384eec036e56c76c5104009c60b3daeeaa8c
Opcode Fuzzy Hash: 20673bb0dd0d476465353f81658d8a072f6559d7ea614f6567867374e6f90a8a
Instruction Fuzzy Hash: 6041E471E0862A9FDB64DF48C989BEEB7B5BB84300F1485DAE009A7241D7389EC1CF45

Uniqueness

Uniqueness Score: -1.00%

Function 0042480B Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00424888
_get_int64_arg.LIBCMTD ref: 004248B0
__aullrem.LIBCMT ref: 00424A55
__aulldiv.LIBCMT ref: 00424A77

Strings

9, xrefs: 00424A88

Memory Dump Source

Source File: 00000000.00000002.386662790.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: _get_int64_arg$__aulldiv__aullrem
String ID: 9
API String ID: 2124759748-2366072709
Opcode ID: 52b33b09ba93cfe225179afbd334edf23daf10a9ddb99f53eed7ec5f04d9215f
Instruction ID: 584235817bc73f8ae962284972e65426d18d9de26950287a78096d0aaed1cb15
Opcode Fuzzy Hash: 52b33b09ba93cfe225179afbd334edf23daf10a9ddb99f53eed7ec5f04d9215f
Instruction Fuzzy Hash: FF41D5B1E15228DFDB24CF58E889BAEB7B5FB84300F60859AD449A7240D7385E81CF49

Uniqueness

Uniqueness Score: -1.00%

Function 00417D0C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00417D89
_get_int64_arg.LIBCMTD ref: 00417DB1
__aullrem.LIBCMT ref: 00417F56
__aulldiv.LIBCMT ref: 00417F78

Strings

9, xrefs: 00417F89

Memory Dump Source

Source File: 00000000.00000002.386662790.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: _get_int64_arg$__aulldiv__aullrem
String ID: 9
API String ID: 2124759748-2366072709
Opcode ID: 86485ad8320365a21d973e09cedde198a619cafc6831d8c362282d666b7d4256
Instruction ID: 80de0027016aba27cfb710d9a3c87b46e20102838d83ac131788fc0b50bedefa
Opcode Fuzzy Hash: 86485ad8320365a21d973e09cedde198a619cafc6831d8c362282d666b7d4256
Instruction Fuzzy Hash: 4041E4B1E082299FDB64DF58C989BEEB7B5BB84300F1045DAE409A7241D7389EC1CF49

Uniqueness

Uniqueness Score: -1.00%

Function 0042D3CD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0042D450
_get_int64_arg.LIBCMTD ref: 0042D478
__aullrem.LIBCMT ref: 0042D620
__aulldiv.LIBCMT ref: 0042D642

Strings

9, xrefs: 0042D653

Memory Dump Source

Source File: 00000000.00000002.386662790.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: _get_int64_arg$__aulldiv__aullrem
String ID: 9
API String ID: 2124759748-2366072709
Opcode ID: 0dfdaa36073ef9f1184e557c8796e4b4eb4d7ebd374c62414a2cd066758d1c8f
Instruction ID: 0be7bbea8f8936df4ac83a2c52f3f5a9c458ef7ad509494722a83a080cae16c0
Opcode Fuzzy Hash: 0dfdaa36073ef9f1184e557c8796e4b4eb4d7ebd374c62414a2cd066758d1c8f
Instruction Fuzzy Hash: A64105B1E00129AFDB24CF48D981B9EB7B4FF85318F50419AE148A7201D7789E80CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 0041FA90 Relevance: 6.1, APIs: 4, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

___dtold.LIBCMTD ref: 0041FAAA
_$I10_OUTPUT.LIBCMTD ref: 0041FAD2
_wcscpy_s.LIBCMTD ref: 0041FB12

Part of subcall function 0040D730: __invalid_parameter.LIBCMTD ref: 0040D7A2

__invoke_watson_if_error.LIBCMTD ref: 0041FB1B

Memory Dump Source

Source File: 00000000.00000002.386662790.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: I10____dtold__invalid_parameter__invoke_watson_if_error_wcscpy_s
String ID:
API String ID: 289039318-0
Opcode ID: 92aaf2b82aea1797b1c4990a34dc3c2eaf7d02ca6b795ae88429b16248d6c0e2
Instruction ID: 5976e6ebbafa2d317bb44c7ecfea3bb8eedc22a98761cefad2f2701c318cf0c0
Opcode Fuzzy Hash: 92aaf2b82aea1797b1c4990a34dc3c2eaf7d02ca6b795ae88429b16248d6c0e2
Instruction Fuzzy Hash: 20214DB5A002089BCB04EFA4D942ADEB7F4EF8C704F108569F90567382E634E915CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 004159D2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92COMMON

Download Yara Rule

APIs

__whiteout.LIBCMTD ref: 00415B5F
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00416B66

Strings

n, xrefs: 00415B8A

Memory Dump Source

Source File: 00000000.00000002.386662790.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: Locale$UpdateUpdate::~___whiteout
String ID: n
API String ID: 2661511698-2013832146
Opcode ID: 2516c8dfc543d407d4c8a144eb9cf6009eb1a8c8fb2bed4a5b4bfbd473836ec5
Instruction ID: ecfd4378f8583d72b307479f6d223e2097ebd30da65c6bdb4e1d2919ce9eeb8a
Opcode Fuzzy Hash: 2516c8dfc543d407d4c8a144eb9cf6009eb1a8c8fb2bed4a5b4bfbd473836ec5
Instruction Fuzzy Hash: B241A070909659CBCF24CF54D4957EEBBB1AF41315F14829BD8156B282C338AEC1CF59

Uniqueness

Uniqueness Score: -1.00%

Function 004159A7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92COMMON

Download Yara Rule

APIs

__whiteout.LIBCMTD ref: 00415B5F
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00416B66

Strings

n, xrefs: 00415B8A

Memory Dump Source

Source File: 00000000.00000002.386662790.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: Locale$UpdateUpdate::~___whiteout
String ID: n
API String ID: 2661511698-2013832146
Opcode ID: d2cf797c362700c7c598d5f58046728f5b52e3385e363cb4ed932ee8fd006abd
Instruction ID: ecfd4378f8583d72b307479f6d223e2097ebd30da65c6bdb4e1d2919ce9eeb8a
Opcode Fuzzy Hash: d2cf797c362700c7c598d5f58046728f5b52e3385e363cb4ed932ee8fd006abd
Instruction Fuzzy Hash: B241A070909659CBCF24CF54D4957EEBBB1AF41315F14829BD8156B282C338AEC1CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00415A97 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 85COMMON

Download Yara Rule

APIs

__whiteout.LIBCMTD ref: 00415B5F
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00416B66

Strings

n, xrefs: 00415B8A

Memory Dump Source

Source File: 00000000.00000002.386662790.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: Locale$UpdateUpdate::~___whiteout
String ID: n
API String ID: 2661511698-2013832146
Opcode ID: 81b4a4ac1d906f0f7d1c4b56dcd511b19de96e8159785e3cfc507fb03a1586ed
Instruction ID: 877292e96ff1bb00e21e4e8a2193c3722173543034e2bdd30c2b242f653ec0a3
Opcode Fuzzy Hash: 81b4a4ac1d906f0f7d1c4b56dcd511b19de96e8159785e3cfc507fb03a1586ed
Instruction Fuzzy Hash: 4A318270909668CBCF24CF55D4957EEBBB0AF41315F14829BD8656B282C338AEC1CF19

Uniqueness

Uniqueness Score: -1.00%

Function 0041610E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_isxdigit.LIBCMTD ref: 0041617D
__hextodec.LIBCMTD ref: 004161B0
_isdigit.LIBCMTD ref: 004161D6
__inc.LIBCMTD ref: 004162C0
__un_inc.LIBCMTD ref: 004162E4
_isxdigit.LIBCMTD ref: 0041633D
__hextodec.LIBCMTD ref: 00416360
_isdigit.LIBCMTD ref: 00416383
__inc.LIBCMTD ref: 00416434
__un_inc.LIBCMTD ref: 00416458
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00416B66

Strings

p, xrefs: 0041616F

Memory Dump Source

Source File: 00000000.00000002.386662790.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: Locale__hextodec__inc__un_inc_isdigit_isxdigit$UpdateUpdate::~_
String ID: p
API String ID: 1652772854-2181537457
Opcode ID: 1588b932da412bbf87f59dad724f1803a9f1c0a02590b428f0eafa555efa337b
Instruction ID: 2e713e9dbd54042634f8fed090cb0d75afbde769bb5addf1dc00d549ecf89bff
Opcode Fuzzy Hash: 1588b932da412bbf87f59dad724f1803a9f1c0a02590b428f0eafa555efa337b
Instruction Fuzzy Hash: 25219071D042698ACF25CF65C8443FEBBB5AF05308F1581EBD81966302D239CAC1CF89

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: erhuushPID: 2344, Parent PID: 1088COMMON

Execution Graph

Execution Coverage:	1.8%
Dynamic/Decrypted Code Coverage:	13.4%
Signature Coverage:	0%
Total number of Nodes:	82
Total number of Limit Nodes:	4

Executed Functions

Function 00409B11 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 185
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 00409B72
_wprintf.LIBCMTD ref: 00409CA1
_wscanf.LIBCMTD ref: 00409CAA
_wscanf.LIBCMTD ref: 00409CB7
__wremove.LIBCMTD ref: 00409CBD
__wrename.LIBCMTD ref: 00409CC4
_labs.LIBCMTD ref: 00409CE1
_abort.LIBCMTD ref: 00409CE6
_realloc.LIBCMTD ref: 00409D0D

Part of subcall function 0040A7B0: __realloc_dbg.LIBCMTD ref: 0040A7C4

_malloc.LIBCMTD ref: 00409D13

Part of subcall function 0040A780: __nh_malloc_dbg.LIBCMTD ref: 0040A796

__wctomb_s_l.LIBCMTD ref: 00409D1D

Strings

msimg32.dll, xrefs: 00409CB2

Memory Dump Source

Source File: 00000007.00000002.440706921.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_409000_erhuush.jbxd

Similarity

API ID: _wscanf$__nh_malloc_dbg__realloc_dbg__wctomb_s_l__wremove__wrename_abort_labs_malloc_memset_realloc_wprintf
String ID: msimg32.dll
API String ID: 2019212891-3287713914
Opcode ID: 2ad864a010214a7997f26c51bd4d6d42cc7d3a8671068fa2767f1c33c8d9b0d1
Instruction ID: e422161b7b5bbf4efaa1130811f3b2fcb5ec8ed0f934f484f65b9b74cbfb9347
Opcode Fuzzy Hash: 2ad864a010214a7997f26c51bd4d6d42cc7d3a8671068fa2767f1c33c8d9b0d1
Instruction Fuzzy Hash: AE517EB2902524BBD7156BA29D0DDDF3B6CEF0A355B000076F606B50A1D73C5A45CBBE

Uniqueness

Uniqueness Score: -1.00%

Function 004017E2 Relevance: 3.1, APIs: 2, Instructions: 53
sleepnativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E004017E2(void* __edx) {
				void* _t4;

				 *((intOrPtr*)(_t4 - 0x77)) =  *((intOrPtr*)(_t4 - 0x77)) + __edx;
			}

0x004017e2

APIs

Sleep.KERNELBASE(00001388), ref: 00401823
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 0040184B

Memory Dump Source

Source File: 00000007.00000002.440669610.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_erhuush.jbxd

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 4dede37128b39f4f7e7a4df5dc33f26b0f76fbcd4aaa8ffb007c11c557e31b11
Instruction ID: ddaf0562df841adfab300f0276baae716c17d25714fd681a3a6e16616d485b4c
Opcode Fuzzy Hash: 4dede37128b39f4f7e7a4df5dc33f26b0f76fbcd4aaa8ffb007c11c557e31b11
Instruction Fuzzy Hash: EC015233148208EBDB017AA59C41DA97729AB45754F30C537FA03791F1D67D8713A72B

Uniqueness

Uniqueness Score: -1.00%

Function 004017E3 Relevance: 3.1, APIs: 2, Instructions: 53
sleepnativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 18%

			E004017E3(intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t8;
				char* _t9;
				void* _t11;
				void* _t13;
				intOrPtr* _t14;
				intOrPtr _t16;
				void* _t17;
				void* _t18;
				void* _t19;
				void* _t20;
				intOrPtr* _t21;
				intOrPtr* _t22;
				void* _t24;
				void* _t26;

				_push(0x181b);
				_t8 =  *_t21;
				_t22 = _t21 + 4;
				L00401118(_t8, _t13, 0x61, _t19, _t20, _t24);
				_t14 = _a4;
				Sleep(0x1388);
				_t3 =  &_v8; // 0x1b68f34d
				_t9 = _t3;
				_push(_t9);
				_push(_a12);
				_push(_a8);
				_push(_t14); // executed
				L00401360(); // executed
				_t25 = _t9;
				if(_t9 != 0) {
					_push(_a16);
					_push(_v8);
					_push(_t9);
					_push(_t14); // executed
					E00401432(_t14, _t17, _t18, _t19, _t26); // executed
				}
				 *_t14(0xffffffff, 0); // executed
				_t11 = 0x181b;
				_push(0x61);
				_t16 =  *_t22;
				L00401118(_t11, _t14, _t16, _t19, _t20, _t25);
				return _t11;
			}

APIs

Sleep.KERNELBASE(00001388), ref: 00401823
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 0040184B

Memory Dump Source

Source File: 00000007.00000002.440669610.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_erhuush.jbxd

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: eed50f69cd3fa7174ad76653e673f5296f9ebb16c169d6494c900a5425ffe511
Instruction ID: 1d0556d2ce3487287f662705d53e2785c513140bae9e3f24436a296874fe77da
Opcode Fuzzy Hash: eed50f69cd3fa7174ad76653e673f5296f9ebb16c169d6494c900a5425ffe511
Instruction Fuzzy Hash: 15017533108208F7D7017A958C42DAA3628AB45754F30C437BA03790F1D57DDB12676B

Uniqueness

Uniqueness Score: -1.00%

Function 004017EE Relevance: 3.0, APIs: 2, Instructions: 47
sleepnativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 20%

			E004017EE(void* __edi, void* __esi) {
				intOrPtr _t8;
				intOrPtr* _t9;
				void* _t11;
				void* _t13;
				intOrPtr* _t14;
				intOrPtr _t17;
				void* _t18;
				void* _t19;
				intOrPtr* _t25;
				intOrPtr* _t26;
				void* _t29;
				void* _t31;

				_t21 = __esi;
				_t19 = __edi;
				_push(0x181b);
				_t8 =  *_t25;
				_t26 = _t25 + 4;
				L00401118(_t8, _t13, 0x61, __esi, 0x1b68f351, _t29);
				_t14 =  *((intOrPtr*)(0x1b68f359));
				Sleep(0x1388);
				_t9 = 0x1b68f34d;
				_push(_t9);
				_push( *0x1B68F361);
				_push( *0x1B68F35D);
				_push(_t14); // executed
				L00401360(); // executed
				_t30 = _t9;
				if(_t9 != 0) {
					_push( *0x1B68F365);
					_push( *((intOrPtr*)(0x1b68f34d)));
					_push(_t9);
					_push(_t14); // executed
					E00401432(_t14, _t18, _t19, _t21, _t31); // executed
				}
				 *_t14(0xffffffff, 0); // executed
				_t11 = 0x181b;
				_push(0x61);
				_t17 =  *_t26;
				L00401118(_t11, _t14, _t17, _t21, 0x1b68f351, _t30);
				return _t11;
			}

APIs

Sleep.KERNELBASE(00001388), ref: 00401823
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 0040184B

Memory Dump Source

Source File: 00000007.00000002.440669610.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_erhuush.jbxd

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 0a9656e0e1b5f21b45c9f82a7808bfe019579950b80e51e68eaabb0023cd3f01
Instruction ID: 6a2648c31bf342f80e2744bc490c75df06b0a743f4722301b2fbabc3dba0a0aa
Opcode Fuzzy Hash: 0a9656e0e1b5f21b45c9f82a7808bfe019579950b80e51e68eaabb0023cd3f01
Instruction Fuzzy Hash: 54016733508304ABDB017AA18C42EA937289B45754F24C577BB13790F2D57DCB12A72B

Uniqueness

Uniqueness Score: -1.00%

Function 00401807 Relevance: 3.0, APIs: 2, Instructions: 40
sleepnativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 24%

			E00401807(signed int __edx, void* __edi, void* __esi) {
				void* _t9;
				void* _t10;
				void* _t12;
				void* _t14;
				intOrPtr* _t15;
				intOrPtr _t18;
				void* _t21;
				void* _t25;
				intOrPtr* _t27;
				signed char _t30;
				void* _t32;

				_t23 = __esi;
				_t21 = __edi;
				_t20 = __edx |  *(_t25 + 0x7b);
				_t30 = __edx |  *(_t25 + 0x7b);
				L00401118(_t9, _t14, 0x61, __esi, _t25, _t30);
				_t15 =  *((intOrPtr*)(_t25 + 8));
				Sleep(0x1388);
				_t4 = _t25 - 4; // 0x1b68f34d
				_t10 = _t4;
				_push(_t10);
				_push( *((intOrPtr*)(_t25 + 0x10)));
				_push( *((intOrPtr*)(_t25 + 0xc)));
				_push(_t15); // executed
				L00401360(); // executed
				_t31 = _t10;
				if(_t10 != 0) {
					_push( *((intOrPtr*)(_t25 + 0x14)));
					_push( *((intOrPtr*)(_t25 - 4)));
					_push(_t10);
					_push(_t15); // executed
					E00401432(_t15, _t20, _t21, _t23, _t32); // executed
				}
				 *_t15(0xffffffff, 0); // executed
				_t12 = 0x181b;
				_push(0x61);
				_t18 =  *_t27;
				L00401118(_t12, _t15, _t18, _t23, _t25, _t31);
				return _t12;
			}

APIs

Sleep.KERNELBASE(00001388), ref: 00401823
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 0040184B

Memory Dump Source

Source File: 00000007.00000002.440669610.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_erhuush.jbxd

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: fa61b3bfe6e1efcc42a3172324d87a3747898b17389843dd474e8030b106d628
Instruction ID: d1e85a843a3bf15b3ffbd62fd2fe31d474754e63a526ee7ed21e8696c92682af
Opcode Fuzzy Hash: fa61b3bfe6e1efcc42a3172324d87a3747898b17389843dd474e8030b106d628
Instruction Fuzzy Hash: 2FF04F33204208FBDB007BA18C42EAD3729AB45754F20C537BA13790F2D679CA12A72B

Uniqueness

Uniqueness Score: -1.00%

Function 0040AEB0 Relevance: 16.6, APIs: 11, Instructions: 114
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_check_managed_app.LIBCMTD ref: 0040AF2C
__heap_init.LIBCMTD ref: 0040AF36

Part of subcall function 00419610: HeapCreate.KERNELBASE(00000000,00001000,00000000,?,0040AF3B,00000001), ref: 00419626

_fast_error_exit.LIBCMTD ref: 0040AF44

Part of subcall function 0040B090: ___crtExitProcess.LIBCMTD ref: 0040B0B4

__mtinit.LIBCMTD ref: 0040AF4C
_fast_error_exit.LIBCMTD ref: 0040AF57
__RTC_Initialize.LIBCMTD ref: 0040AF69
___crtGetEnvironmentStringsA.LIBCMTD ref: 0040AF93
___setargv.LIBCMTD ref: 0040AF9D
__setenvp.LIBCMTD ref: 0040AFB0
__cinit.LIBCMTD ref: 0040AFC5
__wincmdln.LIBCMTD ref: 0040AFE2

Memory Dump Source

Source File: 00000007.00000002.440706921.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_409000_erhuush.jbxd

Similarity

API ID: ___crt_fast_error_exit$CreateEnvironmentExitHeapInitializeProcessStrings___setargv__cinit__heap_init__mtinit__setenvp__wincmdln_check_managed_app
String ID:
API String ID: 2258361453-0
Opcode ID: 4086065ac970038e79a776750f7548aa05e0e09ea29f0b4c0b31f8981395e636
Instruction ID: a7ddb7468b00b09513485c08426ead2e5ea3c26d69e3af7857e19453d79bf949
Opcode Fuzzy Hash: 4086065ac970038e79a776750f7548aa05e0e09ea29f0b4c0b31f8981395e636
Instruction Fuzzy Hash: 6B41B3F1D003099BDB00ABB2AC0679E76B4AF54748F10013EE515AB2C2EB799540CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 0040AF25 Relevance: 16.6, APIs: 11, Instructions: 88
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_check_managed_app.LIBCMTD ref: 0040AF2C
__heap_init.LIBCMTD ref: 0040AF36

Part of subcall function 00419610: HeapCreate.KERNELBASE(00000000,00001000,00000000,?,0040AF3B,00000001), ref: 00419626

_fast_error_exit.LIBCMTD ref: 0040AF44

Part of subcall function 0040B090: ___crtExitProcess.LIBCMTD ref: 0040B0B4

__mtinit.LIBCMTD ref: 0040AF4C
_fast_error_exit.LIBCMTD ref: 0040AF57
__RTC_Initialize.LIBCMTD ref: 0040AF69
___crtGetEnvironmentStringsA.LIBCMTD ref: 0040AF93
___setargv.LIBCMTD ref: 0040AF9D
__setenvp.LIBCMTD ref: 0040AFB0
__cinit.LIBCMTD ref: 0040AFC5
__wincmdln.LIBCMTD ref: 0040AFE2

Memory Dump Source

Source File: 00000007.00000002.440706921.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_409000_erhuush.jbxd

Similarity

API ID: ___crt_fast_error_exit$CreateEnvironmentExitHeapInitializeProcessStrings___setargv__cinit__heap_init__mtinit__setenvp__wincmdln_check_managed_app
String ID:
API String ID: 2258361453-0
Opcode ID: b4164f6d4685f9dc647e4ff3c01fe10f2011dd5ecc3773d6662f2e0acad5b2fb
Instruction ID: 9f0ef44384bb957edc35c3b29ca9c2b5aa09c4f6599d807b4947cf27e1b66438
Opcode Fuzzy Hash: b4164f6d4685f9dc647e4ff3c01fe10f2011dd5ecc3773d6662f2e0acad5b2fb
Instruction Fuzzy Hash: CF3173F1D003059AEB10BBB2AD067DE7660AF5434CF10013FE9196B2C2FB799954CA9B

Uniqueness

Uniqueness Score: -1.00%

Function 0040B4D7 Relevance: 7.8, APIs: 5, Instructions: 252
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__CrtCheckMemory.LIBCMTD ref: 0040B4FA
__heap_alloc_base.LIBCMTD ref: 0040B681
_memset.LIBCMT ref: 0040B7C9
_memset.LIBCMT ref: 0040B7E6
_memset.LIBCMT ref: 0040B801

Memory Dump Source

Source File: 00000007.00000002.440706921.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_409000_erhuush.jbxd

Similarity

API ID: _memset$CheckMemory__heap_alloc_base
String ID:
API String ID: 4254127243-0
Opcode ID: 782c486867dbfdf79707c8b7b84721dc0e730895fb2ba11e1fecccc80f7ba8a3
Instruction ID: 10aa9e1e72f509eec9c2030512bc02d8ab3a9285472f538c0d3528d51176eff9
Opcode Fuzzy Hash: 782c486867dbfdf79707c8b7b84721dc0e730895fb2ba11e1fecccc80f7ba8a3
Instruction Fuzzy Hash: 59A14A79A002049FDB14DF44DC85BAE77B1FB89314F20826AE9056B3D2D379AD40CF99

Uniqueness

Uniqueness Score: -1.00%

Function 00409630 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 421
memorylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LocalAlloc.KERNELBASE(00000000), ref: 00409649
_memset.LIBCMT ref: 004097B4
LoadLibraryW.KERNELBASE(00844200), ref: 00409966

Strings

msimg32.dll, xrefs: 00409741, 00409753, 00409838, 0040984D, 00409854

Memory Dump Source

Source File: 00000007.00000002.440706921.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_409000_erhuush.jbxd

Similarity

API ID: AllocLibraryLoadLocal_memset
String ID: msimg32.dll
API String ID: 3001991562-3287713914
Opcode ID: 3c6d298495194a7d43d133cce53dba0bfa3f0cc23cecebb99af27589142207ee
Instruction ID: 4bbf95d1d07f5b793a551445cec3f97fb7520ad9971ce6f5d0ca53ce5d14d8fc
Opcode Fuzzy Hash: 3c6d298495194a7d43d133cce53dba0bfa3f0cc23cecebb99af27589142207ee
Instruction Fuzzy Hash: A4D1E1B6800258BFE7016BB0EDC8EAB776CFB19349B005436F646E1572D6788D85CB78

Uniqueness

Uniqueness Score: -1.00%

Function 004190F0 Relevance: 6.3, APIs: 4, Instructions: 326
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__nh_malloc_dbg.LIBCMTD ref: 0041917B
__nh_malloc_dbg.LIBCMTD ref: 004192A7

Memory Dump Source

Source File: 00000007.00000002.440706921.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_409000_erhuush.jbxd

Similarity

API ID: __nh_malloc_dbg
String ID:
API String ID: 2526938719-0
Opcode ID: 1dedd40c212b86d737cc42a500783f936d07058c4a6aec1a18194dda0f85cf9a
Instruction ID: 7fdf9e2f47d08c1cdaf3c05fa1e569e8f274e39fd4e0f730588c364ff7165eea
Opcode Fuzzy Hash: 1dedd40c212b86d737cc42a500783f936d07058c4a6aec1a18194dda0f85cf9a
Instruction Fuzzy Hash: 8FE11B74E04249DFDB24CFA8C894BADFBB1BB49314F24825ED8656B392C7349886CF45

Uniqueness

Uniqueness Score: -1.00%

Function 0040952F Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 50
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(00000040,?), ref: 0040962A

Strings

msimg32.dll, xrefs: 00409536, 0040953B, 0040959D

Memory Dump Source

Source File: 00000007.00000002.440706921.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_409000_erhuush.jbxd

Similarity

API ID: ProtectVirtual
String ID: msimg32.dll
API String ID: 544645111-3287713914
Opcode ID: 17b0aac0a531702174b7c65180c391707bf38b3425d045184fdffbf97c0d013b
Instruction ID: 9b7cfc5e17716be782b59f166dd39e07db881f3a278859cfbeeeb5f88a7b37f4
Opcode Fuzzy Hash: 17b0aac0a531702174b7c65180c391707bf38b3425d045184fdffbf97c0d013b
Instruction Fuzzy Hash: F7219A98E08AC1DAF306C768ED08B913E965723749F0A00BD91954A2B2E7FB5158C77F

Uniqueness

Uniqueness Score: -1.00%

Function 00409531 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 49
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(00000040,?), ref: 0040962A

Strings

msimg32.dll, xrefs: 00409536, 0040953B, 0040959D

Memory Dump Source

Source File: 00000007.00000002.440706921.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_409000_erhuush.jbxd

Similarity

API ID: ProtectVirtual
String ID: msimg32.dll
API String ID: 544645111-3287713914
Opcode ID: 86775875dd883554000b779353b5ca5ef6f1083c8ec8bb8f7521579d1f137b51
Instruction ID: 07589be915f535defbfa72ec759fc0598ce49b4d87d3ca622b32015d16d1199b
Opcode Fuzzy Hash: 86775875dd883554000b779353b5ca5ef6f1083c8ec8bb8f7521579d1f137b51
Instruction Fuzzy Hash: 6521A998E0CAC1DAF306C768ED08B913E965723749F0A00BD91954A2B2E7FB5158C77F

Uniqueness

Uniqueness Score: -1.00%

Function 0040B43F Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

QQ, xrefs: 0040B439

Memory Dump Source

Source File: 00000007.00000002.440706921.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_409000_erhuush.jbxd

Similarity

API ID:
String ID: QQ
API String ID: 0-3460843698
Opcode ID: 75285a33f3e3a8226227495b54544be31729fa98091c7b21b9d872baf7ad745d
Instruction ID: 8ebcda0000eecf523cbd085e01e090e350d6b15ac35dbad072ca10934f5ebcd5
Opcode Fuzzy Hash: 75285a33f3e3a8226227495b54544be31729fa98091c7b21b9d872baf7ad745d
Instruction Fuzzy Hash: D301FBB5A00109EBDB04DF54D840BAE73B4EB48304F10816AFD09A7382D339DB51DB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040B84E Relevance: 3.1, APIs: 2, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__invalid_parameter.LIBCMTD ref: 0040B8AD
_memset.LIBCMT ref: 0040B8F9

Memory Dump Source

Source File: 00000007.00000002.440706921.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_409000_erhuush.jbxd

Similarity

API ID: __invalid_parameter_memset
String ID:
API String ID: 3961059608-0
Opcode ID: 05b10813307af71d25597e47c8649d7a6d084c0bb43746682a81a9517d95371d
Instruction ID: 1324000d97abd66836b031af892333075081cfb50ad0cef0dc97aef94c640520
Opcode Fuzzy Hash: 05b10813307af71d25597e47c8649d7a6d084c0bb43746682a81a9517d95371d
Instruction Fuzzy Hash: DC1166B1A40208BBDB04DF94CC82F9E3375EB54704F10856AF908BB3D1E778EA508799

Uniqueness

Uniqueness Score: -1.00%

Function 00419164 Relevance: 1.5, APIs: 1, Instructions: 22
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__nh_malloc_dbg.LIBCMTD ref: 0041917B
__nh_malloc_dbg.LIBCMTD ref: 004192A7

Memory Dump Source

Source File: 00000007.00000002.440706921.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_409000_erhuush.jbxd

Similarity

API ID: __nh_malloc_dbg
String ID:
API String ID: 2526938719-0
Opcode ID: f9bf8707853167085b66593613993b00e5ed86952c72447d674ae544adeca308
Instruction ID: c4f57cec82e4bd0dba32cc6c1f0b5ad598e6c7fbc5f644fcfa7b04f801fa35e6
Opcode Fuzzy Hash: f9bf8707853167085b66593613993b00e5ed86952c72447d674ae544adeca308
Instruction Fuzzy Hash: 95E020B1E84308A9E7309AA5580775C7720E744B31F20472FE235362C2D77504404F09

Uniqueness

Uniqueness Score: -1.00%

Function 00412400 Relevance: 1.5, APIs: 1, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

__encode_pointer.LIBCMTD ref: 00412407

Part of subcall function 00412330: __crt_wait_module_handle.LIBCMTD ref: 0041237C
Part of subcall function 00412330: RtlEncodePointer.NTDLL(?), ref: 004123B7

Memory Dump Source

Source File: 00000007.00000002.440706921.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_409000_erhuush.jbxd

Similarity

API ID: EncodePointer__crt_wait_module_handle__encode_pointer
String ID:
API String ID: 2010845264-0
Opcode ID: f00befe9f6ce37f0a9e0ee05923ac5330ac6df44ba7645856ef0dc2498812e42
Instruction ID: 017c5cb46a1c4d55b1340ad0c3270c38816836f5326e70259e7eaab19cdf7902
Opcode Fuzzy Hash: f00befe9f6ce37f0a9e0ee05923ac5330ac6df44ba7645856ef0dc2498812e42
Instruction Fuzzy Hash: 13A0127244420C23E00020933903B03750C43C0638F080021F91C051422886B5604097

Uniqueness

Uniqueness Score: -1.00%

Function 0040AE90 Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

___security_init_cookie.LIBCMTD ref: 0040AE95

Part of subcall function 0040AEB0: _check_managed_app.LIBCMTD ref: 0040AF2C
Part of subcall function 0040AEB0: __heap_init.LIBCMTD ref: 0040AF36
Part of subcall function 0040AEB0: _fast_error_exit.LIBCMTD ref: 0040AF44
Part of subcall function 0040AEB0: __mtinit.LIBCMTD ref: 0040AF4C
Part of subcall function 0040AEB0: _fast_error_exit.LIBCMTD ref: 0040AF57
Part of subcall function 0040AEB0: __RTC_Initialize.LIBCMTD ref: 0040AF69
Part of subcall function 0040AEB0: ___crtGetEnvironmentStringsA.LIBCMTD ref: 0040AF93
Part of subcall function 0040AEB0: ___setargv.LIBCMTD ref: 0040AF9D
Part of subcall function 0040AEB0: __setenvp.LIBCMTD ref: 0040AFB0
Part of subcall function 0040AEB0: __cinit.LIBCMTD ref: 0040AFC5
Part of subcall function 0040AEB0: __wincmdln.LIBCMTD ref: 0040AFE2

Memory Dump Source

Source File: 00000007.00000002.440706921.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_409000_erhuush.jbxd

Similarity

API ID: _fast_error_exit$EnvironmentInitializeStrings___crt___security_init_cookie___setargv__cinit__heap_init__mtinit__setenvp__wincmdln_check_managed_app
String ID:
API String ID: 2731678867-0
Opcode ID: ee8f2d7c38ba407090a88614530fa8bfefe5418cda479201f07807e08c8461eb
Instruction ID: 4163ddfda7dbc0b273293bbe506c37d36eb456cb6e14ae8899fefb7f074ccf43
Opcode Fuzzy Hash: ee8f2d7c38ba407090a88614530fa8bfefe5418cda479201f07807e08c8461eb
Instruction Fuzzy Hash: DCA02232080B0C02020033E3200B80B320E08C032C382002FBA0C022032C3CB8A000EF

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0041C68E Relevance: 51.2, APIs: 25, Strings: 4, Instructions: 431COMMON

Download Yara Rule

APIs

__invoke_watson_if_error.LIBCMTD ref: 0041C6D2
_wcscat_s.LIBCMTD ref: 0041C8EA

Part of subcall function 00421870: __invalid_parameter.LIBCMTD ref: 004218E2

__invoke_watson_if_error.LIBCMTD ref: 0041C8F3

Part of subcall function 0040DBB0: __invoke_watson.LIBCMTD ref: 0040DBD1

_wcscat_s.LIBCMTD ref: 0041C922

Part of subcall function 00421870: _memset.LIBCMT ref: 0042194B
Part of subcall function 00421870: __invalid_parameter.LIBCMTD ref: 004219A7

__invoke_watson_if_error.LIBCMTD ref: 0041C92B
__snwprintf_s.LIBCMTD ref: 0041C984

Part of subcall function 0041BFE0: __vsnprintf_s_l.LIBCMTD ref: 0041C002

__invoke_watson_if_oneof.LIBCMTD ref: 0041C9BD
_wcscpy_s.LIBCMTD ref: 0041CA02
__invoke_watson_if_error.LIBCMTD ref: 0041CA0B
__cftoe.LIBCMTD ref: 0041CA7F
__invoke_watson_if_oneof.LIBCMTD ref: 0041CAAE
_wcscpy_s.LIBCMTD ref: 0041CAE6
__invoke_watson_if_error.LIBCMTD ref: 0041CAEF
__itow_s.LIBCMTD ref: 0041C6C9

Part of subcall function 00426280: _xtow_s@20.LIBCMTD ref: 004262AB

__strftime_l.LIBCMTD ref: 0041C789
__invoke_watson_if_oneof.LIBCMTD ref: 0041C7C2
_wcscpy_s.LIBCMTD ref: 0041C807
__invoke_watson_if_error.LIBCMTD ref: 0041C810
_wcscpy_s.LIBCMTD ref: 0041C863
__invoke_watson_if_error.LIBCMTD ref: 0041C86C
_wcscat_s.LIBCMTD ref: 0041C89D
__invoke_watson_if_error.LIBCMTD ref: 0041C8A6

Strings

t9j, xrefs: 0041CD15
t8j, xrefs: 0041CABD
D\@, xrefs: 0041C850, 0041C856
h8[@, xrefs: 0041C885

Memory Dump Source

Source File: 00000007.00000002.440706921.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_409000_erhuush.jbxd

Similarity

API ID: __invoke_watson_if_error$_wcscpy_s$__invoke_watson_if_oneof_wcscat_s$__invalid_parameter$__cftoe__invoke_watson__itow_s__snwprintf_s__strftime_l__vsnprintf_s_l_memset_xtow_s@20
String ID: D\@$h8[@$t8j$t9j
API String ID: 2582952045-1301031898
Opcode ID: 8c649d36ace655ee30945a0357195b502b76c5f9a91b9f55d6bee1a9a8e625e2
Instruction ID: 02178abfe23e56a54a67b4c7eb7c84d33cb54055c7f1e4f72fd57db3d001e6e7
Opcode Fuzzy Hash: 8c649d36ace655ee30945a0357195b502b76c5f9a91b9f55d6bee1a9a8e625e2
Instruction Fuzzy Hash: 660293B4A80714AADB20EF50DC8ABDF7374AB44745F5440AAF608762C1D7B89AC4CF99

Uniqueness

Uniqueness Score: -1.00%

Function 00416507 Relevance: 35.4, APIs: 19, Strings: 1, Instructions: 382COMMON

Download Yara Rule

APIs

__inc.LIBCMTD ref: 0041654C
_isdigit.LIBCMTD ref: 00416572
___check_float_string.LIBCMTD ref: 004165D2
__inc.LIBCMTD ref: 004165F0
_isdigit.LIBCMTD ref: 004166A2
___check_float_string.LIBCMTD ref: 00416702
___check_float_string.LIBCMTD ref: 00416689

Part of subcall function 00416C60: __nh_malloc_dbg.LIBCMTD ref: 00416CBD

__inc.LIBCMTD ref: 0041664D

Part of subcall function 00416DC0: __filbuf.LIBCMTD ref: 00416E01

___check_float_string.LIBCMTD ref: 00416796
__inc.LIBCMTD ref: 004167B4
___check_float_string.LIBCMTD ref: 004167F7
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00416B66

Strings

+, xrefs: 0041680C

Memory Dump Source

Source File: 00000007.00000002.440706921.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_409000_erhuush.jbxd

Similarity

API ID: ___check_float_string$__inc$Locale_isdigit$UpdateUpdate::~___filbuf__nh_malloc_dbg
String ID: +
API String ID: 1483831053-2126386893
Opcode ID: 3f1cdc535125063f7d7ef7ae872c682c660c3678df03c0684fb82a37ac454917
Instruction ID: 45a2f262c5410c48cc6ad1d3327226c1787b0f07e4967d97fcea125fd92b63d4
Opcode Fuzzy Hash: 3f1cdc535125063f7d7ef7ae872c682c660c3678df03c0684fb82a37ac454917
Instruction Fuzzy Hash: 26F16FB1D042199BCF14CF99C894AEEBB75AF44308F1482AED819A7342D739EA84CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00415FAF Relevance: 30.1, APIs: 15, Strings: 2, Instructions: 387COMMON

Download Yara Rule

APIs

__inc.LIBCMTD ref: 00416001
__inc.LIBCMTD ref: 00416029
__inc.LIBCMTD ref: 0041605C
__un_inc.LIBCMTD ref: 004160E3
_isxdigit.LIBCMTD ref: 0041617D
__hextodec.LIBCMTD ref: 004161B0

Strings

F, xrefs: 0041647B
8, xrefs: 00416395

Memory Dump Source

Source File: 00000007.00000002.440706921.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_409000_erhuush.jbxd

Similarity

API ID: __inc$__hextodec__un_inc_isxdigit
String ID: 8$F
API String ID: 3652663768-3144575033
Opcode ID: c694fde765daef34fe86b015504b5841358a78d6cc7151bbf1d403a4172b6c69
Instruction ID: 4e8990ed9834d67cabe5cdc1a52b903055c43b73c622471bf65cd64a9ca038d8
Opcode Fuzzy Hash: c694fde765daef34fe86b015504b5841358a78d6cc7151bbf1d403a4172b6c69
Instruction Fuzzy Hash: 1B028EB0D052698BCF25CF64C8943EEBBB1AF15308F1481DAD8196B342D33A9AC5CF49

Uniqueness

Uniqueness Score: -1.00%

Function 004247F9 Relevance: 30.1, APIs: 15, Strings: 2, Instructions: 368COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00424888
_get_int64_arg.LIBCMTD ref: 004248B0
__aullrem.LIBCMT ref: 00424A55
__aulldiv.LIBCMT ref: 00424A77
_write_multi_char.LIBCMTD ref: 00424B7E
_write_string.LIBCMTD ref: 00424B99
_write_multi_char.LIBCMTD ref: 00424BC5
_wctomb_s.LIBCMTD ref: 00424C42

Strings

9, xrefs: 00424A88
-, xrefs: 00424B1E

Memory Dump Source

Source File: 00000007.00000002.440706921.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_409000_erhuush.jbxd

Similarity

API ID: _get_int64_arg_write_multi_char$__aulldiv__aullrem_wctomb_s_write_string
String ID: -$9
API String ID: 3451365851-1631151375
Opcode ID: 73748dadc7ea5df593242549316a037bffe645614e081454c675fba9bebad1a7
Instruction ID: a721a5725b6536229582cc34f6c4b56e6aafc0d91daa9a2dae563fcae3e2e464
Opcode Fuzzy Hash: 73748dadc7ea5df593242549316a037bffe645614e081454c675fba9bebad1a7
Instruction Fuzzy Hash: 9BF14BB1E012298FDB24CF58DC99BAEB7B1FB84304F5481DAD419A7281D7789E80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0042D3BB Relevance: 28.4, APIs: 15, Strings: 1, Instructions: 365COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0042D450
_get_int64_arg.LIBCMTD ref: 0042D478
__aullrem.LIBCMT ref: 0042D620
__aulldiv.LIBCMT ref: 0042D642
_write_multi_char.LIBCMTD ref: 0042D75B
_write_string.LIBCMTD ref: 0042D776
_write_multi_char.LIBCMTD ref: 0042D7A2
__mbtowc_l.LIBCMTD ref: 0042D811

Strings

9, xrefs: 0042D653

Memory Dump Source

Source File: 00000007.00000002.440706921.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_409000_erhuush.jbxd

Similarity

API ID: _get_int64_arg_write_multi_char$__aulldiv__aullrem__mbtowc_l_write_string
String ID: 9
API String ID: 3455034128-2366072709
Opcode ID: 530e62bac20449fc3ef16af2ea562a2331bce4f960ca9bf1045f95520d08cb73
Instruction ID: 87f28a10b6e7806872ac3917b900aa704c7eb3b4201bc77d767262b33af21855
Opcode Fuzzy Hash: 530e62bac20449fc3ef16af2ea562a2331bce4f960ca9bf1045f95520d08cb73
Instruction Fuzzy Hash: FDF16CB1E002299FDF24DF58DC81BAEB7B1BF85304F54419AE109A7241D778AE84CF59

Uniqueness

Uniqueness Score: -1.00%

Function 004266F3 Relevance: 25.8, APIs: 17, Instructions: 296COMMON

Download Yara Rule

APIs

_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0042673B
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00426771
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00426792
wcsncnt.LIBCMTD ref: 004267C9
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0042682F
_wcslen.LIBCMTD ref: 00426A3F
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00426A4D

Memory Dump Source

Source File: 00000007.00000002.440706921.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_409000_erhuush.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$_wcslenwcsncnt
String ID:
API String ID: 1043867012-0
Opcode ID: fc4f0b37faa7f4946a6c5e9665ee82d9b71174bf5f156293fab80b3a31791081
Instruction ID: 7f75a814af551cf217c73b50f5ce39038cad51a7708300b5ccdc52a67e21c884
Opcode Fuzzy Hash: fc4f0b37faa7f4946a6c5e9665ee82d9b71174bf5f156293fab80b3a31791081
Instruction Fuzzy Hash: 84D12775A00218DFCB08DF94D894BEEB7B1FF85304F60C55AE4126B290DB38AE86DB55

Uniqueness

Uniqueness Score: -1.00%

Function 00424557 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 241COMMON

Download Yara Rule

APIs

_get_int_arg.LIBCMTD ref: 0042455B
__get_printf_count_output.LIBCMTD ref: 00424569
__invalid_parameter.LIBCMTD ref: 004245F0
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00424605
_write_multi_char.LIBCMTD ref: 00424B7E
_write_string.LIBCMTD ref: 00424B99
_write_multi_char.LIBCMTD ref: 00424BC5
_wctomb_s.LIBCMTD ref: 00424C42

Strings

-, xrefs: 00424B1E

Memory Dump Source

Source File: 00000007.00000002.440706921.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_409000_erhuush.jbxd

Similarity

API ID: Locale_write_multi_char$UpdateUpdate::~___get_printf_count_output__invalid_parameter_get_int_arg_wctomb_s_write_string
String ID: -
API String ID: 2357813345-2547889144
Opcode ID: d2fd1506c183ec86f59f6aee48fb561d843edaa370c390d2ac749d9266cd7004
Instruction ID: 09383132ef6e3c52153bc865bd17f4b6936478b15fe0a08a49ab86f91775dfed
Opcode Fuzzy Hash: d2fd1506c183ec86f59f6aee48fb561d843edaa370c390d2ac749d9266cd7004
Instruction Fuzzy Hash: F8A18C70E012298BDB24DF59DC49BAEB7B0EB84305F5481DAE1197B281D778AEC0CF59

Uniqueness

Uniqueness Score: -1.00%

Function 004243A5 Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 225COMMON

Download Yara Rule

APIs

_get_int_arg.LIBCMTD ref: 004243A9
_strlen.LIBCMT ref: 004243D9
_write_multi_char.LIBCMTD ref: 00424B7E
_write_string.LIBCMTD ref: 00424B99
_write_multi_char.LIBCMTD ref: 00424BC5
_wctomb_s.LIBCMTD ref: 00424C42

Strings

-, xrefs: 00424B1E
I@, xrefs: 004243CC

Memory Dump Source

Source File: 00000007.00000002.440706921.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_409000_erhuush.jbxd

Similarity

API ID: _write_multi_char$_get_int_arg_strlen_wctomb_s_write_string
String ID: -$I@
API String ID: 2232461714-3662616159
Opcode ID: c4d7bbb1e4a35970b1e2731a79c68ebfb12efde7635d023d49e88d8b318ebf39
Instruction ID: 504cf34f6a1f140e24b7c590ea058f5024a33f02ea29967f28fa7e95d4e844db
Opcode Fuzzy Hash: c4d7bbb1e4a35970b1e2731a79c68ebfb12efde7635d023d49e88d8b318ebf39
Instruction Fuzzy Hash: 7EA18F74E012298FDB24CF55DC49BEEB7B0EB88305F5481DAD0196B291D778AE80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00415C3C Relevance: 17.8, APIs: 6, Strings: 4, Instructions: 256COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00415C84
__un_inc.LIBCMTD ref: 00415DD8
__inc.LIBCMTD ref: 00415E0A
__inc.LIBCMTD ref: 00415EC9
__mbtowc_l.LIBCMTD ref: 00415F0B
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00416B66

Strings

, xrefs: 00415E43
{, xrefs: 00415E4C
], xrefs: 00415C9D
{, xrefs: 00415DB2

Memory Dump Source

Source File: 00000007.00000002.440706921.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_409000_erhuush.jbxd

Similarity

API ID: Locale__inc$UpdateUpdate::~___mbtowc_l__un_inc_memset
String ID: $]${${
API String ID: 2643002128-1336171634
Opcode ID: a0d6f3a7a88c6dea91ec17ea94e745941b8181ae169e3f2fdeed4f4618f4c2ce
Instruction ID: 733e9da3a28c0a21848e95e8901b80b5ba50e6ecae14809abc89287093d81474
Opcode Fuzzy Hash: a0d6f3a7a88c6dea91ec17ea94e745941b8181ae169e3f2fdeed4f4618f4c2ce
Instruction Fuzzy Hash: A6B1D670D09798CBCF15CBA9D4946EDBBB1AF46304F14C19FE869AB342C2389A81CF15

Uniqueness

Uniqueness Score: -1.00%

Function 0042CF44 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 222COMMON

Download Yara Rule

APIs

_get_int_arg.LIBCMTD ref: 0042CF48
_strlen.LIBCMT ref: 0042CF78
_write_multi_char.LIBCMTD ref: 0042D75B
_write_string.LIBCMTD ref: 0042D776
_write_multi_char.LIBCMTD ref: 0042D7A2
__mbtowc_l.LIBCMTD ref: 0042D811

Strings

I@, xrefs: 0042CF6B

Memory Dump Source

Source File: 00000007.00000002.440706921.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_409000_erhuush.jbxd

Similarity

API ID: _write_multi_char$__mbtowc_l_get_int_arg_strlen_write_string
String ID: I@
API String ID: 909868375-3008766272
Opcode ID: 5160bf8aaf3c93fb7daea3ac61722fa4b3b9303f281fa05acda3142a6fb74e5b
Instruction ID: aeb1a302864e0295b61b224f0f41cef40e82057aba0da1d2740614cba2eebc2e
Opcode Fuzzy Hash: 5160bf8aaf3c93fb7daea3ac61722fa4b3b9303f281fa05acda3142a6fb74e5b
Instruction Fuzzy Hash: 1AA181B0E002289FDB24DF55DC81BAEB7B5BF44304F54819AE61967282D738AE84CF5D

Uniqueness

Uniqueness Score: -1.00%

Function 0042D11A Relevance: 16.7, APIs: 11, Instructions: 238COMMON

Download Yara Rule

APIs

_get_int_arg.LIBCMTD ref: 0042D11E
__get_printf_count_output.LIBCMTD ref: 0042D12C
__invalid_parameter.LIBCMTD ref: 0042D1B3
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0042D1C8
_write_multi_char.LIBCMTD ref: 0042D75B
_write_string.LIBCMTD ref: 0042D776
_write_multi_char.LIBCMTD ref: 0042D7A2
__mbtowc_l.LIBCMTD ref: 0042D811

Memory Dump Source

Source File: 00000007.00000002.440706921.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_409000_erhuush.jbxd

Similarity

API ID: Locale_write_multi_char$UpdateUpdate::~___get_printf_count_output__invalid_parameter__mbtowc_l_get_int_arg_write_string
String ID:
API String ID: 2386203720-0
Opcode ID: f607765c8f2682145a9edb787064b82d444e2ed9b0f04ad2e4101b47de9843e8
Instruction ID: 08d3cf6121706dbf829b6d05311f1c81cf8396b18442ce7c14708cc00a2cbdda
Opcode Fuzzy Hash: f607765c8f2682145a9edb787064b82d444e2ed9b0f04ad2e4101b47de9843e8
Instruction Fuzzy Hash: 61A1AFF0E002289BDB24DF55DC85BAEB774AF84304F50419AE6197B282D778AE84CF5D

Uniqueness

Uniqueness Score: -1.00%

Function 00415BEA Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 205COMMON

Download Yara Rule

APIs

__un_inc.LIBCMTD ref: 00415DD8
__inc.LIBCMTD ref: 00415E0A
__inc.LIBCMTD ref: 00415EC9
__mbtowc_l.LIBCMTD ref: 00415F0B

Strings

, xrefs: 00415E43
c, xrefs: 00415F85

Memory Dump Source

Source File: 00000007.00000002.440706921.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_409000_erhuush.jbxd

Similarity

API ID: __inc$__mbtowc_l__un_inc
String ID: $c
API String ID: 579247601-3797896886
Opcode ID: 98046de7fd322e1f917b2e6fd8048b3892d2d27587e911f3b1c5c2ec91a3c4cd
Instruction ID: 7ecbc0b786a77850220586fe59660f87f2dbd110734eb0342331823304e5aa8a
Opcode Fuzzy Hash: 98046de7fd322e1f917b2e6fd8048b3892d2d27587e911f3b1c5c2ec91a3c4cd
Instruction Fuzzy Hash: B8918F70D05758DBCF24CF95D8946EEBB71AF85308F14819AE829AB342D7389AC1CF09

Uniqueness

Uniqueness Score: -1.00%

Function 00419BB7 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 100windowCOMMON

Download Yara Rule

APIs

__snwprintf_s.LIBCMTD ref: 00419C5B
__invoke_watson_if_oneof.LIBCMTD ref: 00419C8E
_wcscpy_s.LIBCMTD ref: 00419CD0
__invoke_watson_if_error.LIBCMTD ref: 00419CD9
___crtMessageBoxW.LIBCMTD ref: 00419CF2
_raise.LIBCMTD ref: 00419D0B

Strings

`D@, xrefs: 00419C28, 00419C2E
^9@, xrefs: 00419BDF

Memory Dump Source

Source File: 00000007.00000002.440706921.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_409000_erhuush.jbxd

Similarity

API ID: Message___crt__invoke_watson_if_error__invoke_watson_if_oneof__snwprintf_s_raise_wcscpy_s
String ID: ^9@$`D@
API String ID: 1485069716-273578848
Opcode ID: 61b2dbe9ec1f8faa36acc654127eec5d54c4783b504d953776bc1184599c36c0
Instruction ID: c0e6340a1cda6ef02aac5938a198a3969f3bcb851ff0069ec62fe23309543b73
Opcode Fuzzy Hash: 61b2dbe9ec1f8faa36acc654127eec5d54c4783b504d953776bc1184599c36c0
Instruction Fuzzy Hash: 7C316AB5A40218ABDB24DB91DC46FDA73B5BB58744F0041EAF308762C1D6B85EC08F99

Uniqueness

Uniqueness Score: -1.00%

Function 0040C205 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 264memoryCOMMON

Download Yara Rule

APIs

_CheckBytes.LIBCMTD ref: 0040C219
__CrtIsValidHeapPointer.LIBCMTD ref: 0040C2A5
_CheckBytes.LIBCMTD ref: 0040C350
_CheckBytes.LIBCMTD ref: 0040C40A
_memset.LIBCMT ref: 0040C501
__free_base.LIBCMTD ref: 0040C50D

Strings

tDj, xrefs: 0040C25B

Memory Dump Source

Source File: 00000007.00000002.440706921.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_409000_erhuush.jbxd

Similarity

API ID: BytesCheck$HeapPointerValid__free_base_memset
String ID: tDj
API String ID: 25084783-2513116121
Opcode ID: b9adceee1fe61f2cee6d43c756ee87a5a7a58a641edfea7588e9ec640f752860
Instruction ID: faefe7da996400bbef58c54e5170c74f93222f4de7125747aeed027e64bc3a06
Opcode Fuzzy Hash: b9adceee1fe61f2cee6d43c756ee87a5a7a58a641edfea7588e9ec640f752860
Instruction Fuzzy Hash: C591B175A40204EBEB28DB84DDC2F6A7375AB44708F344269F604BB2C2D279EE41D79D

Uniqueness

Uniqueness Score: -1.00%

Function 00415C24 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 108COMMON

Download Yara Rule

APIs

__un_inc.LIBCMTD ref: 00415DD8
__inc.LIBCMTD ref: 00415E0A
__inc.LIBCMTD ref: 00415EC9
__mbtowc_l.LIBCMTD ref: 00415F0B

Strings

, xrefs: 00415E43
{, xrefs: 00415E4C

Memory Dump Source

Source File: 00000007.00000002.440706921.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_409000_erhuush.jbxd

Similarity

API ID: __inc$__mbtowc_l__un_inc
String ID: ${
API String ID: 579247601-4046706400
Opcode ID: c4822b5e9e88f4911f299a29db30f343fa9385594b584e860edcc568e7ba0c09
Instruction ID: f8bebf5dfd94e6c9dc363e16e45155c9ab91aad30fd5ed40b4ee189f875d7f82
Opcode Fuzzy Hash: c4822b5e9e88f4911f299a29db30f343fa9385594b584e860edcc568e7ba0c09
Instruction Fuzzy Hash: C54190B4D05758DBCF24CB95D8446EEBB71AF85305F14C1AEE429A7202D7389AC5CF09

Uniqueness

Uniqueness Score: -1.00%

Function 00424827 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 104COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00424888
__aullrem.LIBCMT ref: 00424A55
__aulldiv.LIBCMT ref: 00424A77

Strings

9, xrefs: 00424A88
', xrefs: 00424827
0, xrefs: 00424843

Memory Dump Source

Source File: 00000007.00000002.440706921.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_409000_erhuush.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: '$0$9
API String ID: 3120068967-269856862
Opcode ID: 61ff73877e2c891499c3fb64a8486ea2c305938b2ba7b0e0e707b528870ff651
Instruction ID: 26c336a9f065971cb0d320951b209e2e278aa466309384de1234029c3de788cf
Opcode Fuzzy Hash: 61ff73877e2c891499c3fb64a8486ea2c305938b2ba7b0e0e707b528870ff651
Instruction Fuzzy Hash: B941F4B1E15229DFDB24CF58E899BAEB7B5FB84304F5481DAD448A7240C7389E81CF49

Uniqueness

Uniqueness Score: -1.00%

Function 00417D28 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 104COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00417D89
__aullrem.LIBCMT ref: 00417F56
__aulldiv.LIBCMT ref: 00417F78

Strings

9, xrefs: 00417F89
', xrefs: 00417D28
0, xrefs: 00417D44

Memory Dump Source

Source File: 00000007.00000002.440706921.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_409000_erhuush.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: '$0$9
API String ID: 3120068967-269856862
Opcode ID: 0685f91b45cbdf0ca138cdfba6d584006a9b8105de1a8e68d10636028a782ff3
Instruction ID: 66da96a2bac71dcb13fa53c53b410c2ec7dc3b67ccd4c81c7949b8dad1257f88
Opcode Fuzzy Hash: 0685f91b45cbdf0ca138cdfba6d584006a9b8105de1a8e68d10636028a782ff3
Instruction Fuzzy Hash: AE41D3719082299FDB64CF58C989BEEB7B5BB84304F1445DAE409AB241C7389EC1CF45

Uniqueness

Uniqueness Score: -1.00%

Function 00415FCA Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 92COMMON

Download Yara Rule

APIs

__inc.LIBCMTD ref: 00416029
__inc.LIBCMTD ref: 0041605C
_isxdigit.LIBCMTD ref: 0041617D
__hextodec.LIBCMTD ref: 004161B0
_isdigit.LIBCMTD ref: 004161D6
__inc.LIBCMTD ref: 004162C0
__un_inc.LIBCMTD ref: 004162E4

Strings

p, xrefs: 0041616F
0, xrefs: 0041600F

Memory Dump Source

Source File: 00000007.00000002.440706921.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_409000_erhuush.jbxd

Similarity

API ID: __inc$__hextodec__un_inc_isdigit_isxdigit
String ID: 0$p
API String ID: 500523077-2059906072
Opcode ID: 04da5069397b075e653506d4188bde8c25525b423427e154921d5491573031cb
Instruction ID: 6b59d60e470b2688df4fca62ab249f9125279fcdb80552354e7482094790bb3c
Opcode Fuzzy Hash: 04da5069397b075e653506d4188bde8c25525b423427e154921d5491573031cb
Instruction Fuzzy Hash: 75414CB1D042A99ACF25CF65C8942EEBB71AF05308F2581EFD81966302D239DAC5CF49

Uniqueness

Uniqueness Score: -1.00%

Function 00424814 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 106COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00424888
__aullrem.LIBCMT ref: 00424A55
__aulldiv.LIBCMT ref: 00424A77

Strings

9, xrefs: 00424A88
0, xrefs: 00424843

Memory Dump Source

Source File: 00000007.00000002.440706921.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_409000_erhuush.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 0$9
API String ID: 3120068967-1975997740
Opcode ID: adf89d3c19f081dca0014650f750430d885a7cf6bbcb9a16a6fa2b3a43d07e97
Instruction ID: 74cb3aa1fb84b278cd05ca6ea8a4370dc3a41d3c72b4f31d23988da057b4ed0c
Opcode Fuzzy Hash: adf89d3c19f081dca0014650f750430d885a7cf6bbcb9a16a6fa2b3a43d07e97
Instruction Fuzzy Hash: 114105B1E15228DFDB24CF58E889BAEBBB5FB84304F50819AD448A7240C7385E81CF49

Uniqueness

Uniqueness Score: -1.00%

Function 00417D15 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 106COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00417D89
__aullrem.LIBCMT ref: 00417F56
__aulldiv.LIBCMT ref: 00417F78

Strings

9, xrefs: 00417F89
0, xrefs: 00417D44

Memory Dump Source

Source File: 00000007.00000002.440706921.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_409000_erhuush.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 0$9
API String ID: 3120068967-1975997740
Opcode ID: 65d4fb54393684fd377d7b0f3d77692b0563070c7f279eb9e5d07005dacc9ba6
Instruction ID: e675631b09abcb4a3db81451e5924fefa61cd99c30674d547d3908986f46349b
Opcode Fuzzy Hash: 65d4fb54393684fd377d7b0f3d77692b0563070c7f279eb9e5d07005dacc9ba6
Instruction Fuzzy Hash: 5041E2B1D082299FDB64CF48C989BEEB7B5BB84304F1445DAE449AB241C7389EC1CF49

Uniqueness

Uniqueness Score: -1.00%

Function 0042D3E9 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 105COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0042D450
__aullrem.LIBCMT ref: 0042D620
__aulldiv.LIBCMT ref: 0042D642

Strings

9, xrefs: 0042D653
', xrefs: 0042D3E9

Memory Dump Source

Source File: 00000007.00000002.440706921.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_409000_erhuush.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: '$9
API String ID: 3120068967-1823400153
Opcode ID: b53842285cc36683f1c6ce8fb90574166aff5df858b6c8ef311ad64556746230
Instruction ID: 88a54ba87f90a9f5b032cfd84d745c94e298abe8153fd9a8b2ffa27ed5e4d3c8
Opcode Fuzzy Hash: b53842285cc36683f1c6ce8fb90574166aff5df858b6c8ef311ad64556746230
Instruction Fuzzy Hash: 994107B1E10129AFDF24CF48D981BAEB7B5FF85318F50409AD148AB241D7789E81CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 004160F7 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 81COMMON

Download Yara Rule

APIs

__inc.LIBCMTD ref: 00416145
_isxdigit.LIBCMTD ref: 0041617D
__hextodec.LIBCMTD ref: 004161B0

Strings

p, xrefs: 0041616F
+, xrefs: 00416110

Memory Dump Source

Source File: 00000007.00000002.440706921.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_409000_erhuush.jbxd

Similarity

API ID: __hextodec__inc_isxdigit
String ID: +$p
API String ID: 3003077261-1790238857
Opcode ID: f8efa3abca31849c5592b86eeb0e740c30bf76091945ac1854910c1bafb44064
Instruction ID: adce234988b22d8bd5ae00344cc608b77643e63ba8c088d33e61c2c02cac5546
Opcode Fuzzy Hash: f8efa3abca31849c5592b86eeb0e740c30bf76091945ac1854910c1bafb44064
Instruction Fuzzy Hash: 33317E70D042999BCF25CFA8C8553EEBB71AF05308F1581EBD85966303D2399AC5CF49

Uniqueness

Uniqueness Score: -1.00%

Function 00414FA1 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

__set_error_mode.LIBCMTD ref: 00415008
__set_error_mode.LIBCMTD ref: 00415017
_strlen.LIBCMT ref: 00415054

Strings

jjj, xrefs: 00414FF0
t/j, xrefs: 00415041

Memory Dump Source

Source File: 00000007.00000002.440706921.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_409000_erhuush.jbxd

Similarity

API ID: __set_error_mode$_strlen
String ID: jjj$t/j
API String ID: 3008368703-194299851
Opcode ID: 5237a7f9a8c83429df2317257b9317bfec3c0575f1e6d1d1950fffdc02ce5e66
Instruction ID: 6db5c2610d0dec12d3da948c66cac38ab562fe90bf1a157d35b76242cbf996f9
Opcode Fuzzy Hash: 5237a7f9a8c83429df2317257b9317bfec3c0575f1e6d1d1950fffdc02ce5e66
Instruction Fuzzy Hash: 0A21C174904208FBDB20DB94DD45BEE3770EB89314F2082AAE40567391D3799E91DF8A

Uniqueness

Uniqueness Score: -1.00%

Function 0041E210 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 62COMMON

Download Yara Rule

APIs

__raise_exc.LIBCMTD ref: 0041E231

Part of subcall function 0041E800: __raise_exc_ex.LIBCMTD ref: 0041E81F

__umatherr.LIBCMTD ref: 0041E286

Part of subcall function 0041EB40: __ctrlfp.LIBCMTD ref: 0041EB90

__ctrlfp.LIBCMTD ref: 0041E2AA

Strings

RB, xrefs: 0041E298
Q., xrefs: 0041E23C

Memory Dump Source

Source File: 00000007.00000002.440706921.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_409000_erhuush.jbxd

Similarity

API ID: __ctrlfp$__raise_exc__raise_exc_ex__umatherr
String ID: Q.$RB
API String ID: 3448981373-1859500299
Opcode ID: 79aa403e752d0bb788226e970f0c201ec913c65f09f5babb0604909f941a5acb
Instruction ID: 65805f5889b076a55894a1ab3ee9b8424b6840a77c5e5b563534fe767c40347b
Opcode Fuzzy Hash: 79aa403e752d0bb788226e970f0c201ec913c65f09f5babb0604909f941a5acb
Instruction Fuzzy Hash: 9A11A5FA800104DBCF14EF95ECC6ADA7374BF48304F0446DDED454A14AEA35D9A8CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040A0AD Relevance: 7.6, APIs: 5, Instructions: 127COMMON

Download Yara Rule

APIs

___libm_error_support.LIBCMTD ref: 0040A155

Part of subcall function 0040E600: __encode_pointer.LIBCMTD ref: 0040E6E1

Memory Dump Source

Source File: 00000007.00000002.440706921.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_409000_erhuush.jbxd

Similarity

API ID: ___libm_error_support__encode_pointer
String ID:
API String ID: 3390238661-0
Opcode ID: f2b5aa644959d262cfab37b3245a945c98fff48b4c57d48cb8fde3180fc3fbeb
Instruction ID: 7b92bbdbbb07480f0aed9223c0c225ba86dfd7bf963a0cba62cf58ff75b82bfd
Opcode Fuzzy Hash: f2b5aa644959d262cfab37b3245a945c98fff48b4c57d48cb8fde3180fc3fbeb
Instruction Fuzzy Hash: 98412935C04704D6CB21AF79DA4516E77B0EF85344F10CB7AF88876291EB348959D34B

Uniqueness

Uniqueness Score: -1.00%

Function 00423881 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 123COMMON

Download Yara Rule

APIs

__isatty.LIBCMTD ref: 00423963
__getbuf.LIBCMTD ref: 00423973
__write.LIBCMTD ref: 004239FB

Strings

8uA, xrefs: 004239F7, 0042395F, 00423962, 004239FA

Memory Dump Source

Source File: 00000007.00000002.440706921.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_409000_erhuush.jbxd

Similarity

API ID: __getbuf__isatty__write
String ID: 8uA
API String ID: 2861569966-2259325327
Opcode ID: cc1b0abdc2988826ec5a43669376b69e5abb6e32c2e8dc166d42234ab6b96b39
Instruction ID: 0dd3b1d60e5f64f8659b5d50802fca4c560dc3e1392e070fed4939187e0a6d64
Opcode Fuzzy Hash: cc1b0abdc2988826ec5a43669376b69e5abb6e32c2e8dc166d42234ab6b96b39
Instruction Fuzzy Hash: 87510874A00208EFDB04CF94D491AADFBB1FF89324F548299E8856B391C739EA81CF44

Uniqueness

Uniqueness Score: -1.00%

Function 00426CE4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00426D43
_memset.LIBCMT ref: 00426DCC
__invalid_parameter.LIBCMTD ref: 00426E2B

Strings

P, xrefs: 00426E40

Memory Dump Source

Source File: 00000007.00000002.440706921.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_409000_erhuush.jbxd

Similarity

API ID: _memset$__invalid_parameter
String ID: P
API String ID: 2178901135-3110715001
Opcode ID: c1c4b16355b8126a1f74390666c0cf54e97bcb35e05dabf74a386e16d8580c85
Instruction ID: 246fb221c4c39f57b5f0615587a7835857ec6ffcce735e185f1bf46c02527c7d
Opcode Fuzzy Hash: c1c4b16355b8126a1f74390666c0cf54e97bcb35e05dabf74a386e16d8580c85
Instruction Fuzzy Hash: AB418974B04319EBCF24CF58D8857AE7771FB41328F21866AE8252A3C0D3799995CF89

Uniqueness

Uniqueness Score: -1.00%

Function 0042D3D6 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 107COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0042D450
__aullrem.LIBCMT ref: 0042D620
__aulldiv.LIBCMT ref: 0042D642

Strings

9, xrefs: 0042D653

Memory Dump Source

Source File: 00000007.00000002.440706921.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_409000_erhuush.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: a9d99888770cab9d7e0f0c34f27cf5cecb2e14e8e89c15b6abf3e2c8dcae7157
Instruction ID: 0f748674789098517c81c6bfd64f9e761f8b5fa2f9a4a8db8edf5eac7631dedc
Opcode Fuzzy Hash: a9d99888770cab9d7e0f0c34f27cf5cecb2e14e8e89c15b6abf3e2c8dcae7157
Instruction Fuzzy Hash: F04117B1E10129AFDF24CF48D881BAEB7B4FF85318F50409AD148AB241D7789E85CF4A

Uniqueness

Uniqueness Score: -1.00%

Function 0042485C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00424888
__aullrem.LIBCMT ref: 00424A55
__aulldiv.LIBCMT ref: 00424A77

Strings

9, xrefs: 00424A88

Memory Dump Source

Source File: 00000007.00000002.440706921.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_409000_erhuush.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: 71fc9a78994e6d16d0c1169087281eb279d550b6d0d5854cb0eb6f4c469db18a
Instruction ID: 7d622ab20ed276f116396610c0aec0db95fc003ade2d99466f96e2832dab4621
Opcode Fuzzy Hash: 71fc9a78994e6d16d0c1169087281eb279d550b6d0d5854cb0eb6f4c469db18a
Instruction Fuzzy Hash: 2041E4B1E15229DFEB24CF58EC99BAEB7B5FB84300F50859AD449A7240D7385E81CF48

Uniqueness

Uniqueness Score: -1.00%

Function 0042D424 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0042D450
__aullrem.LIBCMT ref: 0042D620
__aulldiv.LIBCMT ref: 0042D642

Strings

9, xrefs: 0042D653

Memory Dump Source

Source File: 00000007.00000002.440706921.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_409000_erhuush.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: d9517b125610d09cf6686e9e1e60e3f7890620e4f9ac7ed4a8b95ee4aad8908b
Instruction ID: c5f49ca03594f23acbc4f4cd6f5b4d54cf19c5277b46b3f938c6ca43fe85ffb3
Opcode Fuzzy Hash: d9517b125610d09cf6686e9e1e60e3f7890620e4f9ac7ed4a8b95ee4aad8908b
Instruction Fuzzy Hash: F54106B1E10129AFDB24CF48DD81BAEB7B5FF85314F508199D148AB241D7789E80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00417D5D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00417D89
__aullrem.LIBCMT ref: 00417F56
__aulldiv.LIBCMT ref: 00417F78

Strings

9, xrefs: 00417F89

Memory Dump Source

Source File: 00000007.00000002.440706921.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_409000_erhuush.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: 20673bb0dd0d476465353f81658d8a072f6559d7ea614f6567867374e6f90a8a
Instruction ID: a4f503f4a05c619a2cb2715f3afc384eec036e56c76c5104009c60b3daeeaa8c
Opcode Fuzzy Hash: 20673bb0dd0d476465353f81658d8a072f6559d7ea614f6567867374e6f90a8a
Instruction Fuzzy Hash: 6041E471E0862A9FDB64DF48C989BEEB7B5BB84300F1485DAE009A7241D7389EC1CF45

Uniqueness

Uniqueness Score: -1.00%

Function 0042480B Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00424888
_get_int64_arg.LIBCMTD ref: 004248B0
__aullrem.LIBCMT ref: 00424A55
__aulldiv.LIBCMT ref: 00424A77

Strings

9, xrefs: 00424A88

Memory Dump Source

Source File: 00000007.00000002.440706921.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_409000_erhuush.jbxd

Similarity

API ID: _get_int64_arg$__aulldiv__aullrem
String ID: 9
API String ID: 2124759748-2366072709
Opcode ID: 52b33b09ba93cfe225179afbd334edf23daf10a9ddb99f53eed7ec5f04d9215f
Instruction ID: 584235817bc73f8ae962284972e65426d18d9de26950287a78096d0aaed1cb15
Opcode Fuzzy Hash: 52b33b09ba93cfe225179afbd334edf23daf10a9ddb99f53eed7ec5f04d9215f
Instruction Fuzzy Hash: FF41D5B1E15228DFDB24CF58E889BAEB7B5FB84300F60859AD449A7240D7385E81CF49

Uniqueness

Uniqueness Score: -1.00%

Function 00417D0C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00417D89
_get_int64_arg.LIBCMTD ref: 00417DB1
__aullrem.LIBCMT ref: 00417F56
__aulldiv.LIBCMT ref: 00417F78

Strings

9, xrefs: 00417F89

Memory Dump Source

Source File: 00000007.00000002.440706921.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_409000_erhuush.jbxd

Similarity

API ID: _get_int64_arg$__aulldiv__aullrem
String ID: 9
API String ID: 2124759748-2366072709
Opcode ID: 86485ad8320365a21d973e09cedde198a619cafc6831d8c362282d666b7d4256
Instruction ID: 80de0027016aba27cfb710d9a3c87b46e20102838d83ac131788fc0b50bedefa
Opcode Fuzzy Hash: 86485ad8320365a21d973e09cedde198a619cafc6831d8c362282d666b7d4256
Instruction Fuzzy Hash: 4041E4B1E082299FDB64DF58C989BEEB7B5BB84300F1045DAE409A7241D7389EC1CF49

Uniqueness

Uniqueness Score: -1.00%

Function 0042D3CD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0042D450
_get_int64_arg.LIBCMTD ref: 0042D478
__aullrem.LIBCMT ref: 0042D620
__aulldiv.LIBCMT ref: 0042D642

Strings

9, xrefs: 0042D653

Memory Dump Source

Source File: 00000007.00000002.440706921.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_409000_erhuush.jbxd

Similarity

API ID: _get_int64_arg$__aulldiv__aullrem
String ID: 9
API String ID: 2124759748-2366072709
Opcode ID: 0dfdaa36073ef9f1184e557c8796e4b4eb4d7ebd374c62414a2cd066758d1c8f
Instruction ID: 0be7bbea8f8936df4ac83a2c52f3f5a9c458ef7ad509494722a83a080cae16c0
Opcode Fuzzy Hash: 0dfdaa36073ef9f1184e557c8796e4b4eb4d7ebd374c62414a2cd066758d1c8f
Instruction Fuzzy Hash: A64105B1E00129AFDB24CF48D981B9EB7B4FF85318F50419AE148A7201D7789E80CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 0041FA90 Relevance: 6.1, APIs: 4, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

___dtold.LIBCMTD ref: 0041FAAA
_$I10_OUTPUT.LIBCMTD ref: 0041FAD2
_wcscpy_s.LIBCMTD ref: 0041FB12

Part of subcall function 0040D730: __invalid_parameter.LIBCMTD ref: 0040D7A2

__invoke_watson_if_error.LIBCMTD ref: 0041FB1B

Memory Dump Source

Source File: 00000007.00000002.440706921.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_409000_erhuush.jbxd

Similarity

API ID: I10____dtold__invalid_parameter__invoke_watson_if_error_wcscpy_s
String ID:
API String ID: 289039318-0
Opcode ID: 92aaf2b82aea1797b1c4990a34dc3c2eaf7d02ca6b795ae88429b16248d6c0e2
Instruction ID: 5976e6ebbafa2d317bb44c7ecfea3bb8eedc22a98761cefad2f2701c318cf0c0
Opcode Fuzzy Hash: 92aaf2b82aea1797b1c4990a34dc3c2eaf7d02ca6b795ae88429b16248d6c0e2
Instruction Fuzzy Hash: 20214DB5A002089BCB04EFA4D942ADEB7F4EF8C704F108569F90567382E634E915CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 004159D2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92COMMON

Download Yara Rule

APIs

__whiteout.LIBCMTD ref: 00415B5F
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00416B66

Strings

n, xrefs: 00415B8A

Memory Dump Source

Source File: 00000007.00000002.440706921.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_409000_erhuush.jbxd

Similarity

API ID: Locale$UpdateUpdate::~___whiteout
String ID: n
API String ID: 2661511698-2013832146
Opcode ID: 2516c8dfc543d407d4c8a144eb9cf6009eb1a8c8fb2bed4a5b4bfbd473836ec5
Instruction ID: ecfd4378f8583d72b307479f6d223e2097ebd30da65c6bdb4e1d2919ce9eeb8a
Opcode Fuzzy Hash: 2516c8dfc543d407d4c8a144eb9cf6009eb1a8c8fb2bed4a5b4bfbd473836ec5
Instruction Fuzzy Hash: B241A070909659CBCF24CF54D4957EEBBB1AF41315F14829BD8156B282C338AEC1CF59

Uniqueness

Uniqueness Score: -1.00%

Function 004159A7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92COMMON

Download Yara Rule

APIs

__whiteout.LIBCMTD ref: 00415B5F
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00416B66

Strings

n, xrefs: 00415B8A

Memory Dump Source

Source File: 00000007.00000002.440706921.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_409000_erhuush.jbxd

Similarity

API ID: Locale$UpdateUpdate::~___whiteout
String ID: n
API String ID: 2661511698-2013832146
Opcode ID: d2cf797c362700c7c598d5f58046728f5b52e3385e363cb4ed932ee8fd006abd
Instruction ID: ecfd4378f8583d72b307479f6d223e2097ebd30da65c6bdb4e1d2919ce9eeb8a
Opcode Fuzzy Hash: d2cf797c362700c7c598d5f58046728f5b52e3385e363cb4ed932ee8fd006abd
Instruction Fuzzy Hash: B241A070909659CBCF24CF54D4957EEBBB1AF41315F14829BD8156B282C338AEC1CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00415A97 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 85COMMON

Download Yara Rule

APIs

__whiteout.LIBCMTD ref: 00415B5F
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00416B66

Strings

n, xrefs: 00415B8A

Memory Dump Source

Source File: 00000007.00000002.440706921.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_409000_erhuush.jbxd

Similarity

API ID: Locale$UpdateUpdate::~___whiteout
String ID: n
API String ID: 2661511698-2013832146
Opcode ID: 81b4a4ac1d906f0f7d1c4b56dcd511b19de96e8159785e3cfc507fb03a1586ed
Instruction ID: 877292e96ff1bb00e21e4e8a2193c3722173543034e2bdd30c2b242f653ec0a3
Opcode Fuzzy Hash: 81b4a4ac1d906f0f7d1c4b56dcd511b19de96e8159785e3cfc507fb03a1586ed
Instruction Fuzzy Hash: 4A318270909668CBCF24CF55D4957EEBBB0AF41315F14829BD8656B282C338AEC1CF19

Uniqueness

Uniqueness Score: -1.00%

Function 0041610E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_isxdigit.LIBCMTD ref: 0041617D
__hextodec.LIBCMTD ref: 004161B0
_isdigit.LIBCMTD ref: 004161D6
__inc.LIBCMTD ref: 004162C0
__un_inc.LIBCMTD ref: 004162E4
_isxdigit.LIBCMTD ref: 0041633D
__hextodec.LIBCMTD ref: 00416360
_isdigit.LIBCMTD ref: 00416383
__inc.LIBCMTD ref: 00416434
__un_inc.LIBCMTD ref: 00416458
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00416B66

Strings

p, xrefs: 0041616F

Memory Dump Source

Source File: 00000007.00000002.440706921.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_409000_erhuush.jbxd

Similarity

API ID: Locale__hextodec__inc__un_inc_isdigit_isxdigit$UpdateUpdate::~_
String ID: p
API String ID: 1652772854-2181537457
Opcode ID: 1588b932da412bbf87f59dad724f1803a9f1c0a02590b428f0eafa555efa337b
Instruction ID: 2e713e9dbd54042634f8fed090cb0d75afbde769bb5addf1dc00d549ecf89bff
Opcode Fuzzy Hash: 1588b932da412bbf87f59dad724f1803a9f1c0a02590b428f0eafa555efa337b
Instruction Fuzzy Hash: 25219071D042698ACF25CF65C8443FEBBB5AF05308F1581EBD81966302D239CAC1CF89

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: regsvr32.exePID: 4712, Parent PID: 3328COMMON

Execution Graph

Execution Coverage:	25.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	39
Total number of Limit Nodes:	8

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 05082B6C Relevance: 6.4, APIs: 4, Instructions: 431
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 05082F8B
VirtualProtect.KERNELBASE(?,?,?,?), ref: 05082FAB
VirtualProtect.KERNELBASE(?,?,?,?), ref: 05082FCB

Memory Dump Source

Source File: 0000000D.00000002.476573820.0000000005081000.00000020.00001000.00020000.00000000.sdmp, Offset: 05081000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5081000_regsvr32.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: d67ae0f6c3b0dbc33e0c3acd2ed51920f1be3291a69c20c17ebd32c678925008
Instruction ID: 531de4570f36d656be9c38c82be310caf13423bad07a55519043eed3463b1a99
Opcode Fuzzy Hash: d67ae0f6c3b0dbc33e0c3acd2ed51920f1be3291a69c20c17ebd32c678925008
Instruction Fuzzy Hash: 92023B75E002299BCB58DF68DC91BEDB7B1BF88714F14859AD549EB340DB30AA81CF90

Uniqueness

Uniqueness Score: -1.00%

Function 05151000 Relevance: 1.7, APIs: 1, Instructions: 205
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtCreateThreadEx.NTDLL(?,?,?,?,?,?,?,?,?,?,?), ref: 05151216

Memory Dump Source

Source File: 0000000D.00000002.477821755.0000000005151000.00000020.00001000.00020000.00000000.sdmp, Offset: 05151000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5151000_regsvr32.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 7eb43aab4efcc3de7a31bfca7b793fa7d04a26d42464197c98bcc33c3cb16c47
Instruction ID: 757db3a90fe77c6d4d3eb4f73f0a6fb342948fc77e2eaec4c25b029a397e1f9b
Opcode Fuzzy Hash: 7eb43aab4efcc3de7a31bfca7b793fa7d04a26d42464197c98bcc33c3cb16c47
Instruction Fuzzy Hash: F1917136618341DFD724CF28C840A9AB7E3FFC9324F268A18E9D997354D771A846CB81

Uniqueness

Uniqueness Score: -1.00%

Function 05154418 Relevance: 1.4, APIs: 1, Instructions: 137
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualFree.KERNELBASE(?,?,?), ref: 05154438

Memory Dump Source

Source File: 0000000D.00000002.477821755.0000000005151000.00000020.00001000.00020000.00000000.sdmp, Offset: 05151000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5151000_regsvr32.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 65b2b484bf10636dde6829dd02dbe3d3f020211f918f641257ad7756cf0f29a3
Instruction ID: 4f060e6b18ad06abdd1db40ecbb8478d34339e93804741a04ba6bdd056033432
Opcode Fuzzy Hash: 65b2b484bf10636dde6829dd02dbe3d3f020211f918f641257ad7756cf0f29a3
Instruction Fuzzy Hash: BD511E76E10119CFDF14CFA9C881A9DBBB7BF88320F168155D919BB294D774A982CF80

Uniqueness

Uniqueness Score: -1.00%

Function 051519DD Relevance: 1.4, APIs: 1, Instructions: 137
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(?,?,?,?), ref: 05151A0F

Memory Dump Source

Source File: 0000000D.00000002.477821755.0000000005151000.00000020.00001000.00020000.00000000.sdmp, Offset: 05151000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5151000_regsvr32.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 72811427c7125005a66f81e193421bd24a6dbe3df2fe88cabc43ab9c77ee4d8b
Instruction ID: 1cd69722c51ee7d6b0b837c65faa5791ae209b1045b479c67c9c86b51478a9a3
Opcode Fuzzy Hash: 72811427c7125005a66f81e193421bd24a6dbe3df2fe88cabc43ab9c77ee4d8b
Instruction Fuzzy Hash: DD512B76E10219DFCF15CFA9C980A9DBBB2FF88320F268659D859EB244D730A941CF40

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: 87B9.exePID: 5612, Parent PID: 3528COMMON

Execution Graph

Execution Coverage:	2.5%
Dynamic/Decrypted Code Coverage:	11.4%
Signature Coverage:	19.7%
Total number of Nodes:	315
Total number of Limit Nodes:	13

Executed Functions

Function 026F0110 Relevance: 22.7, APIs: 15, Instructions: 248
memorynativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 026F0156
GetModuleFileNameA.KERNELBASE(00000000,?,00002800), ref: 026F016C
CreateProcessA.KERNELBASE(?,00000000), ref: 026F0255
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 026F0270
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 026F0283
GetThreadContext.KERNELBASE(00000000,?), ref: 026F029F
ReadProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 026F02C8
NtUnmapViewOfSection.NTDLL(00000000,?), ref: 026F02E3
VirtualAllocEx.KERNELBASE(00000000,?,?,00003000,00000040), ref: 026F0304
NtWriteVirtualMemory.NTDLL(00000000,?,?,00000000,00000000), ref: 026F032A
NtWriteVirtualMemory.NTDLL(00000000,00000000,?,00000002,00000000), ref: 026F0399
WriteProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 026F03BF
SetThreadContext.KERNELBASE(00000000,?), ref: 026F03E1
ResumeThread.KERNELBASE(00000000), ref: 026F03ED
ExitProcess.KERNEL32(00000000), ref: 026F0412

Memory Dump Source

Source File: 0000000E.00000002.495843293.00000000026F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_26f0000_87B9.jbxd

Yara matches

Similarity

API ID: Virtual$MemoryProcess$AllocThreadWrite$Context$CreateExitFileFreeModuleNameReadResumeSectionUnmapView
String ID:
API String ID: 2875986403-0
Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction ID: f13f60e8c58926e614ed86f55abfb4ffd670488b30d84ea72b1e75d59586b8bc
Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction Fuzzy Hash: F3B1C674A00209AFDB44CF98C895F9EBBB5FF88314F248158E608AB395D771AE41CF94

Uniqueness

Uniqueness Score: -1.00%

Function 026F0420 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 026F0533

Strings

saodkfnosa9uin, xrefs: 026F04DA
d, xrefs: 026F0584
0, xrefs: 026F0492
mfoaskdfnoa, xrefs: 026F0520, 026F0523

Memory Dump Source

Source File: 0000000E.00000002.495843293.00000000026F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_26f0000_87B9.jbxd

Yara matches

Similarity

API ID: CreateWindow
String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
API String ID: 716092398-2341455598
Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction ID: 328dd358fa8ba898349e2b39869626b604e78c5789c625e2367e5a0da11a91fc
Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction Fuzzy Hash: 7E512870D08388DAEF11CBE8C949BDDBFB6AF11708F144058D5446F28AC3FA5659CB66

Uniqueness

Uniqueness Score: -1.00%

Function 026F05B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(apfHQ), ref: 026F05EC

Strings

o, xrefs: 026F0600
apfHQ, xrefs: 026F05E2, 026F05E5

Memory Dump Source

Source File: 0000000E.00000002.495843293.00000000026F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_26f0000_87B9.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID: apfHQ$o
API String ID: 3188754299-2999369273
Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction ID: dcfe0c3e538cb2b3c3c0572a8f8800ec27a57cce1cb67bb959ed21f50f7199de
Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction Fuzzy Hash: 5C011E70C0425CEADF54DB98C5183AEBFB5AF41308F148099C5092B342D7B69B59CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 025457C6 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 025457EE
Module32First.KERNEL32(00000000,00000224), ref: 0254580E

Memory Dump Source

Source File: 0000000E.00000002.494725828.0000000002545000.00000040.00000800.00020000.00000000.sdmp, Offset: 02545000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2545000_87B9.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: e9f3f7ca4e46d36a32fe97bd1d8cd0e7f4989d2590682eeed6ac78a43ffb93df
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: A0F09C351007116FD7203BF5988DF6EB6E8BF5567DF500538E542910C0EF70E8458655

Uniqueness

Uniqueness Score: -1.00%

Function 004121C0 Relevance: 1.5, APIs: 1, Instructions: 8
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E004121C0() {
				void* _t1;

				_t1 = E004120F0(0); // executed
				return _t1;
			}

0x004121c7
0x004121d0

APIs

__encode_pointer.LIBCMTD ref: 004121C7

Part of subcall function 004120F0: TlsGetValue.KERNEL32(00000004), ref: 00412105
Part of subcall function 004120F0: TlsGetValue.KERNEL32(00000004,00000005), ref: 00412126
Part of subcall function 004120F0: __crt_wait_module_handle.LIBCMTD ref: 0041213C
Part of subcall function 004120F0: GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 00412156
Part of subcall function 004120F0: RtlEncodePointer.NTDLL(?), ref: 00412177

Memory Dump Source

Source File: 0000000E.00000002.493613078.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.493523065.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000E.00000002.493860522.0000000000430000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000E.00000002.493899985.0000000000436000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000E.00000002.494094997.00000000004C7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000E.00000002.494402030.00000000008C7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000E.00000002.494433804.00000000008CA000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_87B9.jbxd

Similarity

API ID: Value$AddressEncodePointerProc__crt_wait_module_handle__encode_pointer
String ID:
API String ID: 568403282-0
Opcode ID: f00befe9f6ce37f0a9e0ee05923ac5330ac6df44ba7645856ef0dc2498812e42
Instruction ID: 56bd8f253069a7568e0a68e63b4c6b3685c6f2a49c54f90427001d980ce716fe
Opcode Fuzzy Hash: f00befe9f6ce37f0a9e0ee05923ac5330ac6df44ba7645856ef0dc2498812e42
Instruction Fuzzy Hash: ABA011B288820823EA0020833803B023A0E83C0A38F080022FA0C0A2822882A8A080AB

Uniqueness

Uniqueness Score: -1.00%

Function 0040AD40 Relevance: 1.5, APIs: 1, Instructions: 5
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			_entry_() {
				void* _t3;
				void* _t4;
				void* _t5;

				E00418370(); // executed
				return L0040AD60(_t3, _t4, _t5);
			}

0x0040ad45
0x0040ad50

APIs

___security_init_cookie.LIBCMTD ref: 0040AD45

Memory Dump Source

Source File: 0000000E.00000002.493613078.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.493523065.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000E.00000002.493860522.0000000000430000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000E.00000002.493899985.0000000000436000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000E.00000002.494094997.00000000004C7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000E.00000002.494402030.00000000008C7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000E.00000002.494433804.00000000008CA000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_87B9.jbxd

Similarity

API ID: ___security_init_cookie
String ID:
API String ID: 3657697845-0
Opcode ID: 2ee9993cee9888740ab7b244044e9f3a06580834980761ffb4b15bbb2664e5cd
Instruction ID: 1aa6f64352c82f2f7399416b74ec9f369f850dca5733670cb696924c3eb91816
Opcode Fuzzy Hash: 2ee9993cee9888740ab7b244044e9f3a06580834980761ffb4b15bbb2664e5cd
Instruction Fuzzy Hash: BAA0022504478C66416073B7041794AB54E4DC0B1979D402E7968125435C6DE85140AF

Uniqueness

Uniqueness Score: -1.00%

Function 02545485 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 025454D6

Memory Dump Source

Source File: 0000000E.00000002.494725828.0000000002545000.00000040.00000800.00020000.00000000.sdmp, Offset: 02545000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2545000_87B9.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: a5658c9da31a931ee5485c01809f8a0a62f825dc7609f26e98eb85e0f1a2f803
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: E4116C79A00208EFDB01DF98C985E98BFF1AF08350F0580A4F9489B361E731EA90DF84

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00414FF0 Relevance: 7.6, APIs: 5, Instructions: 59
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 85%

			E00414FF0(intOrPtr __eax, intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, char _a4) {
				intOrPtr _v0;
				void* _v804;
				intOrPtr _v808;
				intOrPtr _v812;
				intOrPtr _t6;
				intOrPtr _t11;
				long _t15;
				intOrPtr _t19;
				intOrPtr _t20;
				intOrPtr _t21;
				intOrPtr _t22;
				intOrPtr _t23;
				intOrPtr _t24;
				intOrPtr _t25;
				intOrPtr* _t29;
				void* _t34;

				_t25 = __esi;
				_t24 = __edi;
				_t22 = __edx;
				_t20 = __ecx;
				_t19 = __ebx;
				_t6 = __eax;
				_t34 = _t20 -  *0x4c74b4; // 0x29cd8344
				if(_t34 == 0) {
					asm("repe ret");
				}
				 *0x8c7fd8 = _t6;
				 *0x8c7fd4 = _t20;
				 *0x8c7fd0 = _t22;
				 *0x8c7fcc = _t19;
				 *0x8c7fc8 = _t25;
				 *0x8c7fc4 = _t24;
				 *0x8c7ff0 = ss;
				 *0x8c7fe4 = cs;
				 *0x8c7fc0 = ds;
				 *0x8c7fbc = es;
				 *0x8c7fb8 = fs;
				 *0x8c7fb4 = gs;
				asm("pushfd");
				_pop( *0x8c7fe8);
				 *0x8c7fdc =  *_t29;
				 *0x8c7fe0 = _v0;
				 *0x8c7fec =  &_a4;
				 *0x8c7f28 = 0x10001;
				_t11 =  *0x8c7fe0; // 0x0
				 *0x8c7edc = _t11;
				 *0x8c7ed0 = 0xc0000409;
				 *0x8c7ed4 = 1;
				_t21 =  *0x4c74b4; // 0x29cd8344
				_v812 = _t21;
				_t23 =  *0x4c74b8; // 0xd6327cbb
				_v808 = _t23;
				 *0x8c7f20 = IsDebuggerPresent();
				_push(1);
				E00419C00(_t12);
				SetUnhandledExceptionFilter(0);
				_t15 = UnhandledExceptionFilter(0x407424);
				if( *0x8c7f20 == 0) {
					_push(1);
					E00419C00(_t15);
				}
				return TerminateProcess(GetCurrentProcess(), 0xc0000409);
			}

0x00414ff0
0x00414ff0
0x00414ff0
0x00414ff0
0x00414ff0
0x00414ff0
0x00414ff0
0x00414ff6
0x00414ff8
0x00414ff8
0x0042298b
0x00422990
0x00422996
0x0042299c
0x004229a2
0x004229a8
0x004229ae
0x004229b5
0x004229bc
0x004229c3
0x004229ca
0x004229d1
0x004229d8
0x004229d9
0x004229e2
0x004229ea
0x004229f2
0x004229fd
0x00422a07
0x00422a0c
0x00422a11
0x00422a1b
0x00422a25
0x00422a2b
0x00422a31
0x00422a37
0x00422a43
0x00422a48
0x00422a4a
0x00422a54
0x00422a5f
0x00422a6c
0x00422a6e
0x00422a70
0x00422a75
0x00422a8d

APIs

IsDebuggerPresent.KERNEL32 ref: 00422A3D
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00422A54
UnhandledExceptionFilter.KERNEL32(00407424), ref: 00422A5F
GetCurrentProcess.KERNEL32(C0000409), ref: 00422A7D
TerminateProcess.KERNEL32(00000000), ref: 00422A84

Memory Dump Source

Source File: 0000000E.00000002.493613078.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.493523065.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000E.00000002.493860522.0000000000430000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000E.00000002.493899985.0000000000436000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000E.00000002.494094997.00000000004C7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000E.00000002.494402030.00000000008C7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000E.00000002.494433804.00000000008CA000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_87B9.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 20ba4a53340203b7253ed8d8ad130542b95855e528025d143a85a03c04e694f9
Instruction ID: 477f6a4badbea5c725874083a945a85caf440e46fc1222ffedf0e1de5a151d7a
Opcode Fuzzy Hash: 20ba4a53340203b7253ed8d8ad130542b95855e528025d143a85a03c04e694f9
Instruction Fuzzy Hash: 0F210EB98282049FC304DF19FE84E587BB4BB1C300F4041AEE909973B1EBB45981CF9A

Uniqueness

Uniqueness Score: -1.00%

Function 0254671C Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.494725828.0000000002545000.00000040.00000800.00020000.00000000.sdmp, Offset: 02545000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2545000_87B9.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d6b6acc52598ba466396b9b98489674ce8409ccf4a4742af8d6b4b599497031
Instruction ID: 2fe1e5304ab3599173cb3ab50fa312ea859c17b7dc1ade8051a62beeec96aa88
Opcode Fuzzy Hash: 1d6b6acc52598ba466396b9b98489674ce8409ccf4a4742af8d6b4b599497031
Instruction Fuzzy Hash: B43155398062429FDB15CE70D890BA5FB74FF87238F18999CC0818B106D726A04BCB98

Uniqueness

Uniqueness Score: -1.00%

Function 02713F16 Relevance: 16.8, APIs: 11, Instructions: 258
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 02713F51

Part of subcall function 02715BA8: __getptd_noexit.LIBCMT ref: 02715BA8

__gmtime64_s.LIBCMT ref: 02713FEA
__gmtime64_s.LIBCMT ref: 02714020
__gmtime64_s.LIBCMT ref: 0271403D
__allrem.LIBCMT ref: 02714093
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 027140AF
__allrem.LIBCMT ref: 027140C6
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 027140E4
__allrem.LIBCMT ref: 027140FB
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 02714119
__invoke_watson.LIBCMT ref: 0271418A

Memory Dump Source

Source File: 0000000E.00000002.495843293.00000000026F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_26f0000_87B9.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction ID: dc8064418785bee7030b7546196399908d7ea8bd75ca8bdf22ed79a3a890212c
Opcode Fuzzy Hash: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction Fuzzy Hash: 39712672A00727ABE715AF7DCC55B6AB3B9AF11324F14427AE514E7680E770D9048BD0

Uniqueness

Uniqueness Score: -1.00%

Function 027184AB Relevance: 16.6, APIs: 11, Instructions: 92COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtCorExitProcess.LIBCMT ref: 027184B1
_free.LIBCMT ref: 027184E2
_free.LIBCMT ref: 027184F5
_free.LIBCMT ref: 02718513
_free.LIBCMT ref: 02718525
_free.LIBCMT ref: 02718536
_free.LIBCMT ref: 02718541
_free.LIBCMT ref: 02718565
_free.LIBCMT ref: 02718581
_free.LIBCMT ref: 02718597
_free.LIBCMT ref: 027185BF

Memory Dump Source

Source File: 0000000E.00000002.495843293.00000000026F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_26f0000_87B9.jbxd

Yara matches

Similarity

API ID: _free$ExitProcess___crt
String ID:
API String ID: 1022109855-0
Opcode ID: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction ID: e0b17afb17f667c11b35bbf3af587469114bfffec4f7f5be7b02623547428add
Opcode Fuzzy Hash: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction Fuzzy Hash: 5E31C531900260DFDB229F1DFC8584D77A6FF14324754862AEA085B2B0CBB459C9AF96

Uniqueness

Uniqueness Score: -1.00%

Function 0273FC0C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0273FC1F
__CxxThrowException@8.LIBCMT ref: 0273FC34
std::exception::exception.LIBCMT ref: 0273FC4D
__CxxThrowException@8.LIBCMT ref: 0273FC62
std::regex_error::regex_error.LIBCPMT ref: 0273FC74

Part of subcall function 0273F914: std::exception::exception.LIBCMT ref: 0273F92E

__CxxThrowException@8.LIBCMT ref: 0273FC82
std::exception::exception.LIBCMT ref: 0273FC9B
__CxxThrowException@8.LIBCMT ref: 0273FCB0

Strings

leM, xrefs: 0273FCA8

Memory Dump Source

Source File: 0000000E.00000002.495843293.00000000026F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_26f0000_87B9.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception$std::regex_error::regex_error
String ID: leM
API String ID: 2862078307-2926266777
Opcode ID: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction ID: ab05b6671ea12a0a1402bf6ac04151d103bd85f2541a8c8dfc6f8a22d5e2dc33
Opcode Fuzzy Hash: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction Fuzzy Hash: 9111BC79C0020DBBCF01FFA5D499CDDBB7DBA04344B808566ED1897641EB74A3488F95

Uniqueness

Uniqueness Score: -1.00%

Function 026FF010 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 026FF01F

Part of subcall function 02711602: __FF_MSGBANNER.LIBCMT ref: 02711619
Part of subcall function 02711602: __NMSG_WRITE.LIBCMT ref: 02711620

_malloc.LIBCMT ref: 026FF02B
_wprintf.LIBCMT ref: 026FF03E
_free.LIBCMT ref: 026FF044
_free.LIBCMT ref: 026FF065
_malloc.LIBCMT ref: 026FF06D
_sprintf.LIBCMT ref: 026FF0C0
_wprintf.LIBCMT ref: 026FF0D2
_wprintf.LIBCMT ref: 026FF0DC
_free.LIBCMT ref: 026FF0E5

Memory Dump Source

Source File: 0000000E.00000002.495843293.00000000026F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_26f0000_87B9.jbxd

Yara matches

Similarity

API ID: _free_malloc_wprintf$_sprintf
String ID:
API String ID: 3721157643-0
Opcode ID: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction ID: 874de40cfd86eb632812124e8d7c59c38e4ef28d57c799a797d4908af60c8629
Opcode Fuzzy Hash: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction Fuzzy Hash: 541136B29006A07AC762B6B90C16FFF3BDD9F45302F4800A9FF8CD5180DA185A049BB1

Uniqueness

Uniqueness Score: -1.00%

Function 02701960 Relevance: 13.6, APIs: 9, Instructions: 149COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 027019C6
__CxxThrowException@8.LIBCMT ref: 027019F1
__CxxThrowException@8.LIBCMT ref: 02701A1A
__CxxThrowException@8.LIBCMT ref: 02701A4B
_memset.LIBCMT ref: 02701A6A
__CxxThrowException@8.LIBCMT ref: 02701A90
_malloc.LIBCMT ref: 02701AA0
_memset.LIBCMT ref: 02701AAB
_sprintf.LIBCMT ref: 02701ACE

Memory Dump Source

Source File: 0000000E.00000002.495843293.00000000026F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_26f0000_87B9.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset$_malloc_sprintf
String ID:
API String ID: 65388428-0
Opcode ID: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction ID: 00a3513da542f7f94c6f6828f942502954b6dcb99bf9270f0d68133e93e610f5
Opcode Fuzzy Hash: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction Fuzzy Hash: 79512CB1D40219EBDB11DBA5DC8AFEFBBB9FF04744F100029F909B6190E7745A058BA5

Uniqueness

Uniqueness Score: -1.00%

Function 026FF210 Relevance: 10.7, APIs: 7, Instructions: 165COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 026FF284
__CxxThrowException@8.LIBCMT ref: 026FF2AF
__CxxThrowException@8.LIBCMT ref: 026FF2DE
__CxxThrowException@8.LIBCMT ref: 026FF30F
_memset.LIBCMT ref: 026FF32E
__CxxThrowException@8.LIBCMT ref: 026FF354
_sprintf.LIBCMT ref: 026FF373

Memory Dump Source

Source File: 0000000E.00000002.495843293.00000000026F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_26f0000_87B9.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction ID: e5c8fc0af1c73ac428bcefa6ebd8ba2045e13b861210f154ebb0c34fca3e1902
Opcode Fuzzy Hash: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction Fuzzy Hash: EF514F71D40249AADF11DFA5DC86FEEBBB9AF05704F100029FA05B62C0D775AA058BA5

Uniqueness

Uniqueness Score: -1.00%

Function 026FF440 Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 026FF4B7
__CxxThrowException@8.LIBCMT ref: 026FF4E2
__CxxThrowException@8.LIBCMT ref: 026FF504
__CxxThrowException@8.LIBCMT ref: 026FF535
_memset.LIBCMT ref: 026FF554
__CxxThrowException@8.LIBCMT ref: 026FF57A
_sprintf.LIBCMT ref: 026FF594

Memory Dump Source

Source File: 0000000E.00000002.495843293.00000000026F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_26f0000_87B9.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction ID: 2e297b61a455df3a8f9e132d0753f447bd02fc1154528b468e905658e82d5a4a
Opcode Fuzzy Hash: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction Fuzzy Hash: 90515271D40249AADF21DFA5DC86FEEBBB9FF04704F100129FA05B62C0D774AA058BA4

Uniqueness

Uniqueness Score: -1.00%

Function 027B66D9 Relevance: 9.1, APIs: 6, Instructions: 100COMMON

Download Yara Rule

APIs

__getptd_noexit.LIBCMT ref: 027B66DD

Part of subcall function 027159BF: __calloc_crt.LIBCMT ref: 027159E2
Part of subcall function 027159BF: __initptd.LIBCMT ref: 02715A04

__calloc_crt.LIBCMT ref: 027B6700
__get_sys_err_msg.LIBCMT ref: 027B671E
__invoke_watson.LIBCMT ref: 027B673B
__get_sys_err_msg.LIBCMT ref: 027B676D
__invoke_watson.LIBCMT ref: 027B678B

Memory Dump Source

Source File: 0000000E.00000002.495843293.00000000026F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_26f0000_87B9.jbxd

Yara matches

Similarity

API ID: __calloc_crt__get_sys_err_msg__invoke_watson$__getptd_noexit__initptd
String ID:
API String ID: 4066021419-0
Opcode ID: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction ID: 573f560f762483f4b7a3b828448c350b878f1d4a26858bcec0015d89b5868110
Opcode Fuzzy Hash: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction Fuzzy Hash: BC11E3726012196BEB237E29DC05BFB738EEF007A4F000466FF08A6A40E732DD014AE5

Uniqueness

Uniqueness Score: -1.00%

Function 02712AD0 Relevance: 7.7, APIs: 5, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 02712B2E
_memcpy_s.LIBCMT ref: 02712BA0
__read_nolock.LIBCMT ref: 02712BFE
__filbuf.LIBCMT ref: 02712C21
_memset.LIBCMT ref: 02712C65

Part of subcall function 02715BA8: __getptd_noexit.LIBCMT ref: 02715BA8

Memory Dump Source

Source File: 0000000E.00000002.495843293.00000000026F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_26f0000_87B9.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock_memcpy_s
String ID:
API String ID: 1559183368-0
Opcode ID: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction ID: f71b0a3bb356d990f009ae40e2929e353b62ba84bc5c2c184c8d5f72dcf2a0d9
Opcode Fuzzy Hash: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction Fuzzy Hash: 1751B370A0132A9BDB398F7DCC84AAE77B6AF40324F148729ED35962D2E7709951CF44

Uniqueness

Uniqueness Score: -1.00%

Function 02702670 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 382COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 027026DB
_memset.LIBCMT ref: 02702A30
_memset.LIBCMT ref: 02702AC0

Strings

D, xrefs: 02702AC8

Memory Dump Source

Source File: 0000000E.00000002.495843293.00000000026F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_26f0000_87B9.jbxd

Yara matches

Similarity

API ID: _memset
String ID: D
API String ID: 2102423945-2746444292
Opcode ID: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction ID: 23d381bd7dda34dada29c75e5fb6aeb40eca5b4199e57a00032d54d6c629dcf8
Opcode Fuzzy Hash: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction Fuzzy Hash: 52E14E72D00219EADF65DBA0CD89FEEB7B8BF04304F144069EA09F6191EB746A49CF54

Uniqueness

Uniqueness Score: -1.00%

Function 026FD8B0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 228COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 026FD8EA

Strings

$, xrefs: 026FDAE2
, xrefs: 026FDADB
(, xrefs: 026FDAE9

Memory Dump Source

Source File: 0000000E.00000002.495843293.00000000026F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_26f0000_87B9.jbxd

Yara matches

Similarity

API ID: _memset
String ID: $$$(
API String ID: 2102423945-3551151888
Opcode ID: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction ID: d3623191b57079487b63ed15f34aad2639fa24312bff41c4f6322e5e1c021ace
Opcode Fuzzy Hash: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction Fuzzy Hash: BC91BEB1D00218EAEF21CFA4CC99BEEBBB5AF05308F144169D505772C1DBB66A48CF65

Uniqueness

Uniqueness Score: -1.00%

Function 0273FBDE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0273FBF1
__CxxThrowException@8.LIBCMT ref: 0273FC06

Strings

TeM, xrefs: 0273FBE7, 0273FBFB
TeM, xrefs: 0273FBFE

Memory Dump Source

Source File: 0000000E.00000002.495843293.00000000026F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_26f0000_87B9.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception
String ID: TeM$TeM
API String ID: 3728558374-3870166017
Opcode ID: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction ID: 8c62b8e21a8754684fdc97649330c5cd2a0dd2ce96c9d9aaf3b5acd99312a58b
Opcode Fuzzy Hash: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction Fuzzy Hash: F2D06775C0025CBBCB01EFA5D499CDDBBB9AA04344B408466E91897241EA74A34D8F94

Uniqueness

Uniqueness Score: -1.00%

Function 026FD0E0 Relevance: 6.3, APIs: 4, Instructions: 254COMMON

Download Yara Rule

APIs

Part of subcall function 0271197D: __wfsopen.LIBCMT ref: 02711988

_fgetws.LIBCMT ref: 026FD15C

Memory Dump Source

Source File: 0000000E.00000002.495843293.00000000026F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_26f0000_87B9.jbxd

Yara matches

Similarity

API ID: __wfsopen_fgetws
String ID:
API String ID: 853134316-0
Opcode ID: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction ID: 9ce9700aae661c56e95719d10a2449f61aa114e94654cfb20c09d74e9e315d51
Opcode Fuzzy Hash: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction Fuzzy Hash: 1791B272D00219ABCF61DFA8CC89BAEB7B5BF05314F140529EA15A3240E775BA48CBD5

Uniqueness

Uniqueness Score: -1.00%

Function 026FD540 Relevance: 6.2, APIs: 4, Instructions: 240COMMON

Download Yara Rule

APIs

__except_handler4.MSVCRT ref: 026FD77E
_malloc.LIBCMT ref: 026FD7B2
_malloc.LIBCMT ref: 026FD7C1
_fprintf.LIBCMT ref: 026FD815

Memory Dump Source

Source File: 0000000E.00000002.495843293.00000000026F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_26f0000_87B9.jbxd

Yara matches

Similarity

API ID: _malloc$__except_handler4_fprintf
String ID:
API String ID: 1783060780-0
Opcode ID: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction ID: ac7e43378d7f1c130b583ca12d7cdc7bbedd3002e06e256c1528b43cbd70a727
Opcode Fuzzy Hash: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction Fuzzy Hash: 98A151B1C00259DBEF12EFE4CC49BDEBB76AF15308F140028D50576292D7B65A58CFA6

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. Regsvr32.exe is also a Microsoft signed binary.
Tactics:	Defense Evasion
Data Sources:	Loaded DLLs, Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Djvu

Threatname: SmokeLoader

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\geo[1].json

C:\Users\user\AppData\Local\Temp\254.exe

C:\Users\user\AppData\Local\Temp\4A99.exe

C:\Users\user\AppData\Local\Temp\519F.exe

C:\Users\user\AppData\Local\Temp\70E4.dll

C:\Users\user\AppData\Local\Temp\87B9.exe

C:\Users\user\AppData\Local\Temp\964B.exe

C:\Users\user\AppData\Local\Temp\A024.exe

C:\Users\user\AppData\Local\Temp\ACE4.exe

C:\Users\user\AppData\Local\Temp\C05F.exe

C:\Users\user\AppData\Local\Temp\C39A.exe

C:\Users\user\AppData\Local\Temp\D86C.exe

C:\Users\user\AppData\Local\Temp\E9D3.exe

Windows Analysis Report
file.exe

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN , ZXProxy, and ZXPortMap. Adversaries use these types of proxies to manage command and control communications, reduce the number of simultaneous outbound network connections, provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion. Adversaries may chain together multiple proxies to further disguise the source of malicious traffic.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre