Edit tour

Windows Analysis Report
ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe

Overview

General Information

Sample name:	ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe renamed because original name is a hash value
Original sample name:	ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC TWSE0211390.scr.exe
Analysis ID:	1528880
MD5:	77372096fcdd78300c5cdc1baa95004b
SHA1:	93b4aaa039f65f2780cf177f2554ca9e4be809be
SHA256:	0d89ebfc019f155ecbb5f5fb49dc172741f17de763013f2abb39b9ee3d5cc433
Tags:	exeuser-threatcat_ch
Infos:

Detection

Remcos

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Contains functionality to bypass UAC (CMSTPLUA)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected AntiVM3

Yara detected Remcos RAT

Yara detected UAC Bypass using CMSTP

.NET source code contains potential unpacker

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Contains functionality to register a low level keyboard hook

Contains functionality to steal Chrome passwords or cookies

Contains functionality to steal Firefox passwords or cookies

Contains functionalty to change the wallpaper

Creates autostart registry keys with suspicious names

Delayed program exit found

Drops executable to a common third party application directory

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains functionality for read data from the clipboard

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to download and launch executables

Contains functionality to dynamically determine API calls

Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)

Contains functionality to enumerate running services

Contains functionality to launch a control a shell (cmd.exe)

Contains functionality to modify clipboard data

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates processes with suspicious names

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evaded block containing many API calls

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Keylogger Generic

Yara signature match

Classification

Process Tree

System is w10x64

ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe (PID: 7300 cmdline: "C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe" MD5: 77372096FCDD78300C5CDC1BAA95004B)

ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe (PID: 7448 cmdline: "C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe" MD5: 77372096FCDD78300C5CDC1BAA95004B)

Adobe.exe (PID: 7504 cmdline: "C:\ProgramData\Adobe\Adobe.exe" MD5: 77372096FCDD78300C5CDC1BAA95004B)

Adobe.exe (PID: 7552 cmdline: "C:\ProgramData\Adobe\Adobe.exe" MD5: 77372096FCDD78300C5CDC1BAA95004B)

Adobe.exe (PID: 7560 cmdline: "C:\ProgramData\Adobe\Adobe.exe" MD5: 77372096FCDD78300C5CDC1BAA95004B)

Adobe.exe (PID: 7768 cmdline: "C:\ProgramData\Adobe\Adobe.exe" MD5: 77372096FCDD78300C5CDC1BAA95004B)

Adobe.exe (PID: 7812 cmdline: "C:\ProgramData\Adobe\Adobe.exe" MD5: 77372096FCDD78300C5CDC1BAA95004B)

Adobe.exe (PID: 8080 cmdline: "C:\ProgramData\Adobe\Adobe.exe" MD5: 77372096FCDD78300C5CDC1BAA95004B)

Adobe.exe (PID: 8128 cmdline: "C:\ProgramData\Adobe\Adobe.exe" MD5: 77372096FCDD78300C5CDC1BAA95004B)

Adobe.exe (PID: 8172 cmdline: "C:\ProgramData\Adobe\Adobe.exe" MD5: 77372096FCDD78300C5CDC1BAA95004B)

Adobe.exe (PID: 2992 cmdline: "C:\ProgramData\Adobe\Adobe.exe" MD5: 77372096FCDD78300C5CDC1BAA95004B)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Remcos, RemcosRAT	Remcos (acronym of Remote Control & Surveillance Software) is a commercial Remote Access Tool to remotely control computers.Remcos is advertised as legitimate software which can be used for surveillance and penetration testing purposes, but has been used in numerous hacking campaigns.Remcos, once installed, opens a backdoor on the computer, granting full access to the remote user.Remcos is developed by the cybersecurity company BreakingSecurity.	APT33 The Gorgon Group UAC-0050	http://malware-traffic-analysis.net/2017/12/22/index.html https://0xmrmagnezi.github.io/malware%20analysis/RemcosRAT/ https://asec.ahnlab.com/en/32376/ https://asec.ahnlab.com/ko/25837/ https://asec.ahnlab.com/ko/32101/	https://malpedia.caad.fkie.fraunhofer.de/details/win.remcos

Malware Configuration

Threatname: Remcos

{"Host:Port:Password": "104.250.180.178:7902:1", "Assigned name": "RemoteHost", "Connect interval": "1", "Install flag": "Enable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Enable", "Install path": "Application path", "Copy file": "Adobe.exe", "Startup value": "Disable", "Hide file": "Disable", "Mutex": "Adobe-7P3KE1", "Keylog flag": "0", "Keylog path": "Application path", "Keylog file": "logs.dat", "Keylog crypt": "Disable", "Hide keylog file": "Disable", "Screenshot flag": "Disable", "Screenshot time": "10", "Take Screenshot option": "Disable", "Take screenshot title": "", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000005.00000002.4240809916.00000000012C7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6c4b8:$a1: Remcos restarted by watchdog! 0x6ca30:$a3: %02i:%02i:%02i:%03i
00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp	REMCOS_RAT_variants	unknown	unknown	0x6650c:$str_a1: C:\Windows\System32\cmd.exe 0x66488:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x66488:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x66988:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x671b8:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x6657c:$str_b2: Executing file: 0x675fc:$str_b3: GetDirectListeningPort 0x66fa8:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x67128:$str_b7: \update.vbs 0x665a4:$str_b9: Downloaded file: 0x66590:$str_b10: Downloading file: 0x66634:$str_b12: Failed to upload file: 0x675c4:$str_b13: StartForward 0x675e4:$str_b14: StopForward 0x67080:$str_b15: fso.DeleteFile " 0x67014:$str_b16: On Error Resume Next 0x670b0:$str_b17: fso.DeleteFolder " 0x66624:$str_b18: Uploaded file: 0x665e4:$str_b19: Unable to delete: 0x67048:$str_b20: while fso.FileExists(" 0x66ac1:$str_c0: [Firefox StoredLogins not found]
00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x663f8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x6638c:$s1: CoGetObject 0x663a0:$s1: CoGetObject 0x663bc:$s1: CoGetObject 0x7035e:$s1: CoGetObject 0x6634c:$s2: Elevation:Administrator!new:
0000000E.00000002.2090565715.00000000010D7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
0000000C.00000002.2003988802.0000000000EF7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000007.00000002.1924889857.0000000001097000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000002.00000002.1807790638.0000000001208000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000000.00000002.1807355144.0000000003499000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000000.00000002.1807355144.0000000003499000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000000.00000002.1807355144.0000000003499000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000000.00000002.1807355144.0000000003499000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x824a8:$a1: Remcos restarted by watchdog! 0x2bcf30:$a1: Remcos restarted by watchdog! 0x2de550:$a1: Remcos restarted by watchdog! 0x82a20:$a3: %02i:%02i:%02i:%03i 0x2bd4a8:$a3: %02i:%02i:%02i:%03i 0x2deac8:$a3: %02i:%02i:%02i:%03i
Process Memory Space: ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe PID: 7300	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe PID: 7300	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
Process Memory Space: ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe PID: 7300	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe PID: 7300	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe PID: 7300	Windows_Trojan_Remcos_b296e965	unknown	unknown	0xbac62:$a1: Remcos restarted by watchdog! 0xbb1bc:$a3: %02i:%02i:%02i:%03i 0xbb5eb:$a3: %02i:%02i:%02i:%03i
Process Memory Space: ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe PID: 7448	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe PID: 7448	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
Process Memory Space: ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe PID: 7448	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe PID: 7448	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x8725:$a1: Remcos restarted by watchdog! 0x8c7f:$a3: %02i:%02i:%02i:%03i 0x90ae:$a3: %02i:%02i:%02i:%03i
Process Memory Space: Adobe.exe PID: 7504	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: Adobe.exe PID: 7560	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
Process Memory Space: Adobe.exe PID: 7812	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
Process Memory Space: Adobe.exe PID: 8128	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
Process Memory Space: Adobe.exe PID: 2992	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
Click to see the 24 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.36eb478.4.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.36eb478.4.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.36eb478.4.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.36eb478.4.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x690b8:$a1: Remcos restarted by watchdog! 0x69630:$a3: %02i:%02i:%02i:%03i
0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.36eb478.4.unpack	REMCOS_RAT_variants	unknown	unknown	0x6310c:$str_a1: C:\Windows\System32\cmd.exe 0x63088:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x63088:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x63588:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x63db8:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x6317c:$str_b2: Executing file: 0x641fc:$str_b3: GetDirectListeningPort 0x63ba8:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x63d28:$str_b7: \update.vbs 0x631a4:$str_b9: Downloaded file: 0x63190:$str_b10: Downloading file: 0x63234:$str_b12: Failed to upload file: 0x641c4:$str_b13: StartForward 0x641e4:$str_b14: StopForward 0x63c80:$str_b15: fso.DeleteFile " 0x63c14:$str_b16: On Error Resume Next 0x63cb0:$str_b17: fso.DeleteFolder " 0x63224:$str_b18: Uploaded file: 0x631e4:$str_b19: Unable to delete: 0x63c48:$str_b20: while fso.FileExists(" 0x636c1:$str_c0: [Firefox StoredLogins not found]
0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.36eb478.4.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x62ff8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x62f8c:$s1: CoGetObject 0x62fa0:$s1: CoGetObject 0x62fbc:$s1: CoGetObject 0x6cf5e:$s1: CoGetObject 0x62f4c:$s2: Elevation:Administrator!new:
2.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.400000.0.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
2.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.400000.0.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
2.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.400000.0.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
2.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.400000.0.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6aab8:$a1: Remcos restarted by watchdog! 0x6b030:$a3: %02i:%02i:%02i:%03i
2.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.400000.0.unpack	REMCOS_RAT_variants	unknown	unknown	0x64b0c:$str_a1: C:\Windows\System32\cmd.exe 0x64a88:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x64a88:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x64f88:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x657b8:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x64b7c:$str_b2: Executing file: 0x65bfc:$str_b3: GetDirectListeningPort 0x655a8:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x65728:$str_b7: \update.vbs 0x64ba4:$str_b9: Downloaded file: 0x64b90:$str_b10: Downloading file: 0x64c34:$str_b12: Failed to upload file: 0x65bc4:$str_b13: StartForward 0x65be4:$str_b14: StopForward 0x65680:$str_b15: fso.DeleteFile " 0x65614:$str_b16: On Error Resume Next 0x656b0:$str_b17: fso.DeleteFolder " 0x64c24:$str_b18: Uploaded file: 0x64be4:$str_b19: Unable to delete: 0x65648:$str_b20: while fso.FileExists(" 0x650c1:$str_c0: [Firefox StoredLogins not found]
2.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x649f8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x6498c:$s1: CoGetObject 0x649a0:$s1: CoGetObject 0x649bc:$s1: CoGetObject 0x6e95e:$s1: CoGetObject 0x6494c:$s2: Elevation:Administrator!new:
0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.34b09f0.2.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.34b09f0.2.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.34b09f0.2.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.34b09f0.2.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x690b8:$a1: Remcos restarted by watchdog! 0x69630:$a3: %02i:%02i:%02i:%03i
0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.34b09f0.2.unpack	REMCOS_RAT_variants	unknown	unknown	0x6310c:$str_a1: C:\Windows\System32\cmd.exe 0x63088:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x63088:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x63588:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x63db8:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x6317c:$str_b2: Executing file: 0x641fc:$str_b3: GetDirectListeningPort 0x63ba8:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x63d28:$str_b7: \update.vbs 0x631a4:$str_b9: Downloaded file: 0x63190:$str_b10: Downloading file: 0x63234:$str_b12: Failed to upload file: 0x641c4:$str_b13: StartForward 0x641e4:$str_b14: StopForward 0x63c80:$str_b15: fso.DeleteFile " 0x63c14:$str_b16: On Error Resume Next 0x63cb0:$str_b17: fso.DeleteFolder " 0x63224:$str_b18: Uploaded file: 0x631e4:$str_b19: Unable to delete: 0x63c48:$str_b20: while fso.FileExists(" 0x636c1:$str_c0: [Firefox StoredLogins not found]
0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.34b09f0.2.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x62ff8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x62f8c:$s1: CoGetObject 0x62fa0:$s1: CoGetObject 0x62fbc:$s1: CoGetObject 0x6cf5e:$s1: CoGetObject 0x62f4c:$s2: Elevation:Administrator!new:
0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.36eb478.4.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.36eb478.4.raw.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.36eb478.4.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.36eb478.4.raw.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6aab8:$a1: Remcos restarted by watchdog! 0x8c0d8:$a1: Remcos restarted by watchdog! 0x6b030:$a3: %02i:%02i:%02i:%03i 0x8c650:$a3: %02i:%02i:%02i:%03i
0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.36eb478.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x649f8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x86018:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x6498c:$s1: CoGetObject 0x649a0:$s1: CoGetObject 0x649bc:$s1: CoGetObject 0x6e95e:$s1: CoGetObject 0x85fac:$s1: CoGetObject 0x85fc0:$s1: CoGetObject 0x85fdc:$s1: CoGetObject 0x8ff7e:$s1: CoGetObject 0x6494c:$s2: Elevation:Administrator!new: 0x85f6c:$s2: Elevation:Administrator!new:
2.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.400000.0.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
2.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.400000.0.raw.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
2.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.400000.0.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
2.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.400000.0.raw.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6c4b8:$a1: Remcos restarted by watchdog! 0x6ca30:$a3: %02i:%02i:%02i:%03i
2.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.400000.0.raw.unpack	REMCOS_RAT_variants	unknown	unknown	0x6650c:$str_a1: C:\Windows\System32\cmd.exe 0x66488:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x66488:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x66988:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x671b8:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x6657c:$str_b2: Executing file: 0x675fc:$str_b3: GetDirectListeningPort 0x66fa8:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x67128:$str_b7: \update.vbs 0x665a4:$str_b9: Downloaded file: 0x66590:$str_b10: Downloading file: 0x66634:$str_b12: Failed to upload file: 0x675c4:$str_b13: StartForward 0x675e4:$str_b14: StopForward 0x67080:$str_b15: fso.DeleteFile " 0x67014:$str_b16: On Error Resume Next 0x670b0:$str_b17: fso.DeleteFolder " 0x66624:$str_b18: Uploaded file: 0x665e4:$str_b19: Unable to delete: 0x67048:$str_b20: while fso.FileExists(" 0x66ac1:$str_c0: [Firefox StoredLogins not found]
2.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.400000.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x663f8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x6638c:$s1: CoGetObject 0x663a0:$s1: CoGetObject 0x663bc:$s1: CoGetObject 0x7035e:$s1: CoGetObject 0x6634c:$s2: Elevation:Administrator!new:
0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.3630e58.3.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.3630e58.3.raw.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.3630e58.3.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.3630e58.3.raw.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x1250d8:$a1: Remcos restarted by watchdog! 0x1466f8:$a1: Remcos restarted by watchdog! 0x125650:$a3: %02i:%02i:%02i:%03i 0x146c70:$a3: %02i:%02i:%02i:%03i
0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.3630e58.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x11f018:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x140638:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x11efac:$s1: CoGetObject 0x11efc0:$s1: CoGetObject 0x11efdc:$s1: CoGetObject 0x128f7e:$s1: CoGetObject 0x1405cc:$s1: CoGetObject 0x1405e0:$s1: CoGetObject 0x1405fc:$s1: CoGetObject 0x14a59e:$s1: CoGetObject 0x11ef6c:$s2: Elevation:Administrator!new: 0x14058c:$s2: Elevation:Administrator!new:
0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.34b09f0.2.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.34b09f0.2.raw.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.34b09f0.2.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.34b09f0.2.raw.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6aab8:$a1: Remcos restarted by watchdog! 0x2a5540:$a1: Remcos restarted by watchdog! 0x2c6b60:$a1: Remcos restarted by watchdog! 0x6b030:$a3: %02i:%02i:%02i:%03i 0x2a5ab8:$a3: %02i:%02i:%02i:%03i 0x2c70d8:$a3: %02i:%02i:%02i:%03i
0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.34b09f0.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x649f8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x29f480:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x2c0aa0:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x6498c:$s1: CoGetObject 0x649a0:$s1: CoGetObject 0x649bc:$s1: CoGetObject 0x6e95e:$s1: CoGetObject 0x29f414:$s1: CoGetObject 0x29f428:$s1: CoGetObject 0x29f444:$s1: CoGetObject 0x2a93e6:$s1: CoGetObject 0x2c0a34:$s1: CoGetObject 0x2c0a48:$s1: CoGetObject 0x2c0a64:$s1: CoGetObject 0x2caa06:$s1: CoGetObject 0x6494c:$s2: Elevation:Administrator!new: 0x29f3d4:$s2: Elevation:Administrator!new: 0x2c09f4:$s2: Elevation:Administrator!new:
Click to see the 34 entries

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\ProgramData\Adobe\Adobe.exe", EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe, ProcessId: 7448, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Adobe-7P3KE1

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\ProgramData\Adobe\Adobe.exe", EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe, ProcessId: 7448, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Adobe-7P3KE1

Suricata Signatures

ET JA3 Hash - Remcos 3.x/4.x TLS Connection

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T11:28:22.504765+0200	2036594	1	Malware Command and Control Activity Detected	192.168.2.4	49733	104.250.180.178	7902	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T11:28:24.462475+0200	2803304	3	Unknown Traffic	192.168.2.4	49735	178.237.33.50	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000005.00000002.4240809916.00000000012C7000.00000004.00000020.00020000.00000000.sdmp

Malware Configuration Extractor: Remcos {"Host:Port:Password": "104.250.180.178:7902:1", "Assigned name": "RemoteHost", "Connect interval": "1", "Install flag": "Enable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Enable", "Install path": "Application path", "Copy file": "Adobe.exe", "Startup value": "Disable", "Hide file": "Disable", "Mutex": "Adobe-7P3KE1", "Keylog flag": "0", "Keylog path": "Application path", "Keylog file": "logs.dat", "Keylog crypt": "Disable", "Hide keylog file": "Disable", "Screenshot flag": "Disable", "Screenshot time": "10", "Take Screenshot option": "Disable", "Take screenshot title": "", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5"}

Multi AV Scanner detection for domain / URL

Source: 104.250.180.178

Virustotal: Detection: 15%

Perma Link

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\Adobe\Adobe.exe	ReversingLabs: Detection: 18%
Source: C:\ProgramData\Adobe\Adobe.exe	Virustotal: Detection: 28%			Perma Link

Multi AV Scanner detection for submitted file

Source: ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	ReversingLabs: Detection: 18%
Source: ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Virustotal: Detection: 28%			Perma Link

Yara detected Remcos RAT

Source: Yara match	File source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.36eb478.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.34b09f0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.36eb478.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.3630e58.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.34b09f0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.4240809916.00000000012C7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2090565715.00000000010D7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2003988802.0000000000EF7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1924889857.0000000001097000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1807790638.0000000001208000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1807355144.0000000003499000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe PID: 7300, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe PID: 7448, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Adobe.exe PID: 7560, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Adobe.exe PID: 7812, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Adobe.exe PID: 8128, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Adobe.exe PID: 2992, type: MEMORYSTR

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\ProgramData\Adobe\Adobe.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe

Code function: 2_2_004338C8 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,

2_2_004338C8

Source: ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe, 00000000.00000002.1807355144.0000000003499000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_a3cf315e-1

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.36eb478.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.34b09f0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.36eb478.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.3630e58.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.34b09f0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1807355144.0000000003499000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe PID: 7300, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe PID: 7448, type: MEMORYSTR

Privilege Escalation

Contains functionality to bypass UAC (CMSTPLUA)

Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe

Code function: 2_2_00407538 _wcslen,CoGetObject,

2_2_00407538

Source: ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: Wzfx.pdbSHA256 source: ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe, Adobe.exe.2.dr
Source:	Binary string: Wzfx.pdb source: ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe, Adobe.exe.2.dr

Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Code function: 2_2_0040928E __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	2_2_0040928E
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Code function: 2_2_0041C322 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	2_2_0041C322
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Code function: 2_2_0040C388 FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	2_2_0040C388
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Code function: 2_2_004096A0 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	2_2_004096A0
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Code function: 2_2_00408847 __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	2_2_00408847
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Code function: 2_2_00407877 FindFirstFileW,FindNextFileW,	2_2_00407877
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Code function: 2_2_0040BB6B FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	2_2_0040BB6B
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Code function: 2_2_00419B86 FindFirstFileW,FindNextFileW,FindNextFileW,	2_2_00419B86
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Code function: 2_2_0040BD72 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	2_2_0040BD72

Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe

Code function: 2_2_00407CD2 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,

2_2_00407CD2

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.4:49733 -> 104.250.180.178:7902

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 104.250.180.178

Source: global traffic

TCP traffic: 192.168.2.4:49733 -> 104.250.180.178:7902

Source: global traffic

HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 104.250.180.178 104.250.180.178
Source: Joe Sandbox View	IP Address: 178.237.33.50 178.237.33.50

Source: Joe Sandbox View

ASN Name: M247GB M247GB

Source: Network traffic

Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49735 -> 178.237.33.50:80

Source: unknown	TCP traffic detected without corresponding DNS query: 104.250.180.178
Source: unknown	TCP traffic detected without corresponding DNS query: 104.250.180.178
Source: unknown	TCP traffic detected without corresponding DNS query: 104.250.180.178
Source: unknown	TCP traffic detected without corresponding DNS query: 104.250.180.178
Source: unknown	TCP traffic detected without corresponding DNS query: 104.250.180.178
Source: unknown	TCP traffic detected without corresponding DNS query: 104.250.180.178
Source: unknown	TCP traffic detected without corresponding DNS query: 104.250.180.178
Source: unknown	TCP traffic detected without corresponding DNS query: 104.250.180.178
Source: unknown	TCP traffic detected without corresponding DNS query: 104.250.180.178
Source: unknown	TCP traffic detected without corresponding DNS query: 104.250.180.178
Source: unknown	TCP traffic detected without corresponding DNS query: 104.250.180.178
Source: unknown	TCP traffic detected without corresponding DNS query: 104.250.180.178
Source: unknown	TCP traffic detected without corresponding DNS query: 104.250.180.178
Source: unknown	TCP traffic detected without corresponding DNS query: 104.250.180.178
Source: unknown	TCP traffic detected without corresponding DNS query: 104.250.180.178
Source: unknown	TCP traffic detected without corresponding DNS query: 104.250.180.178
Source: unknown	TCP traffic detected without corresponding DNS query: 104.250.180.178
Source: unknown	TCP traffic detected without corresponding DNS query: 104.250.180.178
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe

Code function: 2_2_0041B411 InternetOpenW,InternetOpenUrlW,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

2_2_0041B411

Source: global traffic

HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: geoplugin.net
Source: global traffic	DNS traffic detected: DNS query: 206.23.85.13.in-addr.arpa

Source: Adobe.exe, 00000005.00000002.4240809916.0000000001320000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gp
Source: Adobe.exe, 00000005.00000002.4240809916.0000000001301000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gp-O3
Source: ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe, 00000000.00000002.1807355144.0000000003499000.00000004.00000800.00020000.00000000.sdmp, ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe, 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gp/C
Source: Adobe.exe, 00000005.00000002.4240809916.0000000001301000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gpGN
Source: Adobe.exe, 00000005.00000002.4240809916.0000000001301000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gpL
Source: Adobe.exe, 00000005.00000002.4240809916.00000000012C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gpSystem32
Source: Adobe.exe, 00000005.00000002.4240809916.0000000001301000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gpl
Source: Adobe.exe, 00000005.00000002.4240809916.0000000001301000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gppND
Source: ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe, 00000000.00000002.1809850264.0000000006652000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe, 00000000.00000002.1809850264.0000000006652000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe, 00000000.00000002.1809850264.0000000006652000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe, 00000000.00000002.1809850264.0000000006652000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe, 00000000.00000002.1809850264.0000000006652000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe, 00000000.00000002.1809850264.0000000006652000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe, 00000000.00000002.1809850264.0000000006652000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe, 00000000.00000002.1809850264.0000000006652000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe, 00000000.00000002.1809850264.0000000006652000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe, 00000000.00000002.1809850264.0000000006652000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe, 00000000.00000002.1809850264.0000000006652000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe, 00000000.00000002.1809850264.0000000006652000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe, 00000000.00000002.1809850264.0000000006652000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe, 00000000.00000002.1809850264.0000000006652000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe, 00000000.00000002.1809850264.0000000006652000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe, 00000000.00000002.1809850264.0000000006652000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe, 00000000.00000002.1809850264.0000000006652000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe, 00000000.00000002.1809850264.0000000006652000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe, 00000000.00000002.1809850264.0000000006652000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe, 00000000.00000002.1809850264.0000000006652000.00000004.00000800.00020000.00000000.sdmp, ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe, 00000000.00000002.1809765254.0000000004E24000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe, 00000000.00000002.1809850264.0000000006652000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe, 00000000.00000002.1809850264.0000000006652000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe, 00000000.00000002.1809850264.0000000006652000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe, 00000000.00000002.1809850264.0000000006652000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe, 00000000.00000002.1809850264.0000000006652000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to register a low level keyboard hook

Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe

Code function: 2_2_0040A2F3 SetWindowsHookExA 0000000D,0040A2DF,00000000

2_2_0040A2F3

Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe

Code function: 2_2_0040B749 OpenClipboard,GetClipboardData,CloseClipboard,

2_2_0040B749

Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe

Code function: 2_2_004168FC OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

2_2_004168FC

Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe

Code function: 2_2_0040B749 OpenClipboard,GetClipboardData,CloseClipboard,

2_2_0040B749

Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe

Code function: 2_2_0040A41B GetForegroundWindow,GetWindowThreadProcessId,GetKeyboardLayout,GetKeyState,GetKeyboardState,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,

2_2_0040A41B

Source: Yara match	File source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.36eb478.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.34b09f0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.36eb478.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.3630e58.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.34b09f0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1807355144.0000000003499000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe PID: 7300, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe PID: 7448, type: MEMORYSTR

E-Banking Fraud

Yara detected Remcos RAT

Source: Yara match	File source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.36eb478.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.34b09f0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.36eb478.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.3630e58.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.34b09f0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.4240809916.00000000012C7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2090565715.00000000010D7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2003988802.0000000000EF7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1924889857.0000000001097000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1807790638.0000000001208000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1807355144.0000000003499000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe PID: 7300, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe PID: 7448, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Adobe.exe PID: 7560, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Adobe.exe PID: 7812, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Adobe.exe PID: 8128, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Adobe.exe PID: 2992, type: MEMORYSTR

Spam, unwanted Advertisements and Ransom Demands

Contains functionalty to change the wallpaper

Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Code function: 2_2_0041CA6D SystemParametersInfoW,		2_2_0041CA6D
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Code function: 2_2_0041CA73 SystemParametersInfoW,		2_2_0041CA73

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.36eb478.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.36eb478.4.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.36eb478.4.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 2.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 2.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 2.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.34b09f0.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.34b09f0.2.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.34b09f0.2.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.36eb478.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.36eb478.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 2.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 2.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 2.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.3630e58.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.3630e58.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.34b09f0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.34b09f0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000000.00000002.1807355144.0000000003499000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe PID: 7300, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe PID: 7448, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown

Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe

Code function: 2_2_004167EF ExitWindowsEx,LoadLibraryA,GetProcAddress,

2_2_004167EF

Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Code function: 0_2_00A5F044	0_2_00A5F044
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Code function: 0_2_06A43A50	0_2_06A43A50
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Code function: 0_2_06A4D3D4	0_2_06A4D3D4
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Code function: 0_2_06A41340	0_2_06A41340
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Code function: 0_2_06EF60A0	0_2_06EF60A0
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Code function: 0_2_06EF0C80	0_2_06EF0C80
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Code function: 0_2_06EF0C70	0_2_06EF0C70
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Code function: 0_2_06EF0848	0_2_06EF0848
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Code function: 2_2_0043706A	2_2_0043706A
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Code function: 2_2_00414005	2_2_00414005
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Code function: 2_2_0043E11C	2_2_0043E11C
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Code function: 2_2_004541D9	2_2_004541D9
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Code function: 2_2_004381E8	2_2_004381E8
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Code function: 2_2_0041F18B	2_2_0041F18B
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Code function: 2_2_00446270	2_2_00446270
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Code function: 2_2_0043E34B	2_2_0043E34B
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Code function: 2_2_004533AB	2_2_004533AB
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Code function: 2_2_0042742E	2_2_0042742E
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Code function: 2_2_00437566	2_2_00437566
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Code function: 2_2_0043E5A8	2_2_0043E5A8
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Code function: 2_2_004387F0	2_2_004387F0
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Code function: 2_2_0043797E	2_2_0043797E
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Code function: 2_2_004339D7	2_2_004339D7
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Code function: 2_2_0044DA49	2_2_0044DA49
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Code function: 2_2_00427AD7	2_2_00427AD7
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Code function: 2_2_0041DBF3	2_2_0041DBF3
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Code function: 2_2_00427C40	2_2_00427C40
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Code function: 2_2_00437DB3	2_2_00437DB3
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Code function: 2_2_00435EEB	2_2_00435EEB
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Code function: 2_2_0043DEED	2_2_0043DEED
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Code function: 2_2_00426E9F	2_2_00426E9F
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 3_2_0129F044	3_2_0129F044
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 3_2_0129B35A	3_2_0129B35A
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 3_2_05140130	3_2_05140130
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 3_2_05140120	3_2_05140120
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 3_2_0575D3D4	3_2_0575D3D4
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 3_2_05753A50	3_2_05753A50
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 3_2_070BE762	3_2_070BE762
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 3_2_070BEFC8	3_2_070BEFC8
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 3_2_070BEB9F	3_2_070BEB9F
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 3_2_070BF8A0	3_2_070BF8A0
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 6_2_0187F044	6_2_0187F044
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 6_2_0759D3D4	6_2_0759D3D4
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 6_2_07593A50	6_2_07593A50
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 6_2_07591248	6_2_07591248
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 6_2_075DEFC8	6_2_075DEFC8
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 6_2_075DEB90	6_2_075DEB90
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 6_2_07A360A0	6_2_07A360A0
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 6_2_07A30C80	6_2_07A30C80
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 6_2_07A30C70	6_2_07A30C70
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 6_2_07A30848	6_2_07A30848
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 11_2_0108F044	11_2_0108F044
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 11_2_07120848	11_2_07120848
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 11_2_07120C70	11_2_07120C70
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 11_2_07120C80	11_2_07120C80
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 11_2_08681248	11_2_08681248
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 11_2_08683A50	11_2_08683A50
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 11_2_0868D3D4	11_2_0868D3D4
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 13_2_0179F044	13_2_0179F044
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 13_2_073DE768	13_2_073DE768
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 13_2_073DEFD8	13_2_073DEFD8
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 13_2_073DEBA0	13_2_073DEBA0
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 13_2_073DEB9F	13_2_073DEB9F

Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Code function: String function: 00402093 appears 50 times
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Code function: String function: 00434801 appears 41 times
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Code function: String function: 00401E65 appears 34 times
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Code function: String function: 00434E70 appears 54 times

Source: ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe, 00000000.00000000.1786554919.00000000000FE000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameWzfx.exeL vs ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe
Source: ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe, 00000000.00000002.1804780784.000000000054E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe
Source: ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe, 00000000.00000002.1810595332.0000000006AC0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe
Source: ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe, 00000000.00000002.1807355144.0000000003499000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe
Source: ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Binary or memory string: OriginalFilenameWzfx.exeL vs ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe

Source: ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.36eb478.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.36eb478.4.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.36eb478.4.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 2.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 2.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 2.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.34b09f0.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.34b09f0.2.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.34b09f0.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.36eb478.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.36eb478.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 2.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 2.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 2.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.3630e58.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.3630e58.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.34b09f0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.34b09f0.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000000.00000002.1807355144.0000000003499000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe PID: 7300, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe PID: 7448, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23

Source: ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: Adobe.exe.2.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.3630e58.3.raw.unpack, oD82hrKsN7c7PWWXpk.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.6ac0000.5.raw.unpack, oD82hrKsN7c7PWWXpk.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.3630e58.3.raw.unpack, XwOhqlo8FBgI4eM36g.cs	Security API names: _0020.SetAccessControl
Source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.3630e58.3.raw.unpack, XwOhqlo8FBgI4eM36g.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.3630e58.3.raw.unpack, XwOhqlo8FBgI4eM36g.cs	Security API names: _0020.AddAccessRule
Source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.6ac0000.5.raw.unpack, XwOhqlo8FBgI4eM36g.cs	Security API names: _0020.SetAccessControl
Source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.6ac0000.5.raw.unpack, XwOhqlo8FBgI4eM36g.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.6ac0000.5.raw.unpack, XwOhqlo8FBgI4eM36g.cs	Security API names: _0020.AddAccessRule

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winEXE@18/5@2/2

Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe

Code function: 2_2_0041798D GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,

2_2_0041798D

Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe

Code function: 2_2_0040F4AF GetModuleFileNameW,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,CloseHandle,

2_2_0040F4AF

Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe

Code function: 2_2_0041B539 FindResourceA,LoadResource,LockResource,SizeofResource,

2_2_0041B539

Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe

Code function: 2_2_0041AADB OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

2_2_0041AADB

Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.log

Jump to behavior

Source: C:\ProgramData\Adobe\Adobe.exe	Mutant created: \Sessions\1\BaseNamedObjects\Adobe-7P3KE1
Source: C:\ProgramData\Adobe\Adobe.exe	Mutant created: NULL

Source: ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	ReversingLabs: Detection: 18%
Source: ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Virustotal: Detection: 28%

Source: ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe

String found in binary or memory: $72794fd6-9579-4364-adda-1580f4b1038b

Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe

File read: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe "C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe"
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Process created: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe "C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe"
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Process created: C:\ProgramData\Adobe\Adobe.exe "C:\ProgramData\Adobe\Adobe.exe"
Source: C:\ProgramData\Adobe\Adobe.exe	Process created: C:\ProgramData\Adobe\Adobe.exe "C:\ProgramData\Adobe\Adobe.exe"
Source: C:\ProgramData\Adobe\Adobe.exe	Process created: C:\ProgramData\Adobe\Adobe.exe "C:\ProgramData\Adobe\Adobe.exe"
Source: unknown	Process created: C:\ProgramData\Adobe\Adobe.exe "C:\ProgramData\Adobe\Adobe.exe"
Source: C:\ProgramData\Adobe\Adobe.exe	Process created: C:\ProgramData\Adobe\Adobe.exe "C:\ProgramData\Adobe\Adobe.exe"
Source: unknown	Process created: C:\ProgramData\Adobe\Adobe.exe "C:\ProgramData\Adobe\Adobe.exe"
Source: C:\ProgramData\Adobe\Adobe.exe	Process created: C:\ProgramData\Adobe\Adobe.exe "C:\ProgramData\Adobe\Adobe.exe"
Source: unknown	Process created: C:\ProgramData\Adobe\Adobe.exe "C:\ProgramData\Adobe\Adobe.exe"
Source: C:\ProgramData\Adobe\Adobe.exe	Process created: C:\ProgramData\Adobe\Adobe.exe "C:\ProgramData\Adobe\Adobe.exe"
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Process created: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe "C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe"	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Process created: C:\ProgramData\Adobe\Adobe.exe "C:\ProgramData\Adobe\Adobe.exe"	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process created: C:\ProgramData\Adobe\Adobe.exe "C:\ProgramData\Adobe\Adobe.exe"	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process created: C:\ProgramData\Adobe\Adobe.exe "C:\ProgramData\Adobe\Adobe.exe"	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process created: C:\ProgramData\Adobe\Adobe.exe "C:\ProgramData\Adobe\Adobe.exe"	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process created: C:\ProgramData\Adobe\Adobe.exe "C:\ProgramData\Adobe\Adobe.exe"	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process created: C:\ProgramData\Adobe\Adobe.exe "C:\ProgramData\Adobe\Adobe.exe"	Jump to behavior

Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: version.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: version.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: version.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: version.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: winmm.dll
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: urlmon.dll
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: wininet.dll
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: iertutil.dll
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: srvcli.dll
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: netutils.dll
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: iphlpapi.dll
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: rstrtmgr.dll
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: ncrypt.dll
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: ntasn1.dll
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: kernel.appcore.dll

Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: Wzfx.pdbSHA256 source: ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe, Adobe.exe.2.dr
Source:	Binary string: Wzfx.pdb source: ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe, Adobe.exe.2.dr

Data Obfuscation

.NET source code contains potential unpacker

Source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.2511ef4.0.raw.unpack, RZ.cs	.Net Code: System.Reflection.Assembly.Load(byte[])
Source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.3630e58.3.raw.unpack, XwOhqlo8FBgI4eM36g.cs	.Net Code: iYVPZ8PO6WCbtayC3Ib System.Reflection.Assembly.Load(byte[])
Source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.8370000.6.raw.unpack, RZ.cs	.Net Code: System.Reflection.Assembly.Load(byte[])
Source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.6ac0000.5.raw.unpack, XwOhqlo8FBgI4eM36g.cs	.Net Code: iYVPZ8PO6WCbtayC3Ib System.Reflection.Assembly.Load(byte[])
Source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.25da034.1.raw.unpack, RZ.cs	.Net Code: System.Reflection.Assembly.Load(byte[])
Source: 3.2.Adobe.exe.2cd18b0.1.raw.unpack, RZ.cs	.Net Code: System.Reflection.Assembly.Load(byte[])
Source: 3.2.Adobe.exe.2d999e4.0.raw.unpack, RZ.cs	.Net Code: System.Reflection.Assembly.Load(byte[])

Source: ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe

Static PE information: 0x9B473DD9 [Sun Jul 21 01:16:09 2052 UTC]

Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe

Code function: 2_2_0041CBE1 LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,

2_2_0041CBE1

Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Code function: 0_2_06A456B7 pushfd ; iretd	0_2_06A456F9
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Code function: 0_2_06A45638 pushad ; iretd	0_2_06A45639
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Code function: 0_2_06A4AE19 push eax; mov dword ptr [esp], edx	0_2_06A4AE2C
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Code function: 0_2_06A8DE00 push esp; ret	0_2_06A8DE01
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Code function: 0_2_06EF502A pushad ; retf	0_2_06EF5031
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Code function: 2_2_00457186 push ecx; ret	2_2_00457199
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Code function: 2_2_0041C7F3 push eax; retf	2_2_0041C7FD
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Code function: 2_2_00457AA8 push eax; ret	2_2_00457AC6
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Code function: 2_2_00434EB6 push ecx; ret	2_2_00434EC9
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 3_2_05755613 pushad ; iretd	3_2_05755639
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 3_2_0575AE19 push eax; mov dword ptr [esp], edx	3_2_0575AE2C
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 3_2_057556B7 pushfd ; iretd	3_2_057556F9
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 3_2_070BDE00 push esp; ret	3_2_070BDE01
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 6_2_0759AE19 push eax; mov dword ptr [esp], edx	6_2_0759AE2C
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 6_2_07595638 pushad ; iretd	6_2_07595639
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 6_2_075956B7 pushfd ; iretd	6_2_075956F9
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 6_2_075926A5 push FFFFFF8Bh; iretd	6_2_075926AF
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 6_2_07592835 push FFFFFF8Bh; iretd	6_2_0759283F
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 6_2_075DDE00 push esp; ret	6_2_075DDE01
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 11_2_06CC56E7 push ebp; retf 0006h	11_2_06CC5702
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 11_2_06CCC61B push es; iretd	11_2_06CCC628
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 11_2_06CCA444 push eax; retf 0006h	11_2_06CCA446
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 11_2_06CCA233 pushfd ; retf	11_2_06CCA23A
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 11_2_06CC6E81 push ss; retf	11_2_06CC6E82
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 11_2_06CC6E83 push ss; retf	11_2_06CC6E8A
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 11_2_06CC6E59 push ss; retf	11_2_06CC6E5A
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 11_2_06CCDE00 push esp; ret	11_2_06CCDE01
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 11_2_06CCDC89 push eax; retf 0006h	11_2_06CCDC92
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 11_2_06CC5BC0 push es; retf	11_2_06CC5BCA
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 11_2_06CC5BA9 push es; retf	11_2_06CC5BAA
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 11_2_06CC5BA1 push es; retf	11_2_06CC5BA2

Source: ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Static PE information: section name: .text entropy: 7.84955113303724
Source: Adobe.exe.2.dr	Static PE information: section name: .text entropy: 7.84955113303724

Source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.3630e58.3.raw.unpack, FLx19bXjtRAXWi2Tk2V.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'd0HSNntKTF', 'MXDSmYqwHA', 'hUFSCnuB4Z', 'k4jSZymKsI', 've0SYK19kT', 'fobSpDO08H', 'W1aSf85U2D'
Source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.3630e58.3.raw.unpack, SDjGOZNANbCedYguBf.cs	High entropy of concatenated method names: 'DH1nkyh0jW', 'NXAnEa0WAy', 'tMKnNWIOGi', 'PMHnmFuk6Q', 'XWenvATOH2', 'JBbn3HfED3', 'nnrnPS92EH', 'TLMncq7kvd', 'J1pnhSQded', 'lc1nbxbFyT'
Source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.3630e58.3.raw.unpack, xkDBqBtWjuw9kRZZyO.cs	High entropy of concatenated method names: 'pJldq0HyMF', 'sPXd2pjCuv', 'kl5dVfR3yT', 'JF9d76UYse', 'SHodopuVem', 'BJ9VYLLasw', 'aJSVpVfZUR', 'BGSVfKU5RK', 'XbwVFDdBqA', 'zOPVehR51K'
Source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.3630e58.3.raw.unpack, OcmTWa2oyaOJJxPelH.cs	High entropy of concatenated method names: 'Dispose', 'r8fXe9l7cS', 'KZtLvnfAIf', 'WnHNNZ1Pw6', 'v1dXsF1aEt', 'MybXzXyw16', 'ProcessDialogKey', 'QmGL4ICFDF', 'P3xLXkDGHg', 'UDdLL5BVnl'
Source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.3630e58.3.raw.unpack, t4oEIFbvRwoW65lEML.cs	High entropy of concatenated method names: 'JBp7gOWIcf', 'cZx7TgDxqg', 'vWw7dJeUoQ', 'aNkdsH7xFI', 'oWudzRxoPo', 'B9o74f0km8', 'GyH7Xf3e4C', 'ikL7L3mhen', 'hF87jGl7Vj', 'EGQ7O1vuGC'
Source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.3630e58.3.raw.unpack, XwOhqlo8FBgI4eM36g.cs	High entropy of concatenated method names: 'k6wjqP9R54', 'n5SjgwV8DO', 'Gvlj29jQC1', 'm0hjTrEc0b', 'sMBjVYhvCF', 'q8ZjdwebNT', 'R0Nj76WF3F', 'C7cjo7RYKW', 'RXEjHg8uIO', 'wpSj0NjDTo'
Source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.3630e58.3.raw.unpack, MICFDFeE3xkDGHgYDd.cs	High entropy of concatenated method names: 'jxxrti7Zay', 'TTHrvgUAGK', 'i4Rr3d3End', 'lFerPFaK0G', 'NsLrNQPJR8', 'CJgrcbwFV5', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.3630e58.3.raw.unpack, F1ohmFa6SAqV5VrInf.cs	High entropy of concatenated method names: 'wOs71R6rev', 'tTA7IvhchW', 'C6y7Ba8y6m', 'J3L7uA0cBS', 'xqv7AFf4Pc', 'rtM7yPwwP7', 'WPh790A7Le', 'tym7KOZFye', 'vQ97RURtpq', 'i4N7lB42iV'
Source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.3630e58.3.raw.unpack, tUx7qVLrF3GUOfJXKq.cs	High entropy of concatenated method names: 'jwjBu621q', 'Df8uCyqXL', 'Rbvy6iyBQ', 'XEV9m76r2', 'rr8R0O0nb', 'Nu9lHQInt', 'HguvPQkeA6ZS9L3AQQ', 'yByXQBygdnqTQAAkBL', 'UC6r24sOH', 'jRnSrS09a'
Source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.3630e58.3.raw.unpack, cGNZbtlxNmvUk31WdS.cs	High entropy of concatenated method names: 'EDdVAxfnee', 'pjBV9TG4dd', 'afZT3YgfCc', 'VdZTPpLX3M', 'oY0TcrMZsj', 'GDCThXfK4K', 'KGaTbNKJ5m', 'rnuTGV4GYS', 'LEFTa9XYXN', 'cFpTk06oMq'
Source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.3630e58.3.raw.unpack, qBVnlbsf9pN9QV313U.cs	High entropy of concatenated method names: 'HNL6XLOZVv', 'mqw6jgLqRU', 'qTA6ObuQCq', 'W6L6gaC7Mn', 'pBg62YiDnU', 'B5D6VcfAAD', 'b4i6dcbv8R', 'N86rfL3GgK', 'UNNrFcs9p9', 'Iu9reFecNr'
Source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.3630e58.3.raw.unpack, XsHs8rOQ8LikvKijZh.cs	High entropy of concatenated method names: 'kpnX7D82hr', 'YN7Xoc7PWW', 'yCqX0UFwC3', 'IykXUcLGNZ', 'H1WXndSwkD', 'zqBXJWjuw9', 'vdSjSbbfsStmB7Qf7j', 'd7Us5PgmBmZ0MiYpFQ', 'zacXXsQ6dc', 'Vt4Xj4Nhg8'
Source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.3630e58.3.raw.unpack, ydF1aEFtaybXyw16Nm.cs	High entropy of concatenated method names: 'WGhrgfhJeU', 'fDhr28JaIa', 'cqbrTnO2i8', 'EH0rVpdMnp', 'RehrdlqcCE', 'VP0r7P8VSk', 'agbroRWhZF', 'LJVrHKwJtL', 'QETr0f5Iln', 'EeSrUr2AMF'
Source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.3630e58.3.raw.unpack, aO67m4X49uxqliUwrEw.cs	High entropy of concatenated method names: 'Ddq619NYLZ', 'ffY6IvRFwX', 'VNA6BVSSTw', 'evQ6uW3S5S', 'VKh6AgNn9N', 'pp96yPlZ6W', 'vbS69OTYea', 'fHR6Kjdu2b', 'LmM6RiJ8Wf', 'bGD6l2mwGv'
Source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.3630e58.3.raw.unpack, S6yPeIRCqUFwC3Pykc.cs	High entropy of concatenated method names: 'TxcTufiUvy', 'MkGTyfOgg2', 'zndTKHPmtH', 'V3wTRB8UJR', 'mvJTnmvmXw', 'aUbTJaPTgg', 'axhT5w7k26', 'tnkTrqngbE', 'zwVT6ddgFc', 'p7ETSgTETY'
Source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.3630e58.3.raw.unpack, BRVNpxzluRuXKlvRO4.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'FTi6iwCCSW', 'SqU6ngO51M', 'hxP6JMpOD6', 'ugd65cgl4S', 'SH86rbxYwf', 'gkD66onyyi', 'eCY6SAY89p'
Source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.3630e58.3.raw.unpack, PKBVDdpqLjn2ClEPX9.cs	High entropy of concatenated method names: 'cBA5FCRk7s', 'mP55snlDGA', 'xi5r4eheux', 'EumrXlwbym', 'yo65MwvjKc', 'X465Ev0Nha', 'KZI5DxPQxf', 'Dvk5NBYwL1', 'Svm5meAiNC', 'zb25ClpGsK'
Source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.3630e58.3.raw.unpack, NbvnNJDoiYmbSofMKN.cs	High entropy of concatenated method names: 'wldiK3lsYR', 'R5QiR33hD6', 'D8hitM3Vte', 'ABNivSFXVI', 'OV2iPooIGD', 'aEbicEvFdN', 'GJiibt8vuI', 'tIAiG3AO3N', 'bDbiklb6Fi', 'fdWiM5ySTX'
Source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.3630e58.3.raw.unpack, oD82hrKsN7c7PWWXpk.cs	High entropy of concatenated method names: 'cIF2NTjpXf', 'GuZ2mxXQEv', 'wwM2CCVI4h', 'QWQ2ZbbijW', 'o9B2Y3hNoi', 'ouX2pPwEoG', 'Y282f6Tx2Z', 'fNd2FSrN2k', 'CO42eRp0q1', 'LMl2sMHQ8D'
Source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.6ac0000.5.raw.unpack, FLx19bXjtRAXWi2Tk2V.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'd0HSNntKTF', 'MXDSmYqwHA', 'hUFSCnuB4Z', 'k4jSZymKsI', 've0SYK19kT', 'fobSpDO08H', 'W1aSf85U2D'
Source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.6ac0000.5.raw.unpack, SDjGOZNANbCedYguBf.cs	High entropy of concatenated method names: 'DH1nkyh0jW', 'NXAnEa0WAy', 'tMKnNWIOGi', 'PMHnmFuk6Q', 'XWenvATOH2', 'JBbn3HfED3', 'nnrnPS92EH', 'TLMncq7kvd', 'J1pnhSQded', 'lc1nbxbFyT'
Source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.6ac0000.5.raw.unpack, xkDBqBtWjuw9kRZZyO.cs	High entropy of concatenated method names: 'pJldq0HyMF', 'sPXd2pjCuv', 'kl5dVfR3yT', 'JF9d76UYse', 'SHodopuVem', 'BJ9VYLLasw', 'aJSVpVfZUR', 'BGSVfKU5RK', 'XbwVFDdBqA', 'zOPVehR51K'
Source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.6ac0000.5.raw.unpack, OcmTWa2oyaOJJxPelH.cs	High entropy of concatenated method names: 'Dispose', 'r8fXe9l7cS', 'KZtLvnfAIf', 'WnHNNZ1Pw6', 'v1dXsF1aEt', 'MybXzXyw16', 'ProcessDialogKey', 'QmGL4ICFDF', 'P3xLXkDGHg', 'UDdLL5BVnl'
Source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.6ac0000.5.raw.unpack, t4oEIFbvRwoW65lEML.cs	High entropy of concatenated method names: 'JBp7gOWIcf', 'cZx7TgDxqg', 'vWw7dJeUoQ', 'aNkdsH7xFI', 'oWudzRxoPo', 'B9o74f0km8', 'GyH7Xf3e4C', 'ikL7L3mhen', 'hF87jGl7Vj', 'EGQ7O1vuGC'
Source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.6ac0000.5.raw.unpack, XwOhqlo8FBgI4eM36g.cs	High entropy of concatenated method names: 'k6wjqP9R54', 'n5SjgwV8DO', 'Gvlj29jQC1', 'm0hjTrEc0b', 'sMBjVYhvCF', 'q8ZjdwebNT', 'R0Nj76WF3F', 'C7cjo7RYKW', 'RXEjHg8uIO', 'wpSj0NjDTo'
Source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.6ac0000.5.raw.unpack, MICFDFeE3xkDGHgYDd.cs	High entropy of concatenated method names: 'jxxrti7Zay', 'TTHrvgUAGK', 'i4Rr3d3End', 'lFerPFaK0G', 'NsLrNQPJR8', 'CJgrcbwFV5', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.6ac0000.5.raw.unpack, F1ohmFa6SAqV5VrInf.cs	High entropy of concatenated method names: 'wOs71R6rev', 'tTA7IvhchW', 'C6y7Ba8y6m', 'J3L7uA0cBS', 'xqv7AFf4Pc', 'rtM7yPwwP7', 'WPh790A7Le', 'tym7KOZFye', 'vQ97RURtpq', 'i4N7lB42iV'
Source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.6ac0000.5.raw.unpack, tUx7qVLrF3GUOfJXKq.cs	High entropy of concatenated method names: 'jwjBu621q', 'Df8uCyqXL', 'Rbvy6iyBQ', 'XEV9m76r2', 'rr8R0O0nb', 'Nu9lHQInt', 'HguvPQkeA6ZS9L3AQQ', 'yByXQBygdnqTQAAkBL', 'UC6r24sOH', 'jRnSrS09a'
Source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.6ac0000.5.raw.unpack, cGNZbtlxNmvUk31WdS.cs	High entropy of concatenated method names: 'EDdVAxfnee', 'pjBV9TG4dd', 'afZT3YgfCc', 'VdZTPpLX3M', 'oY0TcrMZsj', 'GDCThXfK4K', 'KGaTbNKJ5m', 'rnuTGV4GYS', 'LEFTa9XYXN', 'cFpTk06oMq'
Source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.6ac0000.5.raw.unpack, qBVnlbsf9pN9QV313U.cs	High entropy of concatenated method names: 'HNL6XLOZVv', 'mqw6jgLqRU', 'qTA6ObuQCq', 'W6L6gaC7Mn', 'pBg62YiDnU', 'B5D6VcfAAD', 'b4i6dcbv8R', 'N86rfL3GgK', 'UNNrFcs9p9', 'Iu9reFecNr'
Source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.6ac0000.5.raw.unpack, XsHs8rOQ8LikvKijZh.cs	High entropy of concatenated method names: 'kpnX7D82hr', 'YN7Xoc7PWW', 'yCqX0UFwC3', 'IykXUcLGNZ', 'H1WXndSwkD', 'zqBXJWjuw9', 'vdSjSbbfsStmB7Qf7j', 'd7Us5PgmBmZ0MiYpFQ', 'zacXXsQ6dc', 'Vt4Xj4Nhg8'
Source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.6ac0000.5.raw.unpack, ydF1aEFtaybXyw16Nm.cs	High entropy of concatenated method names: 'WGhrgfhJeU', 'fDhr28JaIa', 'cqbrTnO2i8', 'EH0rVpdMnp', 'RehrdlqcCE', 'VP0r7P8VSk', 'agbroRWhZF', 'LJVrHKwJtL', 'QETr0f5Iln', 'EeSrUr2AMF'
Source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.6ac0000.5.raw.unpack, aO67m4X49uxqliUwrEw.cs	High entropy of concatenated method names: 'Ddq619NYLZ', 'ffY6IvRFwX', 'VNA6BVSSTw', 'evQ6uW3S5S', 'VKh6AgNn9N', 'pp96yPlZ6W', 'vbS69OTYea', 'fHR6Kjdu2b', 'LmM6RiJ8Wf', 'bGD6l2mwGv'
Source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.6ac0000.5.raw.unpack, S6yPeIRCqUFwC3Pykc.cs	High entropy of concatenated method names: 'TxcTufiUvy', 'MkGTyfOgg2', 'zndTKHPmtH', 'V3wTRB8UJR', 'mvJTnmvmXw', 'aUbTJaPTgg', 'axhT5w7k26', 'tnkTrqngbE', 'zwVT6ddgFc', 'p7ETSgTETY'
Source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.6ac0000.5.raw.unpack, BRVNpxzluRuXKlvRO4.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'FTi6iwCCSW', 'SqU6ngO51M', 'hxP6JMpOD6', 'ugd65cgl4S', 'SH86rbxYwf', 'gkD66onyyi', 'eCY6SAY89p'
Source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.6ac0000.5.raw.unpack, PKBVDdpqLjn2ClEPX9.cs	High entropy of concatenated method names: 'cBA5FCRk7s', 'mP55snlDGA', 'xi5r4eheux', 'EumrXlwbym', 'yo65MwvjKc', 'X465Ev0Nha', 'KZI5DxPQxf', 'Dvk5NBYwL1', 'Svm5meAiNC', 'zb25ClpGsK'
Source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.6ac0000.5.raw.unpack, NbvnNJDoiYmbSofMKN.cs	High entropy of concatenated method names: 'wldiK3lsYR', 'R5QiR33hD6', 'D8hitM3Vte', 'ABNivSFXVI', 'OV2iPooIGD', 'aEbicEvFdN', 'GJiibt8vuI', 'tIAiG3AO3N', 'bDbiklb6Fi', 'fdWiM5ySTX'
Source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.6ac0000.5.raw.unpack, oD82hrKsN7c7PWWXpk.cs	High entropy of concatenated method names: 'cIF2NTjpXf', 'GuZ2mxXQEv', 'wwM2CCVI4h', 'QWQ2ZbbijW', 'o9B2Y3hNoi', 'ouX2pPwEoG', 'Y282f6Tx2Z', 'fNd2FSrN2k', 'CO42eRp0q1', 'LMl2sMHQ8D'

Persistence and Installation Behavior

Drops executable to a common third party application directory

Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe

File written: C:\ProgramData\Adobe\Adobe.exe

Jump to behavior

Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe

Code function: 2_2_00406EEB ShellExecuteW,URLDownloadToFileW,

2_2_00406EEB

Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	File created: \isf 10+2 - so - so 4042 - rothenberger usa, inc#u51fa#u8ca8 twse0211390.scr.exe
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	File created: \isf 10+2 - so - so 4042 - rothenberger usa, inc#u51fa#u8ca8 twse0211390.scr.exe
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	File created: \isf 10+2 - so - so 4042 - rothenberger usa, inc#u51fa#u8ca8 twse0211390.scr.exe	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	File created: \isf 10+2 - so - so 4042 - rothenberger usa, inc#u51fa#u8ca8 twse0211390.scr.exe	Jump to behavior

Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe

File created: C:\ProgramData\Adobe\Adobe.exe

Jump to dropped file

Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe

File created: C:\ProgramData\Adobe\Adobe.exe

Jump to dropped file

Boot Survival

Creates autostart registry keys with suspicious names

Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe

Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Adobe-7P3KE1

Jump to behavior

Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe

Code function: 2_2_0041AADB OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

2_2_0041AADB

Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Adobe-7P3KE1	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Adobe-7P3KE1	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Adobe-7P3KE1	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Adobe-7P3KE1	Jump to behavior

Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe

2_2_0041CBE1

Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe PID: 7300, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Adobe.exe PID: 7504, type: MEMORYSTR

Delayed program exit found

Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe

Code function: 2_2_0040F7E2 Sleep,ExitProcess,

2_2_0040F7E2

Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Memory allocated: A30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Memory allocated: 2490000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Memory allocated: 2250000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Memory allocated: 85F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Memory allocated: 6CC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Memory allocated: 95F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Memory allocated: A5F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Memory allocated: 1020000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Memory allocated: 2C50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Memory allocated: 2B60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Memory allocated: 8670000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Memory allocated: 9670000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Memory allocated: 9850000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Memory allocated: A850000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Memory allocated: 1870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Memory allocated: 33E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Memory allocated: 32F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Memory allocated: 8F60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Memory allocated: 7810000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Memory allocated: 9F60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Memory allocated: AF60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Memory allocated: 1080000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Memory allocated: 2AD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Memory allocated: 2A20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Memory allocated: 8690000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Memory allocated: 6F00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Memory allocated: 9690000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Memory allocated: A690000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Memory allocated: 1430000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Memory allocated: 2FB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Memory allocated: 4FB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Memory allocated: 8B20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Memory allocated: 9B20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Memory allocated: 9D10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Memory allocated: AD10000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe

Code function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,

2_2_0041A7D9

Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\ProgramData\Adobe\Adobe.exe

Window / User API: threadDelayed 9672

Jump to behavior

Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Evaded block: after key decision			graph_2-47011
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Evaded block: after key decision			graph_2-47038

Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe

API coverage: 6.4 %

Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe TID: 7320	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe TID: 7524	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe TID: 7592	Thread sleep count: 321 > 30	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe TID: 7592	Thread sleep time: -963000s >= -30000s	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe TID: 7592	Thread sleep count: 9672 > 30	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe TID: 7592	Thread sleep time: -29016000s >= -30000s	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe TID: 7792	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe TID: 8104	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe TID: 5980	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Code function: 2_2_0040928E __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	2_2_0040928E
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Code function: 2_2_0041C322 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	2_2_0041C322
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Code function: 2_2_0040C388 FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	2_2_0040C388
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Code function: 2_2_004096A0 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	2_2_004096A0
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Code function: 2_2_00408847 __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	2_2_00408847
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Code function: 2_2_00407877 FindFirstFileW,FindNextFileW,	2_2_00407877
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Code function: 2_2_0040BB6B FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	2_2_0040BB6B
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Code function: 2_2_00419B86 FindFirstFileW,FindNextFileW,FindNextFileW,	2_2_00419B86
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Code function: 2_2_0040BD72 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	2_2_0040BD72

Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe

Code function: 2_2_00407CD2 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,

2_2_00407CD2

Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: Adobe.exe, 00000005.00000002.4240809916.000000000133B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Adobe.exe, 00000005.00000002.4240809916.00000000012C7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW(
Source: Adobe.exe, 00000005.00000002.4240809916.000000000133B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWH

Source: C:\ProgramData\Adobe\Adobe.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe

Code function: 2_2_00434A8A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

2_2_00434A8A

Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe

2_2_0041CBE1

Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe

Code function: 2_2_00443355 mov eax, dword ptr fs:[00000030h]

2_2_00443355

Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe

Code function: 2_2_004120B2 GetProcessHeap,HeapFree,

2_2_004120B2

Source: C:\ProgramData\Adobe\Adobe.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Code function: 2_2_0043503C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_0043503C
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Code function: 2_2_00434A8A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00434A8A
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Code function: 2_2_0043BB71 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_0043BB71
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Code function: 2_2_00434BD8 SetUnhandledExceptionFilter,	2_2_00434BD8

Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Memory written: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Memory written: C:\ProgramData\Adobe\Adobe.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Memory written: C:\ProgramData\Adobe\Adobe.exe base: 400000 value starts with: 4D5A	Jump to behavior

Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe

Code function: GetCurrentProcessId,OpenMutexA,CloseHandle,CreateThread,CloseHandle,Sleep,OpenProcess, svchost.exe

2_2_00412132

Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe

Code function: 2_2_00419662 mouse_event,

2_2_00419662

Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Process created: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe "C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe"	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Process created: C:\ProgramData\Adobe\Adobe.exe "C:\ProgramData\Adobe\Adobe.exe"	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process created: C:\ProgramData\Adobe\Adobe.exe "C:\ProgramData\Adobe\Adobe.exe"	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process created: C:\ProgramData\Adobe\Adobe.exe "C:\ProgramData\Adobe\Adobe.exe"	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process created: C:\ProgramData\Adobe\Adobe.exe "C:\ProgramData\Adobe\Adobe.exe"	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process created: C:\ProgramData\Adobe\Adobe.exe "C:\ProgramData\Adobe\Adobe.exe"	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process created: C:\ProgramData\Adobe\Adobe.exe "C:\ProgramData\Adobe\Adobe.exe"	Jump to behavior

Source: Adobe.exe, 00000005.00000002.4240809916.0000000001320000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: Adobe.exe, 00000005.00000002.4240809916.0000000001320000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerV&
Source: Adobe.exe, 00000005.00000002.4240809916.00000000012C7000.00000004.00000020.00020000.00000000.sdmp, Adobe.exe, 00000005.00000002.4240809916.0000000001301000.00000004.00000020.00020000.00000000.sdmp, Adobe.exe, 00000005.00000002.4240809916.0000000001320000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \|Program Manager\|

Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe

Code function: 2_2_00434CB6 cpuid

2_2_00434CB6

Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Code function: EnumSystemLocalesW,	2_2_0045201B
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Code function: EnumSystemLocalesW,	2_2_004520B6
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	2_2_00452143
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Code function: GetLocaleInfoW,	2_2_00452393
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Code function: EnumSystemLocalesW,	2_2_00448484
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	2_2_004524BC
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Code function: GetLocaleInfoW,	2_2_004525C3
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	2_2_00452690
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Code function: GetLocaleInfoW,	2_2_0044896D
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Code function: GetLocaleInfoA,	2_2_0040F90C
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	2_2_00451D58
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Code function: EnumSystemLocalesW,	2_2_00451FD0

Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\DUBAI-REGULAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\DUBAI-MEDIUM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\DUBAI-BOLD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Queries volume information: C:\ProgramData\Adobe\Adobe.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Queries volume information: C:\ProgramData\Adobe\Adobe.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Queries volume information: C:\ProgramData\Adobe\Adobe.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Queries volume information: C:\ProgramData\Adobe\Adobe.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe

Code function: 2_2_0041A045 __EH_prolog,GdiplusStartup,CreateDirectoryW,Sleep,Sleep,GetLocalTime,Sleep,

2_2_0041A045

Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe

Code function: 2_2_0041B69E GetUserNameW,

2_2_0041B69E

Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe

Code function: 2_2_0044942D _free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

2_2_0044942D

Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Remcos RAT

Source: Yara match	File source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.36eb478.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.34b09f0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.36eb478.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.3630e58.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.34b09f0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.4240809916.00000000012C7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2090565715.00000000010D7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2003988802.0000000000EF7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1924889857.0000000001097000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1807790638.0000000001208000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1807355144.0000000003499000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe PID: 7300, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe PID: 7448, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Adobe.exe PID: 7560, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Adobe.exe PID: 7812, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Adobe.exe PID: 8128, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Adobe.exe PID: 2992, type: MEMORYSTR

Contains functionality to steal Chrome passwords or cookies

Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe

Code function: \AppData\Local\Google\Chrome\User Data\Default\Login Data

2_2_0040BA4D

Contains functionality to steal Firefox passwords or cookies

Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Code function: \AppData\Roaming\Mozilla\Firefox\Profiles\		2_2_0040BB6B
Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Code function: \key3.db		2_2_0040BB6B

Remote Access Functionality

Yara detected Remcos RAT

Source: Yara match	File source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.36eb478.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.34b09f0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.36eb478.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.3630e58.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.34b09f0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.4240809916.00000000012C7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2090565715.00000000010D7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2003988802.0000000000EF7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1924889857.0000000001097000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1807790638.0000000001208000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1807355144.0000000003499000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe PID: 7300, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe PID: 7448, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Adobe.exe PID: 7560, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Adobe.exe PID: 7812, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Adobe.exe PID: 8128, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Adobe.exe PID: 2992, type: MEMORYSTR

Source: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe

Code function: cmd.exe

2_2_0040569A

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	12 Command and Scripting Interpreter	1 Windows Service	1 Bypass User Account Control	1 Deobfuscate/Decode Files or Information	111 Input Capture	1 Account Discovery	Remote Desktop Protocol	111 Input Capture	2 Encrypted Channel	Exfiltration Over Bluetooth	1 Defacement
Email Addresses	DNS Server	Domain Accounts	2 Service Execution	11 Registry Run Keys / Startup Folder	1 Access Token Manipulation	3 Obfuscated Files or Information	2 Credentials In Files	1 System Service Discovery	SMB/Windows Admin Shares	3 Clipboard Data	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Windows Service	12 Software Packing	NTDS	3 File and Directory Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	122 Process Injection	1 Timestomp	LSA Secrets	33 System Information Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	11 Registry Run Keys / Startup Folder	1 DLL Side-Loading	Cached Domain Credentials	121 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Bypass User Account Control	DCSync	31 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Masquerading	Proc Filesystem	3 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	31 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Access Token Manipulation	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	122 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	18%	ReversingLabs	Win32.Trojan.Generic
ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	29%	Virustotal		Browse
ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\ProgramData\Adobe\Adobe.exe	100%	Joe Sandbox ML
C:\ProgramData\Adobe\Adobe.exe	18%	ReversingLabs	Win32.Trojan.Generic
C:\ProgramData\Adobe\Adobe.exe	29%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
geoplugin.net	0%	Virustotal		Browse
206.23.85.13.in-addr.arpa	1%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://www.fontbureau.com	0%	URL Reputation	safe
http://www.fontbureau.com	0%	URL Reputation	safe
http://www.fontbureau.com/designersG	0%	URL Reputation	safe
http://www.fontbureau.com/designers/?	0%	URL Reputation	safe
http://www.fontbureau.com/designers/?	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.fontbureau.com/designers?	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.fontbureau.com/designers	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://geoplugin.net/json.gp	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.fontbureau.com/designers/cabarga.htmlN	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.fontbureau.com/designers/frere-user.html	0%	URL Reputation	safe
http://geoplugin.net/json.gp/C	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.fontbureau.com/designers8	0%	URL Reputation	safe
http://www.fonts.com	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
104.250.180.178	16%	Virustotal		Browse
http://geoplugin.net/json.gpSystem32	1%	Virustotal		Browse
http://geoplugin.net/json.gpGN	4%	Virustotal		Browse
http://www.apache.org/licenses/LICENSE-2.0	0%	Virustotal		Browse
http://geoplugin.net/json.gpl	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
geoplugin.net	178.237.33.50	true	false	0%, Virustotal, Browse	unknown
206.23.85.13.in-addr.arpa	unknown	unknown	true	1%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
104.250.180.178	true	16%, Virustotal, Browse	unknown
http://geoplugin.net/json.gp	false	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.apache.org/licenses/LICENSE-2.0	ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe, 00000000.00000002.1809850264.0000000006652000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://www.fontbureau.com	ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe, 00000000.00000002.1809850264.0000000006652000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designersG	ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe, 00000000.00000002.1809850264.0000000006652000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/?	ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe, 00000000.00000002.1809850264.0000000006652000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://www.founder.com.cn/cn/bThe	ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe, 00000000.00000002.1809850264.0000000006652000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://geoplugin.net/json.gpl	Adobe.exe, 00000005.00000002.4240809916.0000000001301000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://www.fontbureau.com/designers?	ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe, 00000000.00000002.1809850264.0000000006652000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://geoplugin.net/json.gp-O3	Adobe.exe, 00000005.00000002.4240809916.0000000001301000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.tiro.com	ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe, 00000000.00000002.1809850264.0000000006652000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers	ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe, 00000000.00000002.1809850264.0000000006652000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.goodfont.co.kr	ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe, 00000000.00000002.1809850264.0000000006652000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://geoplugin.net/json.gppND	Adobe.exe, 00000005.00000002.4240809916.0000000001301000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://geoplugin.net/json.gpSystem32	Adobe.exe, 00000005.00000002.4240809916.00000000012C7000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
http://www.carterandcone.coml	ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe, 00000000.00000002.1809850264.0000000006652000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sajatypeworks.com	ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe, 00000000.00000002.1809850264.0000000006652000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.typography.netD	ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe, 00000000.00000002.1809850264.0000000006652000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe, 00000000.00000002.1809850264.0000000006652000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/cThe	ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe, 00000000.00000002.1809850264.0000000006652000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe, 00000000.00000002.1809850264.0000000006652000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn	ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe, 00000000.00000002.1809850264.0000000006652000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-user.html	ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe, 00000000.00000002.1809850264.0000000006652000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://geoplugin.net/json.gp/C	ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe, 00000000.00000002.1807355144.0000000003499000.00000004.00000800.00020000.00000000.sdmp, ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe, 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://geoplugin.net/json.gpL	Adobe.exe, 00000005.00000002.4240809916.0000000001301000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.jiyu-kobo.co.jp/	ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe, 00000000.00000002.1809850264.0000000006652000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/DPlease	ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe, 00000000.00000002.1809850264.0000000006652000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe, 00000000.00000002.1809850264.0000000006652000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fonts.com	ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe, 00000000.00000002.1809850264.0000000006652000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sandoll.co.kr	ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe, 00000000.00000002.1809850264.0000000006652000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://geoplugin.net/json.gpGN	Adobe.exe, 00000005.00000002.4240809916.0000000001301000.00000004.00000020.00020000.00000000.sdmp	false	4%, Virustotal, Browse	unknown
http://www.urwpp.deDPlease	ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe, 00000000.00000002.1809850264.0000000006652000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe, 00000000.00000002.1809850264.0000000006652000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sakkal.com	ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe, 00000000.00000002.1809850264.0000000006652000.00000004.00000800.00020000.00000000.sdmp, ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe, 00000000.00000002.1809765254.0000000004E24000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.250.180.178	unknown	United States		9009	M247GB	true
178.237.33.50	geoplugin.net	Netherlands		8455	ATOM86-ASATOM86NL	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1528880
Start date and time:	2024-10-08 11:27:12 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe renamed because original name is a hash value
Original Sample Name:	ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC TWSE0211390.scr.exe
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winEXE@18/5@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 352 Number of non-executed functions: 210
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
05:28:18	API Interceptor	1x Sleep call for process: ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe modified
05:28:19	API Interceptor	4450422x Sleep call for process: Adobe.exe modified
10:28:21	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Adobe-7P3KE1 "C:\ProgramData\Adobe\Adobe.exe"
10:28:30	Autostart	Run: HKLM\Software\Microsoft\Windows\CurrentVersion\Run Adobe-7P3KE1 "C:\ProgramData\Adobe\Adobe.exe"
10:28:38	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Adobe-7P3KE1 "C:\ProgramData\Adobe\Adobe.exe"

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.250.180.178	F41355 SO 7670 HBL EXPRESS RELEASEpdf.pdf.scr.exe	Get hash	malicious	XWorm	Browse
	DRAFT BL - CLS930 KHH-TOLEDO(VIA NYC) SO6615#U21928152 WKH2406122.scr.exe	Get hash	malicious	XWorm	Browse
	6122.scr.exe	Get hash	malicious	Remcos	Browse
	6122.scr.exe	Get hash	malicious	Remcos	Browse
	DRAFT BL - CLS930 KHH-TOLEDO(VIA NYC) SO6615#U21928152 WKH2406122.scr.exe	Get hash	malicious	XWorm	Browse
	BNE400266900B - RLS SO# W317pdf.scr.exe	Get hash	malicious	Remcos	Browse
	BNE400266900A - BL NO.BNE400266900.pdf.scr.exe	Get hash	malicious	XWorm	Browse
	(Draft) - SO# L539-SE2409060 Cut off #Uff19-15 - CHR# 487700191.scr.exe	Get hash	malicious	Remcos	Browse
	SEA - SO#L539 (SO+INV+PKG+ISF+VGM).scr.exe	Get hash	malicious	XWorm	Browse
	rSO3315RCOHBLKHRTMP249013CO240913.pdf.scr.exe	Get hash	malicious	Remcos	Browse
178.237.33.50	1728373206596a852cdbe7ae697de423fbd80cabe33d7a6a584032b72164b61e0692c12d1a849.dat-decoded.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	SWIFT 103 202410071519130850 071024.pdf.vbs	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	Salary Increase Letter_Oct 2024.vbs	Get hash	malicious	Remcos, GuLoader	Browse	geoplugin.net/json.gp
	September Report 24'.vbs	Get hash	malicious	Remcos, GuLoader	Browse	geoplugin.net/json.gp
	SecuriteInfo.com.FileRepMalware.12793.28433.exe	Get hash	malicious	Remcos, GuLoader	Browse	geoplugin.net/json.gp
	beNwFiUxpf.rtf	Get hash	malicious	Remcos, PureLog Stealer	Browse	geoplugin.net/json.gp
	invoice_45009.xls	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	HkeU5FHEO1.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	Quotation request YN2024-10-07pdf.vbs	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	17282393454a20ebb72846132bb7146ed4a1a58abc0a2fcca78c88bb5a73356856494e7ece637.dat-decoded.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
geoplugin.net	1728373206596a852cdbe7ae697de423fbd80cabe33d7a6a584032b72164b61e0692c12d1a849.dat-decoded.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	SWIFT 103 202410071519130850 071024.pdf.vbs	Get hash	malicious	Remcos	Browse	178.237.33.50
	Salary Increase Letter_Oct 2024.vbs	Get hash	malicious	Remcos, GuLoader	Browse	178.237.33.50
	September Report 24'.vbs	Get hash	malicious	Remcos, GuLoader	Browse	178.237.33.50
	SecuriteInfo.com.FileRepMalware.12793.28433.exe	Get hash	malicious	Remcos, GuLoader	Browse	178.237.33.50
	beNwFiUxpf.rtf	Get hash	malicious	Remcos, PureLog Stealer	Browse	178.237.33.50
	invoice_45009.xls	Get hash	malicious	Remcos	Browse	178.237.33.50
	HkeU5FHEO1.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	Quotation request YN2024-10-07pdf.vbs	Get hash	malicious	Remcos	Browse	178.237.33.50
	17282393454a20ebb72846132bb7146ed4a1a58abc0a2fcca78c88bb5a73356856494e7ece637.dat-decoded.exe	Get hash	malicious	Remcos	Browse	178.237.33.50

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
M247GB	F41355 SO 7670 HBL EXPRESS RELEASEpdf.pdf.scr.exe	Get hash	malicious	XWorm	Browse	104.250.180.178
	na.elf	Get hash	malicious	Mirai	Browse	38.206.34.62
	PO# EB202329720241007_Hardy_Process^^^^.pif.exe	Get hash	malicious	Unknown	Browse	89.238.176.5
	NEW INVOICE.exe	Get hash	malicious	FormBook	Browse	45.150.55.15
	Quotation request YN2024-10-07pdf.vbs	Get hash	malicious	Remcos	Browse	172.111.244.100
	Urgent Purchase Order (P.O.) No.477764107102024.vbs	Get hash	malicious	Remcos	Browse	172.111.244.100
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	38.206.46.29
	17282393454a20ebb72846132bb7146ed4a1a58abc0a2fcca78c88bb5a73356856494e7ece637.dat-decoded.exe	Get hash	malicious	Remcos	Browse	185.236.203.101
	na.rtf	Get hash	malicious	Remcos	Browse	185.236.203.101
	file.dll	Get hash	malicious	Matanbuchus	Browse	193.109.85.31
ATOM86-ASATOM86NL	1728373206596a852cdbe7ae697de423fbd80cabe33d7a6a584032b72164b61e0692c12d1a849.dat-decoded.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	SWIFT 103 202410071519130850 071024.pdf.vbs	Get hash	malicious	Remcos	Browse	178.237.33.50
	Salary Increase Letter_Oct 2024.vbs	Get hash	malicious	Remcos, GuLoader	Browse	178.237.33.50
	September Report 24'.vbs	Get hash	malicious	Remcos, GuLoader	Browse	178.237.33.50
	SecuriteInfo.com.FileRepMalware.12793.28433.exe	Get hash	malicious	Remcos, GuLoader	Browse	178.237.33.50
	beNwFiUxpf.rtf	Get hash	malicious	Remcos, PureLog Stealer	Browse	178.237.33.50
	invoice_45009.xls	Get hash	malicious	Remcos	Browse	178.237.33.50
	HkeU5FHEO1.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	Quotation request YN2024-10-07pdf.vbs	Get hash	malicious	Remcos	Browse	178.237.33.50
	17282393454a20ebb72846132bb7146ed4a1a58abc0a2fcca78c88bb5a73356856494e7ece637.dat-decoded.exe	Get hash	malicious	Remcos	Browse	178.237.33.50

Process:	C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	963072
Entropy (8bit):	7.844536086714657
Encrypted:	false
SSDEEP:	12288:2nCTYl8XTvggoho/kRgyfmbQ6VV9Q1WzgN/OO6uuSKOMP3t06I4iM8mNiXpveoD2:7gYTIPokubh9XzduwxPd0qDIXpJ9E
MD5:	77372096FCDD78300C5CDC1BAA95004B
SHA1:	93B4AAA039F65F2780CF177F2554CA9E4BE809BE
SHA-256:	0D89EBFC019F155ECBB5F5FB49DC172741F17DE763013F2ABB39B9EE3D5CC433
SHA-512:	AF8ECB2971E9DCEC6B9052E8F91E06362B0C952A4BFA7707B8EF593FC44EC6641D69AC6B0F15F9911CC8667CAF945A1E5420E2510EA7D73A393D791C6FDCD9F9
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 18% Antivirus: Virustotal, Detection: 29%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....=G...............0.................. ........@.. ....................... ............@.................................r...O.......................................p............................................ ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........w..@V..........0................................................0............{.....+..B...}.....(.........0............{.....+..B...}.....(.........0...........(........A(........(.......}.....(....}......, .... ....(....}......! .... ....(....}......@ .... ....(....}......$ .... ....(....}.......}......(....k.(....k.{....k"...."....s....}..... .(...(......( ...o!.....("...o#.....r...p".. A.s$...o%......}......}....*....0............{........,...o&...(......o&...

C:\ProgramData\Adobe\Adobe.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Adobe.exe.log

Download File

Process:	C:\ProgramData\Adobe\Adobe.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.log

Download File

Process:	C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\json[1].json

Download File

Process:	C:\ProgramData\Adobe\Adobe.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.013811273052389
Encrypted:	false
SSDEEP:	12:tklu+mnd6CsGkMyGWKyGXPVGArwY307f7aZHI7GZArpv/mOAaNO+ao9W7iN5zzkk:qlu+KdRNuKyGX85jvXhNlT3/7AcV9Wro
MD5:	18BC6D34FABB00C1E30D98E8DAEC814A
SHA1:	D21EF72B8421AA7D1F8E8B1DB1323AA93B884C54
SHA-256:	862D5523F77D193121112B15A36F602C4439791D03E24D97EF25F3A6CBE37ED0
SHA-512:	8DF14178B08AD2EDE670572394244B5224C8B070199A4BD851245B88D4EE3D7324FC7864D180DE85221ADFBBCAACB9EE9D2A77B5931D4E878E27334BF8589D71
Malicious:	false
Preview:	{. "geoplugin_request":"8.46.123.33",. "geoplugin_status":200,. "geoplugin_delay":"1ms",. "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.",. "geoplugin_city":"New York",. "geoplugin_region":"New York",. "geoplugin_regionCode":"NY",. "geoplugin_regionName":"New York",. "geoplugin_areaCode":"",. "geoplugin_dmaCode":"501",. "geoplugin_countryCode":"US",. "geoplugin_countryName":"United States",. "geoplugin_inEU":0,. "geoplugin_euVATrate":false,. "geoplugin_continentCode":"NA",. "geoplugin_continentName":"North America",. "geoplugin_latitude":"40.7123",. "geoplugin_longitude":"-74.0068",. "geoplugin_locationAccuracyRadius":"20",. "geoplugin_timezone":"America\/New_York",. "geoplugin_currencyCode":"USD",. "geoplugin_currencySymbol":"$",. "geoplugin_currencySymbol_UTF8":"$",. "geoplugin_currencyConverter":0.}

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.844536086714657
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe
File size:	963'072 bytes
MD5:	77372096fcdd78300c5cdc1baa95004b
SHA1:	93b4aaa039f65f2780cf177f2554ca9e4be809be
SHA256:	0d89ebfc019f155ecbb5f5fb49dc172741f17de763013f2abb39b9ee3d5cc433
SHA512:	af8ecb2971e9dcec6b9052e8f91e06362b0c952a4bfa7707b8ef593fc44ec6641d69ac6b0f15f9911cc8667caf945a1e5420e2510ea7d73a393d791c6fdcd9f9
SSDEEP:	12288:2nCTYl8XTvggoho/kRgyfmbQ6VV9Q1WzgN/OO6uuSKOMP3t06I4iM8mNiXpveoD2:7gYTIPokubh9XzduwxPd0qDIXpJ9E
TLSH:	F025126A5B19D507C8585BB84DB2F1B02B291DEDB002E3075FED5CEBB97AF118D48283
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....=G...............0.................. ........@.. ....................... ............@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x4ec6c6
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x9B473DD9 [Sun Jul 21 01:16:09 2052 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xec672	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xee000	0x5cc	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xf0000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xea000	0x70	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xea6cc	0xea800	988cbfb8a15a8e400c41bd948b7f2390	False	0.9353396938299574	data	7.84955113303724	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xee000	0x5cc	0x600	267d7a9a4105b4c0946bdc32f842c48b	False	0.4296875	data	4.143501290061974	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xf0000	0xc	0x200	c234b42ea37660a9d9acea60e80a6457	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xee090	0x33c	data			0.4311594202898551
RT_MANIFEST	0xee3dc	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-08T11:28:22.504765+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.4	49733	104.250.180.178	7902	TCP
2024-10-08T11:28:24.462475+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49735	178.237.33.50	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 8, 2024 11:28:21.497373104 CEST	49733	7902	192.168.2.4	104.250.180.178
Oct 8, 2024 11:28:21.502455950 CEST	7902	49733	104.250.180.178	192.168.2.4
Oct 8, 2024 11:28:21.502767086 CEST	49733	7902	192.168.2.4	104.250.180.178
Oct 8, 2024 11:28:21.507242918 CEST	49733	7902	192.168.2.4	104.250.180.178
Oct 8, 2024 11:28:21.512299061 CEST	7902	49733	104.250.180.178	192.168.2.4
Oct 8, 2024 11:28:22.450992107 CEST	7902	49733	104.250.180.178	192.168.2.4
Oct 8, 2024 11:28:22.504765034 CEST	49733	7902	192.168.2.4	104.250.180.178
Oct 8, 2024 11:28:22.740974903 CEST	7902	49733	104.250.180.178	192.168.2.4
Oct 8, 2024 11:28:22.746429920 CEST	49733	7902	192.168.2.4	104.250.180.178
Oct 8, 2024 11:28:22.751518011 CEST	7902	49733	104.250.180.178	192.168.2.4
Oct 8, 2024 11:28:22.751588106 CEST	49733	7902	192.168.2.4	104.250.180.178
Oct 8, 2024 11:28:22.756479025 CEST	7902	49733	104.250.180.178	192.168.2.4
Oct 8, 2024 11:28:23.466247082 CEST	7902	49733	104.250.180.178	192.168.2.4
Oct 8, 2024 11:28:23.468760967 CEST	49733	7902	192.168.2.4	104.250.180.178
Oct 8, 2024 11:28:23.473613977 CEST	7902	49733	104.250.180.178	192.168.2.4
Oct 8, 2024 11:28:23.742079020 CEST	7902	49733	104.250.180.178	192.168.2.4
Oct 8, 2024 11:28:23.786016941 CEST	49733	7902	192.168.2.4	104.250.180.178
Oct 8, 2024 11:28:23.841921091 CEST	49735	80	192.168.2.4	178.237.33.50
Oct 8, 2024 11:28:23.847027063 CEST	80	49735	178.237.33.50	192.168.2.4
Oct 8, 2024 11:28:23.847121000 CEST	49735	80	192.168.2.4	178.237.33.50
Oct 8, 2024 11:28:23.847265005 CEST	49735	80	192.168.2.4	178.237.33.50
Oct 8, 2024 11:28:23.852102995 CEST	80	49735	178.237.33.50	192.168.2.4
Oct 8, 2024 11:28:24.462295055 CEST	80	49735	178.237.33.50	192.168.2.4
Oct 8, 2024 11:28:24.462475061 CEST	49735	80	192.168.2.4	178.237.33.50
Oct 8, 2024 11:28:24.482453108 CEST	49733	7902	192.168.2.4	104.250.180.178
Oct 8, 2024 11:28:24.487453938 CEST	7902	49733	104.250.180.178	192.168.2.4
Oct 8, 2024 11:28:25.448375940 CEST	80	49735	178.237.33.50	192.168.2.4
Oct 8, 2024 11:28:25.449875116 CEST	49735	80	192.168.2.4	178.237.33.50
Oct 8, 2024 11:28:26.581454039 CEST	7902	49733	104.250.180.178	192.168.2.4
Oct 8, 2024 11:28:26.583863020 CEST	49733	7902	192.168.2.4	104.250.180.178
Oct 8, 2024 11:28:26.589993000 CEST	7902	49733	104.250.180.178	192.168.2.4
Oct 8, 2024 11:28:56.464179039 CEST	7902	49733	104.250.180.178	192.168.2.4
Oct 8, 2024 11:28:56.466065884 CEST	49733	7902	192.168.2.4	104.250.180.178
Oct 8, 2024 11:28:56.472985983 CEST	7902	49733	104.250.180.178	192.168.2.4
Oct 8, 2024 11:29:26.454411983 CEST	7902	49733	104.250.180.178	192.168.2.4
Oct 8, 2024 11:29:26.471558094 CEST	49733	7902	192.168.2.4	104.250.180.178
Oct 8, 2024 11:29:26.477453947 CEST	7902	49733	104.250.180.178	192.168.2.4
Oct 8, 2024 11:29:56.569602966 CEST	7902	49733	104.250.180.178	192.168.2.4
Oct 8, 2024 11:29:56.573085070 CEST	49733	7902	192.168.2.4	104.250.180.178
Oct 8, 2024 11:29:56.578001976 CEST	7902	49733	104.250.180.178	192.168.2.4
Oct 8, 2024 11:30:13.786736012 CEST	49735	80	192.168.2.4	178.237.33.50
Oct 8, 2024 11:30:14.098993063 CEST	49735	80	192.168.2.4	178.237.33.50
Oct 8, 2024 11:30:14.708278894 CEST	49735	80	192.168.2.4	178.237.33.50
Oct 8, 2024 11:30:15.911418915 CEST	49735	80	192.168.2.4	178.237.33.50
Oct 8, 2024 11:30:18.317692995 CEST	49735	80	192.168.2.4	178.237.33.50
Oct 8, 2024 11:30:23.224050999 CEST	49735	80	192.168.2.4	178.237.33.50
Oct 8, 2024 11:30:26.481542110 CEST	7902	49733	104.250.180.178	192.168.2.4
Oct 8, 2024 11:30:26.484509945 CEST	49733	7902	192.168.2.4	104.250.180.178
Oct 8, 2024 11:30:26.489499092 CEST	7902	49733	104.250.180.178	192.168.2.4
Oct 8, 2024 11:30:32.927088022 CEST	49735	80	192.168.2.4	178.237.33.50
Oct 8, 2024 11:30:56.711532116 CEST	7902	49733	104.250.180.178	192.168.2.4
Oct 8, 2024 11:30:56.712881088 CEST	49733	7902	192.168.2.4	104.250.180.178
Oct 8, 2024 11:30:56.717736006 CEST	7902	49733	104.250.180.178	192.168.2.4
Oct 8, 2024 11:31:29.008404970 CEST	7902	49733	104.250.180.178	192.168.2.4
Oct 8, 2024 11:31:29.010056019 CEST	49733	7902	192.168.2.4	104.250.180.178
Oct 8, 2024 11:31:29.015007973 CEST	7902	49733	104.250.180.178	192.168.2.4
Oct 8, 2024 11:31:58.091919899 CEST	7902	49733	104.250.180.178	192.168.2.4
Oct 8, 2024 11:31:58.096421957 CEST	49733	7902	192.168.2.4	104.250.180.178
Oct 8, 2024 11:31:58.101281881 CEST	7902	49733	104.250.180.178	192.168.2.4
Oct 8, 2024 11:32:26.669605970 CEST	7902	49733	104.250.180.178	192.168.2.4
Oct 8, 2024 11:32:26.724334955 CEST	49733	7902	192.168.2.4	104.250.180.178

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 8, 2024 11:28:23.792831898 CEST	50364	53	192.168.2.4	1.1.1.1
Oct 8, 2024 11:28:23.800791979 CEST	53	50364	1.1.1.1	192.168.2.4
Oct 8, 2024 11:28:52.762651920 CEST	53	61519	162.159.36.2	192.168.2.4
Oct 8, 2024 11:28:53.225528002 CEST	62190	53	192.168.2.4	1.1.1.1
Oct 8, 2024 11:28:53.233081102 CEST	53	62190	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 8, 2024 11:28:23.792831898 CEST	192.168.2.4	1.1.1.1	0x517c	Standard query (0)	geoplugin.net	A (IP address)	IN (0x0001)	false
Oct 8, 2024 11:28:53.225528002 CEST	192.168.2.4	1.1.1.1	0x1325	Standard query (0)	206.23.85.13.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 8, 2024 11:28:23.800791979 CEST	1.1.1.1	192.168.2.4	0x517c	No error (0)	geoplugin.net		178.237.33.50	A (IP address)	IN (0x0001)	false
Oct 8, 2024 11:28:53.233081102 CEST	1.1.1.1	192.168.2.4	0x1325	Name error (3)	206.23.85.13.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false

HTTP Request Dependency Graph

geoplugin.net

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49735	178.237.33.50	80	7560	C:\ProgramData\Adobe\Adobe.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:28:23.847265005 CEST	71	OUT	GET /json.gp HTTP/1.1 Host: geoplugin.net Cache-Control: no-cache
Oct 8, 2024 11:28:24.462295055 CEST	1170	IN	HTTP/1.1 200 OK date: Tue, 08 Oct 2024 09:28:24 GMT server: Apache content-length: 962 content-type: application/json; charset=utf-8 cache-control: public, max-age=300 access-control-allow-origin: * Data Raw: 7b 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 71 75 65 73 74 22 3a 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 73 74 61 74 75 73 22 3a 32 30 30 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 64 65 6c 61 79 22 3a 22 31 6d 73 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 72 65 64 69 74 22 3a 22 53 6f 6d 65 20 6f 66 20 74 68 65 20 72 65 74 75 72 6e 65 64 20 64 61 74 61 20 69 6e 63 6c 75 64 65 73 20 47 65 6f 4c 69 74 65 32 20 64 61 74 61 20 63 72 65 61 74 65 64 20 62 79 20 4d 61 78 4d 69 6e 64 2c 20 61 76 61 69 6c 61 62 6c 65 20 66 72 6f 6d 20 3c 61 20 68 72 65 66 3d 27 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 6d 61 78 6d 69 6e 64 2e 63 6f 6d 27 3e 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 6d 61 78 6d 69 6e 64 2e 63 6f 6d 3c 5c 2f 61 3e 2e 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 69 74 79 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 67 69 6f 6e 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 22 67 65 6f [TRUNCATED] Data Ascii: { "geoplugin_request":"8.46.123.33", "geoplugin_status":200, "geoplugin_delay":"1ms", "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.", "geoplugin_city":"New York", "geoplugin_region":"New York", "geoplugin_regionCode":"NY", "geoplugin_regionName":"New York", "geoplugin_areaCode":"", "geoplugin_dmaCode":"501", "geoplugin_countryCode":"US", "geoplugin_countryName":"United States", "geoplugin_inEU":0, "geoplugin_euVATrate":false, "geoplugin_continentCode":"NA", "geoplugin_continentName":"North America", "geoplugin_latitude":"40.7123", "geoplugin_longitude":"-74.0068", "geoplugin_locationAccuracyRadius":"20", "geoplugin_timezone":"America\/New_York", "geoplugin_currencyCode":"USD", "geoplugin_currencySymbol":"$", "geoplugin_currencySymbol_UTF8":"$", "geoplugin_currencyConverter":0}

Analysis Process: ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exePID: 7300, Parent PID: 2580

General

Target ID:	0
Start time:	05:28:17
Start date:	08/10/2024
Path:	C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe"
Imagebase:	0x10000
File size:	963'072 bytes
MD5 hash:	77372096FCDD78300C5CDC1BAA95004B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000000.00000002.1807355144.0000000003499000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000000.00000002.1807355144.0000000003499000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000002.1807355144.0000000003499000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000000.00000002.1807355144.0000000003499000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exePID: 7448, Parent PID: 7300

General

Target ID:	2
Start time:	05:28:19
Start date:	08/10/2024
Path:	C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe"
Imagebase:	0xb70000
File size:	963'072 bytes
MD5 hash:	77372096FCDD78300C5CDC1BAA95004B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000002.00000002.1807790638.0000000001208000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	05:28:19
Start date:	08/10/2024
Path:	C:\ProgramData\Adobe\Adobe.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Adobe\Adobe.exe"
Imagebase:	0x7c0000
File size:	963'072 bytes
MD5 hash:	77372096FCDD78300C5CDC1BAA95004B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 18%, ReversingLabs Detection: 29%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	05:28:20
Start date:	08/10/2024
Path:	C:\ProgramData\Adobe\Adobe.exe
Wow64 process (32bit):	false
Commandline:	"C:\ProgramData\Adobe\Adobe.exe"
Imagebase:	0x2a0000
File size:	963'072 bytes
MD5 hash:	77372096FCDD78300C5CDC1BAA95004B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	05:28:20
Start date:	08/10/2024
Path:	C:\ProgramData\Adobe\Adobe.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Adobe\Adobe.exe"
Imagebase:	0xbf0000
File size:	963'072 bytes
MD5 hash:	77372096FCDD78300C5CDC1BAA95004B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000005.00000002.4240809916.00000000012C7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	05:28:30
Start date:	08/10/2024
Path:	C:\ProgramData\Adobe\Adobe.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Adobe\Adobe.exe"
Imagebase:	0xf60000
File size:	963'072 bytes
MD5 hash:	77372096FCDD78300C5CDC1BAA95004B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	05:28:31
Start date:	08/10/2024
Path:	C:\ProgramData\Adobe\Adobe.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Adobe\Adobe.exe"
Imagebase:	0xa90000
File size:	963'072 bytes
MD5 hash:	77372096FCDD78300C5CDC1BAA95004B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000007.00000002.1924889857.0000000001097000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	05:28:38
Start date:	08/10/2024
Path:	C:\ProgramData\Adobe\Adobe.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Adobe\Adobe.exe"
Imagebase:	0x670000
File size:	963'072 bytes
MD5 hash:	77372096FCDD78300C5CDC1BAA95004B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	05:28:39
Start date:	08/10/2024
Path:	C:\ProgramData\Adobe\Adobe.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Adobe\Adobe.exe"
Imagebase:	0x8f0000
File size:	963'072 bytes
MD5 hash:	77372096FCDD78300C5CDC1BAA95004B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000C.00000002.2003988802.0000000000EF7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	05:28:46
Start date:	08/10/2024
Path:	C:\ProgramData\Adobe\Adobe.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Adobe\Adobe.exe"
Imagebase:	0xbe0000
File size:	963'072 bytes
MD5 hash:	77372096FCDD78300C5CDC1BAA95004B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	05:28:47
Start date:	08/10/2024
Path:	C:\ProgramData\Adobe\Adobe.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Adobe\Adobe.exe"
Imagebase:	0xaf0000
File size:	963'072 bytes
MD5 hash:	77372096FCDD78300C5CDC1BAA95004B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000E.00000002.2090565715.00000000010D7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exePID: 7300, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	12.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	280
Total number of Limit Nodes:	20

Executed Functions

Function 06A4D3D4 Relevance: .9, Instructions: 931COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810392953.0000000006A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a40000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c735887e06198a5d0fe17d8c17a1bc4a0bc5dc3d6839def60e5ee835fe0c791
Instruction ID: cd623fbeedc4567d02baf9b3ad7c0393c4dac34d576cd5a9856a853fb254fe8f
Opcode Fuzzy Hash: 9c735887e06198a5d0fe17d8c17a1bc4a0bc5dc3d6839def60e5ee835fe0c791
Instruction Fuzzy Hash: D5A24B71E002198FDB15EF68C8946DDB7B1FF89300F1486AAD90AA7351EB74AE85CF50

Function 06A41340 Relevance: .7, Instructions: 651COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810392953.0000000006A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a40000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a494831e06340615092d8701ab7945584e12a7738bec8767aad9ee4dd17d330f
Instruction ID: 40f10e7e01ea02b6b06e3d262a354a26c309bec52864f9dfd8c77e0504e4b8b7
Opcode Fuzzy Hash: a494831e06340615092d8701ab7945584e12a7738bec8767aad9ee4dd17d330f
Instruction Fuzzy Hash: E342D238B10210CFCB58AB78C95866977E6FFC930AF10487ED5079B7A5DA369C81CB91

Function 06A43A50 Relevance: .5, Instructions: 470COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810392953.0000000006A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a40000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01fb6a6ec64876d6176cd5d8bf81f6f2dbe0804627a39189b2a86fb02674c741
Instruction ID: 9e79d14a18b48d7f3d95885d64d9185f59578b69abc37a1c0edfb4ea86a27b20
Opcode Fuzzy Hash: 01fb6a6ec64876d6176cd5d8bf81f6f2dbe0804627a39189b2a86fb02674c741
Instruction Fuzzy Hash: B6223B34A10219CFCB54EF69D984A9DBBB2FF85300F15C5A9D409AB266DB30ED85CF90

Function 06A381F0 Relevance: 3.9, Strings: 3, Instructions: 146
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hoq, xrefs: 06A38304
Hoq, xrefs: 06A38349
Hoq, xrefs: 06A382BF

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID: Hoq$Hoq$Hoq
API String ID: 0-3310881576
Opcode ID: 092d9cebf64e9880a440959efffab48a9882528d3732de68d1eae0305dea6c21
Instruction ID: b6b9655b1d9fcd65e346e5bd610532e716f21f4ff169529a4313b949a4f0868f
Opcode Fuzzy Hash: 092d9cebf64e9880a440959efffab48a9882528d3732de68d1eae0305dea6c21
Instruction Fuzzy Hash: E541F2307047508BD7AABBB9852052A77EBBFC4240725487DE512CF794EF29DC02C352

Function 06A32C88 Relevance: 2.9, Strings: 2, Instructions: 376
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hoq, xrefs: 06A32D4A
Hoq, xrefs: 06A32DD1

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID: Hoq$Hoq
API String ID: 0-3106737575
Opcode ID: 2125e3ea4cbe3aee34cafde18ab161926cd2438aa31e441b12b88f80b352ac48
Instruction ID: 24f7d130808dad1e5d8fc2a254be309880e2149f1321378e2dbe309886c4e3b2
Opcode Fuzzy Hash: 2125e3ea4cbe3aee34cafde18ab161926cd2438aa31e441b12b88f80b352ac48
Instruction Fuzzy Hash: E8E19534A003689FDB15DF78C8506AEBBF6FF89300F14859AE449AB351EB309D46CB91

Function 06A86140 Relevance: 2.6, Strings: 2, Instructions: 71
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

8oq, xrefs: 06A861D3
8oq, xrefs: 06A8619C

Memory Dump Source

Source File: 00000000.00000002.1810547439.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID: 8oq$8oq
API String ID: 0-150699234
Opcode ID: 7919c64e784a8dc320520bcbb32a340ca38e81e65400d91514c7620507621d42
Instruction ID: 3805f7d69b5440dbd9b42a99a63736fd5206bbafa8b3e4822c174c9ac8ca6e1c
Opcode Fuzzy Hash: 7919c64e784a8dc320520bcbb32a340ca38e81e65400d91514c7620507621d42
Instruction Fuzzy Hash: BD21D835B102049FF784BA789805A6A76EAEBC8310F144479E606DB386EE30CD4187A2

Function 06EF1D6D Relevance: 1.7, APIs: 1, Instructions: 249
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 06EF1FAE

Memory Dump Source

Source File: 00000000.00000002.1811019110.0000000006EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ef0000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 9fd8622de4053b240ce1ab4aca8b839a8e1dffdea9de2764afa4f8070b6787fd
Instruction ID: c55d30c08566a79599d372d0264fdeb76a783374e454535824b22555da66326c
Opcode Fuzzy Hash: 9fd8622de4053b240ce1ab4aca8b839a8e1dffdea9de2764afa4f8070b6787fd
Instruction Fuzzy Hash: A2A17871D10319CFDB50CFA8C840BEEBBB2BF48314F1485A9E948A7250EB749A85CF91

Function 06EF1D78 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 06EF1FAE

Memory Dump Source

Source File: 00000000.00000002.1811019110.0000000006EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ef0000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: a0a692ae75b90a4877449e40f3f3ad16f81b2e804899be51b5bd1c0e303e62dc
Instruction ID: a75f1ce0c371f38519fbac8743a0c63717afd18eb968600c0bba9cb0e6a48e6a
Opcode Fuzzy Hash: a0a692ae75b90a4877449e40f3f3ad16f81b2e804899be51b5bd1c0e303e62dc
Instruction Fuzzy Hash: 3C916871D10319DFDB50CFA8C840BEEBBB2BF48314F1485A9E908A7254EB749A85CF91

Function 00A5AEB8 Relevance: 1.7, APIs: 1, Instructions: 204
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00A5B11E

Memory Dump Source

Source File: 00000000.00000002.1805354704.0000000000A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 768ae61332cf297a5ee677baed84a42718dbeb3306299ee5d4f1d02a7681c416
Instruction ID: c7c5a2a70bdd9f94d4f12beeb3ac7a3cfa6a42dbeab80600b2d89fc46da635ac
Opcode Fuzzy Hash: 768ae61332cf297a5ee677baed84a42718dbeb3306299ee5d4f1d02a7681c416
Instruction Fuzzy Hash: 1C8148B0A00B458FD724DF29D44575ABBF1FF98301F008A2EE88ADBA50D775E949CB91

Function 06A8F930 Relevance: 1.6, Strings: 1, Instructions: 370
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'kq, xrefs: 06A8FE40

Memory Dump Source

Source File: 00000000.00000002.1810547439.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID: 4'kq
API String ID: 0-3255046985
Opcode ID: 33d6716b8f6fb9da6a97433cc4bd8a626b77ebe1f386790c56d12576b25122b1
Instruction ID: a92baaf7ddab3eaa0e2e06da04b5481d63d022db97600a9283042bad9b112393
Opcode Fuzzy Hash: 33d6716b8f6fb9da6a97433cc4bd8a626b77ebe1f386790c56d12576b25122b1
Instruction Fuzzy Hash: BEE17F34A00209DFDB45FFA8C954AAEBBF6FB88340F10845AE405BB369CB359D85CB51

Function 06A4A290 Relevance: 1.6, APIs: 1, Instructions: 109timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,02306428,?,?,?,?,?,?,06A4A0B0,00000000,00000000,?), ref: 06A4A25D

Memory Dump Source

Source File: 00000000.00000002.1810392953.0000000006A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a40000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID: Timer
String ID:
API String ID: 2870079774-0
Opcode ID: ec0bf8b0d8a0b29ef62080892496715b6b35355425be22791ecd66c4c5b51091
Instruction ID: 0f110a2e1d57eb9365152b23022d5745e27defeabe97f00cb4265509caeeb058
Opcode Fuzzy Hash: ec0bf8b0d8a0b29ef62080892496715b6b35355425be22791ecd66c4c5b51091
Instruction Fuzzy Hash: 7B311431A402008FC750BB69D848BAAFFE5EFC6310F1940AAE505DF376CA75E844DBA1

Function 00A55A94 Relevance: 1.6, APIs: 1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1805354704.0000000000A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9131d3f30e9393b6aef6cca1306bebb967e2a5761c9ba23f9aca5e4c2affec30
Instruction ID: 79ef63439e277d243df55986852d21b410b44656fe03e9097d71cc9dad768dd3
Opcode Fuzzy Hash: 9131d3f30e9393b6aef6cca1306bebb967e2a5761c9ba23f9aca5e4c2affec30
Instruction Fuzzy Hash: 4041CEB1C04A49CFCB11CFF8C8587DDBBB0BF55315F148199D805AB265D779A90ACB41

Function 00A5591C Relevance: 1.6, APIs: 1, Instructions: 101COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 00A559D9

Memory Dump Source

Source File: 00000000.00000002.1805354704.0000000000A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: c4b32014b40122b4969ed1b7770898e45b5192caee36d77253e8011f6195932f
Instruction ID: 58f396eba1200f80167a67e7ea18785df8c1a65cda89c44e02b17e3b0e8c7c2f
Opcode Fuzzy Hash: c4b32014b40122b4969ed1b7770898e45b5192caee36d77253e8011f6195932f
Instruction Fuzzy Hash: DF41F4B0C00719CFDB24CFA9C8847DDBBB5BF49304F2481AAD408AB265DB75694ACF91

Function 00A54514 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 00A559D9

Memory Dump Source

Source File: 00000000.00000002.1805354704.0000000000A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 0f03ad6ff63609c92970dae2e90c2fad5ee50fafc00dfc8caf166fa42da32ab3
Instruction ID: c0fc02cd47903e689486e93f2c7a9df9b2caa5a76273914b41ab8eda18ab4ad3
Opcode Fuzzy Hash: 0f03ad6ff63609c92970dae2e90c2fad5ee50fafc00dfc8caf166fa42da32ab3
Instruction Fuzzy Hash: 5841D1B0C0071DCBDB24CFA9C844B9EBBF5BF48304F2481AAD508AB265DB756949CF90

Function 04A86799 Relevance: 1.6, APIs: 1, Instructions: 87COMMON

Download Yara Rule

APIs

DrawTextExW.USER32(?,?,?,?,?,?), ref: 04A86837

Memory Dump Source

Source File: 00000000.00000002.1809341380.0000000004A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a80000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: 88b57a40c584f661fa2cdd49ab9948793633946a70626dc9dcb27a56a74896cc
Instruction ID: 5766dad3e77c6957c6beb03a8c495f5140c0c3c1cf8db4de74066a4f0158e456
Opcode Fuzzy Hash: 88b57a40c584f661fa2cdd49ab9948793633946a70626dc9dcb27a56a74896cc
Instruction Fuzzy Hash: 2C31E1B6D002599FDB10DF9AD880ADEFBF4FF58320F14842AE919A7210D771A945CFA0

Function 06EF16E8 Relevance: 1.6, APIs: 1, Instructions: 72injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 06EF1780

Memory Dump Source

Source File: 00000000.00000002.1811019110.0000000006EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ef0000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 84a29c696c13816e1d95e2555c15c9218ccc14814fa153346b2d34bbb7afba1d
Instruction ID: d11dc5a4fc52cdc38b645e7eba4f6031c6f431366da4393a594cde97913ab773
Opcode Fuzzy Hash: 84a29c696c13816e1d95e2555c15c9218ccc14814fa153346b2d34bbb7afba1d
Instruction Fuzzy Hash: B02126B5910359DFCB10CFA9C885BEEBBF5FF48324F108429E959A7290D7789944CBA0

Function 04A867A0 Relevance: 1.6, APIs: 1, Instructions: 69COMMON

Download Yara Rule

APIs

DrawTextExW.USER32(?,?,?,?,?,?), ref: 04A86837

Memory Dump Source

Source File: 00000000.00000002.1809341380.0000000004A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a80000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: 44efd3894e3cd0d6a940a8c91ad947553bab995d5f213c4e3ec5c138cbf9c6ad
Instruction ID: 92b5dc521d0256959ba1fd5c7538cb6c5640981d4736844172208e4dcf9123ea
Opcode Fuzzy Hash: 44efd3894e3cd0d6a940a8c91ad947553bab995d5f213c4e3ec5c138cbf9c6ad
Instruction Fuzzy Hash: 5721DDB5D002499FDB10DF9AD884ADEFBF5FB58320F14842EE919A7210D775A944CFA0

Function 06EF16F0 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 06EF1780

Memory Dump Source

Source File: 00000000.00000002.1811019110.0000000006EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ef0000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 0583ac2ddfd7d4a50a5344b4c778b43ec38cd6449d0d294c86161b74b18adee1
Instruction ID: 3c8d47c7c1d2ed37c4d20bbbce1d1c3153aa5d072f0d9fbc1a5b191d0ff00aae
Opcode Fuzzy Hash: 0583ac2ddfd7d4a50a5344b4c778b43ec38cd6449d0d294c86161b74b18adee1
Instruction Fuzzy Hash: 0F2127B5900359DFCB10CFA9C885BDEBBF5FF48324F108429E959A7290D778A944CBA4

Function 06EF17D9 Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 06EF1860

Memory Dump Source

Source File: 00000000.00000002.1811019110.0000000006EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ef0000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: c360104fb3c154e90cddf05bb7828271a728185de1245106666a553133a132d5
Instruction ID: 107321353a374418a3d4d86ad2819d992dd0fb94cf6447b0f2233d2f07d39e56
Opcode Fuzzy Hash: c360104fb3c154e90cddf05bb7828271a728185de1245106666a553133a132d5
Instruction Fuzzy Hash: 95214AB1C00359DFDB10DFAAC881AEEBBF5FF48320F508429E559A7250C734A944CBA0

Function 06EF1552 Relevance: 1.6, APIs: 1, Instructions: 68threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 06EF15D6

Memory Dump Source

Source File: 00000000.00000002.1811019110.0000000006EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ef0000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 9f9aa606a74ffae604045ac4baf6753d8f1cb3eb1cd77ad479c0bff03a007c84
Instruction ID: cef56ca5f33d4fb83c71cb9335545ee4a19fca11e9202eec2bbe4c7b7c22b49a
Opcode Fuzzy Hash: 9f9aa606a74ffae604045ac4baf6753d8f1cb3eb1cd77ad479c0bff03a007c84
Instruction Fuzzy Hash: CE215971D043098FDB10DFAAC4857EEBBF4EB88324F108429D559A7240CB78A944CFA0

Function 06EF4058 Relevance: 1.6, APIs: 1, Instructions: 65windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 06EF4025

Memory Dump Source

Source File: 00000000.00000002.1811019110.0000000006EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ef0000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 91c5febc76f065132fcd4cf996ff77b0b2bf002aa8590e465ce9b22db003f2d4
Instruction ID: 6368603d9f2f23987259e1c4f25ddf259824548f316856dc78bfc0a3c77a1ca8
Opcode Fuzzy Hash: 91c5febc76f065132fcd4cf996ff77b0b2bf002aa8590e465ce9b22db003f2d4
Instruction Fuzzy Hash: 5021AC76D15328CFCB20DBA6D4047EFBBF5AF94314F20845AC605BB281D7B65900CBA2

Function 00A5D0FC Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00A5D76E,?,?,?,?,?), ref: 00A5D82F

Memory Dump Source

Source File: 00000000.00000002.1805354704.0000000000A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 044781b46a5d13df949c0b76b208a78dc661dca4fab2de1b943ef062c5041e29
Instruction ID: 4f26ff9dea9a74012b0369b1a235c674f93be12264bda12fafeb2f1db2754d84
Opcode Fuzzy Hash: 044781b46a5d13df949c0b76b208a78dc661dca4fab2de1b943ef062c5041e29
Instruction Fuzzy Hash: 4F21E4B5900248DFDB10CFAAD984ADEBFF4FB48324F14842AE958A7310D374A944CFA5

Function 00A5D7A0 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00A5D76E,?,?,?,?,?), ref: 00A5D82F

Memory Dump Source

Source File: 00000000.00000002.1805354704.0000000000A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: ed32c79cfee5b7733a306c72f228c3dfa7b6b817c1e24bcc1034c8c5c23c3a82
Instruction ID: f26c968da54ae864e003d32b070677e390684a39461328a3d3a6c1a20f2de167
Opcode Fuzzy Hash: ed32c79cfee5b7733a306c72f228c3dfa7b6b817c1e24bcc1034c8c5c23c3a82
Instruction Fuzzy Hash: 262112B5900248DFDB10CFAAD884ADEBFF4FB48320F14842AE918A7310D374A944CFA0

Function 06EF17E0 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 06EF1860

Memory Dump Source

Source File: 00000000.00000002.1811019110.0000000006EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ef0000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 72d2d05d9001833bfcfc95f773c8aa2e28842f2f5be376f3dcfd7b0413264d9a
Instruction ID: ffe3e28864473fa799436900be9c12ad1004f7675ae93692adf9835c579a9a91
Opcode Fuzzy Hash: 72d2d05d9001833bfcfc95f773c8aa2e28842f2f5be376f3dcfd7b0413264d9a
Instruction Fuzzy Hash: 3B2128B1C00359DFDB10DFAAC941ADEBBF5FF48320F508429E559A7250C734A944CBA4

Function 06EF1558 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 06EF15D6

Memory Dump Source

Source File: 00000000.00000002.1811019110.0000000006EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ef0000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 9d6337a1780b4cae9213623ac37e8f3a1b468a6a4cb14e7fb89931d657261e7d
Instruction ID: e25c26047215c9c94fdff6e2e6fff3480f45a888d797730fb90441882b0cf52e
Opcode Fuzzy Hash: 9d6337a1780b4cae9213623ac37e8f3a1b468a6a4cb14e7fb89931d657261e7d
Instruction Fuzzy Hash: E02138B1D003098FDB10DFAAC4857EEBBF4EF48324F148429D559A7240CB78A944CFA4

Function 06EF14A0 Relevance: 1.6, APIs: 1, Instructions: 60threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 06EF150A

Memory Dump Source

Source File: 00000000.00000002.1811019110.0000000006EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ef0000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: eb848121f223f250a91aecf804e80ca67a36e5fd4731c786d6bb5c4927636f0b
Instruction ID: e679cb74083febe251f00553a14bdb460046fdffac10efbb367673405fd66aba
Opcode Fuzzy Hash: eb848121f223f250a91aecf804e80ca67a36e5fd4731c786d6bb5c4927636f0b
Instruction Fuzzy Hash: CA119AB1D00249CFCB10CFA9D8847EEBFF5EF88324F248869C155A7200C635A845CFA4

Function 06EF1628 Relevance: 1.6, APIs: 1, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 06EF169E

Memory Dump Source

Source File: 00000000.00000002.1811019110.0000000006EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ef0000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 87d554658fdbb3d80a73f48bce5ba94a2ccf4cef4f62864a049ab04a19ceaa8b
Instruction ID: 3e25157bf77cbb102162f7e6e345b27c16741690cd742f5a03b7136daa093fe6
Opcode Fuzzy Hash: 87d554658fdbb3d80a73f48bce5ba94a2ccf4cef4f62864a049ab04a19ceaa8b
Instruction Fuzzy Hash: 36112971910249DFCB10DFA9C845BDEBFF5EF88324F248819E559A7250C7759944CFA0

Function 06EF1630 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 06EF169E

Memory Dump Source

Source File: 00000000.00000002.1811019110.0000000006EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ef0000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: a8df788ce0ce80ffbeba440a0c54d6a4526d95e3194721439672be79220b491c
Instruction ID: eed847dad16b139295c7bbf9dc86f426db9df078017ea7b3cfaee06f8e37240b
Opcode Fuzzy Hash: a8df788ce0ce80ffbeba440a0c54d6a4526d95e3194721439672be79220b491c
Instruction Fuzzy Hash: D7112671900249DFCB10DFAAC845ADEBBF5EB88324F148819E555A7250C775A544CFA4

Function 06EF14A8 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 06EF150A

Memory Dump Source

Source File: 00000000.00000002.1811019110.0000000006EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ef0000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: ff92b0a95a4c10c63795468fade06fe8a390c83a711f56e63ad142499d219901
Instruction ID: e2199d4e54aef80b25791559d14ca035c974c1d52696ec0f332bb04517517002
Opcode Fuzzy Hash: ff92b0a95a4c10c63795468fade06fe8a390c83a711f56e63ad142499d219901
Instruction Fuzzy Hash: E81125B19003498BDB20DFAAC4457DEFBF8EB88324F248829D559A7250CA75A944CFA5

Function 06A4A1F8 Relevance: 1.5, APIs: 1, Instructions: 49timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,02306428,?,?,?,?,?,?,06A4A0B0,00000000,00000000,?), ref: 06A4A25D

Memory Dump Source

Source File: 00000000.00000002.1810392953.0000000006A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a40000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID: Timer
String ID:
API String ID: 2870079774-0
Opcode ID: 59f6dd5d409c124291ce39a2d9706d9a0ce181014ab64e26998a551d42605ab6
Instruction ID: 199f6d4ffc3bb55bb7cf9923826c32dff48505c7fd713a82ee11a51c1bd8f0bd
Opcode Fuzzy Hash: 59f6dd5d409c124291ce39a2d9706d9a0ce181014ab64e26998a551d42605ab6
Instruction Fuzzy Hash: 2C11F2B58003499FDB10DF9AC884BDEBFF8FB89324F10845AE958A7250D375A584CFA5

Function 06EF3FC1 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 06EF4025

Memory Dump Source

Source File: 00000000.00000002.1811019110.0000000006EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ef0000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: ec70d7c384fc669b636edc8fcaaaa54be33f525bb4fbf4521b50cce35cd79083
Instruction ID: f379e2b0f82a75f6f868e1519dc391cdfa511a1227b8bf65b38f9542b669fac8
Opcode Fuzzy Hash: ec70d7c384fc669b636edc8fcaaaa54be33f525bb4fbf4521b50cce35cd79083
Instruction Fuzzy Hash: E811F2B5800349DFDB10CF9AD885BDEBFF8EB58324F208459E958A7240D375A984CFA1

Function 06EF1980 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 06EF4025

Memory Dump Source

Source File: 00000000.00000002.1811019110.0000000006EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ef0000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: bb8181701b692d6f46e3d97e0f210844d1ad135d9495590d86e0edd6aff04295
Instruction ID: 2424af164f0dc3f9118480fe6fc095c954fb13c2ce87e0638b9b5287f502bce5
Opcode Fuzzy Hash: bb8181701b692d6f46e3d97e0f210844d1ad135d9495590d86e0edd6aff04295
Instruction Fuzzy Hash: B71122B5800348DFDB10CF8AC844BDEBBF8EB58324F108419E958A7240D375A980CFA1

Function 06A488D8 Relevance: 1.5, APIs: 1, Instructions: 47timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,02306428,?,?,?,?,?,?,06A4A0B0,00000000,00000000,?), ref: 06A4A25D

Memory Dump Source

Source File: 00000000.00000002.1810392953.0000000006A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a40000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID: Timer
String ID:
API String ID: 2870079774-0
Opcode ID: 98cd58aa3cede006df1d88f18db492936e5a2a6ec26f7abca62e91d479425e1c
Instruction ID: 7313b476adaf664b4d10ab0e006c82cf16710b1df5e8739e0e688492caa8030e
Opcode Fuzzy Hash: 98cd58aa3cede006df1d88f18db492936e5a2a6ec26f7abca62e91d479425e1c
Instruction Fuzzy Hash: 0C11F5B58043499FDB10EF9AC844BDEBBF8FB48324F10845AE558B7250D375A944CFA5

Function 00A5B0B8 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00A5B11E

Memory Dump Source

Source File: 00000000.00000002.1805354704.0000000000A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: f8e117dc0560771acdee696f929afc5c6b370bcf6a4eb420a62926a636f74641
Instruction ID: 29804a76910ac33e14807a39c6ad4e69f4d8aebc0cd4d70f0506c0211a69a67f
Opcode Fuzzy Hash: f8e117dc0560771acdee696f929afc5c6b370bcf6a4eb420a62926a636f74641
Instruction Fuzzy Hash: B91110B5C006498FCB10CF9AD844ADEFBF4BB88324F10852AD859A7210D375A545CFA1

Function 06A8C62A Relevance: 1.5, Strings: 1, Instructions: 234COMMON

Download Yara Rule

Strings

r, xrefs: 06A8C71A

Memory Dump Source

Source File: 00000000.00000002.1810547439.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID: r
API String ID: 0-1812594589
Opcode ID: 227a216dbfe5cb7a1eb9da9e91fd2a2b95e4a6e2f781b5117249502b7c88faac
Instruction ID: caae47c05709a14001763b70c0d0ec03cd9417d08f35c9ae8e2cdb163d547658
Opcode Fuzzy Hash: 227a216dbfe5cb7a1eb9da9e91fd2a2b95e4a6e2f781b5117249502b7c88faac
Instruction Fuzzy Hash: 2D910774D09104CFDB44FF69D4844EDFBBAFB49311B14E165E41AAB242D734A982CFA0

Function 06A317B0 Relevance: 1.4, Strings: 1, Instructions: 186COMMON

Download Yara Rule

Strings

(oq, xrefs: 06A337B7

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID: (oq
API String ID: 0-3175707579
Opcode ID: e3b310f13886fee9927f1007c1bed8c2d1a293103b331ac4e84db2978a028a4f
Instruction ID: 6e4e69dd3cf2f030b3369a964ed489e77be99658fb0db0de0a77c6f8c82cbeb3
Opcode Fuzzy Hash: e3b310f13886fee9927f1007c1bed8c2d1a293103b331ac4e84db2978a028a4f
Instruction Fuzzy Hash: CE71E075A00259AFCF41DFA9D980AEEBBF6FF48310F14852AF915A7220D731A951CB90

Function 06A84F1B Relevance: 1.4, Strings: 1, Instructions: 158COMMON

Download Yara Rule

Strings

%*&/)(#$^@!~-_, xrefs: 06A84F51

Memory Dump Source

Source File: 00000000.00000002.1810547439.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID: %*&/)(#$^@!~-_
API String ID: 0-3325533558
Opcode ID: bbd310361ab35dc45339222f69e502f50b5ffc8c4a38d3063440a23a2a0278f1
Instruction ID: bddb25ffd47009e069b506ff485e887d8a9bd8c5a1999961a4054d7e0f233924
Opcode Fuzzy Hash: bbd310361ab35dc45339222f69e502f50b5ffc8c4a38d3063440a23a2a0278f1
Instruction Fuzzy Hash: E3519B31B002549FD705BBB4D4446AEBBB3BF89300F14C4A9ED95AB29ACF306D49CB91

Function 06A84F28 Relevance: 1.4, Strings: 1, Instructions: 152COMMON

Download Yara Rule

Strings

%*&/)(#$^@!~-_, xrefs: 06A84F51

Memory Dump Source

Source File: 00000000.00000002.1810547439.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID: %*&/)(#$^@!~-_
API String ID: 0-3325533558
Opcode ID: c7663d8bf8eb3ae1c42ca21bca3d9b5e6735fa2a606ebb827ff61bffd1fd992e
Instruction ID: ea506feb6a596fcd2d61fdb2d0be203dc5ed33fe40ae683cd8e002f497d01061
Opcode Fuzzy Hash: c7663d8bf8eb3ae1c42ca21bca3d9b5e6735fa2a606ebb827ff61bffd1fd992e
Instruction Fuzzy Hash: A3519C31E002149BDB04BBB4D4456AEBBB3BF88300F54C4A9ED55AB39ACF306D49CB81

Function 06A31640 Relevance: 1.4, Strings: 1, Instructions: 146COMMON

Download Yara Rule

Strings

(oq, xrefs: 06A3475C

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID: (oq
API String ID: 0-3175707579
Opcode ID: ac3e0eca71ebbff69095d0c7b6b563aef09296f0e670fa1e61c589e5f31130b1
Instruction ID: 7ad6d8a4fc6c0ff4f14acdc442a71f113bfde94b1109be15a2fbd2c414b08d82
Opcode Fuzzy Hash: ac3e0eca71ebbff69095d0c7b6b563aef09296f0e670fa1e61c589e5f31130b1
Instruction Fuzzy Hash: 4141C131B046148FDB40EB7DD4446AEBBF5EF8A310F1545AAE0099B361DB30ED85CB91

Function 06A3EF70 Relevance: 1.4, Strings: 1, Instructions: 128COMMON

Download Yara Rule

Strings

(oq, xrefs: 06A3EFBC

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID: (oq
API String ID: 0-3175707579
Opcode ID: 6a433c7bf58b93fa00ef054e96a05d9a1b6f620f0b2b30c36bebc6d98df51f41
Instruction ID: 17a87c31f98ccc7841810e6814525f9e073830836751e8c4036831e05eeba76a
Opcode Fuzzy Hash: 6a433c7bf58b93fa00ef054e96a05d9a1b6f620f0b2b30c36bebc6d98df51f41
Instruction Fuzzy Hash: B341BF70E112049FEB54EF68D940AAEBBF6BF89200F148069E805DB341EF35DD01CBA1

Function 06A80040 Relevance: 1.4, Strings: 1, Instructions: 116COMMON

Download Yara Rule

Strings

(oq, xrefs: 06A801DD

Memory Dump Source

Source File: 00000000.00000002.1810547439.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID: (oq
API String ID: 0-3175707579
Opcode ID: 8ea6c0fd1ff754d788b0e803581e15983b2d9fb7b210e75809454550df80c8b8
Instruction ID: 211570dbf41ac6b97ccef43a4577054ddf7d0131d30056927c7f9277b791c977
Opcode Fuzzy Hash: 8ea6c0fd1ff754d788b0e803581e15983b2d9fb7b210e75809454550df80c8b8
Instruction Fuzzy Hash: 66416E31A00204AFDB55BF69C8547AEBAE6FF88210F10882AE406EB791DF74DD45CB91

Function 06A8ADC0 Relevance: 1.3, Strings: 1, Instructions: 77COMMON

Download Yara Rule

Strings

Tekq, xrefs: 06A8AF7A

Memory Dump Source

Source File: 00000000.00000002.1810547439.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID: Tekq
API String ID: 0-2319236580
Opcode ID: 02810992d8eb7d69b63cf19ba4782de377b3f3c6b20dce855426c816c87082e5
Instruction ID: c20cc66cd05933f667e3b6662cd3eab1e14fe2412bd5cfd846c8b43174f0bcbb
Opcode Fuzzy Hash: 02810992d8eb7d69b63cf19ba4782de377b3f3c6b20dce855426c816c87082e5
Instruction Fuzzy Hash: BA31C374E082488FDB44EFA9C8846ADBBF6BF49301F14906AE519AB355DB345846CF40

Function 06A8AE25 Relevance: 1.3, Strings: 1, Instructions: 73COMMON

Download Yara Rule

Strings

Tekq, xrefs: 06A8AEC9

Memory Dump Source

Source File: 00000000.00000002.1810547439.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID: Tekq
API String ID: 0-2319236580
Opcode ID: 769ac7e8a699a02797f8471967042dbfde72b0167340649905cd7d14dec5d307
Instruction ID: 181190fc80d61a9e1fe63d2f00c80023b7c8c446303c5dcfd75485dbc8e61660
Opcode Fuzzy Hash: 769ac7e8a699a02797f8471967042dbfde72b0167340649905cd7d14dec5d307
Instruction Fuzzy Hash: E531C074E00219CFDB08DFA8C9849ADBBB1FF48310F20812AEA19AB361C7356946CF50

Function 06A86130 Relevance: 1.3, Strings: 1, Instructions: 68COMMON

Download Yara Rule

Strings

8oq, xrefs: 06A8619C

Memory Dump Source

Source File: 00000000.00000002.1810547439.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID: 8oq
API String ID: 0-3198120224
Opcode ID: cd8ea851b416baa35229b7edc00370407c43cdd5c1495aa359d6a6e59a24f7fd
Instruction ID: 97fd190a3a518106ea7e9e521371061007ce6dc03fad72a2615aa36157096d08
Opcode Fuzzy Hash: cd8ea851b416baa35229b7edc00370407c43cdd5c1495aa359d6a6e59a24f7fd
Instruction Fuzzy Hash: 23110A35B142049FF784BF749C45A6ABBF6EB89310F15447AE606DB383EA308D01C7A2

Function 06A8AE3F Relevance: 1.3, Strings: 1, Instructions: 54COMMON

Download Yara Rule

Strings

Tekq, xrefs: 06A8AEC9

Memory Dump Source

Source File: 00000000.00000002.1810547439.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID: Tekq
API String ID: 0-2319236580
Opcode ID: ce8611a9604bf0502c1838a5b7178f1f578a28a03a79f0ee433a33a9106636bf
Instruction ID: 46a52e8abbe999e23a89dabf2197c78b0f49943f9cddba10407e06bf32fa922f
Opcode Fuzzy Hash: ce8611a9604bf0502c1838a5b7178f1f578a28a03a79f0ee433a33a9106636bf
Instruction Fuzzy Hash: 2711C275E00209CFCB08DFD8C9849ADBBB2FF88300F10812AEA19AB355C7315916CF50

Function 06A3BB68 Relevance: .5, Instructions: 523COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7ec6cd56175b96c9dddba54e27cf264c09007bf00a9e41214733f1e8c69953f
Instruction ID: 722dee983b53dbeff9571bbbb74b20f6508a40f2ea53b15e48b6351ce4b7eb41
Opcode Fuzzy Hash: e7ec6cd56175b96c9dddba54e27cf264c09007bf00a9e41214733f1e8c69953f
Instruction Fuzzy Hash: 9D42F230D1062DCFCB54EFA8C8446DCBBB1BF59300F518299E5497B265EB30AA99CF91

Function 06A35471 Relevance: .5, Instructions: 467COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: deca97bcc0471a045fa111c2541a1ea23863ed9b763515e38731694d0fc5a107
Instruction ID: d1930848050f54531384f4a0ad5f9b95ab6d956ff06b1b117cb8950aa801d354
Opcode Fuzzy Hash: deca97bcc0471a045fa111c2541a1ea23863ed9b763515e38731694d0fc5a107
Instruction Fuzzy Hash: BCE18060F403204BCBD6BF7D99A022EA5E29FC5211395C87DA90B9F39BDE6DDC094790

Function 06A35480 Relevance: .5, Instructions: 464COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2436c8ba79aa8e61e62a50464590d26afab0b59e12b96edc811b4c6db3c730b
Instruction ID: 6d6fb545de5ad9728b04b9296f5103fae5d9bad1e810516489f4202072d73cf9
Opcode Fuzzy Hash: d2436c8ba79aa8e61e62a50464590d26afab0b59e12b96edc811b4c6db3c730b
Instruction Fuzzy Hash: A2E17D60F403204BCBD6BF7D99A022EA5E29FC5211395C87DA90B9F39ADE6DDC094790

Function 06A30260 Relevance: .4, Instructions: 360COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50aae98f69691a798a3bfaab6daabd2f665ca39b083651c6bd9211a230f5f481
Instruction ID: 311275366981bd3228f54a040daadfef6364be567dd217e6d2b98e6bbb2a4068
Opcode Fuzzy Hash: 50aae98f69691a798a3bfaab6daabd2f665ca39b083651c6bd9211a230f5f481
Instruction Fuzzy Hash: 2D02A431D1061ACFCB51EF68C944ADDB7B1FF59304F118699E959BB220EB70AA85CF80

Function 06A38AD0 Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bedab34ddb08cbe71ac61373770a4b62cf7ea2d26aa6195d9579232fcb4acf09
Instruction ID: 10778d1f0b982a492aaff0153eaeefa3ed596059f25aaafba251c2eeba94d3b6
Opcode Fuzzy Hash: bedab34ddb08cbe71ac61373770a4b62cf7ea2d26aa6195d9579232fcb4acf09
Instruction Fuzzy Hash: 66B1F231E01228CFDB61EFA5C9506AEFFF2FF88300F21456AE545AB252DB359851CB91

Function 06A830F0 Relevance: .3, Instructions: 332COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810547439.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96ff1d844c2f3fc18c1cfc7885de5060d44e596041b68ee849c538fca15183dc
Instruction ID: c50754cfbdb457fbad3ced8f4b4f3c8fc452cd725414485e3a79a417b8b09b93
Opcode Fuzzy Hash: 96ff1d844c2f3fc18c1cfc7885de5060d44e596041b68ee849c538fca15183dc
Instruction Fuzzy Hash: 26F1D971D1061A8FCF10EFA8C954AEDB7B5FF98300F1186A9D519B7214EB70AA85CF90

Function 06A30250 Relevance: .3, Instructions: 329COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ac7fd624a0b9bd1892dc2f3f09b4c30a617212a8fabc31be1cd2fb9c2f639a7
Instruction ID: a71120e622c94e28edf480e0191dfec13f034bf22c8db94c10241ab77c714a3f
Opcode Fuzzy Hash: 3ac7fd624a0b9bd1892dc2f3f09b4c30a617212a8fabc31be1cd2fb9c2f639a7
Instruction Fuzzy Hash: CDF1A531D1061A8FCF11EF68C950ADDB7B1FF59304F11869AE9597B221EB70AA85CF80

Function 06A83700 Relevance: .3, Instructions: 305COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810547439.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 990de3767cd2c6c9ec99c475596ba6353453e7d21d8433af4391411d658bba40
Instruction ID: ab9679a80c0c6b0c05e8b6da74554f3da401cac5b9d2dde9e3d1d9db3159b369
Opcode Fuzzy Hash: 990de3767cd2c6c9ec99c475596ba6353453e7d21d8433af4391411d658bba40
Instruction Fuzzy Hash: 56C17F31E00219CFDF54EFA8C9546ADB7B2BF85704F1485A9D40ABB350EB30AE85CB91

Function 06A830DF Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810547439.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d40ecdf4082865998d3d7df51580885587b347360caf2b4fa397d339879475ff
Instruction ID: 1a8aef9c07b2dee1c9d6c49ba908d86fd03af9d9cd25c0570163f69b42911127
Opcode Fuzzy Hash: d40ecdf4082865998d3d7df51580885587b347360caf2b4fa397d339879475ff
Instruction Fuzzy Hash: 56E1D971D1061A8FCF14EFA8C9546EDB7B5FF98300F1186AAD509B7214EB70AA85CF90

Function 06A3CC40 Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e3612e18e4772309b3ebb3ce5d0179b5a08b34642c848644f76693f79b4d521
Instruction ID: e0c01551258c3a24465295108c9821bf01d91a715c4f8637cf5db4df41d92b53
Opcode Fuzzy Hash: 0e3612e18e4772309b3ebb3ce5d0179b5a08b34642c848644f76693f79b4d521
Instruction Fuzzy Hash: EAA1D375910619CFDB10EF68C940A99FBB1FF49314F05C299E949BB315EB30AA89CF90

Function 06A32DB1 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae2625f97f56ac291007d32529ea2f7bd9627d32f0df68f5119892ae53a653d9
Instruction ID: f6424c43f9ff46d96cdb1a181e4c0cacb6b4b32ca14bdc949013ee115cd07bea
Opcode Fuzzy Hash: ae2625f97f56ac291007d32529ea2f7bd9627d32f0df68f5119892ae53a653d9
Instruction Fuzzy Hash: 3CA14C34900759DFDB14DF64C940BAEBBB5FF89300F14819AE849AB211EB71AE85CF91

Function 06A379A0 Relevance: .2, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4347ceafc0ec888a94799d254ecaeb4934f5d74b1d57cf5a241cbb4094a69883
Instruction ID: e095bd215a58487e750e6d49d74fdf87c4f443fc45951fe09cea6239e274566a
Opcode Fuzzy Hash: 4347ceafc0ec888a94799d254ecaeb4934f5d74b1d57cf5a241cbb4094a69883
Instruction Fuzzy Hash: 7791E475A0021A9FDB51DFA8C980AAEB7F2FF48310F148569F925EB251E730EA50CB54

Function 06A38F90 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dca9a898eca7790cb87dfa49bdc22710c738291b66a282ab0b6dcd3a41467460
Instruction ID: 69acb07aec66bb611bfaf8ed959d57a59304757752a5a71c7d85273c1954b8b6
Opcode Fuzzy Hash: dca9a898eca7790cb87dfa49bdc22710c738291b66a282ab0b6dcd3a41467460
Instruction Fuzzy Hash: 2281A131A10218DFDB44EFA4D8989EDBBB5FF89300F118569E502BB364EB71A945CF90

Function 06A82380 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810547439.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5e0c9e2f796afdaaaf3f1a8394d301f3aea68a1cc4be159b8cfefa85a9dba0e
Instruction ID: f2494679133628c97744c721df843b1b000256956a4e6166e8ce2259c9fad0dd
Opcode Fuzzy Hash: e5e0c9e2f796afdaaaf3f1a8394d301f3aea68a1cc4be159b8cfefa85a9dba0e
Instruction Fuzzy Hash: 3A818E30E10219DFDB55FF68D9587ACBBB1FF84300F114069E446AB2A4EB34DAA5CB91

Function 06A30C40 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90838a41723514c3903da097f2c12da26095a3fcd82ebcdeab8f321106f7ba78
Instruction ID: 79b9f3a734f6d60517b85ddf8148e524952a22247582a9da92745e485d9f83df
Opcode Fuzzy Hash: 90838a41723514c3903da097f2c12da26095a3fcd82ebcdeab8f321106f7ba78
Instruction Fuzzy Hash: 62910C31E00619CFDB50EF68C840ADDB7B5FF49304F1585A9E949BB225EB31AA85CF90

Function 06A87B5B Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810547439.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00a6aeb414c8e8857a0faeefc09ef26b734ced1650b73d80d5c50574bf7771e7
Instruction ID: e2f0a3bca349c8eed7115c1e4bc2929bd12ccf3bb347a931e992a42f87b2f10b
Opcode Fuzzy Hash: 00a6aeb414c8e8857a0faeefc09ef26b734ced1650b73d80d5c50574bf7771e7
Instruction Fuzzy Hash: 6481A170E045588FDB50EFA5C580AAEBBF2BF45300F24C5A6E456AB396D730EC42CB90

Function 06A3F1E0 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce1f061a45ca43428ef0f87d4bfd88c88a33d8757ede65c8fc1073fc3058e2dd
Instruction ID: 459681432a5ff8b935ec2cd4a5514d3287549b339751880d4a58afb34c0725db
Opcode Fuzzy Hash: ce1f061a45ca43428ef0f87d4bfd88c88a33d8757ede65c8fc1073fc3058e2dd
Instruction Fuzzy Hash: 3781F834A00355CFCB44EFA8C99499CBBB1FF49304F1585A9E809AF36ADB75E949CB40

Function 06A87BE9 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810547439.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb365875336e0dc21312ea42d1025ad78003bbc54eb1c179c9ac2b36cf85df1b
Instruction ID: f2200f2f1045f0298d50b7c1a3bc6a4cbe5d574dd03d297e996b60e686877db0
Opcode Fuzzy Hash: eb365875336e0dc21312ea42d1025ad78003bbc54eb1c179c9ac2b36cf85df1b
Instruction Fuzzy Hash: C4617C70E045188FDB50EFA5C580AAEBBF2BF45300F24C556E566AB396E734EC42CB90

Function 06A3CC30 Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8045e7f409476c070eee6bd5876ea8eb4765fbeb8bcb1ee7ff3bb8d95061a7fe
Instruction ID: ffaeb87ad96a2cd6b044590331ec12bda913683d966963d05fa84e5922cb73a8
Opcode Fuzzy Hash: 8045e7f409476c070eee6bd5876ea8eb4765fbeb8bcb1ee7ff3bb8d95061a7fe
Instruction Fuzzy Hash: 2E71F571910619CFDB50EF68C940A99FBB5FF49314F05C299E849BB315EB30AA89CF90

Function 06A873F7 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810547439.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bacaf7931742b6a358049086a1df8e360eee6b00f1f55625dc5b530b0019f58e
Instruction ID: 70e1754c8057182198bb04aed4fd56f39eeb48a987f97ec78ec0145c632c61f5
Opcode Fuzzy Hash: bacaf7931742b6a358049086a1df8e360eee6b00f1f55625dc5b530b0019f58e
Instruction Fuzzy Hash: F6517370E046059FEB44FFA9C9517AEFAB2FB84310F208126E955A73C4DA34DD42DB92

Function 06A80328 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810547439.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2a44b7550c0144439f43fff817f71a78334e9e6310612b0103503c03e073def
Instruction ID: 4cf960200b2d7c3bd6eb9e152f9bc2fe3e4b36cdba37a3c0a90bc782f7f27da8
Opcode Fuzzy Hash: e2a44b7550c0144439f43fff817f71a78334e9e6310612b0103503c03e073def
Instruction Fuzzy Hash: 74515830E002188FCB55EF68D588AAEBBB2FF89314F158469E406AB261DB31CC46CB50

Function 06A3E4B8 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ed01de1b307a77ea7fc111d19ca510ea62647f5ccc798655efd1b7c61a0d8cb
Instruction ID: 450d4c38e0b23fa0c51c142cd7b61a8afc71039825d38c1639940e89800c37e4
Opcode Fuzzy Hash: 7ed01de1b307a77ea7fc111d19ca510ea62647f5ccc798655efd1b7c61a0d8cb
Instruction Fuzzy Hash: F1511A31E106198FCB40EFA8C8908ADF7B5FF89310B10866AE516BB315EB34E985CB50

Function 06A841C8 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810547439.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 245b51ba468de97d4f59fdc9f85fe4592e04d6f790f28f389ad8b5bd39433961
Instruction ID: ee8cf4138e96f2cd064c12fc7abae9ebc3749bd4a6640b743621d03df1476489
Opcode Fuzzy Hash: 245b51ba468de97d4f59fdc9f85fe4592e04d6f790f28f389ad8b5bd39433961
Instruction Fuzzy Hash: 3E418D30E052169FEB94FFA8D944AAEBBF6FF89201F1040A9E412D7250EE34D845CB91

Function 06A8B550 Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810547439.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 986ef1d64e9dd855b69309b733f3ec1fb9612d1d454cd92a0777788555a9ae92
Instruction ID: 0ec49d36a3dcde07ee6d3b84bb28577f95f9009d3f366fcf665fa6e3747f3bae
Opcode Fuzzy Hash: 986ef1d64e9dd855b69309b733f3ec1fb9612d1d454cd92a0777788555a9ae92
Instruction Fuzzy Hash: DC414870E05608CFEB48EF9AD4446EEBBF6AF8D301F18D029E41AA7251DB345941CBA4

Function 06A3E4A8 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10c359d5de4b663ff152a4783dfeb4b418cb7bb6c95e5ce1cd23323c4d248632
Instruction ID: 86dc953084ea075eb81d30a9c31079db986de97bb53deaaecffd120ffa24bdd9
Opcode Fuzzy Hash: 10c359d5de4b663ff152a4783dfeb4b418cb7bb6c95e5ce1cd23323c4d248632
Instruction Fuzzy Hash: 65414C31E10619CFCB50EF64C8904ADFBB5FF89310B15866AE916BB311EB34E985CB90

Function 06A3B15C Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c15fb5f16c519218dbe2a45aecc02fa5af95ff8fe4c82bf2b586313f71c943f
Instruction ID: a4595850778a0bd25fea09fcacac41c8333eeee12725c43082b17daa4a352cba
Opcode Fuzzy Hash: 7c15fb5f16c519218dbe2a45aecc02fa5af95ff8fe4c82bf2b586313f71c943f
Instruction Fuzzy Hash: F741B271E1462A9FDB81BF65C9597AA7BB2AB64340F104426F442EB294E734CA10CBA1

Function 06A3B150 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33c262840edcee2296c90f4e79827cebe326d76650cdac9caecacb26bbe6918a
Instruction ID: 1e78dc9d7770abd550f3b8e6ee4eeb25e22dfe7f1bccf2bcb68e428a712898c8
Opcode Fuzzy Hash: 33c262840edcee2296c90f4e79827cebe326d76650cdac9caecacb26bbe6918a
Instruction Fuzzy Hash: 14410671E046369FDB81BF65C9596EA7BF2AF65300F100466F442AB265E7308A00CBF1

Function 06A82170 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810547439.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7422817c0216cf49c59ae475ff4fe730fcb7bf447e4437a19eae37aa6fe90197
Instruction ID: 5eb76b234acca495ac11f8d6b657fa2593ebcf0c296c909bb1a41ee938605a17
Opcode Fuzzy Hash: 7422817c0216cf49c59ae475ff4fe730fcb7bf447e4437a19eae37aa6fe90197
Instruction Fuzzy Hash: DD414030E116049FDB44FFA9D950AADB7B6BF89310F1581A5E401BB3A0DB34D945CB90

Function 06A3B947 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 413527cd86a97ab8c98d236eeb8562e3d176e58e3ae1f9996b2344436f64797d
Instruction ID: 20206be7ba6e068e20638ca84bfed515544b3f132cef3cc5b3ecbe24b21e0d3c
Opcode Fuzzy Hash: 413527cd86a97ab8c98d236eeb8562e3d176e58e3ae1f9996b2344436f64797d
Instruction Fuzzy Hash: E941E171E046369FDB81FF65C9596EA7BF2BF64300F110466F442AB2A5E7308A10CBA1

Function 06A8B540 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810547439.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04edfb57072ca9400ade79d1bf73bdff898db9ab94dd8e6eef22cb5cc56b7637
Instruction ID: 4af72421d520305d48069f608385093a3da2810222134d139444c14f0bfa2514
Opcode Fuzzy Hash: 04edfb57072ca9400ade79d1bf73bdff898db9ab94dd8e6eef22cb5cc56b7637
Instruction Fuzzy Hash: AE412D74E05218DFEB48EF9AD5445EEBBF6AF8D301F14D029E41AA7251DB304941CFA4

Function 06A82180 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810547439.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fb2a03907dbbb57194f4ffb0791e1ed7ce46c091dd31eeec69b1ac5a3c490a3
Instruction ID: aa307ac1d0d68f68290779b05ad0fa6e49f355c8710325d97bee4f4fdefa2e92
Opcode Fuzzy Hash: 4fb2a03907dbbb57194f4ffb0791e1ed7ce46c091dd31eeec69b1ac5a3c490a3
Instruction Fuzzy Hash: 73413F30E116089FDB54FFA9D950BADB7B6BF89310F1585A9E401BB3A0EB34D941CB90

Function 06A30C31 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a73d663a8067ee55ede86341b10eb4615bc58f1e219d6ae653334ad6841500c
Instruction ID: e0fb9f05d83b06442509e7faaea9b3e39f938f77c717bc3635ecf6615dec4698
Opcode Fuzzy Hash: 1a73d663a8067ee55ede86341b10eb4615bc58f1e219d6ae653334ad6841500c
Instruction Fuzzy Hash: CE417131D00219CFDB51EF68C880AD9F7B5FF89300F1582AAE849AB251DB70AD85CF90

Function 06A8DFF9 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810547439.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a68f423ace29ae18948ec53a016729162f01ac2bbde38339aa220593a1e5461
Instruction ID: 5402b59527aedca3b1de4403ad687c4c1b83f8fff5f92261325d37cd25b5bc7a
Opcode Fuzzy Hash: 8a68f423ace29ae18948ec53a016729162f01ac2bbde38339aa220593a1e5461
Instruction Fuzzy Hash: D2414D78A05219DFDB90FF64E994AAC7BB7FB54304F1082A5E90AAB315DB305D42CF60

Function 06A3A988 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ecdd54d9b20659d2fa85201a50c555f9b144232424f46dddcb996c9c1db6d6c
Instruction ID: ec46d9546dafdf55ec6a486b50e25a0267a8c3e5017a17c3561037f579debc87
Opcode Fuzzy Hash: 2ecdd54d9b20659d2fa85201a50c555f9b144232424f46dddcb996c9c1db6d6c
Instruction Fuzzy Hash: AC416931E05228DFEB61AFA5D9949ADFFB2FF84300F224159E4417B256CB3188A1CF45

Function 06A841A0 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810547439.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab8a158f063f8df6c98ffd9e3ac7135470f5f74c2be4953f62adc8a12acdbcef
Instruction ID: 99000818ccbcbc3007fbadd328a01e8d3b7b128e9044ffb71275419c843f1e12
Opcode Fuzzy Hash: ab8a158f063f8df6c98ffd9e3ac7135470f5f74c2be4953f62adc8a12acdbcef
Instruction Fuzzy Hash: F431E730A052569FEB59FF64C904AAE7BF6EF8A301F1540BDE412D7251EE38D805CBA1

Function 06A31784 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14f928b6331761b4820e40592b17bbe4497eed1770068051372323b90f328077
Instruction ID: 7d222cc467d69d885896166042a2edb5d0ff32c3893782a27878b6600042bfe8
Opcode Fuzzy Hash: 14f928b6331761b4820e40592b17bbe4497eed1770068051372323b90f328077
Instruction Fuzzy Hash: 39317AB1904259AFDF10DFA9D844ADEBFF5FB49360F10846AE409E7211D734A940CFA0

Function 06A8514E Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810547439.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83d3bf084f66a7ede85ac04d60a7833da43b0c96f26010fc96266a3fbef6cc57
Instruction ID: 177ce59c7cc55a1cf8f2983621d4d6f2efbdd915f85b0b19d4d6499bc2398fa2
Opcode Fuzzy Hash: 83d3bf084f66a7ede85ac04d60a7833da43b0c96f26010fc96266a3fbef6cc57
Instruction Fuzzy Hash: D931A270B093804FD7526B74982826A7FF5EB86214F1940E7E446CB2D7D92C8C46C772

Function 06A3B7F0 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 266046971e4d7f8c120e4c97c4c631ec7aa149a364300e97313901678fa564cb
Instruction ID: ba71462c0c3865508e72ba19c85d7df407bfe40d6b64f50e06c87449bb27cd0c
Opcode Fuzzy Hash: 266046971e4d7f8c120e4c97c4c631ec7aa149a364300e97313901678fa564cb
Instruction Fuzzy Hash: 2731C330915718CFCB41FF68C951ADEBBB6FF56300F00856AE445AF261DB31A949CBA2

Function 06A3F000 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 292a2328136efcb923fa8709b5b7c434908f020fe6e616172ee70d5e315b9a20
Instruction ID: efeed320943028e06af6a51208e6a082e83438f053736632d5fbb33ebff56af4
Opcode Fuzzy Hash: 292a2328136efcb923fa8709b5b7c434908f020fe6e616172ee70d5e315b9a20
Instruction Fuzzy Hash: 2131A930E112159FEB54FB68E944AAEBBF6FF89200F104069E916E7250EF30DC05CB91

Function 06A31820 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a106b315f0a0c523506f696924858aafead3f783282848412939e2ec7fee548d
Instruction ID: c5ebef404d53438a5ad056e03fecdcafe36144f6d9885469dd63339912f94e80
Opcode Fuzzy Hash: a106b315f0a0c523506f696924858aafead3f783282848412939e2ec7fee548d
Instruction Fuzzy Hash: 1E4167B1805298EFDB52DFA9C844ADEBFF5FB49310F04845AF954AB221C7349854CBA1

Function 06A84018 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810547439.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65cb27f9a4c3796817bbed682bd653664f41122e3e3f2788055b5bc25b2ea749
Instruction ID: 94714b83ed44aa889ec0db343826267cabfc9ccd699d1530bd9b9c6abdd03c7a
Opcode Fuzzy Hash: 65cb27f9a4c3796817bbed682bd653664f41122e3e3f2788055b5bc25b2ea749
Instruction Fuzzy Hash: 73316B31E10219DFDB54BFA8D9409AEBBF6FF88210F10826AE415AB324DB719C55CBD1

Function 06A3A6C8 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d3542df5e8bcffb3acdaffb7c15c6426d5ddb2b2cafb65e54c245e4bb6e8b2d
Instruction ID: b308ef9b0fb6b623002537163fcd98b75e171aa099b5ff77daf3d7bf970bd38a
Opcode Fuzzy Hash: 6d3542df5e8bcffb3acdaffb7c15c6426d5ddb2b2cafb65e54c245e4bb6e8b2d
Instruction Fuzzy Hash: 9D315C35A102288FCB50EFA8C985AEDB7F1FF49310F2441AAE545EB265DB359E00CF60

Function 06A30929 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 964816d81e20ae9bc8f18c0562686df8c77d49464a850f4e47923f02bf8cd20a
Instruction ID: 62c84e4e4e7892a8c3ad7da61ebe0b57af4875ee254ed21eea32a42aae6714ac
Opcode Fuzzy Hash: 964816d81e20ae9bc8f18c0562686df8c77d49464a850f4e47923f02bf8cd20a
Instruction Fuzzy Hash: CA311D35A106199FDF04EF64C884CDDFBB5FF89314B018699E505AB361EB70B94ACB90

Function 06A37460 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3234946801da6a2bd68d30a49d384f2302e94ae1e2c56d5b1fef4dffca8a24a0
Instruction ID: 9f57f3ff00a8fc483560c88982910f820679e06aac53771e1949ac86db90a5a1
Opcode Fuzzy Hash: 3234946801da6a2bd68d30a49d384f2302e94ae1e2c56d5b1fef4dffca8a24a0
Instruction Fuzzy Hash: 00212776B106104FDB289B28C8915BEBBE6EBC4320F28446AF142DB665C734ED41C761

Function 06A32961 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8f979759a4652e4432665cb2d211be00fbb873656021694f459e010d0930f5d
Instruction ID: cbe6077f68d4dc087f67b12e7a18aa8582b08a81d4fb55c9cf689e2c3519dfd3
Opcode Fuzzy Hash: d8f979759a4652e4432665cb2d211be00fbb873656021694f459e010d0930f5d
Instruction Fuzzy Hash: E4210A31F046248BCB64BB7DA5506AE7BE6EFC9A50B1501B9F405CB352CF348D0287D5

Function 06A30938 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f14b59430ae0a02a0e1f1c2ce501c64e21384d89976fb1d9b1e4078dc7ed236
Instruction ID: 1d65fd657b5d87f1d6ae6694df238783ade105c74e0d62b93395bfcc4dcb325d
Opcode Fuzzy Hash: 0f14b59430ae0a02a0e1f1c2ce501c64e21384d89976fb1d9b1e4078dc7ed236
Instruction Fuzzy Hash: 0F310835A106199FCF04EF68C884CDDFBB5FF89314B0186A9E5056B320EB70B949CB90

Function 06A336B8 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5575a3107a9562e7608c57a6fae06a2759c3940a2598cc0bfd2ea4f5ac5cecdf
Instruction ID: 342aa441f943c100d4e0b33a3800c8f29d97832bda125101ef2a94d1a77c09ac
Opcode Fuzzy Hash: 5575a3107a9562e7608c57a6fae06a2759c3940a2598cc0bfd2ea4f5ac5cecdf
Instruction Fuzzy Hash: F731D0B6E00259AFCF41DFA8D9808EEBBF6FF4C310B11812AF915A3210D73199619F90

Function 06A3E79F Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edb9931abb5caa50f81a59b83a4062658a86dfc05d3b10e2ebcb1264d7ab2c1c
Instruction ID: 02d5ed404f0c2010e5e82cb6b7db33a2346a459597f2d524745e2508d6e26f2a
Opcode Fuzzy Hash: edb9931abb5caa50f81a59b83a4062658a86dfc05d3b10e2ebcb1264d7ab2c1c
Instruction Fuzzy Hash: BE317131A106199FCB04EFA8C994CDDBBB5FF89304F018699E505BB325FB30A949CB91

Function 06A80088 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810547439.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 922e62529233412a744682e8c831bbc4789f092bc8a9d934d9378581ede50b9c
Instruction ID: 98c03984080acdbe62e13cd8f900763c89a1587e10e26bc7f5152177fdd6c734
Opcode Fuzzy Hash: 922e62529233412a744682e8c831bbc4789f092bc8a9d934d9378581ede50b9c
Instruction Fuzzy Hash: 87316C70A00305EFDB51EF64C994BAEBBB6FF88714F10841EE4169B2A1CB75AD04CB60

Function 06A84AF8 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810547439.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30c2cd2ba0da80e7f6d6c93621f0136e76682eff8e916ae8c12f5d6f62766e81
Instruction ID: e950da6442dfbd35459c85f2ac822fba925767d783bbe9ed7bed509311a101bd
Opcode Fuzzy Hash: 30c2cd2ba0da80e7f6d6c93621f0136e76682eff8e916ae8c12f5d6f62766e81
Instruction Fuzzy Hash: BA21C474B052444FE7957BB8982827E3BE6EB85214F1484A6E803CB3D5DD39CC46C7B2

Function 06A38F81 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43bafcaa51f98618e34828a684a97eb1269517c9b72e5d0eef3a7e9d8720d0e0
Instruction ID: 2677073d730141b8337248a77fee15070ea7f5343180f4852c78742056068086
Opcode Fuzzy Hash: 43bafcaa51f98618e34828a684a97eb1269517c9b72e5d0eef3a7e9d8720d0e0
Instruction Fuzzy Hash: B031E530900219DFDB04EF64C9549EEBFB5FF89300F048229E416AB364FBB0A945CB90

Function 06A3ED80 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0a81eb9cf93fca3e17c2d6cca7281ac1d616d6dacc4b5ced96d4b8cf2bc795b
Instruction ID: 6a186d9cc8d563de2262ebe0757dbaa042808a38e2920630368875a330b16b6a
Opcode Fuzzy Hash: d0a81eb9cf93fca3e17c2d6cca7281ac1d616d6dacc4b5ced96d4b8cf2bc795b
Instruction Fuzzy Hash: 5E314D31E10619DFCB14EFA9D89499EBBB6FF89310F10852AE506AB270DB719C45CF90

Function 06A38AC0 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3127fcdd8251444cb41373cdaef1de23892947859401763fec0d0a8fc66eb13e
Instruction ID: 3c212020a2bcfacb8a56d465909e080e315a72871ae2b75421593e10638770f4
Opcode Fuzzy Hash: 3127fcdd8251444cb41373cdaef1de23892947859401763fec0d0a8fc66eb13e
Instruction Fuzzy Hash: 3C21E230E00236CBDB957F64C8945AABBB0EF42310F51496AE686BB244EB32D911CBD0

Function 06A381E0 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22b57d6ceb7b1ef8ebe1656519b976cf95088ad0de928d11a1e678f390532425
Instruction ID: 8b4ffb4966e28c9c65389e56654c3c6deee624c17c47be75bd75619d5517242d
Opcode Fuzzy Hash: 22b57d6ceb7b1ef8ebe1656519b976cf95088ad0de928d11a1e678f390532425
Instruction Fuzzy Hash: 4B21B630701B108BE765BBB99610426B3E6EFC9248714447DF956CB760EB3AE806C761

Function 06A37470 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bf61cd48b14bee0b3dff938e61ca164a8d22269c38a138db7ba9500ae1a855f
Instruction ID: a27419b0d9f4ae5b34905fd12ad463651e8939566af379556a90988eaf78e366
Opcode Fuzzy Hash: 0bf61cd48b14bee0b3dff938e61ca164a8d22269c38a138db7ba9500ae1a855f
Instruction Fuzzy Hash: EF2104B6B106204FEB289B25D88157EB7EAEBC4221F28842AF14797754C734FD80C765

Function 06A34658 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c71070dbd0e28164445440fe733af6bb025955b2c14a90fc6ee4c012680635cd
Instruction ID: bc49ba49262ef42be3c1a63de8d9a4186df52fc68739d9f9ab795a943617aaa3
Opcode Fuzzy Hash: c71070dbd0e28164445440fe733af6bb025955b2c14a90fc6ee4c012680635cd
Instruction Fuzzy Hash: 77218D30B046258FCB44EB69C544AAEBBF6EF89300F15419AE415EB361DB70EE44CB91

Function 06A3E7B0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27c5e197e8b42c1ea5ae28fe7dc7424300e8c8e8b43ed3997d7c664cab20e66f
Instruction ID: d6b717ee0cebd14bca3912534362f9a36268d7808895e69ed5ac7943e8c61c27
Opcode Fuzzy Hash: 27c5e197e8b42c1ea5ae28fe7dc7424300e8c8e8b43ed3997d7c664cab20e66f
Instruction Fuzzy Hash: 36311231A106199FCB04EFA8C594CDDFBB5FF89314F018659E5057B224FB70A949CB91

Function 06A3183C Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d7b64c0abec4f9a176d21d0065c0354d4644888dbd746dc6b1b6050c35bda74
Instruction ID: 4e29444fa2cafc0099796577f74e8495b848dc21c3e7dbb8bdf3b8407fe70419
Opcode Fuzzy Hash: 8d7b64c0abec4f9a176d21d0065c0354d4644888dbd746dc6b1b6050c35bda74
Instruction Fuzzy Hash: A83122B5900249EFDF50DF99C984ADEBBF5FB48320F14842AF918A7220C775A850CFA0

Function 06A3DE30 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 695ad0932e23d234c4b862f7a7f4ecc21ff6ae4f59c56060da42de9b22490e55
Instruction ID: c9af00d9ae6777c1b688af6c8d91e8b1081eacbb336cf88cd92b9f0e2da230d5
Opcode Fuzzy Hash: 695ad0932e23d234c4b862f7a7f4ecc21ff6ae4f59c56060da42de9b22490e55
Instruction Fuzzy Hash: 48215E31E00619CFCB51FBA8D8446ADFBB4FF99210F11416AE919E7260EB349945CB91

Function 009DD3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1805194569.00000000009DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 009DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9dd000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3a37253056467e46ce51322e8909a1ef2f2c2c2c3c77f4e14e00deba1407dc7
Instruction ID: d5b4bed91c82d4cfc16eb711596eaac2f50612d9d9e4625282b1c211cc6ebbe6
Opcode Fuzzy Hash: a3a37253056467e46ce51322e8909a1ef2f2c2c2c3c77f4e14e00deba1407dc7
Instruction Fuzzy Hash: 61212871581204DFDB05DF14D9C0B26BF69FB94324F20C56AD9094B3A6C33AE856C6A1

Function 06A82F4B Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810547439.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c74745b4f936de98d3720d9c54d674bee63b7350b90c3c698664002717269511
Instruction ID: 464179d45e4f3b00a1aac24320a008d7d0d5d9761a580be93129c30210d395e2
Opcode Fuzzy Hash: c74745b4f936de98d3720d9c54d674bee63b7350b90c3c698664002717269511
Instruction Fuzzy Hash: EB213075A042058FCB44FF69CD808EEBBB5FF89200751866AD905EB255EB30EE05CBA0

Function 009ED01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1805236367.00000000009ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 009ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ed000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc4d42772e8f7c6681090d17d6c8a0971c96628a24a98857e851b5489cdde692
Instruction ID: 5444c49013419b07dbb5b1724ba8dbd0be13d114286e08efa8ea5eb98487d60b
Opcode Fuzzy Hash: cc4d42772e8f7c6681090d17d6c8a0971c96628a24a98857e851b5489cdde692
Instruction Fuzzy Hash: 5621F271604280DFDB16DF15D984B26BBA5FB84315F28C969D80A4B296C33ADC47CA61

Function 009ED1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1805236367.00000000009ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 009ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ed000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 147bcc5b9f57d4513991a413b0ff45e1c08c43e5c3d514961b5d2c796a63b4d3
Instruction ID: 9d87af0bc70d3602e6810394fe0fac4bc3818f1b84cf895fcfd804865fd8fede
Opcode Fuzzy Hash: 147bcc5b9f57d4513991a413b0ff45e1c08c43e5c3d514961b5d2c796a63b4d3
Instruction Fuzzy Hash: 0B212975504280EFDB06DF15D5C0B26BBA5FB84314F20C96DDA194B395C33ADC46CB61

Function 06A38984 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcf69b0472dd14e706d603ae3da9a1df05a218b4f5cdba232b585346e0ba2e72
Instruction ID: 2eb2a0489660d85347395523bf0a06a1a69faca8d2e6e8ec5b10eb7ac4223ccc
Opcode Fuzzy Hash: fcf69b0472dd14e706d603ae3da9a1df05a218b4f5cdba232b585346e0ba2e72
Instruction Fuzzy Hash: B721D431A01215DFDB64FF65D5806AAF7B2FF84325F10C42DE8199B250E775E984CB90

Function 06A8CAF8 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810547439.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cafaf96582f8716cbdfb647ad681dfe84d579eecdf6b0b9f453ff73e53914eac
Instruction ID: d3b13ea4425aa28feaee695b146337a660e937b969cba056edc75524350eee32
Opcode Fuzzy Hash: cafaf96582f8716cbdfb647ad681dfe84d579eecdf6b0b9f453ff73e53914eac
Instruction Fuzzy Hash: 8B212134D05208EFDB40EFA8C644AADBBF6FB49310F15D1D5E40997252D7309A40DFA1

Function 06A37548 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85cbad8431b73b57495a1e320c2eabfd14178d08a6809c81a44c3dfbe6a7676b
Instruction ID: 4de0756e36cce03595cd5b0ced837176c3ea02852f974e7a8b345de54cb326dd
Opcode Fuzzy Hash: 85cbad8431b73b57495a1e320c2eabfd14178d08a6809c81a44c3dfbe6a7676b
Instruction Fuzzy Hash: 1E212471B102208FCB11EB5DE8808AEFBB9EFC5310B10456BF1059B315DB30E905C7A2

Function 06A32BD1 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 507a418f1035dde8bb028e60e64f5cf439de171ce4760a55aaee6f3f0e55e696
Instruction ID: 15d2692c5088943678fd73a26a33386c2fcb27da818b758e28a199fcf9189795
Opcode Fuzzy Hash: 507a418f1035dde8bb028e60e64f5cf439de171ce4760a55aaee6f3f0e55e696
Instruction Fuzzy Hash: CF21D1788093588FCB12EF64D8447DEBFF4EF46311F1484AAE099AB252C2359645CBA1

Function 06A39868 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32993903126af490520e867527635a2481fbdfb3bf0334d68a81be281dc717ff
Instruction ID: d177f8eb1ae61f1dd3787c0b0669ab46c47dd3871a463557590c2a56c3668355
Opcode Fuzzy Hash: 32993903126af490520e867527635a2481fbdfb3bf0334d68a81be281dc717ff
Instruction Fuzzy Hash: 511181317146108FC741FB78DC54AAEB7EAEF8A614B15456AF045CB361EB31DC02CBA0

Function 06A82F58 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810547439.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e35405b8801d6ae957f31c49810893ec88f5ba1ea322678ef86ba62eebdf47ed
Instruction ID: 9071ed54c836e92301da90bfcd06372199093cc85bcb8840571073bd26e29ef1
Opcode Fuzzy Hash: e35405b8801d6ae957f31c49810893ec88f5ba1ea322678ef86ba62eebdf47ed
Instruction Fuzzy Hash: 50210E75A0020A8FCF44FF69C9809AEF7B5FF89200B518669D905B7351EB30AE45CBA0

Function 06A32780 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1dd0cb8293ddb399f3562de967dd3d0cc930b5033e7bba1c22f85b584cf93d71
Instruction ID: c8e869e7526bcf0f0630e183730aa58f59dba22465dabe9706168465550afc75
Opcode Fuzzy Hash: 1dd0cb8293ddb399f3562de967dd3d0cc930b5033e7bba1c22f85b584cf93d71
Instruction Fuzzy Hash: 8D112B307105608FDF9AF738891466D3297AFC5609B1544BDE00BCB3A0CE36DD42CB95

Function 06A83050 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810547439.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d14c0240dedd1f3689dc706d056fae598e3231f8fbcf6f9dc0a2292781092d28
Instruction ID: 516b6fbf7412b5fac25959649d120cdee0a711b4b0f6e1cf1d136842886fa1ae
Opcode Fuzzy Hash: d14c0240dedd1f3689dc706d056fae598e3231f8fbcf6f9dc0a2292781092d28
Instruction Fuzzy Hash: 30116B327445510BDF29BB2D9C41AFFB766EBC1620B54443EE08ACB692DA38D917C3D1

Function 06A39598 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 811fa01b99262a19768302d5dd19e10d7b1ad1eca18c6b83aa6161d787bb9560
Instruction ID: 7e55cb9ffae1d158349821de56e9fd670162007f21849f247897bac02152fe71
Opcode Fuzzy Hash: 811fa01b99262a19768302d5dd19e10d7b1ad1eca18c6b83aa6161d787bb9560
Instruction Fuzzy Hash: D82122B5D013599FCB10DF9AD884ADEFBF4FB48310F14842AE849AB200D375A944CBA4

Function 06A3D2C8 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3088e6fd7e1f42ca3919098f078d2d304c646f85707ad8d6b9b937057505aaae
Instruction ID: b9dd0440923f8626e0e4bcfadec30b5b8642785f4a2454f8ac22ce7b5435194f
Opcode Fuzzy Hash: 3088e6fd7e1f42ca3919098f078d2d304c646f85707ad8d6b9b937057505aaae
Instruction Fuzzy Hash: 7F116032605158BFCB02DF64EC448EB3F7EEFCA315B044156F945C6222C6364E25DBA1

Function 06A80258 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810547439.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94752c31573cb1fd3c8fafcc48de920600a37a09d55d2f457170c621a74d96b5
Instruction ID: c6d414c508538be44100737f6c4aa23effddf5cf5930e21165fdf7bff3daf9a9
Opcode Fuzzy Hash: 94752c31573cb1fd3c8fafcc48de920600a37a09d55d2f457170c621a74d96b5
Instruction Fuzzy Hash: BF11A231A003118FE766B72AD98476BF756EFD0310F04883AD5164A6B9DF75D8CAC640

Function 06A8B6F0 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810547439.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e28049cd9b1e95ab267422a5fce0022f445e031d3e1ad2bbf11326f1d679dd4
Instruction ID: b6b16b1679d427619cc7e14d966e37e728507135c3318cea6f7c12ad5266d571
Opcode Fuzzy Hash: 5e28049cd9b1e95ab267422a5fce0022f445e031d3e1ad2bbf11326f1d679dd4
Instruction Fuzzy Hash: 52210C78D09209DFDB80EFA9C580AAEBBF5BF49300F505099D509A7712D7309E41CFA1

Function 06A882D0 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810547439.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 178e56113aa6c0d9e8562b117634e2846f64f5402eb1c79f971a04dfa6118299
Instruction ID: b0f0ecf68cf3c55e2abe8ea72b27d12ad42450cf879dc39d873329a37fe6f10f
Opcode Fuzzy Hash: 178e56113aa6c0d9e8562b117634e2846f64f5402eb1c79f971a04dfa6118299
Instruction Fuzzy Hash: CB21D231A05615CFD794BFA9D44027AFBB4FB45300F804167E626CA186EA3C9D54C7EA

Function 06A38AB0 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f705f8f7e92fadb17441a9aa424d41d4faef7f47655de329d834dd64cf45efc7
Instruction ID: 7581c5af6e6ea956925be8e404a2ee943ef8f4605387635bf117e8522b40fdc7
Opcode Fuzzy Hash: f705f8f7e92fadb17441a9aa424d41d4faef7f47655de329d834dd64cf45efc7
Instruction Fuzzy Hash: 69119471F00176EFCB917BA5D9455EDBFB0EB40354B604C65E28AB2194E6308535CBD4

Function 06A882C3 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810547439.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8086701a535196f9467e42d933631466bb26cddfb9430c19f59f78a0357f01a4
Instruction ID: 093750c75326ee9c65828d0145715cb7007b68a9c0fcd7d8d61885e968341e3c
Opcode Fuzzy Hash: 8086701a535196f9467e42d933631466bb26cddfb9430c19f59f78a0357f01a4
Instruction Fuzzy Hash: 35110331E05619CFD790BFA9C8402BAFBB4FB44300F804167E626C6182EB3C9950C7EA

Function 06A8E03A Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810547439.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4cd8da9d70413bb59efdd34e3a3303b9da594f6f874595fb35c0052b924bd04
Instruction ID: 10af0aadd3ab2d5e93223958b049114e4ed5f27f572a8ec86694719630d9787a
Opcode Fuzzy Hash: e4cd8da9d70413bb59efdd34e3a3303b9da594f6f874595fb35c0052b924bd04
Instruction Fuzzy Hash: 04217174906219DFEB50FF64ED94B987BB6FB44304F1046D5E90AA7305EA305E82CF60

Function 06A8BE72 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810547439.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba6e6ac4fc12db27b104da06c6dd9eab892b9748d46c8064721ec56014f86df8
Instruction ID: feb42ec49a771b44b0530de5240fc97698e4b14ac56681ab0167795a17539083
Opcode Fuzzy Hash: ba6e6ac4fc12db27b104da06c6dd9eab892b9748d46c8064721ec56014f86df8
Instruction Fuzzy Hash: EC21F434905218CFEB64EF94D588AECB7F6FB4D321F1051A9D40AAB241D7319D81CF60

Function 06A84B51 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810547439.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96506f420e6de2dd821c5877958f147b5466ebb07c38fba3d27e396ac4ebcde6
Instruction ID: 78f788266c00f04c63d857d3ecfbbb6658a6ef4d18738608e1c797fc6b1fb87c
Opcode Fuzzy Hash: 96506f420e6de2dd821c5877958f147b5466ebb07c38fba3d27e396ac4ebcde6
Instruction Fuzzy Hash: 0E118170B002048FEB957BB8981C27E36E2EB94215F148576E903CB3D5EE39DC42CBA1

Function 06A31F90 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc3e3642244687ee7865e4bcbf5492ba40f07e448d12ece2c0d695cead4d85da
Instruction ID: 99378a26e912c7503c80dc5caa97a7384f0dc6ff3ce0cf73f9f35ff64aecf5cd
Opcode Fuzzy Hash: dc3e3642244687ee7865e4bcbf5492ba40f07e448d12ece2c0d695cead4d85da
Instruction Fuzzy Hash: E1112931A096444FC701F7749C448EEBFB5EFC6210B05869BE8059B252D7745A55C7A2

Function 06A395A0 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a14d9163c6ee7229ad9e825b6b60adf9116438af9b39a18031c1f38542e9c034
Instruction ID: f58e41fc153d3b646c1c48ac02b49ab73441ac60af6cb288eeac9f3096347ecd
Opcode Fuzzy Hash: a14d9163c6ee7229ad9e825b6b60adf9116438af9b39a18031c1f38542e9c034
Instruction Fuzzy Hash: A121FFB1D013599FDB10DF9AD984A9EFBF4FB48310F14842AE819A7200D375A944CBA4

Function 009ED006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1805236367.00000000009ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 009ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ed000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: feeef40257c8a3e5df4d1f5c510aa8ec023986392e9de046a203c0f12f5f52c5
Instruction ID: a0d3ecbe4721c19bc557e409cec56d1b673caed3347110c4d56a88c848bd8dbf
Opcode Fuzzy Hash: feeef40257c8a3e5df4d1f5c510aa8ec023986392e9de046a203c0f12f5f52c5
Instruction Fuzzy Hash: 342149755093C08FDB13CF24D994B15BF71EB46214F28C5EAD8498B6A7C33A980ACB62

Function 06A32B08 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c230f9d5d803a0c4518d247fcfeedd05b4e511ae43bd137a60b682f87646efad
Instruction ID: 00e35a897dc5d4524e9b4128131bdd4e9f69118a8a895d56fc34f3431440b447
Opcode Fuzzy Hash: c230f9d5d803a0c4518d247fcfeedd05b4e511ae43bd137a60b682f87646efad
Instruction Fuzzy Hash: CE117F349002149BCB10EBA8C8507FFBBF6FFC5300F004459D558AB265D7359941CBA1

Function 06A39878 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 105286dae4d87dec810e9ac1b389006ecd18eee547ad09147110c5403e94ef98
Instruction ID: d52a71390f1c77aa07ee956f2bd1e40d06fe9f08c1d22cc4488ea1b02a6a8757
Opcode Fuzzy Hash: 105286dae4d87dec810e9ac1b389006ecd18eee547ad09147110c5403e94ef98
Instruction Fuzzy Hash: 06119A327006108FC744FBA8D848A6EB7EAEFC9214B11456EF406DB361EB70EC01CBA0

Function 06A8BC78 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810547439.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7becf75e743b92a4ac66c440b2d85217b2333e27d9641f72c5e19939a173ca46
Instruction ID: bc2c69023f9dfcfecd31cafbed69b22728b329d00c27834176e1f7917e4ebe52
Opcode Fuzzy Hash: 7becf75e743b92a4ac66c440b2d85217b2333e27d9641f72c5e19939a173ca46
Instruction Fuzzy Hash: 0221B4B1D016189FEB18DFAAD9547DEBEB6AFC9300F04C16AD408A6265DB7409468FA0

Function 06A39670 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96c20f43b6b91e8807b725c513976a032d813bde77a78bcc3550fa518e2e93e6
Instruction ID: d84903f63da9f208d05a250beb31816eb3d50ac5c298ba7a0f16691f1c29d3f9
Opcode Fuzzy Hash: 96c20f43b6b91e8807b725c513976a032d813bde77a78bcc3550fa518e2e93e6
Instruction Fuzzy Hash: 9D0128327025204FE360677DAC8062B77D6EBC4264B11047AF60ACB360EB61DC02C7D1

Function 06A36A13 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1bc1df6e274c10aca305b3d37fb11318891717b4b7f3a73af8f5bd9097a8761
Instruction ID: bad4a92ad8511f4066fbae55564d1443d76c07d8097f778c5360ebe4aedb7a9f
Opcode Fuzzy Hash: b1bc1df6e274c10aca305b3d37fb11318891717b4b7f3a73af8f5bd9097a8761
Instruction Fuzzy Hash: 3111BE74A003589FDB01EFA4C950ABFBBB6EFC5300F05445AD558AB262D7389946CBA1

Function 06A375B0 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0b117002cfebfbcd2650d4641ba08aaf0108ff038dcabecea0fdce3c1045c98
Instruction ID: 0d9091b6de4161a30ea7e693b858e7dd9d6a3667ab3486412f8d8826fef6477d
Opcode Fuzzy Hash: a0b117002cfebfbcd2650d4641ba08aaf0108ff038dcabecea0fdce3c1045c98
Instruction Fuzzy Hash: FF21DB75E0025A8FCB45CFADC8449AEBFF1FF89210B10816AE918E7325D7349911CB90

Function 009DD3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1805194569.00000000009DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 009DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9dd000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: 3f8ff489aca56ef383805678809dd50af0aa426a34c515bd165a3c0e199f25c2
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: 55110376444240DFDB12CF00D5C4B16BF72FB94324F24C2AAD8090B366C33AE85ACBA1

Function 06A317C0 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af02df981ae33633a34180f16569be661c191b239403229848d00792e7b8ba10
Instruction ID: be764db6e5c4d085600a4d7344995150b9475d6db2a8a3a57f064a962af208f1
Opcode Fuzzy Hash: af02df981ae33633a34180f16569be661c191b239403229848d00792e7b8ba10
Instruction Fuzzy Hash: 0D2100B59043599FDB10DF9AC888ADEFFF4FB48320F14842AE919A7210C375A954CFA5

Function 06A8B7AB Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810547439.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7f1a7fdaaa47cd08c7f469f16dfaa68d17c629026b56e36c19f17e44b58c931
Instruction ID: c5de81165380248e3a0aac95fe27469397ee77634eba3aa03d8b9a4b92e8f042
Opcode Fuzzy Hash: a7f1a7fdaaa47cd08c7f469f16dfaa68d17c629026b56e36c19f17e44b58c931
Instruction Fuzzy Hash: C7113A70D0A209EFDB44EFA9C5409AEBFF9BF49310F0595A5D448AB312D3309A41CBA1

Function 009ED1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1805236367.00000000009ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 009ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ed000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: 4956820ae6decd021d7f94deed105a602b101bd15f7c93c05867e27ef459f0ea
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: 4D118B75504280DFDB16CF14D5C4B15BBA1FB84314F24C6AAD9494B796C33AD84ACB61

Function 06A8E2A2 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810547439.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91d56bc25a6045429c14ba32ad0d18bfb34ab646a6ccb58b0d4188e0cd8855f7
Instruction ID: 0383546649905339ea6b8111ac4d9aea8807d1856988450445c6fcf81b53952b
Opcode Fuzzy Hash: 91d56bc25a6045429c14ba32ad0d18bfb34ab646a6ccb58b0d4188e0cd8855f7
Instruction Fuzzy Hash: 4A21D87490420ACFDB80FF68E4886ADBBB6FF44305F109095E90AAB261DB309D81CF51

Function 06A80253 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810547439.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4398b491230d456b5d98146c4511ea0553177be8d903f823bfba7eab6e1de3b
Instruction ID: ac109eaa0fe176c5c1e4cdcc98c9ef77ed7b5dc4c71e7ef50cc4dcd680a7a816
Opcode Fuzzy Hash: f4398b491230d456b5d98146c4511ea0553177be8d903f823bfba7eab6e1de3b
Instruction Fuzzy Hash: DD012830A013018FE775B72ADD84BABBB5BFFC0310F048429D9164A6A4EF74D8CAC690

Function 06A883D8 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810547439.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2de95b57f7f1fa5b8914f8ff6c718357874d9787c77d06e2528619cc8ff11369
Instruction ID: a82a1691e64b587107711ace05b4e57386ba098f2e703035e1e947b1512aeb0d
Opcode Fuzzy Hash: 2de95b57f7f1fa5b8914f8ff6c718357874d9787c77d06e2528619cc8ff11369
Instruction Fuzzy Hash: 5B019631F80100DFE7A4BB159805B2AB79BEBC4700FA58076F1069F2A5DEB9DC41C791

Function 06A375C0 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b15f9404c601c44787ef906b76c338cf9ce5fb086473a45c1a77640e363509f
Instruction ID: d7cbe5d3ddd1400c4cde26a63820778cf6b78652d3d177e43af8bbe4c02cb9df
Opcode Fuzzy Hash: 4b15f9404c601c44787ef906b76c338cf9ce5fb086473a45c1a77640e363509f
Instruction Fuzzy Hash: 391189B5E0051A9F8B44DFADC9459AEBBF5FF88310B10816AE919E7315E7309911CBA0

Function 06A854C8 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810547439.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 158f4d77f42640b1d34508283bc9a18efc4776e7c5f920a270a317c3a831b30f
Instruction ID: f4661d8e0e0fd51664482fed025e5d717df531879fcc22ba61262f648e6a3bfb
Opcode Fuzzy Hash: 158f4d77f42640b1d34508283bc9a18efc4776e7c5f920a270a317c3a831b30f
Instruction Fuzzy Hash: 0D017631E0C2648FD7E0776EAC0063ABBBAFB86231F114123F895CB582D234C811C3A5

Function 06A825F7 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810547439.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 892681d43c1d88d0cc38ab27aacd141bb67420eddea51ed991a648c5b71b5e84
Instruction ID: ad159a3a826b136697eaf7b1304713993d0780e2d095a52d9abd3daa20227a3d
Opcode Fuzzy Hash: 892681d43c1d88d0cc38ab27aacd141bb67420eddea51ed991a648c5b71b5e84
Instruction Fuzzy Hash: 8111AC30E0061A9FDB44EFA8C8417AEBBB1EF49300F008129E415FB391DBB49646CBD1

Function 06A8BC88 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810547439.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7ee5c7db468d1978aa3556df44f9a59cb39bcc284c1db6c491401e3720f5d8f
Instruction ID: a8b06fc8ce746f7dc6fa210a1d5c098d289d6be47b0719b66b5e5f4a827c4410
Opcode Fuzzy Hash: b7ee5c7db468d1978aa3556df44f9a59cb39bcc284c1db6c491401e3720f5d8f
Instruction Fuzzy Hash: 0911A4B1D016189BEB18DFABC9447DEFAF7AFC8310F14C16AD509A6264DB740946CFA0

Function 06A3A7F0 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86d2dfeef12a15de389080d7b02d67a22501d5abeb29abb391b6e4ac787676ae
Instruction ID: 856baed00815c630f44485fbbd6e172eaacda83c0f63dbd20c16340da3039916
Opcode Fuzzy Hash: 86d2dfeef12a15de389080d7b02d67a22501d5abeb29abb391b6e4ac787676ae
Instruction Fuzzy Hash: 47012B31F092B2AFC7827B79D9451E97FB0DB8230071948A6F5C9EB2D2E2304616C7D1

Function 06A835F3 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810547439.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bd28ba82f37aa44377b005f72d5d9596abcc7036f90ea237d9f58529104388f
Instruction ID: 05f7288ce983642325c81bed07a38eda2e66a9d00d6942439035d99028edb95b
Opcode Fuzzy Hash: 3bd28ba82f37aa44377b005f72d5d9596abcc7036f90ea237d9f58529104388f
Instruction Fuzzy Hash: 28111B7190520ADFCF11EFA8D9459EFBBB4EB09310F104136E918B7241D6346A15CBA1

Function 06A8B7B8 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810547439.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78abf44ba9f99a304e01d2b977adc987a46c2a2c0f5b8ea2487de9dab58734e6
Instruction ID: cab2258eb7477a3b7860fafb1538f420fc8bfa1851be188d4124b76881d0aca8
Opcode Fuzzy Hash: 78abf44ba9f99a304e01d2b977adc987a46c2a2c0f5b8ea2487de9dab58734e6
Instruction Fuzzy Hash: 5911F774E09209EFDB84EF99C5809ADBBF9FB48310F14D5A5D418AB315D330AA41CF90

Function 06A36A20 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 010f16522f82b033cd7c1a008097df7aab07eab7b38981ab9cce430017a0ade2
Instruction ID: 7519dbddbba3a1254ecc240edf9c131e372061dc8ba367c2b4e1b38af0bec022
Opcode Fuzzy Hash: 010f16522f82b033cd7c1a008097df7aab07eab7b38981ab9cce430017a0ade2
Instruction Fuzzy Hash: 60117074A002189BDB10EFA9C940BBFB7F6EFC4300F008429D519A7354D7359946CBA1

Function 06A30BB1 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e18a0701beb893db67d161a39f830b211c62f0bc16adcb4ef7fb6cbf21aac5ed
Instruction ID: 458d545d86ef2e34fe9ec40d960e35540d926116f54ecfce3f26a876c5dc44df
Opcode Fuzzy Hash: e18a0701beb893db67d161a39f830b211c62f0bc16adcb4ef7fb6cbf21aac5ed
Instruction Fuzzy Hash: 7B11B7B5D04619AFCB41EFA8C9509EEBBF5EF49200F10859AE858E7211E7705A50CBA2

Function 06A32B18 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7856be628fb66a8bffcf8fb41ffe6f685bf8336117c3991749fe0d213a1cff46
Instruction ID: c0bf3d7becb2c9094bcee8f04be906ff398af0f7273407682bf7684f52332913
Opcode Fuzzy Hash: 7856be628fb66a8bffcf8fb41ffe6f685bf8336117c3991749fe0d213a1cff46
Instruction Fuzzy Hash: 5E117C74A002189BCB10EFA9C8407BFB7F6FFC8310F004429D569AB354E7359941CBA1

Function 06A8AE06 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810547439.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dab79f21794ece6cab2acab38b5d482fb4e0068c69deafee12c4e66d223ddcab
Instruction ID: 2adc0821d7de6fd1f0aa164f7d5b0f9da41211c15435e3f582fd980c27ba97d1
Opcode Fuzzy Hash: dab79f21794ece6cab2acab38b5d482fb4e0068c69deafee12c4e66d223ddcab
Instruction Fuzzy Hash: E0119274E04218DFDB44EFA9D984AADBBF6BF49301F10942AE91AAB395D7709C01CF40

Function 06A8DF50 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810547439.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba6197b9c3867de35b30b7043a27f4bad799f48624d35ce8a828432f7147f033
Instruction ID: c07dadad3fa96036dbf708609a33326c0be0e24da9c6b0d75d77e839fa7ef0e5
Opcode Fuzzy Hash: ba6197b9c3867de35b30b7043a27f4bad799f48624d35ce8a828432f7147f033
Instruction Fuzzy Hash: 7311E134A48205CFD781FBA8D5406ECBFBAFB95301F004625E5069B369DA345D0BCB62

Function 06A8CA78 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810547439.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffa5316ac341a9498b86ff3ad032ecf70086dae6a7f444bc71205e2707813444
Instruction ID: c7a2a547437747a86b9c4f8705fd31bd3a49f43117a03445b435d271497b089d
Opcode Fuzzy Hash: ffa5316ac341a9498b86ff3ad032ecf70086dae6a7f444bc71205e2707813444
Instruction Fuzzy Hash: 9D014034909208EFD744EBA8CA44AA9FFF6AF49310F15D0D9E50A9B252D6309E40DB91

Function 06A362B8 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0084944311b294e0db66f4a42e696195b14869feb2793e41193212d3988761d
Instruction ID: c20074d6e0ed6391c0478d6b5fc697b9c509859721cb8cce9cfdfb25256b0326
Opcode Fuzzy Hash: b0084944311b294e0db66f4a42e696195b14869feb2793e41193212d3988761d
Instruction Fuzzy Hash: E9018F347446119FDB59EF2DC4508AEBBA2EFC931070590AAF946CF325DB31DC028790

Function 06A3BADB Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dad6d7f92f0172cac196726887f322194d0a9633528e1eddf14ed75ca42c2d65
Instruction ID: cd59b9226415fa1b14c1031e83034f39dec54bb95e4b550b0989dfc99b34bd2b
Opcode Fuzzy Hash: dad6d7f92f0172cac196726887f322194d0a9633528e1eddf14ed75ca42c2d65
Instruction Fuzzy Hash: 7E01B53291574A9FCB01AF74DC448DAFB3AFFD6304B11876AE0416B121E770A599CBA0

Function 06A854B9 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810547439.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aeb8236de8a9a53338bf39c7b65fb3f531b5229baf87c736c982acd8b0a18a38
Instruction ID: e4c410f5d88bd98a638b031fed58276da90230ace0d5e7092a53451ad0d40030
Opcode Fuzzy Hash: aeb8236de8a9a53338bf39c7b65fb3f531b5229baf87c736c982acd8b0a18a38
Instruction Fuzzy Hash: E6012632E081209FD7E0B729984066AB7AAFB85231F114623E92ACB281D235C821C3D4

Function 009DD745 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1805194569.00000000009DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 009DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9dd000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fc041ca8c58edd2d289b2e12df1b22eb298059c3f8c34806a4055c645a71fa2
Instruction ID: 72b6e5a36336228a1beaf4576b8edc4508a587cfde775d307b1dc4e86354ce6b
Opcode Fuzzy Hash: 9fc041ca8c58edd2d289b2e12df1b22eb298059c3f8c34806a4055c645a71fa2
Instruction Fuzzy Hash: E0012BB114A3409AE7108E25CD84B67BFDCEF51364F18C9ABED094A386C239D840C6B1

Function 06A3CAF0 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62b4808209155c59e25f66283a46f46fb377db562e79139efb936bd9bf023fb9
Instruction ID: dbeb02e2a3c832eb092da2ff3dfb00660a1b2fdb236554ff084fdb37b93369c1
Opcode Fuzzy Hash: 62b4808209155c59e25f66283a46f46fb377db562e79139efb936bd9bf023fb9
Instruction Fuzzy Hash: ED018672E005189FDB40FA58ED459EEF778EBC5311F408276E5146B200EB316A59C7E1

Function 06A8DF60 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810547439.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8032f41c859e000394af35c97f9cd44d7dd811c4432af00ff717538a06efd0e0
Instruction ID: 89794eef249ffef86fe8c30bc41a9f0ffab15876dd239b34d093b8fb9aef0a18
Opcode Fuzzy Hash: 8032f41c859e000394af35c97f9cd44d7dd811c4432af00ff717538a06efd0e0
Instruction Fuzzy Hash: C6019234A48105CFDB81FBA9D5446ACBFBAFB94301F009525E506AB369DF305C46CB61

Function 06A8CA00 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810547439.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9c97a5f18c01861fe163c221dd61c8898db60cc1eaec8dfadd5b2cabc9b06fb
Instruction ID: 7f9a29ff5c089bd91cf163b6d68dc0eda06c25b78437f457ba45b68340a3da91
Opcode Fuzzy Hash: b9c97a5f18c01861fe163c221dd61c8898db60cc1eaec8dfadd5b2cabc9b06fb
Instruction Fuzzy Hash: 90014F7090D208DFD754FF65D9509E8FBBAEF4A310F05A1A5D40A5B212D7309E45DFA0

Function 06A3CF63 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee3f85abaa59e563079e2711178f71b9e411df6387231aed7e57e4054ae8eb91
Instruction ID: ab6460e3348f18d3839b494bef6ee384e04de3bbf0fd3402eecf0a44af9d13f0
Opcode Fuzzy Hash: ee3f85abaa59e563079e2711178f71b9e411df6387231aed7e57e4054ae8eb91
Instruction Fuzzy Hash: 9A016D31204619AF8B054F99DC448AFBFAAFB8C310B00812AFD15C2612CB318D218BE0

Function 06A3E891 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a48bb94ef2018d1a9b863c370e6057dce23b83b97798389be9a9e114ccb9fa4a
Instruction ID: e4ef4a593468d30cb52e60a927fe6ca022622586635c352b5fe9f9fef66ea299
Opcode Fuzzy Hash: a48bb94ef2018d1a9b863c370e6057dce23b83b97798389be9a9e114ccb9fa4a
Instruction Fuzzy Hash: F911DB30250615CFD795EF38D484B95B7E2FF45604F0548AAE19ACB361DB70AD49CB90

Function 06A3B218 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8747812fa5952c2d9f33989069eafeffa5a7bb3cb6408e058d6852a1812f5a4b
Instruction ID: 876b4fdaadb24c00900e97f4e9efdf2859701d3762735f4c636ab0b78971f2c1
Opcode Fuzzy Hash: 8747812fa5952c2d9f33989069eafeffa5a7bb3cb6408e058d6852a1812f5a4b
Instruction Fuzzy Hash: B311D730250615CFD794EF38D984BA6B7E5FB45304F0189AAE19ACB325DB70B849CB80

Function 06A82608 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810547439.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9443a3c62634841e854fa67112d548a341e896aeb6e06f950b4101e540cfde1e
Instruction ID: 08eedc05c0e7f68bf2287f30c2b1102c1cffe193584bdbea24dc7e4818156c36
Opcode Fuzzy Hash: 9443a3c62634841e854fa67112d548a341e896aeb6e06f950b4101e540cfde1e
Instruction Fuzzy Hash: 66018C30E002098FDB84FF68D8117AEBBB1EF49340F108529E825BB390DB74A645CBD0

Function 06A8D7C8 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810547439.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 207d5fabfa939000d5b28bbc21acf08552d167445f3be9b96561ff6969a9e534
Instruction ID: 5b8452cf371b2406a8cb32ac589269b4cd3e05668552d33af08f4e9e7aa9976c
Opcode Fuzzy Hash: 207d5fabfa939000d5b28bbc21acf08552d167445f3be9b96561ff6969a9e534
Instruction Fuzzy Hash: 4B111E74D04249EFCB50EFA8C9449AEBFF5BF49310F14809AE954E7381D7349A50DBA1

Function 06A399A0 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 429ddb0b317c355e40584169f958ba628cccf2281e492ff393bddfca16f027c6
Instruction ID: 17385bda43d27c46895033a353fa6e7cb592259dc4faf92d6ee4725f91f8f2d0
Opcode Fuzzy Hash: 429ddb0b317c355e40584169f958ba628cccf2281e492ff393bddfca16f027c6
Instruction Fuzzy Hash: ACF04431F102304FDB546A7AD458A2BFBD9AF85755B05407AF845DF3A1E9A5CC408790

Function 06A31FC0 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c5b0e3d1a365c6aeeda06483bea3865c3a4c3b94e24f1e9d0674e2854c48f58
Instruction ID: 93744f2ecd17ad87478ae8d416a4acecae42a2450e8373885a7087ec31a255b3
Opcode Fuzzy Hash: 0c5b0e3d1a365c6aeeda06483bea3865c3a4c3b94e24f1e9d0674e2854c48f58
Instruction Fuzzy Hash: 6801F435A046049FCB00FBA4C8448EEF7B9EFC9310F00825AE91567351EB706A41CBE1

Function 06A362C8 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93cdb3a3a0b54734f7e768e828e7fcdf7b43c46f1eb0b95cf865d3d5620b408b
Instruction ID: eb74b3e647565cc27ffd908917ab1976e950d602d0e6762dba161bc5670bf463
Opcode Fuzzy Hash: 93cdb3a3a0b54734f7e768e828e7fcdf7b43c46f1eb0b95cf865d3d5620b408b
Instruction Fuzzy Hash: 8FF069347006209FDB98BF2AD06096EBBE6AFC42107159069F94ACB324DF31EC028790

Function 06A83670 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810547439.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eeeffa8e133f7d5e69e0f531bb2f164f4e6af82eef53b77c0bfda0d716ac341c
Instruction ID: fb741bd7553ca9cfbc9b0a298d5ad8c8a6a973c8f22c8ec6c853cd46c507000c
Opcode Fuzzy Hash: eeeffa8e133f7d5e69e0f531bb2f164f4e6af82eef53b77c0bfda0d716ac341c
Instruction Fuzzy Hash: C1F02831A046558FCF05BBA888100DEB775AF8A300B0181A6D541BB251EF305A15C7E1

Function 06A84649 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810547439.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a21cc945c3da505009631904b41486529a47ad38e52ffd8d6cc9e130e6932358
Instruction ID: 335a182a7ed3dcb57c8cf776e621441f576a755db0a5185a47b6046fde0af4e5
Opcode Fuzzy Hash: a21cc945c3da505009631904b41486529a47ad38e52ffd8d6cc9e130e6932358
Instruction Fuzzy Hash: 24F0963A3002006FC360BF69E844E977F9AEBD6761F15803AF6458B651CA31C946C7B0

Function 06A8AE52 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810547439.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9536de60c139b3bffa6bc2adce7a14391ddde436b9bc18ef2c62ffe7f9c37d49
Instruction ID: 9e8c955af445baaec003f2c4b3b513a8e657b60c46f8a0c8d762d75c8e4b679d
Opcode Fuzzy Hash: 9536de60c139b3bffa6bc2adce7a14391ddde436b9bc18ef2c62ffe7f9c37d49
Instruction Fuzzy Hash: 8B019E74E05218DFDB44EFA8C984BADBBF6BF49301F14942AE91AAB394D7709801CB40

Function 06A8BD90 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810547439.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aca877550fc371860b88cf8e99bcb34b27c161c72b107129b5ba093f4ec5f012
Instruction ID: 7a7eb819f416ebc77c7ddc2f90a55842b8c23ebffbf7fc2bf66a7c8fadda2a77
Opcode Fuzzy Hash: aca877550fc371860b88cf8e99bcb34b27c161c72b107129b5ba093f4ec5f012
Instruction Fuzzy Hash: 2801D334A15119CFEB94FB89D8C8DEDF7B6BB88220F54A182D406A7255C230AD81CEB4

Function 06A31568 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a308d81bf9de2bae09b9f87ea5d62392a3e21ef2e264f3cc0d1e15af32c7a5d
Instruction ID: f54bd902ec8c2ebfd93c6bc43ff3b0c710716a6b40ee4d42d9b1d90ed884b931
Opcode Fuzzy Hash: 7a308d81bf9de2bae09b9f87ea5d62392a3e21ef2e264f3cc0d1e15af32c7a5d
Instruction Fuzzy Hash: FCF0A4311463A08FD313BB3CC554AD6BFA5EF86310F0908EAD0968F266CA65A985C7E1

Function 06A3321F Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c0e8f247a897c3c43fd044e879b696190a28755b25369a7901ae185006bc683
Instruction ID: 37a89040b3016f4f1451edd99a8957f4ba8f923ad7809874d3ffde1f99c61b25
Opcode Fuzzy Hash: 5c0e8f247a897c3c43fd044e879b696190a28755b25369a7901ae185006bc683
Instruction Fuzzy Hash: 6BF09071608114BF8F48DB98EC41CEB7FEAAB4535070582AAF004DB221E6319A518BA0

Function 06A3BAE8 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65de34347a267b3e990e516bd2b515046350fd8003bd5cc8d120c15c0c092ba9
Instruction ID: 84c2e51035de60cbcb634a20896ce75f61954222bcd6186c29b99ff195550acd
Opcode Fuzzy Hash: 65de34347a267b3e990e516bd2b515046350fd8003bd5cc8d120c15c0c092ba9
Instruction Fuzzy Hash: F001863291061A9FCF10AF65DC448D9FB76FFD5304F118729E1056B210EB70A599CB90

Function 06A30BC0 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebb3a82020dbdeb1e072627d1b424ca65ce5f07aaf27ffa3aad7a70801244fcd
Instruction ID: 93bc90bdbbd5a96353c871e822bdbd51596e9ba4069e0066f40a50f3d7d35b79
Opcode Fuzzy Hash: ebb3a82020dbdeb1e072627d1b424ca65ce5f07aaf27ffa3aad7a70801244fcd
Instruction Fuzzy Hash: 670167B5D0061DAF8B41EFA8C9409EEBBF5EF48210F10855AE858A7310E7709A508BA1

Function 06A3CB6B Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0bfc388ad9e7f24548b5c7e253d5a2da5a0bba54789e0d0c5a5aef4db32b245
Instruction ID: 6205107d5c15a4b8b4c3b959a42e4027495e44ba11d304f0118fe92ff0c132d7
Opcode Fuzzy Hash: f0bfc388ad9e7f24548b5c7e253d5a2da5a0bba54789e0d0c5a5aef4db32b245
Instruction Fuzzy Hash: 230128329007548BC711AFACE414585BBB9EFD2325B01827FE48AAB201EB35A854CBE0

Function 06A83680 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810547439.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 195384899ab2b71f3aea029d95175fb320528bd52dd7a742ed56c75cb438a02e
Instruction ID: 776014a74777a558114241b61d069fc576e24b54d0fef0431dcb631eb0f23169
Opcode Fuzzy Hash: 195384899ab2b71f3aea029d95175fb320528bd52dd7a742ed56c75cb438a02e
Instruction Fuzzy Hash: 72018131A1462E8BCF04BBA8DC144EEB7B5FF88211F008629D91677250FF346A19CBE1

Function 06A8CA10 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810547439.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5243c09c7cfe192641f824224e55f043dfb61dda6f8ee78d3813bee5f32a5807
Instruction ID: 97c21f18b1966713f23e21e643d28fac614d1e9c5b5d8b8042d4b1a534142ef2
Opcode Fuzzy Hash: 5243c09c7cfe192641f824224e55f043dfb61dda6f8ee78d3813bee5f32a5807
Instruction Fuzzy Hash: F0F04970D49208DFD744FFA9D5409B8FBBAAF49320F00E1A5E50A5B212E7309E45DFA0

Function 06A36481 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8a9fc74cf026bdd299127929689b656dc9a223b1d28d383253f7c288d17eed3
Instruction ID: f6020bb8b350b686d9641ff299c3200704f51841d8172f3f26a64616499c18c7
Opcode Fuzzy Hash: b8a9fc74cf026bdd299127929689b656dc9a223b1d28d383253f7c288d17eed3
Instruction Fuzzy Hash: B2F0B431B002145FCBA8BB75ED556AE77AADFC1315F10882DD0199B382DE39A806CBD0

Function 06A3F890 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40cf8a5be3d2bd74e185c0dbecc520de28a6c41fa095494cfc31e7a726192eb0
Instruction ID: fc3a6e07ba8ce1ba570b365ab44078d8583aa830f795c5d784d936e1266808c0
Opcode Fuzzy Hash: 40cf8a5be3d2bd74e185c0dbecc520de28a6c41fa095494cfc31e7a726192eb0
Instruction Fuzzy Hash: D2F096357002049FC365AF59E848F5A7BA9EBD5761F00803AF65A8B280CA35CC15CBA0

Function 06A369B0 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54a8b7507c6a6bff49a8195969574a465f1ac563d650b0986ed8325da340b488
Instruction ID: 625b5e6da3a9f0a29843e142da1b5f9438f5eac028e11002639d293acc002d1c
Opcode Fuzzy Hash: 54a8b7507c6a6bff49a8195969574a465f1ac563d650b0986ed8325da340b488
Instruction Fuzzy Hash: 4DF0273424BB505FD311AB788960FE77BAB9BC6351F0404FAE444CB291CA32AD40C7E0

Function 06A8D7D8 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810547439.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f07f76dc133fb747679fc02faafd36c6fbde5beb274f782d309eef00816b2b9d
Instruction ID: 6280d1e85417ff725d183b3f21b031b20f2683f8dccf1cc820bb026a1c387f91
Opcode Fuzzy Hash: f07f76dc133fb747679fc02faafd36c6fbde5beb274f782d309eef00816b2b9d
Instruction Fuzzy Hash: 8F01C874D002499FCB90EFA9C585AAEFFF5BF48311F108196E954E7381D7349A40DBA1

Function 06A8E0FD Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810547439.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98c15df0df0cc4b8ea3747b1d9de1289883bfa31e0d61f15ae9e4d26574d8cc7
Instruction ID: 79b4dd3c4994e6148143ea866c8a2742327c92e6bf47d5981782efd4bb9e22ea
Opcode Fuzzy Hash: 98c15df0df0cc4b8ea3747b1d9de1289883bfa31e0d61f15ae9e4d26574d8cc7
Instruction Fuzzy Hash: 0F014C78A49309DFCB85FFA5E9944ACBBB7FB55300B204229E50A9B315DB305C02CF51

Function 06A8BDD0 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810547439.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a6afb167d0e586bdefcfa273f91eb5fbe264c2e11c0db501c343cce5981525f
Instruction ID: f0a8e7da34e55d4ab6b1026eb2806306c58c29ca39c1dd10601b9aa49b693806
Opcode Fuzzy Hash: 5a6afb167d0e586bdefcfa273f91eb5fbe264c2e11c0db501c343cce5981525f
Instruction Fuzzy Hash: 7C115D78905228CFEB64DF64C980F9CBBB6BB49201F1095EAE90EA7351D7359E81CF11

Function 009DD744 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1805194569.00000000009DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 009DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9dd000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3868cdd79cde0fa99f08ec445d1dcbf545c17b5127cf0908f5edeebdab9bb496
Instruction ID: 0772327b06b6dca9f0a7e3b86c75eafe7909df2cac463085eb5cc0700b8636b0
Opcode Fuzzy Hash: 3868cdd79cde0fa99f08ec445d1dcbf545c17b5127cf0908f5edeebdab9bb496
Instruction Fuzzy Hash: F2F062714093449AE7108E16CC88B62FFACEB91774F18C45AED085A286C279A844CAB1

Function 06A36360 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b8847136e67c27c132187a19fc6f631a314f9f715db92f142a15989e68dc521
Instruction ID: 13fa15b9699ee40e49fb20157a23aefabd54f11bb7d6716574c17d5f332709fd
Opcode Fuzzy Hash: 4b8847136e67c27c132187a19fc6f631a314f9f715db92f142a15989e68dc521
Instruction Fuzzy Hash: 4CF02B1234AAA13BEA43766C6C645FE3F4A8B83A5474600ABF041DF1D3DA4D490343DA

Function 06A328C1 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71fee8f732c51f2dacabc7966515d6dfbf36fe53fbb06607cc961fa462a52367
Instruction ID: c858b568e485c6c11015fc22ad381ff03a8021642e0f0e5370ff0d6138d9a9d1
Opcode Fuzzy Hash: 71fee8f732c51f2dacabc7966515d6dfbf36fe53fbb06607cc961fa462a52367
Instruction Fuzzy Hash: 6BF0A7342467608FD312B67D8850FD7BBEAEFCA710F0404B9E0958B262CA66AD45C7E0

Function 06A836F0 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810547439.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f3ae00f2cfee55edd697be5d605d105f7a925c30a3162088ae6743e53837776
Instruction ID: 2eb40ebfe068ed15f3a48d6efeb48ef1c17260348e1df7abc9f405395209d3ef
Opcode Fuzzy Hash: 5f3ae00f2cfee55edd697be5d605d105f7a925c30a3162088ae6743e53837776
Instruction Fuzzy Hash: 5DF0B435A043409FC724BB29998089ABF6AFFC6710704017FD5098B250EF21D805C2A1

Function 06A36490 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b10a3dd27247c9276f8573d8d4551cbc4ae58847524752f552f64b8d8b394871
Instruction ID: 7d880fe94eeabec8d479807bc0ce7e405d876d3b2415ece0442918223a7b1b75
Opcode Fuzzy Hash: b10a3dd27247c9276f8573d8d4551cbc4ae58847524752f552f64b8d8b394871
Instruction Fuzzy Hash: DDF08231B002145FCB98BB75E92066E77EADBC1315F10882DD05587341DE38A8068B90

Function 06A33A98 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3505eca4c4f47b9eedf08a55dd57748ed5990ae66817bbcd38af05ed2cdebad6
Instruction ID: 21752406917e1900c0fd1dc8934cc0f688f2c9c15b7af9a0b465a37a38a257e9
Opcode Fuzzy Hash: 3505eca4c4f47b9eedf08a55dd57748ed5990ae66817bbcd38af05ed2cdebad6
Instruction Fuzzy Hash: 9DF0AF74D09296AEDB10DFA88981A9FBFF4AF4A314F048589E510DB252C7758504CBE0

Function 06A3D2D8 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 275b882d827262033a336180e3fbf0fd63cdec2bdf8a51b7157cb95127c8b656
Instruction ID: 8d15fd553fdb955f338b490ab2cdc55f4dea6178ae641877dd72bd3c9934b143
Opcode Fuzzy Hash: 275b882d827262033a336180e3fbf0fd63cdec2bdf8a51b7157cb95127c8b656
Instruction Fuzzy Hash: 76F07A72210119BF9F025F85EC84CAF7F6EEBC8365B104015FA0592521CB768C61EBE1

Function 06A3740E Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b130a9e924a9e7afeff45e442a6a620b90e2d5bc214cd616e7796ad62a59be7f
Instruction ID: 9628060e5521c79f86256baf884f8220fb15fe7072991f41fa48e98095dff611
Opcode Fuzzy Hash: b130a9e924a9e7afeff45e442a6a620b90e2d5bc214cd616e7796ad62a59be7f
Instruction Fuzzy Hash: 37F027708453599FEB42BB74CD127EFBB30EF02214F100692F041AB292CB78E15693A6

Function 06A8E329 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810547439.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d4d5460567eb5e16fc9a9dd204940267f0e11f397195591f796207481e16f41
Instruction ID: f432f2868048daec080ade88d08edf9b80d7bf8fe55772ad0ec8222efeaed0b9
Opcode Fuzzy Hash: 1d4d5460567eb5e16fc9a9dd204940267f0e11f397195591f796207481e16f41
Instruction Fuzzy Hash: 33F06D38A88109CFCB41FB68E5405AC7FBAFB54311B005724E1069B769DB305C07CB50

Function 06A3ADB0 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 409fe0aed514b6c0c063fc09fb0df0e498a1d81e2830d539bb488ddc154a9b64
Instruction ID: 1657faa5db0656a8031bb7303b7ee9cf1e83de8734ef7bbd9e01b6d58a0a6ace
Opcode Fuzzy Hash: 409fe0aed514b6c0c063fc09fb0df0e498a1d81e2830d539bb488ddc154a9b64
Instruction Fuzzy Hash: 51E092745023606FC703BB2C9894BEA7B9AAB83221B000162F4409F756CB29595087E1

Function 06A33AA8 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eec31a74d70556a1fc5713d852344c27bced08c1b7a22fae53e30f9d464c159d
Instruction ID: ebe35348cde28cf8c4bdda8451167c22d6900bd68c7942e5b3ca33ab2694d864
Opcode Fuzzy Hash: eec31a74d70556a1fc5713d852344c27bced08c1b7a22fae53e30f9d464c159d
Instruction Fuzzy Hash: F1F0DAB0E4421A9FDB84EFA9D841AAEBBF4FB48300F1085A9E919E7201D7749544CBD1

Function 06A38B08 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ac6733637b14fe109cc10d295e087c1fb39d76b4d1ad8157bcd17ac8230fe6d
Instruction ID: b79a74bd698645c66d606ebe5fe8cd61aa4796b54898a1c87fdfc8ddbe08cf9f
Opcode Fuzzy Hash: 3ac6733637b14fe109cc10d295e087c1fb39d76b4d1ad8157bcd17ac8230fe6d
Instruction Fuzzy Hash: DDF0A0302093658FC315AB399554426BBA5EA873013558CBAF05A8F266CA35EC84C751

Function 06A32920 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 495e374e4ae03e8a194dab80cca883442fa5533b22101c70befff1a1363a93d1
Instruction ID: f9c2f71690c9503744f68fb191f94c52b17a5630552ec1d18015a656b9908c5b
Opcode Fuzzy Hash: 495e374e4ae03e8a194dab80cca883442fa5533b22101c70befff1a1363a93d1
Instruction Fuzzy Hash: EBE0DF2030EBA81FC306626E18652D3BFCB8B47610F09029BE499C7213CA0A184482A6

Function 06A31668 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99895a0cbeeb4a29f9b1b4ad0514478822fa90d9aed3f8923375afdcde563568
Instruction ID: 27cc16fd4528ec9f41a06ff1a80d2f9ef7f37e5896dff7b408be7db182c674b9
Opcode Fuzzy Hash: 99895a0cbeeb4a29f9b1b4ad0514478822fa90d9aed3f8923375afdcde563568
Instruction Fuzzy Hash: 25E0683074D3704ECB6033E904A03A6FFCB9F46320F09005AF28E87212CA45084101DB

Function 06A315A4 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59b66d0f8b87bb867ecedbaf996c266b565fc586f09189f5f65c834dfec514d3
Instruction ID: 263ba6245a876b5bdf6860afe0e0f4e490b663f336c2f36472cf6cef0afb8cfb
Opcode Fuzzy Hash: 59b66d0f8b87bb867ecedbaf996c266b565fc586f09189f5f65c834dfec514d3
Instruction Fuzzy Hash: 73E09B352862209BD314BB7DC550BE7B796DBC4311F0008B9E45987384CD76E845C7D0

Function 06A31584 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db5299709c9e20816b7b6d48ed87a9eec8c98f3ff8e293733d3cf415b97ae37c
Instruction ID: 4a1124da7e1d23bd92dd05debc3290a1dc59f618e0b3c3ea2e39c8a386196af2
Opcode Fuzzy Hash: db5299709c9e20816b7b6d48ed87a9eec8c98f3ff8e293733d3cf415b97ae37c
Instruction Fuzzy Hash: 0FE06D35282220CBD211B67DC440BEBF6A6EBC8311F000879E05A87694CA66E985CBE0

Function 06A8A552 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810547439.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce40cc6fb9d0cbd44a8619b35a066eb68c2a1e119579e384f2350cca6c38d2f2
Instruction ID: d96cd981ffdcb87509cc603a2060ab4a4bc69fcd77d571d19008ff502da4cdc5
Opcode Fuzzy Hash: ce40cc6fb9d0cbd44a8619b35a066eb68c2a1e119579e384f2350cca6c38d2f2
Instruction Fuzzy Hash: 85F03074E4E209CFDBC4FF95CA805FDB7BAAB89200F006466D20AA6126D7701D45CB81

Function 06A34F26 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4130f674169170a51c980c38aba7de9316368e9cfed3350ac7dadfd453ab0a5b
Instruction ID: fd2086efd29ee195463335c4abfbfcbeaef8b5a21df38ac38d0c1a16207cc3a0
Opcode Fuzzy Hash: 4130f674169170a51c980c38aba7de9316368e9cfed3350ac7dadfd453ab0a5b
Instruction Fuzzy Hash: 8EE01A7A605219AFDB148F51EC48CAFBF7CFB89371B10802AF81897211C7369C02CAA0

Function 06A38F39 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c2f4a7421403487de7288fb8f6e892ae2bc82324b4ed73ad0604611e79edbeb
Instruction ID: cfd1675d261b5b7be4eb65a15f8739d7da5e42b0a1baf9bbe1c71c5faaa3ba40
Opcode Fuzzy Hash: 3c2f4a7421403487de7288fb8f6e892ae2bc82324b4ed73ad0604611e79edbeb
Instruction Fuzzy Hash: E1F06D3191425C9FCB90FF78E9449DD7FA4AF45211F01C56AF86C9F012E635C2A4CB81

Function 06A34F28 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49e50f888aa0022185b02be85479f6861b6d24d1697e74a8d5ac1c24122f6c9d
Instruction ID: 424f46106e33ad94aecd60574f2ab35d9b4e063adccd04944f1bc5d682350de1
Opcode Fuzzy Hash: 49e50f888aa0022185b02be85479f6861b6d24d1697e74a8d5ac1c24122f6c9d
Instruction Fuzzy Hash: 7DE01A7A505318AFDB108F56EC48CABBFBCFB89271B10802AF80493210C732AC01CAB0

Function 06A8F410 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810547439.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c14f203940d78991198a7aa51b2f4638ca7a8b67f876cfe2ad187400016b118
Instruction ID: ed2dfec1b0239e2041706ce59b9d6a03976f8cb22359e2bff9239e9cac7a71bd
Opcode Fuzzy Hash: 4c14f203940d78991198a7aa51b2f4638ca7a8b67f876cfe2ad187400016b118
Instruction Fuzzy Hash: 5CF03974E0120CEFCB44EFA9D54468DBBB1EB88301F00C0AAE918A7390D6345A51DF41

Function 06A8C49E Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810547439.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0b6c915180a6208e6a915c65e327d963719e3ae78bbff3d421d448e19e1d17c
Instruction ID: 9b4eaaf8c95dc78295b15308ececf546c596c59aa5eccb91b5293472905aa8fb
Opcode Fuzzy Hash: d0b6c915180a6208e6a915c65e327d963719e3ae78bbff3d421d448e19e1d17c
Instruction Fuzzy Hash: ACF0F234905115CFEB60FB48C888EA9B7B6BB89310F01D2C1E90A6B256C630AD81CEA0

Function 06A88187 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810547439.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9888c7859e4c8f10fb8dbab314588813df0070aa64c2cd3c3028fdef455cc7dd
Instruction ID: 8c2107760ba8735f06178e6bbe3ce334837e8662970fd10951d540852c551d45
Opcode Fuzzy Hash: 9888c7859e4c8f10fb8dbab314588813df0070aa64c2cd3c3028fdef455cc7dd
Instruction Fuzzy Hash: 01E09270D40605EECB50EFB8C684A8BBFF2BB09314F24C19AD0319A652DB3461428B91

Function 06A8DFA9 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810547439.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7547690bc029ae13b48d261a7288febbc908bb87aa25652fb1e7ad120374c87
Instruction ID: 02793c1dd7b558737a76b7eff2b261161824af6086a5f040c823d8e0323a822a
Opcode Fuzzy Hash: f7547690bc029ae13b48d261a7288febbc908bb87aa25652fb1e7ad120374c87
Instruction Fuzzy Hash: E9F01534905201CFC740FF28E488959BFF6FB2A305B059099E409AB722C7309C82CF11

Function 06A3160C Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b55d6cacc86bac5d5eb5be77595943931d8c705d28884628d7fa025b0551d76
Instruction ID: d5f20e7fcc179a12f62b88b948167948b8f2fb02bb4a64261c1c600d5060f041
Opcode Fuzzy Hash: 9b55d6cacc86bac5d5eb5be77595943931d8c705d28884628d7fa025b0551d76
Instruction Fuzzy Hash: 8CD02B313497301FC654227D18943A7FECFDB85324F04045AF29EC3311C949580442EA

Function 06A3E669 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6067a6d253ad5dcddcada4258263803216df4d9c82c882b5c21b03b4297f5567
Instruction ID: a58802635bba09e03eb32603b088e89afa481cdff4c5eefddeaaeb006c76e6c3
Opcode Fuzzy Hash: 6067a6d253ad5dcddcada4258263803216df4d9c82c882b5c21b03b4297f5567
Instruction Fuzzy Hash: 71E01A3192575C9ECB91FF7899481997FA4AB52211F01C16BE5889F051F730C6A8CB82

Function 06A39560 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8982a67484354a72a34d9e4acb5b5f32649b6b5716011fc480bec231c3524420
Instruction ID: 5bda6a2e29e66db2501ed0b193f44f8fd1f8c53b297b6cf1ef32c0c57c9fc2e5
Opcode Fuzzy Hash: 8982a67484354a72a34d9e4acb5b5f32649b6b5716011fc480bec231c3524420
Instruction Fuzzy Hash: 29E012325055A5AFCB429F949D808C3BF79EF4B70430A8087F1088F426D6269626D7E1

Function 06A8A55D Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810547439.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 662817210d09565eedf6a6cca4e8f65cd2268f5cbe67507eeb9c891a2f11ae74
Instruction ID: 8a8e576d19d2da4ee2603ce3291b3041797a204c352fde1f1b99e70ac7ba8974
Opcode Fuzzy Hash: 662817210d09565eedf6a6cca4e8f65cd2268f5cbe67507eeb9c891a2f11ae74
Instruction Fuzzy Hash: C4E08674E4A2098FCBD0FF54CAD06BCB7BAAB49200F0054A6D30AD6139DA702D89CF81

Function 06A8A9A4 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810547439.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed8098a263aaa555dc04f192f4afc01522349b99b8fa01799a36f8913285ef9c
Instruction ID: 73dbd988e5bf30c085a502bc81c2bf1a6296429e06937dc22fa4dcbacba38ef7
Opcode Fuzzy Hash: ed8098a263aaa555dc04f192f4afc01522349b99b8fa01799a36f8913285ef9c
Instruction Fuzzy Hash: 70E04F7494A6088FDBD0BF54CAC86A8B77AAB15300F1051B692099912AEA705D88CF81

Function 06A88281 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810547439.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a52fb0805fcac544fa9fe26e65e204f914069fd6fb623b61738742706cf8ef2c
Instruction ID: a3e4cfc8d8ae9b9413f9f354467cd5ddcc2d9636ffc7bf104979aa7fd0b2aecd
Opcode Fuzzy Hash: a52fb0805fcac544fa9fe26e65e204f914069fd6fb623b61738742706cf8ef2c
Instruction Fuzzy Hash: 42E02B5050D659CFDFA137B049141587FB1FF86000FB440E5C091CA5A1FD1E8443C713

Function 06A8A399 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810547439.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 085cab789f3a8ead84a4696d5eea35ed20bf88d6fd8bf097e151d35b2182d5bf
Instruction ID: 7f663920a7ce97ce2adc22b6669b00e4041383f4744907c0d6bd3b078b4ab90f
Opcode Fuzzy Hash: 085cab789f3a8ead84a4696d5eea35ed20bf88d6fd8bf097e151d35b2182d5bf
Instruction Fuzzy Hash: 28D05E2040E788AFC3227764AD496957F2A6B03215F090096F289860A3CB640941C772

Function 06A88198 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810547439.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8711753ae46836fd08587a36098f0be6e5a6e25a30e60d2891f3bde98c5ac669
Instruction ID: cb4c842f5208ffa7809d6ea3da62e76f19534cfa188728420d8e4d47e3e0e5a7
Opcode Fuzzy Hash: 8711753ae46836fd08587a36098f0be6e5a6e25a30e60d2891f3bde98c5ac669
Instruction Fuzzy Hash: 94E092B0D40209AFD780EFA9C905A5EBBF1BB08600F5185A9D429E7211EB7896058F91

Function 06A3E678 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f029021a89a6d5fc44f3feaaa513b046b59978003e2cb2db21555de97171981
Instruction ID: ec00bdc531c8b4ce53d342b379787604fe31f6c3d5e89100647d882392005db8
Opcode Fuzzy Hash: 7f029021a89a6d5fc44f3feaaa513b046b59978003e2cb2db21555de97171981
Instruction Fuzzy Hash: 05E0E23182061CAE8B90FF78D90449E7BE8AB55211F41C62AE9489A100EB70D2A8DB81

Function 06A38F48 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f029021a89a6d5fc44f3feaaa513b046b59978003e2cb2db21555de97171981
Instruction ID: 0db04d77a21ac3d5132f48f673b4be3fb94d62f9a255efa2cd4bebb5a1e688ff
Opcode Fuzzy Hash: 7f029021a89a6d5fc44f3feaaa513b046b59978003e2cb2db21555de97171981
Instruction Fuzzy Hash: 25E0E23182061C9E8B80FF79DA0449A7BE8AF55211F40C62AF85C9E100EA34D2A8CB81

Function 06A3743B Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e44cc03e8e7767cfc6b0e23a4576b1cbb5507fd1e553ccef409653b685252575
Instruction ID: caba6ffc64236fbc87c321a6b0008f63b087ea9d102d6c067d3a02339342d2ad
Opcode Fuzzy Hash: e44cc03e8e7767cfc6b0e23a4576b1cbb5507fd1e553ccef409653b685252575
Instruction Fuzzy Hash: B6E01730149385AFC306DF24D804C96BF7AEF07220B0980D6F9888F263C2319A15CBA1

Function 06A36388 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc25d942ebf5d98be9cef474495b2b785c2737a503050c754d1c93047278865b
Instruction ID: c0218cab60fdf61555cabd6cc598824884cb49bb31043c2c9aae180e7fd41fbb
Opcode Fuzzy Hash: cc25d942ebf5d98be9cef474495b2b785c2737a503050c754d1c93047278865b
Instruction Fuzzy Hash: 09C01222711934235CD93298AD3017C718D8FC19A4706042DE0194B282DE4D6D1302DE

Function 06A3F199 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65797db26477521b14ec95503dd7137b0561d99ffecf205dc56f1607da3f60bd
Instruction ID: ac292d7d714bbdf366ddcc2a8096ca3b6f6f7b929a044de405b3828e089fa89e
Opcode Fuzzy Hash: 65797db26477521b14ec95503dd7137b0561d99ffecf205dc56f1607da3f60bd
Instruction Fuzzy Hash: EAE04F706092858BE319DB2C9008340BEA17B65308F0841EEA545CB783E776D4C88BA5

Function 06A8AA22 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810547439.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64eed3828aa82ca8294711aaa348e60441c5108ba1235abb6c15233dc2b35005
Instruction ID: a6d6e316ef9f1b3cc75687d99b4e69d96d650a3a5bc2cd19a9cd26b27a4611b1
Opcode Fuzzy Hash: 64eed3828aa82ca8294711aaa348e60441c5108ba1235abb6c15233dc2b35005
Instruction Fuzzy Hash: E4E0127894A319CFCBD4BB04CA406B4FB79BB55200F105597920AD6135DB309989CF81

Function 06A38F00 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94e69299cb8c832c83708d379ecfb29f9b7492c8c926acbc278d2828091aaaca
Instruction ID: 5c0c234c61716e9246948e8082d527ff4242f1b8ac8591ddf73a33d89956eb78
Opcode Fuzzy Hash: 94e69299cb8c832c83708d379ecfb29f9b7492c8c926acbc278d2828091aaaca
Instruction Fuzzy Hash: 31E0C2300059808FC300EF3CD885AD47F70FF85308F0501DBE0049B226E631E5208B40

Function 06A8E433 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810547439.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a4bc833d029db807b1d6a448f4d666d7cab687076715ead5bc1b9523bb93029
Instruction ID: 4c326531a053444ff594da52a9e3de8529f64b732fbfa3a1f2f984f868e9d251
Opcode Fuzzy Hash: 1a4bc833d029db807b1d6a448f4d666d7cab687076715ead5bc1b9523bb93029
Instruction Fuzzy Hash: 81E0B634D48149CFCB40EFD5C994A9DBBB6FB48310F208215E916AA79DEB345D46CB50

Function 06A3E6DC Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0cdbe8a0ab1ffc9779b430f6907e9436ca11aef9864ca82884bfe2c303604f6c
Instruction ID: 6b38a4f06fa7fb0571644718b14090442ac7f7f2c0bcf7f4e8e178a85c7ac812
Opcode Fuzzy Hash: 0cdbe8a0ab1ffc9779b430f6907e9436ca11aef9864ca82884bfe2c303604f6c
Instruction Fuzzy Hash: 6FD0A737E0401547CB005A48F4440ACF760FBD0325F084167EA849B145DE31085ACB91

Function 06A83EC6 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810547439.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52390bc6d1fce174f356d676951d42916d13804e84393658cc3d76856054d323
Instruction ID: 4c0c1ab9a3fa7b234034bbc4c8071a9539a949d9db817f99c9fd4d37b3a5fe49
Opcode Fuzzy Hash: 52390bc6d1fce174f356d676951d42916d13804e84393658cc3d76856054d323
Instruction Fuzzy Hash: A7D0A733F1401546CB40B688A8401ACF354EBD5220F094157C5946B101DE3108559791

Function 06A33B48 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ae2beacaaa1a6ad153cf33c417fbb2efaaaf246a5e4f13495f1a9a73cba26b9
Instruction ID: 97c79c40c8096a69dd43fa8094b17aa5592a4046ec17f6a0063c07f44757420e
Opcode Fuzzy Hash: 9ae2beacaaa1a6ad153cf33c417fbb2efaaaf246a5e4f13495f1a9a73cba26b9
Instruction Fuzzy Hash: 96D0C9322541089A5B81EE95E840C9277DCAB147007008822F5088B121E621E424D751

Function 06A86E59 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810547439.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d10dfa88c368cb389f71f8f7837bbdd9ab3485f74cc4a62033669b7d67d9c55c
Instruction ID: c08d43ab816bd4493584dd03a6e26163e1a42fe0301a7647aec8f36557bf5d87
Opcode Fuzzy Hash: d10dfa88c368cb389f71f8f7837bbdd9ab3485f74cc4a62033669b7d67d9c55c
Instruction Fuzzy Hash: 5EC08C8800F7C06AD34316344D128C37F64292332471F00E3B180C9063C0C489AAC273

Function 06A39570 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ec9bb768004d6be45f44297ee74bbe7234a646e2b0b6123090173f9cb0430a4
Instruction ID: 80c3164581103e675f824e02694b171b8471bc469bd54ac25b7932004daeb8e1
Opcode Fuzzy Hash: 3ec9bb768004d6be45f44297ee74bbe7234a646e2b0b6123090173f9cb0430a4
Instruction Fuzzy Hash: 2AC01232100128BB4A41AB85D900C86FFADAF49654305C056F5088B121D622E51697D5

Function 06A881A7 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810547439.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 388a2f79cbc7fdbb48eca37645ed135f916d0f1c20338b341d615a8702ef4e0a
Instruction ID: befd6630b11a7b46dc69d5389559946c1e271ee40b72cd2f76ad7cd0db23ffff
Opcode Fuzzy Hash: 388a2f79cbc7fdbb48eca37645ed135f916d0f1c20338b341d615a8702ef4e0a
Instruction Fuzzy Hash: 00D09275A40109EFE780EF65C549A5ABBB2AB08614F21C595D029DB221CB789A448F50

Function 06A38F10 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dded85fcbc4cbf5676b8ed9ac8af2cd94c6a6ae7e7d408959106d102a508a686
Instruction ID: 762ba8a6405d2c9742e43e46d42fd4f93853e72184b53743b2a7541979ea5f34
Opcode Fuzzy Hash: dded85fcbc4cbf5676b8ed9ac8af2cd94c6a6ae7e7d408959106d102a508a686
Instruction Fuzzy Hash: A3D0C931514A048FC300EB6CD945864BBB8EF45604B450195E505AB221EB21F8548A41

Function 06A8A3A8 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810547439.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 943017828e7d583aef156aaf3c2f86c921ecf3a12a3bf66e71c532fff7791b07
Instruction ID: 9769c81caaba91bfd70c11d6b76f97263551c8b9459a2a24d64e26977b7a263c
Opcode Fuzzy Hash: 943017828e7d583aef156aaf3c2f86c921ecf3a12a3bf66e71c532fff7791b07
Instruction Fuzzy Hash: 97C02B31406604CFC3107BD4F44C328B76A9B0030AF004010F30C404A1CFB04C02C661

Function 06A8AA7F Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810547439.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 733d36beb25a89733985f175703255e545d20aceb09c935008b2de903874822c
Instruction ID: 2d80f6df2c03301687a1724e3650d4f74ca12dee9c6ec9e6baa2a48494989cac
Opcode Fuzzy Hash: 733d36beb25a89733985f175703255e545d20aceb09c935008b2de903874822c
Instruction Fuzzy Hash: 08D0C97590A3588FCB91EB14DA907A8BF7AAF55300F0041D2D2499723ADB701E89CF81

Function 06A37448 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810360286.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d6f2623337c38ef8749255ff78b3cbedb78fba73e040c9434c39499d8169e63
Instruction ID: 61412fa5721fa0801f19765b42d0f6ac58f054d2697597a3f249e516f761f0d5
Opcode Fuzzy Hash: 1d6f2623337c38ef8749255ff78b3cbedb78fba73e040c9434c39499d8169e63
Instruction Fuzzy Hash: 87C00235140108AFC740DF55D445D95BBA9EB59660B1180A1F9484B722C632E9119A90

Function 06A8565C Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810547439.0000000006A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a80000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 264c2946086805df0937155d7ea3d99215146d2bfa7890bc759f1c8ba9ad8b9f
Instruction ID: b5c5c7b719bc77ac61fe25bc7ef0405b117df75c5cd0e0ae22c07ae311f1ef26
Opcode Fuzzy Hash: 264c2946086805df0937155d7ea3d99215146d2bfa7890bc759f1c8ba9ad8b9f
Instruction Fuzzy Hash: 5FB0123A1D5300A9B9807364CE4292BE490FBB6B40F04AC213317900149470C874D6AB

Non-executed Functions

Function 06EF60A0 Relevance: .4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811019110.0000000006EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ef0000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f78c231a0e6a58427ac39aff30ab24e51d67c006aa90ff9dde1ef548712c6dca
Instruction ID: 7378c7381eba121c47a18c2bcfe0c9b2646909efc83d4e298323a63b2e6b72e2
Opcode Fuzzy Hash: f78c231a0e6a58427ac39aff30ab24e51d67c006aa90ff9dde1ef548712c6dca
Instruction Fuzzy Hash: ECD1FD71B007048FDB55EB79C920BAEBBFAAF89305F10446DD249DB292DB35E906CB11

Function 06EF0C80 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811019110.0000000006EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ef0000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db34c50ba2f68395fe09e09975003357875dba7fdb2f8efae588adce3cb8eea0
Instruction ID: 3194701ef630c79387c6d93235fb496d1dea21d75751c619c162df5f121c2754
Opcode Fuzzy Hash: db34c50ba2f68395fe09e09975003357875dba7fdb2f8efae588adce3cb8eea0
Instruction Fuzzy Hash: 75E12A74E102198FCB54DFA9C5909AEFBF2BF88304F249169E514AB356D731AD42CFA0

Function 06EF0848 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811019110.0000000006EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ef0000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5885e3501409ffbae365a13f0395698beb4ae97cf9c93b019d4003b8b50af8eb
Instruction ID: 5840582688c1a5f0d3fa2496d5626282bee090b8b395e15a37cd019f762ed1aa
Opcode Fuzzy Hash: 5885e3501409ffbae365a13f0395698beb4ae97cf9c93b019d4003b8b50af8eb
Instruction Fuzzy Hash: FAE10A74E112198FDB14DFA9C5909AEFBF2BF88304F249169D514AB35AD730AD41CFA0

Function 00A5F044 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1805354704.0000000000A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34fa9cc85eff4e5c55013e3d9cdb246b7627a20936b8c60c1010c41b43e383a9
Instruction ID: 422c9841199b687da6fb75be1fdb838ced4e9b1b8667d543823d6a0fbe5a029a
Opcode Fuzzy Hash: 34fa9cc85eff4e5c55013e3d9cdb246b7627a20936b8c60c1010c41b43e383a9
Instruction Fuzzy Hash: 79A17F36E00205CFCF05DFB4C99459EB7B6FF88301B15857AE905AB266EB31E959CB80

Function 06EF0C70 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811019110.0000000006EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ef0000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47902ec32bcf1d9fb75c31cf0ea321e035808f9dec03df874abb09d80377ff81
Instruction ID: 25b035f609dd3107769e43ffb357d40072bbda3f592de746075c5457b3251f51
Opcode Fuzzy Hash: 47902ec32bcf1d9fb75c31cf0ea321e035808f9dec03df874abb09d80377ff81
Instruction Fuzzy Hash: E0512C74E102198FDB14CFA9C5805AEFBF2BF89304F24916AD518AB316D7319942CFA1

Analysis Process: ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exePID: 7448, Parent PID: 7300COMMON

Execution Graph

Execution Coverage:	2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.2%
Total number of Nodes:	742
Total number of Limit Nodes:	17

Executed Functions

Function 0041CBE1 Relevance: 148.9, APIs: 52, Strings: 33, Instructions: 176
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(Psapi,GetProcessImageFileNameW,?,?,?,?,0040EA1C), ref: 0041CBF6
GetProcAddress.KERNEL32(00000000), ref: 0041CBFF
GetModuleHandleA.KERNEL32(Kernel32,GetProcessImageFileNameW,?,?,?,?,0040EA1C), ref: 0041CC16
GetProcAddress.KERNEL32(00000000), ref: 0041CC19
LoadLibraryA.KERNEL32(shcore,SetProcessDpiAwareness,?,?,?,?,0040EA1C), ref: 0041CC2B
GetProcAddress.KERNEL32(00000000), ref: 0041CC2E
LoadLibraryA.KERNEL32(user32,SetProcessDpiAwareness,?,?,?,?,0040EA1C), ref: 0041CC3F
GetProcAddress.KERNEL32(00000000), ref: 0041CC42
LoadLibraryA.KERNEL32(ntdll,NtUnmapViewOfSection,?,?,?,?,0040EA1C), ref: 0041CC54
GetProcAddress.KERNEL32(00000000), ref: 0041CC57
LoadLibraryA.KERNEL32(kernel32,GlobalMemoryStatusEx,?,?,?,?,0040EA1C), ref: 0041CC63
GetProcAddress.KERNEL32(00000000), ref: 0041CC66
GetModuleHandleA.KERNEL32(kernel32,IsWow64Process,?,?,?,?,0040EA1C), ref: 0041CC77
GetProcAddress.KERNEL32(00000000), ref: 0041CC7A
GetModuleHandleA.KERNEL32(kernel32,GetComputerNameExW,?,?,?,?,0040EA1C), ref: 0041CC8B
GetProcAddress.KERNEL32(00000000), ref: 0041CC8E
LoadLibraryA.KERNEL32(Shell32,IsUserAnAdmin,?,?,?,?,0040EA1C), ref: 0041CC9F
GetProcAddress.KERNEL32(00000000), ref: 0041CCA2
GetModuleHandleA.KERNEL32(kernel32,SetProcessDEPPolicy,?,?,?,?,0040EA1C), ref: 0041CCB3
GetProcAddress.KERNEL32(00000000), ref: 0041CCB6
GetModuleHandleA.KERNEL32(user32,EnumDisplayDevicesW,?,?,?,?,0040EA1C), ref: 0041CCC7
GetProcAddress.KERNEL32(00000000), ref: 0041CCCA
GetModuleHandleA.KERNEL32(user32,EnumDisplayMonitors,?,?,?,?,0040EA1C), ref: 0041CCDB
GetProcAddress.KERNEL32(00000000), ref: 0041CCDE
GetModuleHandleA.KERNEL32(user32,GetMonitorInfoW,?,?,?,?,0040EA1C), ref: 0041CCEF
GetProcAddress.KERNEL32(00000000), ref: 0041CCF2
GetModuleHandleA.KERNEL32(kernel32,GetSystemTimes,?,?,?,?,0040EA1C), ref: 0041CD03
GetProcAddress.KERNEL32(00000000), ref: 0041CD06
LoadLibraryA.KERNEL32(Shlwapi,0000000C,?,?,?,?,0040EA1C), ref: 0041CD14
GetProcAddress.KERNEL32(00000000), ref: 0041CD17
LoadLibraryA.KERNEL32(kernel32,GetConsoleWindow,?,?,?,?,0040EA1C), ref: 0041CD28
GetProcAddress.KERNEL32(00000000), ref: 0041CD2B
GetModuleHandleA.KERNEL32(ntdll,NtSuspendProcess,?,?,?,?,0040EA1C), ref: 0041CD38
GetProcAddress.KERNEL32(00000000), ref: 0041CD3B
GetModuleHandleA.KERNEL32(ntdll,NtResumeProcess,?,?,?,?,0040EA1C), ref: 0041CD48
GetProcAddress.KERNEL32(00000000), ref: 0041CD4B
LoadLibraryA.KERNELBASE(Iphlpapi,GetExtendedTcpTable,?,?,?,?,0040EA1C), ref: 0041CD5D
GetProcAddress.KERNEL32(00000000), ref: 0041CD60
LoadLibraryA.KERNEL32(Iphlpapi,GetExtendedUdpTable,?,?,?,?,0040EA1C), ref: 0041CD6D
GetProcAddress.KERNEL32(00000000), ref: 0041CD70
GetModuleHandleA.KERNEL32(ntdll,NtQueryInformationProcess,?,?,?,?,0040EA1C), ref: 0041CD81
GetProcAddress.KERNEL32(00000000), ref: 0041CD84
GetModuleHandleA.KERNEL32(kernel32,GetFinalPathNameByHandleW,?,?,?,?,0040EA1C), ref: 0041CD95
GetProcAddress.KERNEL32(00000000), ref: 0041CD98
LoadLibraryA.KERNELBASE(Rstrtmgr,RmStartSession,?,?,?,?,0040EA1C), ref: 0041CDAA
GetProcAddress.KERNEL32(00000000), ref: 0041CDAD
LoadLibraryA.KERNEL32(Rstrtmgr,RmRegisterResources,?,?,?,?,0040EA1C), ref: 0041CDBA
GetProcAddress.KERNEL32(00000000), ref: 0041CDBD
LoadLibraryA.KERNEL32(Rstrtmgr,RmGetList,?,?,?,?,0040EA1C), ref: 0041CDCA
GetProcAddress.KERNEL32(00000000), ref: 0041CDCD
LoadLibraryA.KERNEL32(Rstrtmgr,RmEndSession,?,?,?,?,0040EA1C), ref: 0041CDDA
GetProcAddress.KERNEL32(00000000), ref: 0041CDDD

Strings

SetProcessDEPPolicy, xrefs: 0041CCA4
kernel32, xrefs: 0041CC5E, 0041CC6D, 0041CC81, 0041CCA9, 0041CCF9, 0041CD1E, 0041CD8B
NtSuspendProcess, xrefs: 0041CD2D
RmGetList, xrefs: 0041CDBF
Kernel32, xrefs: 0041CC11
Shell32, xrefs: 0041CC95
shcore, xrefs: 0041CC26
GetMonitorInfoW, xrefs: 0041CCE0
SetProcessDpiAwareness, xrefs: 0041CC20, 0041CC25, 0041CC39
NtQueryInformationProcess, xrefs: 0041CD72
IsUserAnAdmin, xrefs: 0041CC90
EnumDisplayDevicesW, xrefs: 0041CCB8
GetConsoleWindow, xrefs: 0041CD19
Shlwapi, xrefs: 0041CD0A
user32, xrefs: 0041CC3A, 0041CCBD, 0041CCD1, 0041CCE5
RmEndSession, xrefs: 0041CDCF
GetProcessImageFileNameW, xrefs: 0041CBEB, 0041CBF0, 0041CC10
EnumDisplayMonitors, xrefs: 0041CCCC
NtResumeProcess, xrefs: 0041CD3D
GetComputerNameExW, xrefs: 0041CC7C
GetExtendedTcpTable, xrefs: 0041CD4D
Rstrtmgr, xrefs: 0041CD9F, 0041CDA9, 0041CDB4, 0041CDC4, 0041CDD4
ntdll, xrefs: 0041CC4E, 0041CC53, 0041CD32, 0041CD42, 0041CD77
GlobalMemoryStatusEx, xrefs: 0041CC59
RmStartSession, xrefs: 0041CD9A
GetExtendedUdpTable, xrefs: 0041CD62
RmRegisterResources, xrefs: 0041CDAF
Iphlpapi, xrefs: 0041CD52, 0041CD5C, 0041CD67
GetSystemTimes, xrefs: 0041CCF4
IsWow64Process, xrefs: 0041CC68
GetFinalPathNameByHandleW, xrefs: 0041CD86
NtUnmapViewOfSection, xrefs: 0041CC49
Psapi, xrefs: 0041CBF1

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad$HandleModule
String ID: EnumDisplayDevicesW$EnumDisplayMonitors$GetComputerNameExW$GetConsoleWindow$GetExtendedTcpTable$GetExtendedUdpTable$GetFinalPathNameByHandleW$GetMonitorInfoW$GetProcessImageFileNameW$GetSystemTimes$GlobalMemoryStatusEx$Iphlpapi$IsUserAnAdmin$IsWow64Process$Kernel32$NtQueryInformationProcess$NtResumeProcess$NtSuspendProcess$NtUnmapViewOfSection$Psapi$RmEndSession$RmGetList$RmRegisterResources$RmStartSession$Rstrtmgr$SetProcessDEPPolicy$SetProcessDpiAwareness$Shell32$Shlwapi$kernel32$ntdll$shcore$user32
API String ID: 4236061018-3687161714
Opcode ID: 6b21e851a0d3a51eeec0044f2aae63c374cf6436741b915ef551e22e35f3a136
Instruction ID: 87b5fa294a9840a4da0a94e675c49188b16ea4214af7843bc20054d8537ab592
Opcode Fuzzy Hash: 6b21e851a0d3a51eeec0044f2aae63c374cf6436741b915ef551e22e35f3a136
Instruction Fuzzy Hash: 06419AA0E8035879DA107BB65D8DE3B3E5CD9857953614837B05C93550FBBCDC408EAE

Function 0040EA00 Relevance: 84.8, APIs: 14, Strings: 34, Instructions: 795
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041CBE1: LoadLibraryA.KERNELBASE(Psapi,GetProcessImageFileNameW,?,?,?,?,0040EA1C), ref: 0041CBF6
Part of subcall function 0041CBE1: GetProcAddress.KERNEL32(00000000), ref: 0041CBFF
Part of subcall function 0041CBE1: GetModuleHandleA.KERNEL32(Kernel32,GetProcessImageFileNameW,?,?,?,?,0040EA1C), ref: 0041CC16
Part of subcall function 0041CBE1: GetProcAddress.KERNEL32(00000000), ref: 0041CC19
Part of subcall function 0041CBE1: LoadLibraryA.KERNEL32(shcore,SetProcessDpiAwareness,?,?,?,?,0040EA1C), ref: 0041CC2B
Part of subcall function 0041CBE1: GetProcAddress.KERNEL32(00000000), ref: 0041CC2E
Part of subcall function 0041CBE1: LoadLibraryA.KERNEL32(user32,SetProcessDpiAwareness,?,?,?,?,0040EA1C), ref: 0041CC3F
Part of subcall function 0041CBE1: GetProcAddress.KERNEL32(00000000), ref: 0041CC42
Part of subcall function 0041CBE1: LoadLibraryA.KERNEL32(ntdll,NtUnmapViewOfSection,?,?,?,?,0040EA1C), ref: 0041CC54
Part of subcall function 0041CBE1: GetProcAddress.KERNEL32(00000000), ref: 0041CC57
Part of subcall function 0041CBE1: LoadLibraryA.KERNEL32(kernel32,GlobalMemoryStatusEx,?,?,?,?,0040EA1C), ref: 0041CC63
Part of subcall function 0041CBE1: GetProcAddress.KERNEL32(00000000), ref: 0041CC66
Part of subcall function 0041CBE1: GetModuleHandleA.KERNEL32(kernel32,IsWow64Process,?,?,?,?,0040EA1C), ref: 0041CC77
Part of subcall function 0041CBE1: GetProcAddress.KERNEL32(00000000), ref: 0041CC7A
Part of subcall function 0041CBE1: GetModuleHandleA.KERNEL32(kernel32,GetComputerNameExW,?,?,?,?,0040EA1C), ref: 0041CC8B
Part of subcall function 0041CBE1: GetProcAddress.KERNEL32(00000000), ref: 0041CC8E
Part of subcall function 0041CBE1: LoadLibraryA.KERNEL32(Shell32,IsUserAnAdmin,?,?,?,?,0040EA1C), ref: 0041CC9F
Part of subcall function 0041CBE1: GetProcAddress.KERNEL32(00000000), ref: 0041CCA2
Part of subcall function 0041CBE1: GetModuleHandleA.KERNEL32(kernel32,SetProcessDEPPolicy,?,?,?,?,0040EA1C), ref: 0041CCB3
Part of subcall function 0041CBE1: GetProcAddress.KERNEL32(00000000), ref: 0041CCB6
Part of subcall function 0041CBE1: GetModuleHandleA.KERNEL32(user32,EnumDisplayDevicesW,?,?,?,?,0040EA1C), ref: 0041CCC7
Part of subcall function 0041CBE1: GetProcAddress.KERNEL32(00000000), ref: 0041CCCA
Part of subcall function 0041CBE1: GetModuleHandleA.KERNEL32(user32,EnumDisplayMonitors,?,?,?,?,0040EA1C), ref: 0041CCDB
Part of subcall function 0041CBE1: GetProcAddress.KERNEL32(00000000), ref: 0041CCDE
Part of subcall function 0041CBE1: GetModuleHandleA.KERNEL32(user32,GetMonitorInfoW,?,?,?,?,0040EA1C), ref: 0041CCEF
Part of subcall function 0041CBE1: GetProcAddress.KERNEL32(00000000), ref: 0041CCF2
Part of subcall function 0041CBE1: GetModuleHandleA.KERNEL32(kernel32,GetSystemTimes,?,?,?,?,0040EA1C), ref: 0041CD03
Part of subcall function 0041CBE1: GetProcAddress.KERNEL32(00000000), ref: 0041CD06
Part of subcall function 0041CBE1: LoadLibraryA.KERNEL32(Shlwapi,0000000C,?,?,?,?,0040EA1C), ref: 0041CD14

GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe,00000104), ref: 0040EA29

Part of subcall function 00410F72: __EH_prolog.LIBCMT ref: 00410F77

Strings

Inj, xrefs: 0040EC10, 0040EC27
dMG, xrefs: 0040F1E3
SG, xrefs: 0040EB9D
PG, xrefs: 0040F13E
PG, xrefs: 0040F166
PG, xrefs: 0040EA98
8SG, xrefs: 0040EF58
PG, xrefs: 0040EEE7
PG, xrefs: 0040EDB6
PG, xrefs: 0040EE0E
C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe, xrefs: 0040EA21, 0040EE4A
SG, xrefs: 0040EB40
PG, xrefs: 0040F1C2
Administrator, xrefs: 0040F2C2
User, xrefs: 0040F2C9
8SG, xrefs: 0040EEA0
PG, xrefs: 0040F071
license_code.txt, xrefs: 0040EA88
del, xrefs: 0040F328, 0040F3AA
PG, xrefs: 0040EFA1
PG, xrefs: 0040F113
Remcos Agent initialized, xrefs: 0040F02A
licence, xrefs: 0040EFC3
Access Level: , xrefs: 0040F2DA
del, xrefs: 0040F30C
PG, xrefs: 0040F22E
PG, xrefs: 0040EAD1
PG, xrefs: 0040ED82
PG, xrefs: 0040F18F
exepath, xrefs: 0040EECD, 0040EF7B
Software\, xrefs: 0040EAFE
PG, xrefs: 0040F202
PSG, xrefs: 0040F25F
Exe, xrefs: 0040EB4A

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: AddressProc$Module$Handle$LibraryLoad$FileH_prologName
String ID: SG$ SG$8SG$8SG$Access Level: $Administrator$C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe$Exe$Inj$PSG$Remcos Agent initialized$Software\$User$dMG$del$del$exepath$licence$license_code.txt$PG$PG$PG$PG$PG$PG$PG$PG$PG$PG$PG$PG$PG$PG$PG
API String ID: 2830904901-574084594
Opcode ID: 6202b5512e5facb3af0513cdbd84492cf800003da2c06305936c9bc6b7e1eab1
Instruction ID: f870588dacc207cf398a21a9077505b2b75b96970711a81e27f166ce8512e3fa
Opcode Fuzzy Hash: 6202b5512e5facb3af0513cdbd84492cf800003da2c06305936c9bc6b7e1eab1
Instruction Fuzzy Hash: 9B32F960B043412BDA24B7729C57B7E26994F80748F50483FB9467B2E3EEBC8D45839E

Function 0040CE34 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 203
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcslen.LIBCMT ref: 0040CE42
CreateDirectoryW.KERNELBASE(00000000,00000000,00000000,00000000,?,004750E4,0000000E,00000027,0000000D,00000033,00000000,00000032,00000000,Exe,00000000,0000000E), ref: 0040CE5B
CopyFileW.KERNELBASE(C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe,00000000,00000000,00000000,00000000,00000000,?,004750E4,0000000E,00000027,0000000D,00000033,00000000,00000032,00000000,Exe), ref: 0040CF0B
_wcslen.LIBCMT ref: 0040CF21
CreateDirectoryW.KERNEL32(00000000,00000000,00000000), ref: 0040CFA9
CopyFileW.KERNEL32(C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe,00000000,00000000), ref: 0040CFBF
SetFileAttributesW.KERNEL32(00000000,00000007), ref: 0040CFFE
_wcslen.LIBCMT ref: 0040D001
SetFileAttributesW.KERNEL32(00000000,00000007), ref: 0040D018
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004750E4,0000000E), ref: 0040D068
ShellExecuteW.SHELL32(00000000,open,00000000,00466478,00466478,00000001), ref: 0040D086
ExitProcess.KERNEL32 ref: 0040D09D

Strings

del, xrefs: 0040D030
6, xrefs: 0040CF15
C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe, xrefs: 0040CECC, 0040CED1, 0040CF04, 0040CFB9, 0040CFBE, 0040CFC5, 0040D026
open, xrefs: 0040D07F

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: File$_wcslen$AttributesCopyCreateDirectory$CloseExecuteExitHandleProcessShell
String ID: 6$C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe$del$open
API String ID: 1579085052-3273367227
Opcode ID: 78ec28f4913f4d3f9f1528364862cf6ae71335d4f1464bd7cdb9a6dc9c28360f
Instruction ID: 98553dc1b0994f0aa09194d7cf3a18af63584d9ff732256a229fdfb73b573f5c
Opcode Fuzzy Hash: 78ec28f4913f4d3f9f1528364862cf6ae71335d4f1464bd7cdb9a6dc9c28360f
Instruction Fuzzy Hash: 3151E820208302ABD615B7359C92A6F679D9F8471DF00443FF60AA61E3EF7C9D05866E

Function 0040DA6F Relevance: 17.6, APIs: 1, Strings: 9, Instructions: 139
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLongPathNameW.KERNELBASE(00000000,?,00000208), ref: 0040DBD5

Strings

WinDir, xrefs: 0040DAD6, 0040DAF8, 0040DB4A
Temp, xrefs: 0040DAA1
\SysWOW64, xrefs: 0040DB3B
AppData, xrefs: 0040DB8C
\system32, xrefs: 0040DAE9
SystemDrive, xrefs: 0040DACC
ProgramFiles, xrefs: 0040DBA9
ProgramData, xrefs: 0040DB9A
UserProfile, xrefs: 0040DB93

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: LongNamePath
String ID: AppData$ProgramData$ProgramFiles$SystemDrive$Temp$UserProfile$WinDir$\SysWOW64$\system32
API String ID: 82841172-425784914
Opcode ID: be4ac8304f295cf4b46394ea231ea9abe9adb1149d3e26b594abad322c0f2439
Instruction ID: db29472287e64cad03ac4489520097095d7cef5d056ecb8d0020da3553efca3c
Opcode Fuzzy Hash: be4ac8304f295cf4b46394ea231ea9abe9adb1149d3e26b594abad322c0f2439
Instruction Fuzzy Hash: 0A4151715082019AC205F765DC96CAAB7B8AE90758F10053FB146B20E2FFBCAE4DC65B

Function 0041B354 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041C048: GetCurrentProcess.KERNEL32(?,?,?,0040DAE5,WinDir,00000000,00000000), ref: 0041C059

Part of subcall function 004135E1: RegOpenKeyExA.KERNELBASE(80000001,00000400,00000000,00020019,?), ref: 00413605
Part of subcall function 004135E1: RegQueryValueExA.KERNELBASE(?,?,00000000,00000000,?,00000400), ref: 00413622
Part of subcall function 004135E1: RegCloseKey.KERNELBASE(?), ref: 0041362D

StrToIntA.SHLWAPI(00000000,0046CA08,00000000,00000000,00000000,004750E4,00000003,Exe,00000000,0000000E,00000000,004660CC,00000003,00000000), ref: 0041B3CD

Strings

SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 0041B368, 0041B372, 0041B3B3
ProductName, xrefs: 0041B363
(64 bit), xrefs: 0041B3F9
(32 bit), xrefs: 0041B400
CurrentBuildNumber, xrefs: 0041B3AE

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: CloseCurrentOpenProcessQueryValue
String ID: (32 bit)$ (64 bit)$CurrentBuildNumber$ProductName$SOFTWARE\Microsoft\Windows NT\CurrentVersion
API String ID: 1866151309-2070987746
Opcode ID: c98b1087101755a38b82246d9aa98e7144fe1c3d7bc526724a740bbc80c710b4
Instruction ID: f33cb4008a08c387480eb48f471200dcc92f04aa72c22424ac0a9b44a4c1d04d
Opcode Fuzzy Hash: c98b1087101755a38b82246d9aa98e7144fe1c3d7bc526724a740bbc80c710b4
Instruction Fuzzy Hash: 8811C47064014926C704B7658C97EFE76198790344F94413BF806A61D3FB6C598683EE

Function 0041384F Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 39
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyW.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\,?), ref: 0041385A
RegSetValueExW.KERNELBASE(?,00000000,00000000,00000001,00000000,00000000,?,?,?,?,00000000,004752D8,74DF37E0,?), ref: 00413888
RegCloseKey.ADVAPI32(?,?,?,?,?,00000000,004752D8,74DF37E0,?,?,?,?,?,0040CFE5,?,00000000), ref: 00413893

Strings

Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\, xrefs: 00413858

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: CloseCreateValue
String ID: Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\
API String ID: 1818849710-1051519024
Opcode ID: 3da2de30dd2e4c2ff773a1c969aacac889c14d245fa7b83563a43fe4ea506f1b
Instruction ID: 9133f253890910ff78e8f434c24b82038cc7026402723a24ca4ec17c3e6d8cb5
Opcode Fuzzy Hash: 3da2de30dd2e4c2ff773a1c969aacac889c14d245fa7b83563a43fe4ea506f1b
Instruction Fuzzy Hash: 15F0C271440218FBCF00AFA1EC45FEE376CEF00756F10452AF905A61A1E7759E04DA94

Function 0040D0A4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexA.KERNELBASE(00000000,00000001,00000000,0040EC43,0000000D,00000033,00000000,00000032,00000000,Exe,00000000,0000000E,00000000,004660CC,00000003,00000000), ref: 0040D0B3
GetLastError.KERNEL32 ref: 0040D0BE

Strings

SG, xrefs: 0040D0A4

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: CreateErrorLastMutex
String ID: SG
API String ID: 1925916568-3189917014
Opcode ID: eabddf02165d7cb7ab60b975d5c9d75332e346c4e6257b5baf50d4a4f7034b19
Instruction ID: 57749e379dff282fb0cfe370275dd79dddcb706c5168e3a31171962593876721
Opcode Fuzzy Hash: eabddf02165d7cb7ab60b975d5c9d75332e346c4e6257b5baf50d4a4f7034b19
Instruction Fuzzy Hash: 0DD012B0605700EBDB186770ED5975839559744702F40487AB50FD99F1CBBC88908519

Function 004135E1 Relevance: 4.5, APIs: 3, Instructions: 44
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000001,00000400,00000000,00020019,?), ref: 00413605
RegQueryValueExA.KERNELBASE(?,?,00000000,00000000,?,00000400), ref: 00413622
RegCloseKey.KERNELBASE(?), ref: 0041362D

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 859e64f62c27df18338a46db6ec3b0787647947da56704c1ae6da14bd80b9033
Instruction ID: 0661f39b514c0023b6096d8878825bbc81d19e8e8981dfb5b132c5fecbfe39b6
Opcode Fuzzy Hash: 859e64f62c27df18338a46db6ec3b0787647947da56704c1ae6da14bd80b9033
Instruction Fuzzy Hash: 4A01D676900228FBCB209B91DC08DEF7F7DDB44B51F004066BB05A2240DA748E45DBA4

Function 00413584 Relevance: 4.5, APIs: 3, Instructions: 37
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000001,00000000,00000000,00020019,00000000,00000000), ref: 004135A4
RegQueryValueExA.ADVAPI32(00000000,?,00000000,?,?,?), ref: 004135C2
RegCloseKey.ADVAPI32(00000000), ref: 004135CD

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 1fd388fcba5a36fc4cfbdc9a361dcb97530194601f604bbc1403cef4751c10f9
Instruction ID: 3ea041f737baa467864e73cd7e114674dd940ed34319bd14b5ec79364d8ab256
Opcode Fuzzy Hash: 1fd388fcba5a36fc4cfbdc9a361dcb97530194601f604bbc1403cef4751c10f9
Instruction Fuzzy Hash: 39F01D76900218FFDF109FA09C45FEE7BBDEB04B11F1044A5BA04E6191D6359F549B94

Function 0040165E Relevance: 3.0, APIs: 2, Instructions: 32
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ebd29a8193938baf2c5ce5f6ec3a3ea5040e3c3e83895a942c6279db0e0dd98
Instruction ID: 1e9d0a06bdb6e9f7b23a96960dfc4b712b0be9606a3b942e14a6d4fe6a34620f
Opcode Fuzzy Hash: 9ebd29a8193938baf2c5ce5f6ec3a3ea5040e3c3e83895a942c6279db0e0dd98
Instruction Fuzzy Hash: EBF0E2706042016BCB0C8B34CD50B2A37954B84325F248F7FF02BD61E0C73EC8918A0D

Function 004461B8 Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,00435349,?,?,004388C7,?,?,00000000,00476B50,?,0040DE9D,00435349,?,?,?,?), ref: 004461EA

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 9dc7fa543976cc1aa64452a14dec52ea5ded8d4e1ebcbf177ce858167d1c4c1d
Instruction ID: 139fbca062bb8bf671a891d82c3cf8fc988f9ce198a1a8b78c24da0334343556
Opcode Fuzzy Hash: 9dc7fa543976cc1aa64452a14dec52ea5ded8d4e1ebcbf177ce858167d1c4c1d
Instruction Fuzzy Hash: CEE0E531A0021267F6312A269C01B5B76599B437A0F170137AD15922D2CE6CCD0181EF

Non-executed Functions

Function 00407CD2 Relevance: 44.6, APIs: 10, Strings: 15, Instructions: 835filesleepCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?,?), ref: 00407CF4
GetFileAttributesW.KERNEL32(00000000,00000000,?), ref: 00407DC2
DeleteFileW.KERNEL32(00000000), ref: 00407DE4

Part of subcall function 0041C322: FindFirstFileW.KERNEL32(?,?,?,?,?,?,?,00474EE0,?), ref: 0041C37D
Part of subcall function 0041C322: FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,00474EE0,?), ref: 0041C3AD
Part of subcall function 0041C322: RemoveDirectoryW.KERNEL32(?,?,?,?,?,?,00474EE0,?), ref: 0041C402
Part of subcall function 0041C322: FindClose.KERNEL32(00000000,?,?,?,?,?,00474EE0,?), ref: 0041C463
Part of subcall function 0041C322: RemoveDirectoryW.KERNEL32(00000000,?,?,?,?,?,00474EE0,?), ref: 0041C46A

Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36

Part of subcall function 0041B580: GetLocalTime.KERNEL32(00000000), ref: 0041B59A

Part of subcall function 00404AA1: WaitForSingleObject.KERNEL32(?,00000000,00401A45,?,?,00000004,?,?,00000004,00476B50,00474EE0,00000000), ref: 00404B47
Part of subcall function 00404AA1: SetEvent.KERNEL32(?,?,?,00000004,?,?,00000004,00476B50,00474EE0,00000000,?,?,?,?,?,00401A45), ref: 00404B75

ShellExecuteW.SHELL32(00000000,open,00000000,00000000,00000000,00000001), ref: 004081D2
GetLogicalDriveStringsA.KERNEL32(00000064,?), ref: 004082B3
SetFileAttributesW.KERNEL32(00000000,?,00000000,00000001), ref: 004084FF
DeleteFileA.KERNEL32(?), ref: 0040868D

Part of subcall function 00408847: __EH_prolog.LIBCMT ref: 0040884C
Part of subcall function 00408847: FindFirstFileW.KERNEL32(00000000,?,00466618,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00408905
Part of subcall function 00408847: __CxxThrowException@8.LIBVCRUNTIME ref: 0040892D
Part of subcall function 00408847: FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0040893A

Sleep.KERNEL32(000007D0), ref: 00408733
StrToIntA.SHLWAPI(00000000,00000000), ref: 00408775

Part of subcall function 0041CA73: SystemParametersInfoW.USER32(00000014,00000000,00000000,00000003), ref: 0041CB68

Strings

Unable to delete: , xrefs: 00407E42
XPG, xrefs: 00408753
Unable to rename file!, xrefs: 0040844E
Executing file: , xrefs: 004081E8
XPG, xrefs: 00407E28
Failed to download file: , xrefs: 004080E0
Downloaded file: , xrefs: 00408069
open, xrefs: 004081CC
NG, xrefs: 00407D20
XPG, xrefs: 0040846B
Downloading file: , xrefs: 00407FB8
XPG, xrefs: 00408322
Browsing directory: , xrefs: 00408273
(PG, xrefs: 0040822D
Deleted file: , xrefs: 00407E03

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: File$Find$AttributesDeleteDirectoryEventFirstNextRemove$CloseDriveException@8ExecuteH_prologInfoLocalLogicalObjectParametersShellSingleSleepStringsSystemThrowTimeWaitsend
String ID: (PG$Browsing directory: $Deleted file: $Downloaded file: $Downloading file: $Executing file: $Failed to download file: $Unable to delete: $Unable to rename file!$XPG$XPG$XPG$XPG$open$NG
API String ID: 1067849700-181434739
Opcode ID: 7c18745d317e9d7a180cddf72ef257cec752a247206de6ae7290b7569b6ccf97
Instruction ID: f533dcafa702064eae222fc9ff54aa9327b172b3479e3db69e1c842a3252ef64
Opcode Fuzzy Hash: 7c18745d317e9d7a180cddf72ef257cec752a247206de6ae7290b7569b6ccf97
Instruction Fuzzy Hash: F04293716043016BC604FB76C9579AE77A9AF91348F80483FF542671E2EF7C9908879B

Function 0040569A Relevance: 40.5, APIs: 15, Strings: 8, Instructions: 278pipesleepfileCOMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 004056E6

Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36

__Init_thread_footer.LIBCMT ref: 00405723
CreatePipe.KERNEL32(00476CCC,00476CB4,00476BD8,00000000,004660CC,00000000), ref: 004057B6
CreatePipe.KERNEL32(00476CB8,00476CD4,00476BD8,00000000), ref: 004057CC
CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000001,00000000,00000000,00000000,00476BE8,00476CBC), ref: 0040583F
Sleep.KERNEL32(0000012C,00000093,?), ref: 00405897
PeekNamedPipe.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 004058BC
ReadFile.KERNEL32(00000000,?,?,00000000), ref: 004058E9

Part of subcall function 00434801: __onexit.LIBCMT ref: 00434807

WriteFile.KERNEL32(00000000,00000000,?,00000000,00474F90,004660D0,00000062,004660B4), ref: 004059E4
Sleep.KERNEL32(00000064,00000062,004660B4), ref: 004059FE
TerminateProcess.KERNEL32(00000000), ref: 00405A17
CloseHandle.KERNEL32 ref: 00405A23
CloseHandle.KERNEL32 ref: 00405A2B
CloseHandle.KERNEL32 ref: 00405A3D
CloseHandle.KERNEL32 ref: 00405A45

Strings

0lG, xrefs: 0040585A
SystemDrive, xrefs: 00405761
0lG, xrefs: 00405A2D
0lG, xrefs: 00405954
kG, xrefs: 004057DB
cmd.exe, xrefs: 0040574D
0lG, xrefs: 00405988
0lG, xrefs: 004056D0

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreatePipe$FileInit_thread_footerProcessSleep$NamedPeekReadTerminateWrite__onexitsend
String ID: 0lG$0lG$0lG$0lG$0lG$SystemDrive$cmd.exe$kG
API String ID: 2994406822-18413064
Opcode ID: 069e1c8b270e62708b3ebeb5d363473b059d0bacde6312ecfb8e784b21879d38
Instruction ID: feb7c3e087fbbfe745e3798ef664df189eb35a760580a6c3fca7c2e5343dee52
Opcode Fuzzy Hash: 069e1c8b270e62708b3ebeb5d363473b059d0bacde6312ecfb8e784b21879d38
Instruction Fuzzy Hash: 1A91C271604604AFD711FB36ED42A6B369AEB84308F01443FF589A62E2DB7D9C448F6D

Function 00412132 Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 238threadCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00412141

Part of subcall function 004138B2: RegCreateKeyA.ADVAPI32(80000001,00000000,004660B4), ref: 004138C0
Part of subcall function 004138B2: RegSetValueExA.ADVAPI32(004660B4,000000AF,00000000,00000004,00000001,00000004,?,?,?,0040C18D,00466C58,00000001,000000AF,004660B4), ref: 004138DB
Part of subcall function 004138B2: RegCloseKey.ADVAPI32(004660B4,?,?,?,0040C18D,00466C58,00000001,000000AF,004660B4), ref: 004138E6

OpenMutexA.KERNEL32(00100000,00000000,00000000), ref: 00412181
CloseHandle.KERNEL32(00000000), ref: 00412190
CreateThread.KERNEL32(00000000,00000000,00412829,00000000,00000000,00000000), ref: 004121E6
OpenProcess.KERNEL32(001FFFFF,00000000,?), ref: 00412455

Strings

WinDir, xrefs: 00412256, 004122AB
Watchdog launch failed!, xrefs: 004123BE
Remcos restarted by watchdog!, xrefs: 0041219B
Watchdog module activated, xrefs: 004121BF, 00412417
\SysWOW64\, xrefs: 0041229C
WDH, xrefs: 004121F0, 004121F6, 0041245B
rmclient.exe, xrefs: 00412325
svchost.exe, xrefs: 00412300
fsutil.exe, xrefs: 0041234A
\system32\, xrefs: 00412244

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: CloseCreateOpenProcess$CurrentHandleMutexThreadValue
String ID: Remcos restarted by watchdog!$WDH$Watchdog launch failed!$Watchdog module activated$WinDir$\SysWOW64\$\system32\$fsutil.exe$rmclient.exe$svchost.exe
API String ID: 3018269243-13974260
Opcode ID: 8006cda52f5219bdd696dd0d675ffe777c2bf0d6e0fdc247cffe885ec1085c4b
Instruction ID: f1b014459f2de55ad39b9ce4e2eab06dd530905b6b6ad57ecd0cf2e75cce6712
Opcode Fuzzy Hash: 8006cda52f5219bdd696dd0d675ffe777c2bf0d6e0fdc247cffe885ec1085c4b
Instruction Fuzzy Hash: B971A23160430167C614FB72CD579AE77A4AE94308F40097FF586A21E2FFBC9A49C69E

Function 0040BB6B Relevance: 24.6, APIs: 8, Strings: 6, Instructions: 146fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,\AppData\Roaming\Mozilla\Firefox\Profiles\), ref: 0040BBEA
FindClose.KERNEL32(00000000), ref: 0040BC04
FindNextFileA.KERNEL32(00000000,?), ref: 0040BD27
FindClose.KERNEL32(00000000), ref: 0040BD4D

Strings

\logins.json, xrefs: 0040BC6F
\AppData\Roaming\Mozilla\Firefox\Profiles\, xrefs: 0040BB8D
UserProfile, xrefs: 0040BB9B
[Firefox StoredLogins not found], xrefs: 0040BC0F
[Firefox StoredLogins Cleared!], xrefs: 0040BD3A
\key3.db, xrefs: 0040BCB1

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: Find$CloseFile$FirstNext
String ID: [Firefox StoredLogins Cleared!]$[Firefox StoredLogins not found]$UserProfile$\AppData\Roaming\Mozilla\Firefox\Profiles\$\key3.db$\logins.json
API String ID: 1164774033-3681987949
Opcode ID: b41a8e288d6c781c84b11b836a0024b7a118f79960b3641b573c725179fdc384
Instruction ID: 8b0b2ff803da1d4b435a108118727fe7c74031c8ac088da8990f7d135a86af9b
Opcode Fuzzy Hash: b41a8e288d6c781c84b11b836a0024b7a118f79960b3641b573c725179fdc384
Instruction Fuzzy Hash: C7514F3190021A9ADB14FBB2DC56AEEB739AF10304F50057FF506721E2FF785A49CA99

Function 004168FC Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 80clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 004168FD
EmptyClipboard.USER32 ref: 0041690B
GlobalAlloc.KERNEL32(00002000,-00000002), ref: 0041692B
GlobalLock.KERNEL32(00000000), ref: 00416934
GlobalUnlock.KERNEL32(00000000), ref: 0041696A
SetClipboardData.USER32(0000000D,00000000), ref: 00416973
CloseClipboard.USER32 ref: 00416990
OpenClipboard.USER32 ref: 00416997
GetClipboardData.USER32(0000000D), ref: 004169A7
GlobalLock.KERNEL32(00000000), ref: 004169B0
GlobalUnlock.KERNEL32(00000000), ref: 004169B9
CloseClipboard.USER32 ref: 004169BF

Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36

Strings

!D@, xrefs: 004170C4

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: Clipboard$Global$CloseDataLockOpenUnlock$AllocEmptysend
String ID: !D@
API String ID: 3520204547-604454484
Opcode ID: 22014e37a0533ad6d5301b9a6db5ea665297cd973015afcf0188733ddc164352
Instruction ID: 548dc4d81477911aad8e8b192ef25fd2d65b79b2884d290c2f7190e4363fe536
Opcode Fuzzy Hash: 22014e37a0533ad6d5301b9a6db5ea665297cd973015afcf0188733ddc164352
Instruction Fuzzy Hash: 23215171204301EBD714BB71DC5DAAE7AA9AF88746F00043EF946961E2EF3C8C45866A

Function 0040BD72 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 131fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,\AppData\Roaming\Mozilla\Firefox\Profiles\), ref: 0040BDEA
FindClose.KERNEL32(00000000), ref: 0040BE04
FindNextFileA.KERNEL32(00000000,?), ref: 0040BEC4
FindClose.KERNEL32(00000000), ref: 0040BEEA
FindClose.KERNEL32(00000000), ref: 0040BF0B

Strings

[Firefox Cookies not found], xrefs: 0040BE0F, 0040BED7
\cookies.sqlite, xrefs: 0040BE67
\AppData\Roaming\Mozilla\Firefox\Profiles\, xrefs: 0040BD8D
[Firefox cookies found, cleared!], xrefs: 0040BF1A
UserProfile, xrefs: 0040BD9B

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: Find$Close$File$FirstNext
String ID: [Firefox Cookies not found]$[Firefox cookies found, cleared!]$UserProfile$\AppData\Roaming\Mozilla\Firefox\Profiles\$\cookies.sqlite
API String ID: 3527384056-432212279
Opcode ID: 957e4b9f77f0127c971f2cbaa54e22c6f4c97dcdb1298e2b7e9e5f591e6deb8c
Instruction ID: 490896facf616f27299b965c2ba25c256be2621490ca3b25f990f1d956524bcc
Opcode Fuzzy Hash: 957e4b9f77f0127c971f2cbaa54e22c6f4c97dcdb1298e2b7e9e5f591e6deb8c
Instruction Fuzzy Hash: E0417F3190021AAACB04F7B2DC5A9EE7769AF11704F50057FF506B21E2EF385A458A9D

Function 0041A045 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 176sleeptimeCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0041A04A
GdiplusStartup.GDIPLUS(00474ACC,?,00000000), ref: 0041A07C
CreateDirectoryW.KERNEL32(00000000,00000000,00000000,0000001A,00000019), ref: 0041A108
Sleep.KERNEL32(000003E8), ref: 0041A18E
GetLocalTime.KERNEL32(?), ref: 0041A196
Sleep.KERNEL32(00000000,00000018,00000000), ref: 0041A285

Strings

PG, xrefs: 0041A23E
PG, xrefs: 0041A15A
wnd_%04i%02i%02i_%02i%02i%02i, xrefs: 0041A12B, 0041A14C, 0041A1BA
PG, xrefs: 0041A0A7
time_%04i%02i%02i_%02i%02i%02i, xrefs: 0041A130

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: Sleep$CreateDirectoryGdiplusH_prologLocalStartupTime
String ID: time_%04i%02i%02i_%02i%02i%02i$wnd_%04i%02i%02i_%02i%02i%02i$PG$PG$PG
API String ID: 489098229-1431523004
Opcode ID: ed0dc15d332ee4383210d553d6c4f7a7ac5547de3233ceb75dc48dba0a47a24e
Instruction ID: 12d64888f2a2aa40a87de1a625a26b3edd7a2139bf4817292c9f8cf1352d8a2d
Opcode Fuzzy Hash: ed0dc15d332ee4383210d553d6c4f7a7ac5547de3233ceb75dc48dba0a47a24e
Instruction Fuzzy Hash: 7A517D70A002159ACB14BBB5C8529FD77A9AF54308F40407FF509AB1E2EF7C9D85C799

Function 0040F4AF Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 210processCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000104,00000000,004750E4,?,00475338), ref: 0040F4C9
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,00475338), ref: 0040F4F4
Process32FirstW.KERNEL32(00000000,0000022C), ref: 0040F510
Process32NextW.KERNEL32(00000000,0000022C), ref: 0040F58F
CloseHandle.KERNEL32(00000000,?,00000000,?,?,00475338), ref: 0040F59E

Part of subcall function 0041C26E: OpenProcess.KERNEL32(00001000,00000000,?,00000000,00000000,00000000), ref: 0041C286
Part of subcall function 0041C26E: OpenProcess.KERNEL32(00000400,00000000,?,?,00000000,00000000,00000000), ref: 0041C299

CloseHandle.KERNEL32(00000000,?,00475338), ref: 0040F6A9

Strings

ieinstal.exe, xrefs: 0040F710
Inj, xrefs: 0040F7A4
ielowutil.exe, xrefs: 0040F751
C:\Program Files(x86)\Internet Explorer\, xrefs: 0040F6F9

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: CloseHandleOpenProcessProcess32$CreateFileFirstModuleNameNextSnapshotToolhelp32
String ID: C:\Program Files(x86)\Internet Explorer\$Inj$ieinstal.exe$ielowutil.exe
API String ID: 3756808967-1743721670
Opcode ID: 7e174afa80332a6d9799d90a5ef8f927f9e1300862e9f2cc4ca1dfb4d5584e6a
Instruction ID: 73d50abc618c2a3d6a57d9d5b79267519347fdb4c989691d2635b3abfd1995a7
Opcode Fuzzy Hash: 7e174afa80332a6d9799d90a5ef8f927f9e1300862e9f2cc4ca1dfb4d5584e6a
Instruction Fuzzy Hash: B5712E705083419AC724FB21D8959AEB7E4AF90348F40483FF586631E3EF79994DCB9A

Function 00419662 Relevance: 17.7, APIs: 1, Strings: 9, Instructions: 206COMMON

Download Yara Rule

Strings

5, xrefs: 00419844
VG, xrefs: 004196C6
6, xrefs: 0041984E
2, xrefs: 0041972F
0, xrefs: 0041968C
7, xrefs: 00419865
3, xrefs: 0041978F
1, xrefs: 004196D0
4, xrefs: 004197F3

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID:
String ID: 0$1$2$3$4$5$6$7$VG
API String ID: 0-1861860590
Opcode ID: 23e062be4493d8f612a0f73d7cec249050aa78cf65a3b1cbc455386ce95aeb4f
Instruction ID: 7133b754bba813e7b371628f59950815dc208a5c28e1558ec9b3f3725e93ffbd
Opcode Fuzzy Hash: 23e062be4493d8f612a0f73d7cec249050aa78cf65a3b1cbc455386ce95aeb4f
Instruction Fuzzy Hash: 9171E2709183019FD704EF21D862BAB7B94DF85710F00492FF5A26B2D1DE78AB49CB96

Function 00407538 Relevance: 15.8, APIs: 2, Strings: 7, Instructions: 56COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0040755C
CoGetObject.OLE32(?,00000024,00466528,00000000), ref: 004075BD

Strings

[+] ucmAllocateElevatedObject, xrefs: 00407543
[+] CoGetObject, xrefs: 0040759C
[+] CoGetObject SUCCESS, xrefs: 004075D0
[-] CoGetObject FAILURE, xrefs: 004075C9
{3E5FC7F9-9A51-4367-9063-A120244FBEC7}, xrefs: 00407551, 00407556, 00407595
Elevation:Administrator!new:, xrefs: 0040757D
$, xrefs: 00407576

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: Object_wcslen
String ID: $$Elevation:Administrator!new:$[+] CoGetObject$[+] CoGetObject SUCCESS$[+] ucmAllocateElevatedObject$[-] CoGetObject FAILURE${3E5FC7F9-9A51-4367-9063-A120244FBEC7}
API String ID: 240030777-3166923314
Opcode ID: ee0c587a1dfa56a4776c25ed63fc93c62e7d4b1650b4331978f6b80fa64f11fb
Instruction ID: 28daeeabb8f9d0779e909056d36d27ae9c6096be3406941992b1a3e854751cf1
Opcode Fuzzy Hash: ee0c587a1dfa56a4776c25ed63fc93c62e7d4b1650b4331978f6b80fa64f11fb
Instruction Fuzzy Hash: 88113771D04214B6D710EA959845BDEB77C9B08714F15006FF904B2281EB7CAE448A6F

Function 0041A7D9 Relevance: 15.2, APIs: 10, Instructions: 228serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,00000004,004758E8), ref: 0041A7EF
EnumServicesStatusW.ADVAPI32(00000000,0000003B,00000003,?,00000000,?,?,?), ref: 0041A83E
GetLastError.KERNEL32 ref: 0041A84C
EnumServicesStatusW.ADVAPI32(00000000,0000003B,00000003,00000000,?,?,?,?), ref: 0041A884

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: EnumServicesStatus$ErrorLastManagerOpen
String ID:
API String ID: 3587775597-0
Opcode ID: b4f2e3a96ffad31793e55c3957a9d7d505f7fea0f7d1b1d8364ea5c68624dc3d
Instruction ID: 52116c85fb856a5ac6c14b0259405ec20ae2fa8d9cc538ef9907a440d1633313
Opcode Fuzzy Hash: b4f2e3a96ffad31793e55c3957a9d7d505f7fea0f7d1b1d8364ea5c68624dc3d
Instruction Fuzzy Hash: 17817071104301ABC304EF61D885DAFB7A8FF94749F50082EF185521A2EF78EE49CB9A

Function 0040C388 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 112fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,\Mozilla\Firefox\Profiles\,00000000), ref: 0040C3D6
FindNextFileW.KERNEL32(00000000,?), ref: 0040C4A9
FindClose.KERNEL32(00000000), ref: 0040C4B8
FindClose.KERNEL32(00000000), ref: 0040C4E3

Strings

\cookies.sqlite, xrefs: 0040C444
AppData, xrefs: 0040C393
\Mozilla\Firefox\Profiles\, xrefs: 0040C3A9

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: Find$CloseFile$FirstNext
String ID: AppData$\Mozilla\Firefox\Profiles\$\cookies.sqlite
API String ID: 1164774033-405221262
Opcode ID: a3ce9096115a305f75ad61f69b74af84364be51e2e7fe5988e77a5b22bdf061e
Instruction ID: 33618048715e6b2d4a7b39963b1e19558724686ef99070a322097c87c0ca4c0c
Opcode Fuzzy Hash: a3ce9096115a305f75ad61f69b74af84364be51e2e7fe5988e77a5b22bdf061e
Instruction Fuzzy Hash: 59313E31500219AACB14E761DC9A9EE7778AF50719F10057FF106B21E2EF7C9946CA4D

Function 0041C322 Relevance: 13.6, APIs: 9, Instructions: 106fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,?,?,?,?,?,00474EE0,?), ref: 0041C37D
FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,00474EE0,?), ref: 0041C3AD
SetFileAttributesW.KERNEL32(?,00000080,?,?,?,?,?,00474EE0,?), ref: 0041C41F
DeleteFileW.KERNEL32(?,?,?,?,?,?,00474EE0,?), ref: 0041C42C

Part of subcall function 0041C322: RemoveDirectoryW.KERNEL32(?,?,?,?,?,?,00474EE0,?), ref: 0041C402

GetLastError.KERNEL32(?,?,?,?,?,00474EE0,?), ref: 0041C44D
FindClose.KERNEL32(00000000,?,?,?,?,?,00474EE0,?), ref: 0041C463
RemoveDirectoryW.KERNEL32(00000000,?,?,?,?,?,00474EE0,?), ref: 0041C46A
FindClose.KERNEL32(00000000,?,?,?,?,?,00474EE0,?), ref: 0041C473

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: FileFind$CloseDirectoryRemove$AttributesDeleteErrorFirstLastNext
String ID:
API String ID: 2341273852-0
Opcode ID: 62a2abd498f26ce669d7ffff052401bb4e8331d26592ec8f44b35c1b9ec2a307
Instruction ID: 53b23dfad01ba0d5beec27b7c27070a1caf437d6ccbc5233b8522822963bc02e
Opcode Fuzzy Hash: 62a2abd498f26ce669d7ffff052401bb4e8331d26592ec8f44b35c1b9ec2a307
Instruction Fuzzy Hash: 4A31807284431CAADB24E761DC89EEB736CAF09305F0405FBF559D2051EB3DDAC98A58

Function 00419B86 Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 245fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?), ref: 00419DDC
FindNextFileW.KERNEL32(00000000,?,?), ref: 00419EA8

Part of subcall function 0041C516: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000,00000000,?,?,00000000,0040412F,00465E84), ref: 0041C52F

Strings

NG, xrefs: 00419BB6
PXG, xrefs: 00419EBF
8SG, xrefs: 00419C7C
PG, xrefs: 00419C66
PXG, xrefs: 00419D59

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: File$Find$CreateFirstNext
String ID: 8SG$PXG$PXG$NG$PG
API String ID: 341183262-3812160132
Opcode ID: 6057b9e4d533bd61cce25273c00b3c03e778ec8b0db3b3232dce134713adbecb
Instruction ID: 0eaaaed992bec346a468a6d62c1d6888972f0568f5be94e2eef244f320132bd5
Opcode Fuzzy Hash: 6057b9e4d533bd61cce25273c00b3c03e778ec8b0db3b3232dce134713adbecb
Instruction Fuzzy Hash: 998151315083415BC314FB22C856EEFB3A9AF90344F90493FF546671E2EF789A49C69A

Function 0040A2F3 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 63windowCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00000000), ref: 0040A30E
SetWindowsHookExA.USER32(0000000D,0040A2DF,00000000), ref: 0040A31C
GetLastError.KERNEL32 ref: 0040A328

Part of subcall function 0041B580: GetLocalTime.KERNEL32(00000000), ref: 0041B59A

GetMessageA.USER32(?,00000000,00000000,00000000), ref: 0040A376
TranslateMessage.USER32(?), ref: 0040A385
DispatchMessageA.USER32(?), ref: 0040A390

Strings

Keylogger initialization failure: error , xrefs: 0040A33C

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: Message$DispatchErrorHandleHookLastLocalModuleTimeTranslateWindows
String ID: Keylogger initialization failure: error
API String ID: 3219506041-952744263
Opcode ID: d8c8387710f3476d83fdaf4ec3d7d354e2c1b68a13aa6285ca24eae745b098e4
Instruction ID: 8743f2250fb8cae6a99ae5fb3d4b34fe2baf279f6720e4878f05ffc9670b3ffc
Opcode Fuzzy Hash: d8c8387710f3476d83fdaf4ec3d7d354e2c1b68a13aa6285ca24eae745b098e4
Instruction Fuzzy Hash: 6011BF31510301EBC710BB769D0986B77ACEA95715B20097EFC82E22D1EB34C910CBAA

Function 0040A41B Relevance: 12.1, APIs: 8, Instructions: 112keyboardthreadCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 0040A451
GetWindowThreadProcessId.USER32(00000000,?), ref: 0040A45D
GetKeyboardLayout.USER32(00000000), ref: 0040A464
GetKeyState.USER32(00000010), ref: 0040A46E
GetKeyboardState.USER32(?), ref: 0040A479
ToUnicodeEx.USER32(?,?,?,?,00000010,00000000,00000000), ref: 0040A49C
ToUnicodeEx.USER32(?,?,00000010,00000000,00000000), ref: 0040A4FC
ToUnicodeEx.USER32(?,?,?,?,00000010,00000000,00000000), ref: 0040A535

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: Unicode$KeyboardStateWindow$ForegroundLayoutProcessThread
String ID:
API String ID: 1888522110-0
Opcode ID: 6b13a39d4d7102bd722f9bbc25ae7d3563ebcd6996124b6635e543b06ec7d5c4
Instruction ID: fd17a64e9e4f7f825196359ceba3421c6f582a70c0a4c9d277f8a97da3dc7bda
Opcode Fuzzy Hash: 6b13a39d4d7102bd722f9bbc25ae7d3563ebcd6996124b6635e543b06ec7d5c4
Instruction Fuzzy Hash: 1E316D72504308BFD700DF90DC45F9B7BECBB88744F00083AB645D61A0D7B5E9498BA6

Function 00414005 Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 382registrylibraryloaderCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 004140D8
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 004140E4

Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36

LoadLibraryA.KERNEL32(Shlwapi.dll,SHDeleteKeyW,00000000,00000001), ref: 004142A5
GetProcAddress.KERNEL32(00000000), ref: 004142AC

Strings

Shlwapi.dll, xrefs: 004142A0
SHDeleteKeyW, xrefs: 0041429B

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: AddressCloseCreateLibraryLoadProcsend
String ID: SHDeleteKeyW$Shlwapi.dll
API String ID: 2127411465-314212984
Opcode ID: 6a0141b561faf8d52ce37dfc1c653a2c94c49b9733679f3dde35f2d6581a50f1
Instruction ID: 51cedef5a77654bf04fe1bae55708f30d4330cefe0c145b830acf249c6506b6e
Opcode Fuzzy Hash: 6a0141b561faf8d52ce37dfc1c653a2c94c49b9733679f3dde35f2d6581a50f1
Instruction Fuzzy Hash: 16B1F671A0430066CA14FB76DC579AF36A85F91788F40053FB906771E2EE7D8A48C6DA

Function 004167EF Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 97libraryloadershutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 0041798D: GetCurrentProcess.KERNEL32(00000028,?), ref: 0041799A
Part of subcall function 0041798D: OpenProcessToken.ADVAPI32(00000000), ref: 004179A1
Part of subcall function 0041798D: LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 004179B3
Part of subcall function 0041798D: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 004179D2
Part of subcall function 0041798D: GetLastError.KERNEL32 ref: 004179D8

ExitWindowsEx.USER32(00000000,00000001), ref: 00416891
LoadLibraryA.KERNEL32(PowrProf.dll,SetSuspendState,00000000,00000000,00000000), ref: 004168A6
GetProcAddress.KERNEL32(00000000), ref: 004168AD

Strings

!D@, xrefs: 004170C4
PowrProf.dll, xrefs: 004168A1
SetSuspendState, xrefs: 0041689C

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: ProcessToken$AddressAdjustCurrentErrorExitLastLibraryLoadLookupOpenPrivilegePrivilegesProcValueWindows
String ID: !D@$PowrProf.dll$SetSuspendState
API String ID: 1589313981-2876530381
Opcode ID: d444d066f4fdad4d35a34b464d43113e8d04464aaad5ec9ebe6089587c88fb6e
Instruction ID: 272f3f60014ab8f8f2fa2781f50e1ac7d9ab3f628c5d0f86ef79d7992e461550
Opcode Fuzzy Hash: d444d066f4fdad4d35a34b464d43113e8d04464aaad5ec9ebe6089587c88fb6e
Instruction Fuzzy Hash: D821B17060430166CA14FBB28856ABF36599F41388F41087FB501671D2EF3DD845C76E

Function 0041B411 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 69networkfileCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0041B438
InternetOpenUrlW.WININET(00000000,http://geoplugin.net/json.gp,00000000,00000000,80000000,00000000), ref: 0041B44E
InternetReadFile.WININET(00000000,00000000,0000FFFF,00000000), ref: 0041B467
InternetCloseHandle.WININET(00000000), ref: 0041B4AD
InternetCloseHandle.WININET(00000000), ref: 0041B4B0

Strings

http://geoplugin.net/json.gp, xrefs: 0041B448

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleOpen$FileRead
String ID: http://geoplugin.net/json.gp
API String ID: 3121278467-91888290
Opcode ID: b01590e2803785cbe291e15456c0bc7acaef33a62877e88be574051367ac5976
Instruction ID: e320c318363c88f1c040182635621d8729538b68a2f0080144892bf513bd3cc2
Opcode Fuzzy Hash: b01590e2803785cbe291e15456c0bc7acaef33a62877e88be574051367ac5976
Instruction Fuzzy Hash: 011198311053126BD224AB269C49EBF7F9CEF86765F10043EF945A2282DB689C44C6FA

Function 0040BA4D Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 49fileCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNEL32(00000000,\AppData\Local\Google\Chrome\User Data\Default\Login Data), ref: 0040BA89
GetLastError.KERNEL32 ref: 0040BA93

Strings

[Chrome StoredLogins not found], xrefs: 0040BAAD
\AppData\Local\Google\Chrome\User Data\Default\Login Data, xrefs: 0040BA54
UserProfile, xrefs: 0040BA59
[Chrome StoredLogins found, cleared!], xrefs: 0040BAB9

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: DeleteErrorFileLast
String ID: [Chrome StoredLogins found, cleared!]$[Chrome StoredLogins not found]$UserProfile$\AppData\Local\Google\Chrome\User Data\Default\Login Data
API String ID: 2018770650-1062637481
Opcode ID: d6312413c91956911aeebdf781d371ca6745e6f6be180b60b08b021ffbe32e09
Instruction ID: 0532e36a1aab116e50a9f1d1704ee325f44086adb43c50cfffb7bf5285f9a594
Opcode Fuzzy Hash: d6312413c91956911aeebdf781d371ca6745e6f6be180b60b08b021ffbe32e09
Instruction Fuzzy Hash: 76018F61A402056ACB04B7B6DC5B9BE7724A921704B50057FF806722D2FE7D49098BDE

Function 0041798D Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028,?), ref: 0041799A
OpenProcessToken.ADVAPI32(00000000), ref: 004179A1
LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 004179B3
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 004179D2
GetLastError.KERNEL32 ref: 004179D8

Strings

SeShutdownPrivilege, xrefs: 004179AD

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: ProcessToken$AdjustCurrentErrorLastLookupOpenPrivilegePrivilegesValue
String ID: SeShutdownPrivilege
API String ID: 3534403312-3733053543
Opcode ID: d49d9c43419eaec1bfbdc5cb8a800583ef6843b46de48ba71f06d4aa9fea9060
Instruction ID: 35ac2027e355ce869dd6e937a138cd84cb59798e299a7bc9dfe05b1c572390d3
Opcode Fuzzy Hash: d49d9c43419eaec1bfbdc5cb8a800583ef6843b46de48ba71f06d4aa9fea9060
Instruction Fuzzy Hash: 38F03A71802229FBDB10ABA1EC4DAEF7FBCEF05612F100465B909A1152D7348E04CBB5

Function 0040928E Relevance: 9.3, APIs: 6, Instructions: 293fileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00409293

Part of subcall function 004048C8: connect.WS2_32(?,?,?), ref: 004048E0

Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36

__CxxThrowException@8.LIBVCRUNTIME ref: 0040932F
FindFirstFileW.KERNEL32(00000000,?,?,?,00000064), ref: 0040938D
FindNextFileW.KERNEL32(00000000,?), ref: 004093E5
FindClose.KERNEL32(00000000), ref: 004093FC

Part of subcall function 00404E26: WaitForSingleObject.KERNEL32(?,000000FF,00000000,00474EF8,PkGNG,00000000,00474EF8,00404CA8,00000000,?,?,?,00474EF8,?), ref: 00404E38
Part of subcall function 00404E26: SetEvent.KERNEL32(?), ref: 00404E43
Part of subcall function 00404E26: CloseHandle.KERNEL32(?), ref: 00404E4C

FindClose.KERNEL32(00000000), ref: 004095F4

Part of subcall function 00404AA1: WaitForSingleObject.KERNEL32(?,00000000,00401A45,?,?,00000004,?,?,00000004,00476B50,00474EE0,00000000), ref: 00404B47
Part of subcall function 00404AA1: SetEvent.KERNEL32(?,?,?,00000004,?,?,00000004,00476B50,00474EE0,00000000,?,?,?,?,?,00401A45), ref: 00404B75

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: Find$Close$EventFileObjectSingleWait$Exception@8FirstH_prologHandleNextThrowconnectsend
String ID:
API String ID: 1824512719-0
Opcode ID: a810edf30761c72987c4cb58374515ca85b7de027ac2e2c904d565530509331a
Instruction ID: 89df7f8b75d3b77417eb58d09b4f39b7dfb13bde992cfd9524fc7595df83f5be
Opcode Fuzzy Hash: a810edf30761c72987c4cb58374515ca85b7de027ac2e2c904d565530509331a
Instruction Fuzzy Hash: 34B19D32900109AACB14EBA1DD92AEDB379AF44314F50417FF506B60E2EF785F49CB59

Function 00446270 Relevance: 9.2, APIs: 2, Strings: 3, Instructions: 464COMMONLIBRARYCODE

Download Yara Rule

Strings

FSE, xrefs: 004466D8, 004464C2, 00446351
FSE, xrefs: 0044628D, 00446438, 0044665C, 004465F6, 00446486, 00446414
PkGNG, xrefs: 00446272

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID:
String ID: FSE$FSE$PkGNG
API String ID: 0-1266307253
Opcode ID: 321144b451aceacc10be44255a5eb5313de52b8189587c3c0fdae4375c3dd106
Instruction ID: f88ef0336175cd1615890b4a552d96ffb4623b3c947145a2eaf1ae153763923c
Opcode Fuzzy Hash: 321144b451aceacc10be44255a5eb5313de52b8189587c3c0fdae4375c3dd106
Instruction Fuzzy Hash: AA025D71E002199BEF14CFA9D8806AEFBF1FF49314F26816AD819E7384D734AD418B85

Function 0041AADB Relevance: 9.0, APIs: 6, Instructions: 39serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,00000010,00000000,00000001,?,0041A731,00000000), ref: 0041AAE4
OpenServiceW.ADVAPI32(00000000,00000000,00000010,?,0041A731,00000000), ref: 0041AAF9
CloseServiceHandle.ADVAPI32(00000000,?,0041A731,00000000), ref: 0041AB06
StartServiceW.ADVAPI32(00000000,00000000,00000000,?,0041A731,00000000), ref: 0041AB11
CloseServiceHandle.ADVAPI32(00000000,?,0041A731,00000000), ref: 0041AB23
CloseServiceHandle.ADVAPI32(00000000,?,0041A731,00000000), ref: 0041AB26

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: Service$CloseHandle$Open$ManagerStart
String ID:
API String ID: 276877138-0
Opcode ID: 9428b136f56b7ac5d2013585799c428180de648bb4d6702bc273cde58ba3a705
Instruction ID: 14dbf03deabb1432b93a26d2ddf90514dbbc411f15d31c7908333a88c2a5d316
Opcode Fuzzy Hash: 9428b136f56b7ac5d2013585799c428180de648bb4d6702bc273cde58ba3a705
Instruction Fuzzy Hash: FEF0E971141225AFD2115B209C88DFF276CDF85B66B00082AF901921919B68CC45E579

Function 0040F7E2 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 88sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00413584: RegOpenKeyExA.KERNELBASE(80000001,00000000,00000000,00020019,00000000,00000000), ref: 004135A4
Part of subcall function 00413584: RegQueryValueExA.ADVAPI32(00000000,?,00000000,?,?,?), ref: 004135C2
Part of subcall function 00413584: RegCloseKey.ADVAPI32(00000000), ref: 004135CD

Sleep.KERNEL32(00000BB8), ref: 0040F896
ExitProcess.KERNEL32 ref: 0040F905

Strings

5.1.3 Pro, xrefs: 0040F871, 0040F8DE
pth_unenc, xrefs: 0040F7F8, 0040F83F, 0040F8AC
override, xrefs: 0040F807

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: CloseExitOpenProcessQuerySleepValue
String ID: 5.1.3 Pro$override$pth_unenc
API String ID: 2281282204-1392497409
Opcode ID: 8dc85b8ab8054d92d7c853158ed1b7be28c6e4132a02577863bfe4ed9005faa9
Instruction ID: d275b5d15c9ff05a0ec0da3c9587874d7690dc7fa5d0ec02d6e8a4ede61593ab
Opcode Fuzzy Hash: 8dc85b8ab8054d92d7c853158ed1b7be28c6e4132a02577863bfe4ed9005faa9
Instruction Fuzzy Hash: 5921E171B0420127D6087676885B6AE399A9B80708F50453FF409672D7FF7C8E0483AF

Function 004524BC Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 86COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002), ref: 00452555
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002), ref: 0045257E
GetACP.KERNEL32 ref: 00452593

Strings

ACP, xrefs: 004524DA
OCP, xrefs: 00452510

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 61c68c86ee519c97ea86d50e82dd2762e668b1fdc7e44e8e256cfbf4b452970f
Instruction ID: 097c3b5166b2d36aca1cb621bb06e922528e2ea4561953c90108b9915aa2a338
Opcode Fuzzy Hash: 61c68c86ee519c97ea86d50e82dd2762e668b1fdc7e44e8e256cfbf4b452970f
Instruction Fuzzy Hash: 7E21F932600108B6D734CF14CA10A9B73A6EB16B53B564467ED09D7312F7B6DD44C398

Function 0041B539 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(SETTINGS,0000000A,00000000), ref: 0041B54A
LoadResource.KERNEL32(00000000,?,?,0040F419,00000000), ref: 0041B55E
LockResource.KERNEL32(00000000,?,?,0040F419,00000000), ref: 0041B565
SizeofResource.KERNEL32(00000000,?,?,0040F419,00000000), ref: 0041B574

Strings

SETTINGS, xrefs: 0041B53D

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: Resource$FindLoadLockSizeof
String ID: SETTINGS
API String ID: 3473537107-594951305
Opcode ID: a45aaf07b9511fe1cfb91064365b640b81f442c86eb18a115f7d7951e0b61df2
Instruction ID: d04f7a3eece584ab18b37ce022e38df3785cd6d6757b7dd0dc659012c7d5cbc3
Opcode Fuzzy Hash: a45aaf07b9511fe1cfb91064365b640b81f442c86eb18a115f7d7951e0b61df2
Instruction Fuzzy Hash: 8EE01A76600B22EBEB211BB1AC4CD863E29F7C97637140075F90586231CB798840DA98

Function 004096A0 Relevance: 7.7, APIs: 5, Instructions: 222fileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004096A5
FindFirstFileW.KERNEL32(00000000,?,00000000,00000000,?), ref: 0040971D
FindNextFileW.KERNEL32(00000000,?), ref: 00409746
FindClose.KERNEL32(000000FF,?,?,?,?,?,?), ref: 0040975D

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstH_prologNext
String ID:
API String ID: 1157919129-0
Opcode ID: dd0421224294bb62472ab89505622d6763c67607e6c73e6d1c5958e8fabc376b
Instruction ID: 8e52766585a78a9bd0f7e398a9017c7fe376444e683812dd136b20495b515571
Opcode Fuzzy Hash: dd0421224294bb62472ab89505622d6763c67607e6c73e6d1c5958e8fabc376b
Instruction Fuzzy Hash: 7F814C328001099BCB15EBA2DC969EDB378AF14318F10417FE506B71E2EF789E49CB58

Function 00452690 Relevance: 7.7, APIs: 5, Instructions: 188COMMON

Download Yara Rule

APIs

Part of subcall function 00448295: GetLastError.KERNEL32(?,0043F770,0043A875,0043F770,00474EF8,PkGNG,0043CE65,FF8BC35D,00474EF8,00474EF8), ref: 00448299
Part of subcall function 00448295: _free.LIBCMT ref: 004482CC
Part of subcall function 00448295: SetLastError.KERNEL32(00000000,?,?,00000000), ref: 0044830D
Part of subcall function 00448295: _abort.LIBCMT ref: 00448313

Part of subcall function 00448295: _free.LIBCMT ref: 004482F4
Part of subcall function 00448295: SetLastError.KERNEL32(00000000,?,?,00000000), ref: 00448301

GetUserDefaultLCID.KERNEL32 ref: 0045279C
IsValidCodePage.KERNEL32(00000000), ref: 004527F7
IsValidLocale.KERNEL32(?,00000001), ref: 00452806
GetLocaleInfoW.KERNEL32(?,00001001,?,00000040,?,?,00000055,00000000,?,?,00000055,00000000), ref: 0045284E
GetLocaleInfoW.KERNEL32(?,00001002,?,00000040), ref: 0045286D

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: ErrorLastLocale$InfoValid_free$CodeDefaultPageUser_abort
String ID:
API String ID: 745075371-0
Opcode ID: d20e60e436924f937cd003670a139ed53a354482d02232a94d44678fcfb69b99
Instruction ID: 3c84011e7dbdf7a6f9673bc5a23f9f2f22d5020eb6794df094384b3d0215d6fb
Opcode Fuzzy Hash: d20e60e436924f937cd003670a139ed53a354482d02232a94d44678fcfb69b99
Instruction Fuzzy Hash: 9B518571900205ABDB10DFA5CD45ABF77B8EF0A702F04046BED14E7292E7B89948CB69

Function 00408847 Relevance: 7.7, APIs: 5, Instructions: 186fileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040884C
FindFirstFileW.KERNEL32(00000000,?,00466618,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00408905
__CxxThrowException@8.LIBVCRUNTIME ref: 0040892D
FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0040893A
FindClose.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00408A50

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: Find$File$CloseException@8FirstH_prologNextThrow
String ID:
API String ID: 1771804793-0
Opcode ID: c12026e9037f7077d6674168e11e0174e172a37dfeca1e693adefd43d85b88e8
Instruction ID: 0d5560aa06bbfb8d15084ed76e809f646cede1ce68103026aeaac9ba950e1e68
Opcode Fuzzy Hash: c12026e9037f7077d6674168e11e0174e172a37dfeca1e693adefd43d85b88e8
Instruction Fuzzy Hash: 9D517F72900209AACB04FB65DD569ED7778AF10308F50417FB906B71E2EF389B49CB89

Function 00406EEB Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 222filenetworkCOMMON

Download Yara Rule

APIs

ShellExecuteW.SHELL32(00000000,open,00000000,00000000,00000000,00000001), ref: 00406FF7
URLDownloadToFileW.URLMON(00000000,00000000,00000004,00000000,00000000), ref: 004070DB

Strings

C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe, xrefs: 00407042, 0040716A
open, xrefs: 00406FF1

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: DownloadExecuteFileShell
String ID: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe$open
API String ID: 2825088817-1047274334
Opcode ID: 194bc319dbbf73870cb717309eca5eed55f05450b30b29468f4271e2579073ce
Instruction ID: 89f65c5a2840bfed21b3c91f130df949caec66636536da5e2ea9f2eef63816fc
Opcode Fuzzy Hash: 194bc319dbbf73870cb717309eca5eed55f05450b30b29468f4271e2579073ce
Instruction Fuzzy Hash: 5261B371A0830166CA14FB76C8569BE37A59F81758F40093FB9427B2D3EE3C9905C69B

Function 00407877 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 86fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,?,?,00000000), ref: 00407892
FindNextFileW.KERNEL32(00000000,?,?,?,00000000), ref: 0040795A

Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36

Strings

XPG, xrefs: 004078B2
XPG, xrefs: 00407975

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: FileFind$FirstNextsend
String ID: XPG$XPG
API String ID: 4113138495-1962359302
Opcode ID: d9722b1f8dd4e3be1274e677256ccf7990f5e649a2613ef60cc85d6cc6a2ecd3
Instruction ID: fedc3c23448d2be437c2d68ef58725aa3c97e5c0e74d328490a6b39f64eed896
Opcode Fuzzy Hash: d9722b1f8dd4e3be1274e677256ccf7990f5e649a2613ef60cc85d6cc6a2ecd3
Instruction Fuzzy Hash: 2D21A4315083015BC714FB61D895CEFB3ACAF90358F40493EF696620E1FF78AA098A5B

Function 0041CA73 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 83COMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000014,00000000,00000000,00000003), ref: 0041CB68

Part of subcall function 004137AA: RegCreateKeyA.ADVAPI32(80000001,Control Panel\Desktop,0046612C), ref: 004137B9
Part of subcall function 004137AA: RegSetValueExA.ADVAPI32(0046612C,?,00000000,?,00000000,00000000,Control Panel\Desktop,?,?,0041CB42,WallpaperStyle,0046612C,00000001,00474EE0,00000000), ref: 004137E1
Part of subcall function 004137AA: RegCloseKey.ADVAPI32(0046612C,?,?,0041CB42,WallpaperStyle,0046612C,00000001,00474EE0,00000000,?,00408798,00000001), ref: 004137EC

Strings

Control Panel\Desktop, xrefs: 0041CAAE, 0041CAE1, 0041CB31
WallpaperStyle, xrefs: 0041CAB3, 0041CAE6, 0041CB36
TileWallpaper, xrefs: 0041CB52

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: CloseCreateInfoParametersSystemValue
String ID: Control Panel\Desktop$TileWallpaper$WallpaperStyle
API String ID: 4127273184-3576401099
Opcode ID: f5c8ef2c27851cf1013244d94d6a0450d36d3a4faca39a9ae70033779c708183
Instruction ID: 8ac436d711b2fc3476497f69dc57c3b9a547a247a31514f467319d0910454585
Opcode Fuzzy Hash: f5c8ef2c27851cf1013244d94d6a0450d36d3a4faca39a9ae70033779c708183
Instruction Fuzzy Hash: D7118472BC425022E81831396D9BFBE28068343F61F54456BF6022A6CAE4CF6A9143CF

Function 0041CA6D Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 44COMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000014,00000000,00000000,00000003), ref: 0041CB68

Part of subcall function 004137AA: RegCreateKeyA.ADVAPI32(80000001,Control Panel\Desktop,0046612C), ref: 004137B9
Part of subcall function 004137AA: RegSetValueExA.ADVAPI32(0046612C,?,00000000,?,00000000,00000000,Control Panel\Desktop,?,?,0041CB42,WallpaperStyle,0046612C,00000001,00474EE0,00000000), ref: 004137E1
Part of subcall function 004137AA: RegCloseKey.ADVAPI32(0046612C,?,?,0041CB42,WallpaperStyle,0046612C,00000001,00474EE0,00000000,?,00408798,00000001), ref: 004137EC

Strings

Control Panel\Desktop, xrefs: 0041CAAE
WallpaperStyle, xrefs: 0041CAB3
TileWallpaper, xrefs: 0041CB52

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: CloseCreateInfoParametersSystemValue
String ID: Control Panel\Desktop$TileWallpaper$WallpaperStyle
API String ID: 4127273184-3576401099
Opcode ID: 1be57db16bc80fa37d3a9003a2ea5f51ddd37d0b47a9f0501ac93dd6eaa9563f
Instruction ID: 1d4fccf664b116fd7e9026c1daa93839c24cbfeedf45b0e65449f5778d70c30d
Opcode Fuzzy Hash: 1be57db16bc80fa37d3a9003a2ea5f51ddd37d0b47a9f0501ac93dd6eaa9563f
Instruction Fuzzy Hash: DBF0C272BC421022D82931B96DAFBFE18058742F61F15412BF302652CAD4CE6A81428F

Function 00443355 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000003,PkGNG,0044332B,00000003,0046E958,0000000C,00443482,00000003,00000002,00000000,PkGNG,004461B7,00000003), ref: 00443376
TerminateProcess.KERNEL32(00000000), ref: 0044337D
ExitProcess.KERNEL32 ref: 0044338F

Strings

PkGNG, xrefs: 00443357

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: Process$CurrentExitTerminate
String ID: PkGNG
API String ID: 1703294689-263838557
Opcode ID: 4e3b9aa1e9039f050651c305726e439f17232b6e89e74059b12d513dd76054c6
Instruction ID: 4b22f3a5ffe79ca7dfb81d814e561f82a31e4bef9a776fe0bb9daccb8e878f4b
Opcode Fuzzy Hash: 4e3b9aa1e9039f050651c305726e439f17232b6e89e74059b12d513dd76054c6
Instruction Fuzzy Hash: 9FE0B635401608FBDF11AF55DE09A5D3BAAEB40B56F005469FC498A272CF79EE42CB88

Function 00451D58 Relevance: 6.2, APIs: 4, Instructions: 236COMMON

Download Yara Rule

APIs

Part of subcall function 00448295: GetLastError.KERNEL32(?,0043F770,0043A875,0043F770,00474EF8,PkGNG,0043CE65,FF8BC35D,00474EF8,00474EF8), ref: 00448299
Part of subcall function 00448295: _free.LIBCMT ref: 004482CC
Part of subcall function 00448295: SetLastError.KERNEL32(00000000,?,?,00000000), ref: 0044830D
Part of subcall function 00448295: _abort.LIBCMT ref: 00448313

IsValidCodePage.KERNEL32(00000000), ref: 00451E3A
_wcschr.LIBVCRUNTIME ref: 00451ECA
_wcschr.LIBVCRUNTIME ref: 00451ED8
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,?,00000000,?), ref: 00451F7B

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: ErrorLast_wcschr$CodeInfoLocalePageValid_abort_free
String ID:
API String ID: 4212172061-0
Opcode ID: 715b93ef3f017ee4fea0110e94a068843382a27aff4af5d2daf4b4fdd25eb79d
Instruction ID: 2c98265d6c7a89d72caae9d33925a6d6107158c78f730362dcab12f0c71d6669
Opcode Fuzzy Hash: 715b93ef3f017ee4fea0110e94a068843382a27aff4af5d2daf4b4fdd25eb79d
Instruction Fuzzy Hash: 7F611976600606AAD714AB75CC42FBB73A8EF04306F14056FFD05DB292EB78E948C769

Function 0044942D Relevance: 6.1, APIs: 4, Instructions: 90timeCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0044943D

Part of subcall function 00446802: HeapFree.KERNEL32(00000000,00000000,?,00450CEF,?,00000000,?,00000000,?,00450F93,?,00000007,?,?,004514DE,?), ref: 00446818
Part of subcall function 00446802: GetLastError.KERNEL32(?,?,00450CEF,?,00000000,?,00000000,?,00450F93,?,00000007,?,?,004514DE,?,?), ref: 0044682A

GetTimeZoneInformation.KERNEL32 ref: 0044944F
WideCharToMultiByte.KERNEL32(00000000,?,00472764,000000FF,?,0000003F,?,?), ref: 004494C7
WideCharToMultiByte.KERNEL32(00000000,?,004727B8,000000FF,?,0000003F,?,?,?,00472764,000000FF,?,0000003F,?,?), ref: 004494F4

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$ErrorFreeHeapInformationLastTimeZone_free
String ID:
API String ID: 806657224-0
Opcode ID: aeb37be2ef55a5d103ab6b4be93faccb032caed00e04dd613037f001c8cf3bb4
Instruction ID: d52e19fe16dfdee109f40d049db845c42e01460133d57766726f1505d2785bee
Opcode Fuzzy Hash: aeb37be2ef55a5d103ab6b4be93faccb032caed00e04dd613037f001c8cf3bb4
Instruction Fuzzy Hash: 2D31F371904205EFDB15DF69CE8186EBBB8FF0572072446AFE024A73A1D3748D41EB28

Function 00452143 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 00448295: GetLastError.KERNEL32(?,0043F770,0043A875,0043F770,00474EF8,PkGNG,0043CE65,FF8BC35D,00474EF8,00474EF8), ref: 00448299
Part of subcall function 00448295: _free.LIBCMT ref: 004482CC
Part of subcall function 00448295: SetLastError.KERNEL32(00000000,?,?,00000000), ref: 0044830D
Part of subcall function 00448295: _abort.LIBCMT ref: 00448313

Part of subcall function 00448295: _free.LIBCMT ref: 004482F4
Part of subcall function 00448295: SetLastError.KERNEL32(00000000,?,?,00000000), ref: 00448301

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00452197
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 004521E8
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 004522A8

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: ErrorInfoLastLocale$_free$_abort
String ID:
API String ID: 2829624132-0
Opcode ID: 711793eb573856c12bfad09b44d2354213151b00c391b4c97ce46ce3e25352d9
Instruction ID: 283aa9570716a6929da4b93cb0bca45b8c77d553a5ebfd19e37a994bad1de6ac
Opcode Fuzzy Hash: 711793eb573856c12bfad09b44d2354213151b00c391b4c97ce46ce3e25352d9
Instruction Fuzzy Hash: F361A235500207ABDF289F24CE82B7A77A8EF05306F1441BBED05C6656E7BC9D89CB58

Function 0043BB71 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 0043BC69
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0043BC73
UnhandledExceptionFilter.KERNEL32(?), ref: 0043BC80

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 1e0b73e88f7870ac8a7e49df57248e9339733cda2bb7518ac33a0b9eb889d704
Instruction ID: 25e88f5a56b9fbea854716c485460a06fbe33a825339a9765be54c88dd7cea35
Opcode Fuzzy Hash: 1e0b73e88f7870ac8a7e49df57248e9339733cda2bb7518ac33a0b9eb889d704
Instruction Fuzzy Hash: 0431D374901218ABCB21DF65D9887CDBBB8EF0C311F5051EAE81CA7251EB749F818F48

Function 004338C8 Relevance: 4.5, APIs: 3, Instructions: 30encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000001,F0000000,?,?,00433550,00000034,?,?,00000000), ref: 004338DA
CryptGenRandom.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,PkGNG,004335E3,?,?,?), ref: 004338F0
CryptReleaseContext.ADVAPI32(?,00000000,?,?,?,?,?,?,?,?,PkGNG,004335E3,?,?,?,0041E2E2), ref: 00433902

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: Crypt$Context$AcquireRandomRelease
String ID:
API String ID: 1815803762-0
Opcode ID: 81ae4bbc27a0383ddd18646ed4cc5f88ed8aa0b0f15284250c3048956b898281
Instruction ID: d68cd6f5f98cbfa2ab0450769c499d20ea76a36e668e3df749659bd42d9a4b78
Opcode Fuzzy Hash: 81ae4bbc27a0383ddd18646ed4cc5f88ed8aa0b0f15284250c3048956b898281
Instruction Fuzzy Hash: 40E09A31208310FBEB301F21AC08F573AA5EF89B66F200A3AF256E40E4D6A68801965C

Function 0040B749 Relevance: 4.5, APIs: 3, Instructions: 19clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(00000000), ref: 0040B74C
GetClipboardData.USER32(0000000D), ref: 0040B758
CloseClipboard.USER32 ref: 0040B760

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: Clipboard$CloseDataOpen
String ID:
API String ID: 2058664381-0
Opcode ID: 26d649817908997ada01c7e81b47d9ed8d660a846a8981428adfc510ab3c4a2f
Instruction ID: 1c65eecdd0087a0ffd0b0a04a5b63b9ff0c479b34dfa65f2e767e94bdce73387
Opcode Fuzzy Hash: 26d649817908997ada01c7e81b47d9ed8d660a846a8981428adfc510ab3c4a2f
Instruction Fuzzy Hash: 45E0EC31745320EFC3206B609C49F9B6AA4DF85B52F05443AB905BB2E5DB78CC4086AD

Function 00434CB6 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 134COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A,00000000), ref: 00434CCF

Strings

, xrefs: 00434E36

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-3916222277
Opcode ID: 4259bdeace04940204f61aa74a979230364aaba3051b8f8e0efcae6fb7ed6494
Instruction ID: 5e37b39ef68b784d6588b9ddffa6793edf4c3ade0924e8be62ba08be237937aa
Opcode Fuzzy Hash: 4259bdeace04940204f61aa74a979230364aaba3051b8f8e0efcae6fb7ed6494
Instruction Fuzzy Hash: E4515B71D002488FEB24CF69D98579EBBF4FB88314F24956BD419EB264D378A940CF98

Function 0044896D Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,00000002,00000000,?,20001004,?,20001004,?,00000002,?,?,?,?,00000004), ref: 004489C0

Strings

GetLocaleInfoEx, xrefs: 00448988

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: GetLocaleInfoEx
API String ID: 2299586839-2904428671
Opcode ID: 53574c2ecf56bfb558b2c309ca3eb91f9c7a0a18e0f2245662e0b0bedf18becb
Instruction ID: 58f0578312c774904006f9ed4749830948a62bec6dc8fde4d932476f73229d15
Opcode Fuzzy Hash: 53574c2ecf56bfb558b2c309ca3eb91f9c7a0a18e0f2245662e0b0bedf18becb
Instruction Fuzzy Hash: C0F0F631640608FBDB016F61DC06F6E7B25EB04751F00056EFC0966251DE368D2096DE

Function 004120B2 Relevance: 2.6, APIs: 2, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,?,00000000,00411F72,?,?,?,?,00000000), ref: 00412122
HeapFree.KERNEL32(00000000,?,?,?,?,00000000), ref: 00412129

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 95356b50ae1c40d028bb7c10486cf6eec28d3cbd66e590edfc92b155960a397c
Instruction ID: dd486cb6b879bf1be37f4e59d5b3b18419fca2aff5c7e471244091183f2ba527
Opcode Fuzzy Hash: 95356b50ae1c40d028bb7c10486cf6eec28d3cbd66e590edfc92b155960a397c
Instruction Fuzzy Hash: 0D113632000B11AFC7309F54DE85957BBEAFF08715305892EF29682922CB75FCA0CB48

Function 00452393 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00448295: GetLastError.KERNEL32(?,0043F770,0043A875,0043F770,00474EF8,PkGNG,0043CE65,FF8BC35D,00474EF8,00474EF8), ref: 00448299
Part of subcall function 00448295: _free.LIBCMT ref: 004482CC
Part of subcall function 00448295: SetLastError.KERNEL32(00000000,?,?,00000000), ref: 0044830D
Part of subcall function 00448295: _abort.LIBCMT ref: 00448313

Part of subcall function 00448295: _free.LIBCMT ref: 004482F4
Part of subcall function 00448295: SetLastError.KERNEL32(00000000,?,?,00000000), ref: 00448301

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 004523E7

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: ErrorLast$_free$InfoLocale_abort
String ID:
API String ID: 1663032902-0
Opcode ID: b4047fd74fafd511f87100a415ff7352fa71784cc782813174b617cf7262d9f7
Instruction ID: 2d4dd0c1c30cd12b50dfb53a4a1f7f5f9091958bb121381f53cce851c87d7921
Opcode Fuzzy Hash: b4047fd74fafd511f87100a415ff7352fa71784cc782813174b617cf7262d9f7
Instruction Fuzzy Hash: F921D632600606ABDB249F25DD41FBB73A8EB06316F10407FED01D6152EBBC9D48CB59

Function 0045201B Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 00448295: GetLastError.KERNEL32(?,0043F770,0043A875,0043F770,00474EF8,PkGNG,0043CE65,FF8BC35D,00474EF8,00474EF8), ref: 00448299
Part of subcall function 00448295: _free.LIBCMT ref: 004482CC
Part of subcall function 00448295: SetLastError.KERNEL32(00000000,?,?,00000000), ref: 0044830D
Part of subcall function 00448295: _abort.LIBCMT ref: 00448313

EnumSystemLocalesW.KERNEL32(00452143,00000001), ref: 0045208D

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem_abort_free
String ID:
API String ID: 1084509184-0
Opcode ID: cd62537e8c3e003b13522b9155b4eea68fe7d0001d8d421cd242523031e004a2
Instruction ID: b0e9e6415e7ea3a3ed95e939ef0edb9d062384d4a1a0bde9f31cc9ceae225fa6
Opcode Fuzzy Hash: cd62537e8c3e003b13522b9155b4eea68fe7d0001d8d421cd242523031e004a2
Instruction Fuzzy Hash: 0211553A2007019FDB189F39C9916BBBB92FF8075AB14482EEE4687B41D7B5A946C740

Function 004525C3 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

Part of subcall function 00448295: GetLastError.KERNEL32(?,0043F770,0043A875,0043F770,00474EF8,PkGNG,0043CE65,FF8BC35D,00474EF8,00474EF8), ref: 00448299
Part of subcall function 00448295: _free.LIBCMT ref: 004482CC
Part of subcall function 00448295: SetLastError.KERNEL32(00000000,?,?,00000000), ref: 0044830D
Part of subcall function 00448295: _abort.LIBCMT ref: 00448313

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,00452361,00000000,00000000,?), ref: 004525EF

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale_abort_free
String ID:
API String ID: 2692324296-0
Opcode ID: ed905f4e10f5b376defebc36d7d97aa2bb2c1abe5f1ea1ee61b46868c197e3f5
Instruction ID: 8c29d710edde3bbc403447a64c1727e90569dbd09ff88c71ffccea9529c81983
Opcode Fuzzy Hash: ed905f4e10f5b376defebc36d7d97aa2bb2c1abe5f1ea1ee61b46868c197e3f5
Instruction Fuzzy Hash: C4F04936A00116BBDB245A24D905BBF7B58EB01315F04446BEC05A3241FAF8FD058694

Function 004520B6 Relevance: 1.5, APIs: 1, Instructions: 42COMMON

Download Yara Rule

APIs

Part of subcall function 00448295: GetLastError.KERNEL32(?,0043F770,0043A875,0043F770,00474EF8,PkGNG,0043CE65,FF8BC35D,00474EF8,00474EF8), ref: 00448299
Part of subcall function 00448295: _free.LIBCMT ref: 004482CC
Part of subcall function 00448295: SetLastError.KERNEL32(00000000,?,?,00000000), ref: 0044830D
Part of subcall function 00448295: _abort.LIBCMT ref: 00448313

EnumSystemLocalesW.KERNEL32(00452393,00000001), ref: 00452102

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem_abort_free
String ID:
API String ID: 1084509184-0
Opcode ID: b47e8d7704c3cea33439bb1b9c4b2a0344765dc89a2caae7295f0002ba586764
Instruction ID: 883a99871793c155097d9da94a803295819168bd30f8f35cc04eca091e96b9f4
Opcode Fuzzy Hash: b47e8d7704c3cea33439bb1b9c4b2a0344765dc89a2caae7295f0002ba586764
Instruction Fuzzy Hash: E8F0FF363007056FDB245F399881A6B7B96FB82769B04482EFE458B682DAB99C42D604

Function 0041B69E Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,0040F25E), ref: 0041B6D3

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 6f8df8ca086827d3b7a07e2ceec29cc063485458526563a8914dedb1098b546b
Instruction ID: 8360233331794fbd8bccde093e114755ab2a7c2896376219b9d5f45c8fb32f7b
Opcode Fuzzy Hash: 6f8df8ca086827d3b7a07e2ceec29cc063485458526563a8914dedb1098b546b
Instruction Fuzzy Hash: 90014F7190011CABCB01EBD1DC45EEDB7BCAF44309F10016AB505B21A1EFB46E88CBA8

Function 00448484 Relevance: 1.5, APIs: 1, Instructions: 34COMMON

Download Yara Rule

APIs

Part of subcall function 00445909: EnterCriticalSection.KERNEL32(?,?,0044305C,00000000,0046E938,0000000C,00443017,?,?,?,00445BA7,?,?,0044834A,00000001,00000364), ref: 00445918

EnumSystemLocalesW.KERNEL32(Function_0004843E,00000001,0046EAE0,0000000C), ref: 004484BC

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 08771b5932cf67d2f7a499a1ea32343f451e1cff339441a182db03018af17ba2
Instruction ID: 901ea181f65c0ebd25502bb0be635eecd519ab6688482fb1bf3a60b9f01fb263
Opcode Fuzzy Hash: 08771b5932cf67d2f7a499a1ea32343f451e1cff339441a182db03018af17ba2
Instruction Fuzzy Hash: 37F04F76A50200EFEB00EF69D946B4D37E0FB04725F10446EF514DB2A2DB7899809B49

Function 00451FD0 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00448295: GetLastError.KERNEL32(?,0043F770,0043A875,0043F770,00474EF8,PkGNG,0043CE65,FF8BC35D,00474EF8,00474EF8), ref: 00448299
Part of subcall function 00448295: _free.LIBCMT ref: 004482CC
Part of subcall function 00448295: SetLastError.KERNEL32(00000000,?,?,00000000), ref: 0044830D
Part of subcall function 00448295: _abort.LIBCMT ref: 00448313

EnumSystemLocalesW.KERNEL32(00451F27,00000001), ref: 00452007

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem_abort_free
String ID:
API String ID: 1084509184-0
Opcode ID: 06cdaad2b1dd0330ee545a4703de2c72ad4f4425d90ac6c7aa7d45dfeb8c5d5b
Instruction ID: 16a122e2f6617649f53ffd93528404cf76eb0d70ff9257d35f530b0535ef024d
Opcode Fuzzy Hash: 06cdaad2b1dd0330ee545a4703de2c72ad4f4425d90ac6c7aa7d45dfeb8c5d5b
Instruction Fuzzy Hash: 84F0203630020597CB04AF75D845B6A7F90EB82729B06009AFE058B6A2C7799842C754

Function 0040F90C Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(00000800,0000005A,00000000,00000003,?,?,?,00415537,00474EE0,00475A00,00474EE0,00000000,00474EE0,00000000,00474EE0,5.1.3 Pro), ref: 0040F920

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 60ac6b383c0d02c34bbf412ad9b051435ec7f82dc161eda072fb95a07eb92a85
Instruction ID: 54543d52817102a935349e0949155b160d3bd36039d058f0142c014f19b14c2e
Opcode Fuzzy Hash: 60ac6b383c0d02c34bbf412ad9b051435ec7f82dc161eda072fb95a07eb92a85
Instruction Fuzzy Hash: D5D05B3074421C77D61096959D0AEAA779CD701B52F0001A6BB05D72C0D9E15E0087D1

Function 00434BD8 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00034BE4,0043490B), ref: 00434BDD

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 2ffe05228c785604148d814c7fc250910b5f8136668f43492b8067ac5164d55b
Instruction ID: 702e07acd891e046c8aea5fc6397425f5e3bd38ef0af78e1c7fed93ac6412050
Opcode Fuzzy Hash: 2ffe05228c785604148d814c7fc250910b5f8136668f43492b8067ac5164d55b
Instruction Fuzzy Hash:

Function 00418EB1 Relevance: 49.3, APIs: 27, Strings: 1, Instructions: 328windowmemoryCOMMON

Download Yara Rule

APIs

CreateDCA.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00418ECB
CreateCompatibleDC.GDI32(00000000), ref: 00418ED8

Part of subcall function 00419360: EnumDisplaySettingsW.USER32(?,000000FF,?), ref: 00419390

CreateCompatibleBitmap.GDI32(00000000,?), ref: 00418F4E
DeleteDC.GDI32(00000000), ref: 00418F65
DeleteDC.GDI32(00000000), ref: 00418F68
DeleteObject.GDI32(00000000), ref: 00418F6B
SelectObject.GDI32(00000000,00000000), ref: 00418F8C
DeleteDC.GDI32(00000000), ref: 00418F9D
DeleteDC.GDI32(00000000), ref: 00418FA0
StretchBlt.GDI32(00000000,00000000,00000000,?,?,00000000,?,?,?,?,00CC0020), ref: 00418FC4
GetIconInfo.USER32(?,?), ref: 00418FF8
DeleteObject.GDI32(?), ref: 00419027
DeleteObject.GDI32(?), ref: 00419034
DrawIcon.USER32(00000000,?,?,?), ref: 00419041
BitBlt.GDI32(00000000,00000000,00000000,?,?,?,00000000,00000000,00660046), ref: 00419077
GetObjectA.GDI32(00000000,00000018,?), ref: 004190A3
LocalAlloc.KERNEL32(00000040,00000001), ref: 00419110
GlobalAlloc.KERNEL32(00000000,?), ref: 0041917F
GetDIBits.GDI32(00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 004191A3
DeleteDC.GDI32(?), ref: 004191B7
DeleteDC.GDI32(00000000), ref: 004191BA
DeleteObject.GDI32(00000000), ref: 004191BD
GlobalFree.KERNEL32(?), ref: 004191C8
DeleteObject.GDI32(00000000), ref: 0041927C
GlobalFree.KERNEL32(?), ref: 00419283
DeleteDC.GDI32(?), ref: 00419293
DeleteDC.GDI32(00000000), ref: 0041929E

Strings

DISPLAY, xrefs: 00418EC4

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: Delete$Object$CreateGlobal$AllocCompatibleFreeIcon$BitmapBitsDisplayDrawEnumInfoLocalSelectSettingsStretch
String ID: DISPLAY
API String ID: 479521175-865373369
Opcode ID: a3a4741cb06b3bb280ebd52fb29a8cd3e9580c118e1ba6673d441af15fd395ed
Instruction ID: e1b8f987aa81746083de8242de432fb1856ba331ec6d7e725e66c1191a76d441
Opcode Fuzzy Hash: a3a4741cb06b3bb280ebd52fb29a8cd3e9580c118e1ba6673d441af15fd395ed
Instruction Fuzzy Hash: 64C14C71504301AFD720DF25DC48BABBBE9EB88715F04482EF98993291DB34ED45CB6A

Function 0041812A Relevance: 47.5, APIs: 22, Strings: 5, Instructions: 289libraryloaderthreadCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll,ZwCreateSection,00000000,00000000), ref: 00418171
GetProcAddress.KERNEL32(00000000), ref: 00418174
GetModuleHandleA.KERNEL32(ntdll,ZwMapViewOfSection), ref: 00418185
GetProcAddress.KERNEL32(00000000), ref: 00418188
GetModuleHandleA.KERNEL32(ntdll,ZwUnmapViewOfSection), ref: 00418199
GetProcAddress.KERNEL32(00000000), ref: 0041819C
GetModuleHandleA.KERNEL32(ntdll,ZwClose), ref: 004181AD
GetProcAddress.KERNEL32(00000000), ref: 004181B0
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 00418252
VirtualAlloc.KERNEL32(00000000,00000004,00001000,00000004), ref: 0041826A
GetThreadContext.KERNEL32(?,00000000), ref: 00418280
ReadProcessMemory.KERNEL32(?,?,?,00000004,?), ref: 004182A6
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 00418328
TerminateProcess.KERNEL32(?,00000000), ref: 0041833C
GetCurrentProcess.KERNEL32(?,00000000,00000000,00000000,?,00000001,00000000,00000040), ref: 0041837C
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 00418446
SetThreadContext.KERNEL32(?,00000000), ref: 00418463
ResumeThread.KERNEL32(?), ref: 00418470
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 00418487
GetCurrentProcess.KERNEL32(?), ref: 00418492
TerminateProcess.KERNEL32(?,00000000), ref: 004184AD
GetLastError.KERNEL32 ref: 004184B5

Strings

ZwMapViewOfSection, xrefs: 00418176
ZwCreateSection, xrefs: 00418157
ntdll, xrefs: 0041815C, 0041817B, 0041818F, 004181A3
ZwUnmapViewOfSection, xrefs: 0041818A
ZwClose, xrefs: 0041819E

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: Process$AddressHandleModuleProc$ThreadVirtual$ContextCurrentFreeMemoryTerminate$AllocCreateErrorLastReadResumeWrite
String ID: ZwClose$ZwCreateSection$ZwMapViewOfSection$ZwUnmapViewOfSection$ntdll
API String ID: 4188446516-3035715614
Opcode ID: 270f6f13d6fde63ba60b02dc59acd4711bf4d0802e0e8c14fb5fe4b704ceb149
Instruction ID: d7ba82c79e3f17b97bd8f2c1aaed993f07984c16d96ff77cb9dc1491e823fc6f
Opcode Fuzzy Hash: 270f6f13d6fde63ba60b02dc59acd4711bf4d0802e0e8c14fb5fe4b704ceb149
Instruction Fuzzy Hash: 69A15FB0604305AFDB209F64DD85B6B7BE8FF48705F00482EF685D6291EB78D844CB59

Function 0040D45B Relevance: 45.8, APIs: 6, Strings: 20, Instructions: 282registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0041288B: TerminateProcess.KERNEL32(00000000,?,0040D84A), ref: 0041289B
Part of subcall function 0041288B: WaitForSingleObject.KERNEL32(000000FF,?,0040D84A), ref: 004128AE

GetModuleFileNameW.KERNEL32(00000000,?,00000208,?,?,00000000), ref: 0040D558
RegDeleteKeyA.ADVAPI32(80000001,00000000), ref: 0040D56B
SetFileAttributesW.KERNEL32(?,00000080,?,?,00000000), ref: 0040D584
SetFileAttributesW.KERNEL32(00000000,00000080,?,?,00000000), ref: 0040D5B4

Part of subcall function 0040B8E7: TerminateThread.KERNEL32(0040A2B8,00000000,00000000,?,0040D47D,?,00000000), ref: 0040B8F6
Part of subcall function 0040B8E7: UnhookWindowsHookEx.USER32(004750F0), ref: 0040B902
Part of subcall function 0040B8E7: TerminateThread.KERNEL32(0040A2A2,00000000,?,0040D47D,?,00000000), ref: 0040B910

Part of subcall function 0041C482: CreateFileW.KERNEL32(00000004,40000000,00000000,00000000,00000002,00000080,00000000,00000000,00000000,?,00000004,00000000,0041C5A1,00000000,00000000,00000000), ref: 0041C4C1

ShellExecuteW.SHELL32(00000000,open,00000000,00466478,00466478,00000000), ref: 0040D7FF
ExitProcess.KERNEL32 ref: 0040D80B

Strings

@qF, xrefs: 0040D7C7, 0040D7D2
fso.DeleteFile ", xrefs: 0040D675
while fso.FileExists(", xrefs: 0040D627
Set fso = CreateObject("Scripting.FileSystemObject"), xrefs: 0040D5E5
fso.DeleteFile(Wscript.ScriptFullName), xrefs: 0040D7AE
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\, xrefs: 0040D4FD
""", 0, xrefs: 0040D722
open, xrefs: 0040D7F9
CreateObject("WScript.Shell").Run "cmd /c "", xrefs: 0040D73C
\update.vbs, xrefs: 0040D5B6
Software\Microsoft\Windows\CurrentVersion\Run\, xrefs: 0040D4AC
"), xrefs: 0040D610
@qF, xrefs: 0040D772, 0040D7B3, 0040D69C, 0040D6C9
dMG, xrefs: 0040D496
exepath, xrefs: 0040D532
fso.DeleteFolder ", xrefs: 0040D6E6
Temp, xrefs: 0040D5BB
On Error Resume Next, xrefs: 0040D5F4
wend, xrefs: 0040D6C4
8SG, xrefs: 0040D50A

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: File$Terminate$AttributesProcessThread$CreateDeleteExecuteExitHookModuleNameObjectShellSingleUnhookWaitWindows
String ID: """, 0$")$8SG$@qF$@qF$CreateObject("WScript.Shell").Run "cmd /c ""$On Error Resume Next$Set fso = CreateObject("Scripting.FileSystemObject")$Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\$Software\Microsoft\Windows\CurrentVersion\Run\$Temp$\update.vbs$dMG$exepath$fso.DeleteFile "$fso.DeleteFile(Wscript.ScriptFullName)$fso.DeleteFolder "$open$wend$while fso.FileExists("
API String ID: 1861856835-1447701601
Opcode ID: 5bfd04f2c3675bb3e4ccca17f50e3f4c8b9b0143e22e23c3ef80078f3e2ac138
Instruction ID: 9f807323933333198641953f201c1fc8368d74e19fdabe041c5449f7db564f80
Opcode Fuzzy Hash: 5bfd04f2c3675bb3e4ccca17f50e3f4c8b9b0143e22e23c3ef80078f3e2ac138
Instruction Fuzzy Hash: 8791B0716082005AC315FB62D8529AF77A8AFD4309F10443FB64AA71E3EF7C9D49C65E

Function 0040D0D1 Relevance: 42.3, APIs: 6, Strings: 18, Instructions: 260registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0041288B: TerminateProcess.KERNEL32(00000000,?,0040D84A), ref: 0041289B
Part of subcall function 0041288B: WaitForSingleObject.KERNEL32(000000FF,?,0040D84A), ref: 004128AE

GetModuleFileNameW.KERNEL32(00000000,?,00000208,?,?,?,?,?,004752F0,?,pth_unenc), ref: 0040D1E0
RegDeleteKeyA.ADVAPI32(80000001,00000000), ref: 0040D1F3
SetFileAttributesW.KERNEL32(00000000,00000080,?,?,?,?,?,004752F0,?,pth_unenc), ref: 0040D223
SetFileAttributesW.KERNEL32(?,00000080,?,?,?,?,?,004752F0,?,pth_unenc), ref: 0040D232

Part of subcall function 0040B8E7: TerminateThread.KERNEL32(0040A2B8,00000000,00000000,?,0040D47D,?,00000000), ref: 0040B8F6
Part of subcall function 0040B8E7: UnhookWindowsHookEx.USER32(004750F0), ref: 0040B902
Part of subcall function 0040B8E7: TerminateThread.KERNEL32(0040A2A2,00000000,?,0040D47D,?,00000000), ref: 0040B910

Part of subcall function 0041BA09: GetCurrentProcessId.KERNEL32(00000000,?,?,?,?,?,?,0040407C), ref: 0041BA30

ShellExecuteW.SHELL32(00000000,open,00000000,00466478,00466478,00000000), ref: 0040D44D
ExitProcess.KERNEL32 ref: 0040D454

Strings

pth_unenc, xrefs: 0040D0D7
fso.DeleteFile ", xrefs: 0040D350
while fso.FileExists(", xrefs: 0040D303
Set fso = CreateObject("Scripting.FileSystemObject"), xrefs: 0040D2C0
fso.DeleteFile(Wscript.ScriptFullName), xrefs: 0040D3FC
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\, xrefs: 0040D173
8SG, xrefs: 0040D199
open, xrefs: 0040D447
Software\Microsoft\Windows\CurrentVersion\Run\, xrefs: 0040D122
"), xrefs: 0040D2EC
xpF, xrefs: 0040D3CA
exepath, xrefs: 0040D1BC
dMG, xrefs: 0040D10C
fso.DeleteFolder ", xrefs: 0040D3C5
Temp, xrefs: 0040D281
On Error Resume Next, xrefs: 0040D2CF
wend, xrefs: 0040D39F
.vbs, xrefs: 0040D23C

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: FileProcessTerminate$AttributesThread$CurrentDeleteExecuteExitHookModuleNameObjectShellSingleUnhookWaitWindows
String ID: ")$.vbs$8SG$On Error Resume Next$Set fso = CreateObject("Scripting.FileSystemObject")$Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\$Software\Microsoft\Windows\CurrentVersion\Run\$Temp$dMG$exepath$fso.DeleteFile "$fso.DeleteFile(Wscript.ScriptFullName)$fso.DeleteFolder "$open$pth_unenc$wend$while fso.FileExists("$xpF
API String ID: 3797177996-2483056239
Opcode ID: 4ed49e942f17f0f2b3abb6c7cdc5849daee16a078121c92a28a1cb87cb179660
Instruction ID: f7f00373e35faeae073ffedb9d5543756e5675edee5c5b567d0d61755fae189b
Opcode Fuzzy Hash: 4ed49e942f17f0f2b3abb6c7cdc5849daee16a078121c92a28a1cb87cb179660
Instruction Fuzzy Hash: 6181AF716082405AC315FB62D8529AF77A8AFD0308F10483FB58A671E3EF7C9E49C65E

Function 004124B0 Relevance: 40.4, APIs: 17, Strings: 6, Instructions: 190synchronizationsleepfileCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32(00000000,00000001,00000000,00000000,004750E4,00000003), ref: 004124CF
ExitProcess.KERNEL32(00000000), ref: 004124DB
CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00412555
OpenProcess.KERNEL32(00100000,00000000,00000000), ref: 00412564
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 0041256F
CloseHandle.KERNEL32(00000000), ref: 00412576
GetCurrentProcessId.KERNEL32 ref: 0041257C
PathFileExistsW.SHLWAPI(?), ref: 004125AD
GetTempPathW.KERNEL32(00000104,?), ref: 00412610
GetTempFileNameW.KERNEL32(?,temp_,00000000,?), ref: 0041262A
lstrcatW.KERNEL32(?,.exe), ref: 0041263C

Part of subcall function 0041C482: CreateFileW.KERNEL32(00000004,40000000,00000000,00000000,00000002,00000080,00000000,00000000,00000000,?,00000004,00000000,0041C5A1,00000000,00000000,00000000), ref: 0041C4C1

ShellExecuteW.SHELL32(00000000,open,?,00000000,00000000,00000001), ref: 0041267C
Sleep.KERNEL32(000001F4), ref: 004126BD
OpenProcess.KERNEL32(00100000,00000000,00000000), ref: 004126D2
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 004126DD
CloseHandle.KERNEL32(00000000), ref: 004126E4
GetCurrentProcessId.KERNEL32 ref: 004126EA

Strings

exepath, xrefs: 00412507
temp_, xrefs: 0041261E
.exe, xrefs: 00412630
WDH, xrefs: 00412583, 004126F1
open, xrefs: 00412676
8SG, xrefs: 004124E1

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: Process$File$Create$CloseCurrentHandleObjectOpenPathSingleTempWait$ExecuteExistsExitMutexNameShellSleeplstrcat
String ID: .exe$8SG$WDH$exepath$open$temp_
API String ID: 2649220323-436679193
Opcode ID: 898725a538578efc964f3db07f9b73ad570f6512a08a1881f5d957b613d7759d
Instruction ID: ea0e71dbd1735df2f0ffa6a76a18ae54bfb239dee3d1740714ca762960b89f4c
Opcode Fuzzy Hash: 898725a538578efc964f3db07f9b73ad570f6512a08a1881f5d957b613d7759d
Instruction Fuzzy Hash: 4C51C871A00215BBDB10ABA09C99EFE336D9B04715F1041ABF501E71D2EF7C8E858A5D

Function 0041B0D8 Relevance: 40.4, APIs: 12, Strings: 11, Instructions: 180synchronizationCOMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(00000000,00000000,00000000,00000000), ref: 0041B1CD
mciSendStringA.WINMM(play audio,00000000,00000000,00000000), ref: 0041B1E1
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,000000A9,004660B4), ref: 0041B209
PathFileExistsW.SHLWAPI(00000000,00000000,00000000,00474EE0,00000000), ref: 0041B21F
mciSendStringA.WINMM(pause audio,00000000,00000000,00000000), ref: 0041B260
mciSendStringA.WINMM(resume audio,00000000,00000000,00000000), ref: 0041B278
mciSendStringA.WINMM(status audio mode,?,00000014,00000000), ref: 0041B28D
SetEvent.KERNEL32 ref: 0041B2AA
WaitForSingleObject.KERNEL32(000001F4), ref: 0041B2BB
CloseHandle.KERNEL32 ref: 0041B2CB
mciSendStringA.WINMM(stop audio,00000000,00000000,00000000), ref: 0041B2ED
mciSendStringA.WINMM(close audio,00000000,00000000,00000000), ref: 0041B2F7

Strings

alias audio, xrefs: 0041B149
close audio, xrefs: 0041B2F2
pause audio, xrefs: 0041B25B
stop audio, xrefs: 0041B2E8
resume audio, xrefs: 0041B273
" type , xrefs: 0041B166
stopped, xrefs: 0041B293
open ", xrefs: 0041B161
NG, xrefs: 0041B19A, 0041B11C
status audio mode, xrefs: 0041B288
play audio, xrefs: 0041B1DC

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: SendString$Event$CloseCreateExistsFileHandleObjectPathSingleWait
String ID: alias audio$" type $close audio$open "$pause audio$play audio$resume audio$status audio mode$stop audio$stopped$NG
API String ID: 738084811-2094122233
Opcode ID: 7c34508947559437a3a277e9d61a1f5e5f7acc13b7aac5b1e5b5860917e6a28f
Instruction ID: 904a2ea9ee052b7cd0d2885f28b370526ea16529c5f4723dacad6ab52bd59ce6
Opcode Fuzzy Hash: 7c34508947559437a3a277e9d61a1f5e5f7acc13b7aac5b1e5b5860917e6a28f
Instruction Fuzzy Hash: 015193B12842056ED314B731DC96ABF779CDB80359F10053FB246621E2EF789D498AAE

Function 00401A6D Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 156fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,40000000,00000000), ref: 00401AD9
WriteFile.KERNEL32(00000000,RIFF,00000004,?,00000000), ref: 00401B03
WriteFile.KERNEL32(00000000,00000000,00000004,00000000,00000000), ref: 00401B13
WriteFile.KERNEL32(00000000,WAVE,00000004,00000000,00000000), ref: 00401B23
WriteFile.KERNEL32(00000000,fmt ,00000004,00000000,00000000), ref: 00401B33
WriteFile.KERNEL32(00000000,?,00000004,00000000,00000000), ref: 00401B43
WriteFile.KERNEL32(00000000,?,00000002,00000000,00000000), ref: 00401B54
WriteFile.KERNEL32(00000000,00472AAA,00000002,00000000,00000000), ref: 00401B65
WriteFile.KERNEL32(00000000,00472AAC,00000004,00000000,00000000), ref: 00401B75
WriteFile.KERNEL32(00000000,00000001,00000004,00000000,00000000), ref: 00401B85
WriteFile.KERNEL32(00000000,?,00000002,00000000,00000000), ref: 00401B96
WriteFile.KERNEL32(00000000,00472AB6,00000002,00000000,00000000), ref: 00401BA7
WriteFile.KERNEL32(00000000,data,00000004,00000000,00000000), ref: 00401BB7
WriteFile.KERNEL32(00000000,?,00000004,00000000,00000000), ref: 00401BC7

Strings

fmt , xrefs: 00401B2D
WAVE, xrefs: 00401B1D
data, xrefs: 00401BB1
RIFF, xrefs: 00401AFD

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: File$Write$Create
String ID: RIFF$WAVE$data$fmt
API String ID: 1602526932-4212202414
Opcode ID: bdde9fe629d6d0b3cb01441b1d036ed99aff71c5e0b2c5a0236a53ffdd76988e
Instruction ID: e437df56db769974f3bb03b9acf3047b6271bea3308615ff466a61b001f8e6b8
Opcode Fuzzy Hash: bdde9fe629d6d0b3cb01441b1d036ed99aff71c5e0b2c5a0236a53ffdd76988e
Instruction Fuzzy Hash: D1413F72644218BAE210DB51DD85FBB7FECEB89B50F40441AFA44D60C0E7A5E909DBB3

Function 004072AB Relevance: 35.1, APIs: 12, Strings: 8, Instructions: 62libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(ntdll.dll,RtlInitUnicodeString,00000000,C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe,00000001,00407688,C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe,00000003,004076B0,004752D8,00407709), ref: 004072BF
GetProcAddress.KERNEL32(00000000), ref: 004072C8
GetModuleHandleW.KERNEL32(ntdll.dll,NtAllocateVirtualMemory), ref: 004072DD
GetProcAddress.KERNEL32(00000000), ref: 004072E0
GetModuleHandleW.KERNEL32(ntdll.dll,NtFreeVirtualMemory), ref: 004072F1
GetProcAddress.KERNEL32(00000000), ref: 004072F4
GetModuleHandleW.KERNEL32(ntdll.dll,RtlAcquirePebLock), ref: 00407305
GetProcAddress.KERNEL32(00000000), ref: 00407308
GetModuleHandleW.KERNEL32(ntdll.dll,RtlReleasePebLock), ref: 00407319
GetProcAddress.KERNEL32(00000000), ref: 0040731C
GetModuleHandleW.KERNEL32(ntdll.dll,LdrEnumerateLoadedModules), ref: 0040732D
GetProcAddress.KERNEL32(00000000), ref: 00407330

Strings

LdrEnumerateLoadedModules, xrefs: 00407327
RtlReleasePebLock, xrefs: 00407313
NtFreeVirtualMemory, xrefs: 004072EB
NtAllocateVirtualMemory, xrefs: 004072D7
ntdll.dll, xrefs: 004072B3, 004072BE, 004072DC, 004072F0, 00407304, 00407318, 0040732C
C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe, xrefs: 004072AC
RtlInitUnicodeString, xrefs: 004072B9
RtlAcquirePebLock, xrefs: 004072FF

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe$LdrEnumerateLoadedModules$NtAllocateVirtualMemory$NtFreeVirtualMemory$RtlAcquirePebLock$RtlInitUnicodeString$RtlReleasePebLock$ntdll.dll
API String ID: 1646373207-284433379
Opcode ID: f3da3711bb85931ca03a42678d4c0c1881451176f862cc8ba737a85fa656c6e8
Instruction ID: 405170eedd050388d8f538cead316ce70cca9a1d875d15a5a69166cce564cbe9
Opcode Fuzzy Hash: f3da3711bb85931ca03a42678d4c0c1881451176f862cc8ba737a85fa656c6e8
Instruction Fuzzy Hash: 0A0152A0E4431676D711AF7AAC44D577E9D9E41351311487BB405E2292EEBCE800CD6E

Function 0041C0AC Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 139stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?), ref: 0041C0C7
_memcmp.LIBVCRUNTIME ref: 0041C0DF
lstrlenW.KERNEL32(?), ref: 0041C0F8
FindFirstVolumeW.KERNEL32(?,00000104,?), ref: 0041C133
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 0041C146
QueryDosDeviceW.KERNEL32(?,?,00000064), ref: 0041C18A
lstrcmpW.KERNEL32(?,?), ref: 0041C1A5
FindNextVolumeW.KERNEL32(?,0000003F,00000104), ref: 0041C1BD
_wcslen.LIBCMT ref: 0041C1CC
FindVolumeClose.KERNEL32(?), ref: 0041C1EC
GetLastError.KERNEL32 ref: 0041C204
GetVolumePathNamesForVolumeNameW.KERNEL32(?,?,?,?), ref: 0041C231
lstrcatW.KERNEL32(?,?), ref: 0041C24A
lstrcpyW.KERNEL32(?,?), ref: 0041C259
GetLastError.KERNEL32 ref: 0041C261

Strings

?, xrefs: 0041C15E

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: Volume$ErrorFindLast$lstrlen$CloseDeviceFirstNameNamesNextPathQuery_memcmp_wcslenlstrcatlstrcmplstrcpy
String ID: ?
API String ID: 3941738427-1684325040
Opcode ID: a0ce836f87bdb73d1aed96e44626d16fc1f948222461cff8e144d7328d36a715
Instruction ID: 8d48ee17a24f37a9bc83e71ffc922dd471ae74eb47091415c6e266b1ff6a60c4
Opcode Fuzzy Hash: a0ce836f87bdb73d1aed96e44626d16fc1f948222461cff8e144d7328d36a715
Instruction Fuzzy Hash: B541A671584316EBD720DFA0DC889DBB7ECEB84745F00092BF545D2162EB78CA88CB96

Function 00414DC1 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 109libraryloaderCOMMON

Download Yara Rule

APIs

GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00414E10
LoadLibraryA.KERNEL32(?), ref: 00414E52
GetProcAddress.KERNEL32(00000000,getaddrinfo), ref: 00414E72
FreeLibrary.KERNEL32(00000000), ref: 00414E79
LoadLibraryA.KERNEL32(?), ref: 00414EB1
GetProcAddress.KERNEL32(00000000,getaddrinfo), ref: 00414EC3
FreeLibrary.KERNEL32(00000000), ref: 00414ECA
GetProcAddress.KERNEL32(00000000,?), ref: 00414ED9
FreeLibrary.KERNEL32(00000000), ref: 00414EF0

Strings

getnameinfo, xrefs: 00414DDD
EIA, xrefs: 00414F18
\wship6, xrefs: 00414E99
getaddrinfo, xrefs: 00414DCE, 00414E6C, 00414EBD
freeaddrinfo, xrefs: 00414DED
\ws2_32, xrefs: 00414E3A

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: Library$AddressFreeProc$Load$DirectorySystem
String ID: EIA$\ws2_32$\wship6$freeaddrinfo$getaddrinfo$getnameinfo
API String ID: 2490988753-3346362794
Opcode ID: bff3b13f7ac9eea3f878ccf145141800db562e87b1258dd51974eed62fb821cf
Instruction ID: 3d65f6a93fba2a0b2eac8854c7d2b2934d6e6a161d7d6dc9994b6ec54a408268
Opcode Fuzzy Hash: bff3b13f7ac9eea3f878ccf145141800db562e87b1258dd51974eed62fb821cf
Instruction Fuzzy Hash: 5E31C4B1905315A7D7209F65CC84DDF76DCAB84754F004A2AF944A3210D738D985CBAE

Function 0044F4AD Relevance: 25.9, APIs: 17, Instructions: 419COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0044F53F
_free.LIBCMT ref: 0044F565
_free.LIBCMT ref: 0044F58E
_free.LIBCMT ref: 0044F5C6
_free.LIBCMT ref: 0044F5F7
_free.LIBCMT ref: 0044F638
SetEnvironmentVariableA.KERNEL32(00000000,00000000), ref: 0044F6B9
_free.LIBCMT ref: 0044F6D2
_wcschr.LIBVCRUNTIME ref: 0044F70F
_free.LIBCMT ref: 0044F77B
_free.LIBCMT ref: 0044F7A1
_free.LIBCMT ref: 0044F7CA
_free.LIBCMT ref: 0044F7FF
_free.LIBCMT ref: 0044F830
_free.LIBCMT ref: 0044F871
SetEnvironmentVariableW.KERNEL32(00000000,?,?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0044F8F6
_free.LIBCMT ref: 0044F90F

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: _free$EnvironmentVariable$_wcschr
String ID:
API String ID: 3899193279-0
Opcode ID: 28687395a6aa2078608bd89f57b343956b66557142a9620950dd617db5e8e69e
Instruction ID: 2409d22e097b45b84bdb59948eb4ebc1cd1141af37d2d18b4001dba56dac1aed
Opcode Fuzzy Hash: 28687395a6aa2078608bd89f57b343956b66557142a9620950dd617db5e8e69e
Instruction Fuzzy Hash: E3D135B1D003006FFB24AF799D82A6B7BA8EF01314F05417FE945A7382EB7D99098759

Function 00412AEF Relevance: 25.0, APIs: 9, Strings: 5, Instructions: 482sleepfileCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00412B08

Part of subcall function 0041BA09: GetCurrentProcessId.KERNEL32(00000000,?,?,?,?,?,?,0040407C), ref: 0041BA30

Part of subcall function 004185A3: CloseHandle.KERNEL32(004040F5,?,?,004040F5,00465E84), ref: 004185B9
Part of subcall function 004185A3: CloseHandle.KERNEL32(00465E84,?,?,004040F5,00465E84), ref: 004185C2

Sleep.KERNEL32(0000000A,00465E84), ref: 00412C5A
Sleep.KERNEL32(0000000A,00465E84,00465E84), ref: 00412CFC
Sleep.KERNEL32(0000000A,00465E84,00465E84,00465E84), ref: 00412D9E
DeleteFileW.KERNEL32(00000000,00465E84,00465E84,00465E84), ref: 00412E00
DeleteFileW.KERNEL32(00000000,00465E84,00465E84,00465E84), ref: 00412E37
DeleteFileW.KERNEL32(00000000,00465E84,00465E84,00465E84), ref: 00412E73
Sleep.KERNEL32(000001F4,00465E84,00465E84,00465E84), ref: 00412E8D
Sleep.KERNEL32(00000064), ref: 00412ECF

Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36

Strings

/stext ", xrefs: 00412BE5, 00412C87, 00412D29
NG, xrefs: 00412FA7
0TG, xrefs: 00413061
0TG, xrefs: 00413187
NG, xrefs: 004130FC

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: Sleep$File$Delete$CloseHandle$CurrentModuleNameProcesssend
String ID: /stext "$0TG$0TG$NG$NG
API String ID: 1223786279-2576077980
Opcode ID: 8c943dcdbf7e2afa2f8ef9492e2a8597070d00b8e9ecf695a3f99b050f00a8b7
Instruction ID: 10d3359c81a21c2239512d2238f4034584c87ebec4848cfd83014516dee20f06
Opcode Fuzzy Hash: 8c943dcdbf7e2afa2f8ef9492e2a8597070d00b8e9ecf695a3f99b050f00a8b7
Instruction Fuzzy Hash: 2F0268315083414AC325FB62D891AEFB3E5AFD4348F50483FF58A931E2EF785A49C65A

Function 0041D620 Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 74windowCOMMON

Download Yara Rule

APIs

DefWindowProcA.USER32(?,00000401,?,?), ref: 0041D66B
GetCursorPos.USER32(?), ref: 0041D67A
SetForegroundWindow.USER32(?), ref: 0041D683
TrackPopupMenu.USER32(00000000,?,?,00000000,?,00000000), ref: 0041D69D
Shell_NotifyIconA.SHELL32(00000002,00474B48), ref: 0041D6EE
ExitProcess.KERNEL32 ref: 0041D6F6
CreatePopupMenu.USER32 ref: 0041D6FC
AppendMenuA.USER32(00000000,00000000,00000000,Close), ref: 0041D711

Strings

Close, xrefs: 0041D702

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: Menu$PopupWindow$AppendCreateCursorExitForegroundIconNotifyProcProcessShell_Track
String ID: Close
API String ID: 1657328048-3535843008
Opcode ID: 2cdbc08d807d068952302bab703dbbbb7de86244cd36d8f377370d21a5bc842f
Instruction ID: ffebe08b42ddc2cad69fc5dc181b4667ce265f065f51bc56e4a7814a85689449
Opcode Fuzzy Hash: 2cdbc08d807d068952302bab703dbbbb7de86244cd36d8f377370d21a5bc842f
Instruction Fuzzy Hash: 2D213BB1544209FFDF155FA4ED0EAAA3F35EB08302F000125F909951B2D779EDA1EB19

Function 00404E26 Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 65synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,00000000,00474EF8,PkGNG,00000000,00474EF8,00404CA8,00000000,?,?,?,00474EF8,?), ref: 00404E38
SetEvent.KERNEL32(?), ref: 00404E43
CloseHandle.KERNEL32(?), ref: 00404E4C
closesocket.WS2_32(?), ref: 00404E5A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00404E91
SetEvent.KERNEL32(?), ref: 00404EA2
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00404EA9
SetEvent.KERNEL32(?), ref: 00404EBA
CloseHandle.KERNEL32(?), ref: 00404EBF
CloseHandle.KERNEL32(?), ref: 00404EC4
SetEvent.KERNEL32(?), ref: 00404ED1
CloseHandle.KERNEL32(?), ref: 00404ED6

Strings

PkGNG, xrefs: 00404E28

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$ObjectSingleWait$closesocket
String ID: PkGNG
API String ID: 3658366068-263838557
Opcode ID: 1684f4f73009feb69d70dfcf302ee3e014c0b3edf4bc9f5cbab22c6bf1399946
Instruction ID: 681aebbacbf541c1c6cd6dfca6fba55586e42b113d9ea1c0d4e3a90daa9851ad
Opcode Fuzzy Hash: 1684f4f73009feb69d70dfcf302ee3e014c0b3edf4bc9f5cbab22c6bf1399946
Instruction Fuzzy Hash: DE21EA71154B04AFDB216B26DC49B1BBBA1FF40326F104A2DE2E211AF1CB79B851DB58

Function 00445DD7 Relevance: 22.8, APIs: 15, Instructions: 296COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00445E47
_free.LIBCMT ref: 00445E5D
_free.LIBCMT ref: 00445E6E
_free.LIBCMT ref: 00445E7F
_free.LIBCMT ref: 00445E96
GetCPInfo.KERNEL32(?,?), ref: 00445EDE

Part of subcall function 00452EF4: _free.LIBCMT ref: 00452F5F

_free.LIBCMT ref: 0044608A
_free.LIBCMT ref: 0044609D
_free.LIBCMT ref: 004460AB
_free.LIBCMT ref: 004460B6
_free.LIBCMT ref: 004460F8
_free.LIBCMT ref: 00446100
_free.LIBCMT ref: 00446108
_free.LIBCMT ref: 00446110
_free.LIBCMT ref: 0044611E

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: _free$Info
String ID:
API String ID: 2509303402-0
Opcode ID: d11cf9d75a9b095113a5c4e7a536203a51778a2c4217635f9f2315e0a594c0ce
Instruction ID: 03d8b0dccc9171d7b4ee81f85837dfa1205ba0d7832ce976ccf3d084d520ac26
Opcode Fuzzy Hash: d11cf9d75a9b095113a5c4e7a536203a51778a2c4217635f9f2315e0a594c0ce
Instruction Fuzzy Hash: AFB1CE719002059FEB21DF69C881BEEBBF4BF09304F15842EF495A7242DB79AC458B69

Function 00408BB5 Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 328fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000,000000B6), ref: 00408D1E
GetFileSizeEx.KERNEL32(00000000,?), ref: 00408D56
__aulldiv.LIBCMT ref: 00408D88

Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36

Part of subcall function 0041B580: GetLocalTime.KERNEL32(00000000), ref: 0041B59A

SetFilePointerEx.KERNEL32(00000000,?,?,00000000,00000000), ref: 00408EAB
ReadFile.KERNEL32(00000000,00000000,?,?,00000000), ref: 00408EC6
CloseHandle.KERNEL32(00000000), ref: 00408F9F
CloseHandle.KERNEL32(00000000,00000052), ref: 00408FE9
CloseHandle.KERNEL32(00000000), ref: 00409037

Strings

ReadFile error, xrefs: 00409003
SetFilePointerEx error, xrefs: 0040900F
NG, xrefs: 00408C52
Uploading file to Controller: , xrefs: 00408E10

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: File$CloseHandle$CreateLocalPointerReadSizeTime__aulldivsend
String ID: ReadFile error$SetFilePointerEx error$Uploading file to Controller: $NG
API String ID: 3086580692-2582957567
Opcode ID: 2a6cbd74b7f1d7262aabe967babe0c7563b8d160d0352d0a7d413315700012c3
Instruction ID: 3fce176daff91a8ac67d7e00268aa6ddaa8eb0a69c3dc15cdf5b3728eb075172
Opcode Fuzzy Hash: 2a6cbd74b7f1d7262aabe967babe0c7563b8d160d0352d0a7d413315700012c3
Instruction Fuzzy Hash: CCB1A1316083409BC314FB26C941AAFB7E5AFC4358F40492FF589622D2EF789945CB8B

Function 0040A761 Relevance: 21.2, APIs: 6, Strings: 6, Instructions: 163sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00001388), ref: 0040A77B

Part of subcall function 0040A6B0: CreateFileW.KERNEL32(00000000,80000000,00000007,00000000,00000003,00000080,00000000,?,?,?,0040A788), ref: 0040A6E6
Part of subcall function 0040A6B0: GetFileSize.KERNEL32(00000000,00000000,?,?,?,0040A788), ref: 0040A6F5
Part of subcall function 0040A6B0: Sleep.KERNEL32(00002710,?,?,?,0040A788), ref: 0040A722
Part of subcall function 0040A6B0: CloseHandle.KERNEL32(00000000,?,?,?,0040A788), ref: 0040A729

CreateDirectoryW.KERNEL32(00000000,00000000), ref: 0040A7B7
GetFileAttributesW.KERNEL32(00000000), ref: 0040A7C8
SetFileAttributesW.KERNEL32(00000000,00000080), ref: 0040A7DF
PathFileExistsW.SHLWAPI(00000000,00000000,00000000,00000012), ref: 0040A859

Part of subcall function 0041C516: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000,00000000,?,?,00000000,0040412F,00465E84), ref: 0041C52F

SetFileAttributesW.KERNEL32(00000000,00000006,00000013,00466478,00000000,00000000,00000000), ref: 0040A962

Strings

pQG, xrefs: 0040A79C
PG, xrefs: 0040A942
8SG, xrefs: 0040A832
PG, xrefs: 0040A7E7
pQG, xrefs: 0040A7AC
8SG, xrefs: 0040A83D

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: File$AttributesCreate$Sleep$CloseDirectoryExistsHandlePathSize
String ID: 8SG$8SG$pQG$pQG$PG$PG
API String ID: 3795512280-1152054767
Opcode ID: ff793148450d5445b41cee081077762d1b1ae7bc4452be26425da9ad383290d3
Instruction ID: 2a79d88b44a8fc0b04dcb000ea34af81e4c48788ca5147296d011aa32960a087
Opcode Fuzzy Hash: ff793148450d5445b41cee081077762d1b1ae7bc4452be26425da9ad383290d3
Instruction Fuzzy Hash: B6516E716043015ACB15BB72C866ABE77AA9F80349F00483FF646B71E2DF7C9D09865E

Function 004048C8 Relevance: 21.1, APIs: 4, Strings: 8, Instructions: 144networkCOMMON

Download Yara Rule

APIs

connect.WS2_32(?,?,?), ref: 004048E0
CreateEventW.KERNEL32(00000000,00000000,00000001,00000000), ref: 00404A00
CreateEventW.KERNEL32(00000000,00000000,00000001,00000000), ref: 00404A0E
WSAGetLastError.WS2_32 ref: 00404A21

Part of subcall function 0041B580: GetLocalTime.KERNEL32(00000000), ref: 0041B59A

Strings

TLS Handshake... | , xrefs: 00404904
Connection Failed: , xrefs: 00404A43
TLS Error 3, xrefs: 004049D8
PkGNG, xrefs: 004048C8
TLS Error 1, xrefs: 00404937
TLS Error 2, xrefs: 00404955
TLS Authentication Failed, xrefs: 00404999
Connection Refused, xrefs: 00404A76

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: CreateEvent$ErrorLastLocalTimeconnect
String ID: Connection Failed: $Connection Refused$PkGNG$TLS Authentication Failed$TLS Error 1$TLS Error 2$TLS Error 3$TLS Handshake... |
API String ID: 994465650-3229884001
Opcode ID: f8a90a434b368baa81854eed5f01dc5ff272a353476d3d54f953a4ddd85b29a4
Instruction ID: 8b7d3ad86a52f8452b0ebae4faff6649d271d562dba2871a89d137605d3bb54b
Opcode Fuzzy Hash: f8a90a434b368baa81854eed5f01dc5ff272a353476d3d54f953a4ddd85b29a4
Instruction Fuzzy Hash: CE41E8B57506017BC61877BB890B52E7A56AB81308B50017FEA0256AD3FA7D9C108BEF

Function 00451346 Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 0045138A

Part of subcall function 00450582: _free.LIBCMT ref: 0045059F
Part of subcall function 00450582: _free.LIBCMT ref: 004505B1
Part of subcall function 00450582: _free.LIBCMT ref: 004505C3
Part of subcall function 00450582: _free.LIBCMT ref: 004505D5
Part of subcall function 00450582: _free.LIBCMT ref: 004505E7
Part of subcall function 00450582: _free.LIBCMT ref: 004505F9
Part of subcall function 00450582: _free.LIBCMT ref: 0045060B
Part of subcall function 00450582: _free.LIBCMT ref: 0045061D
Part of subcall function 00450582: _free.LIBCMT ref: 0045062F
Part of subcall function 00450582: _free.LIBCMT ref: 00450641
Part of subcall function 00450582: _free.LIBCMT ref: 00450653
Part of subcall function 00450582: _free.LIBCMT ref: 00450665
Part of subcall function 00450582: _free.LIBCMT ref: 00450677

_free.LIBCMT ref: 0045137F

Part of subcall function 00446802: HeapFree.KERNEL32(00000000,00000000,?,00450CEF,?,00000000,?,00000000,?,00450F93,?,00000007,?,?,004514DE,?), ref: 00446818
Part of subcall function 00446802: GetLastError.KERNEL32(?,?,00450CEF,?,00000000,?,00000000,?,00450F93,?,00000007,?,?,004514DE,?,?), ref: 0044682A

_free.LIBCMT ref: 004513A1
_free.LIBCMT ref: 004513B6
_free.LIBCMT ref: 004513C1
_free.LIBCMT ref: 004513E3
_free.LIBCMT ref: 004513F6
_free.LIBCMT ref: 00451404
_free.LIBCMT ref: 0045140F
_free.LIBCMT ref: 00451447
_free.LIBCMT ref: 0045144E
_free.LIBCMT ref: 0045146B
_free.LIBCMT ref: 00451483

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 9bfda5629608ba7fc19c0d50907ac959002cc076efa33527145bad7316b2b0bb
Instruction ID: 2428002f6fd8eb1a99257b9b861ac38f7c05b5b97acacff09fd9d8cf260fe807
Opcode Fuzzy Hash: 9bfda5629608ba7fc19c0d50907ac959002cc076efa33527145bad7316b2b0bb
Instruction Fuzzy Hash: 403193715003009FEB20AA39D846F5B73E8EF02315F62992FE849D7662DF78AD44C729

Function 0040D83A Relevance: 19.4, APIs: 3, Strings: 8, Instructions: 148COMMON

Download Yara Rule

APIs

Part of subcall function 0041288B: TerminateProcess.KERNEL32(00000000,?,0040D84A), ref: 0041289B
Part of subcall function 0041288B: WaitForSingleObject.KERNEL32(000000FF,?,0040D84A), ref: 004128AE

Part of subcall function 00413733: RegOpenKeyExA.ADVAPI32(80000001,00000000,00000000,00020019,?,00000208), ref: 0041374F
Part of subcall function 00413733: RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,00000000,00000000), ref: 00413768
Part of subcall function 00413733: RegCloseKey.ADVAPI32(?), ref: 00413773

GetModuleFileNameW.KERNEL32(00000000,?,00000208), ref: 0040D894
ShellExecuteW.SHELL32(00000000,open,00000000,00466478,00466478,00000000), ref: 0040D9F3
ExitProcess.KERNEL32 ref: 0040D9FF

Strings

exepath, xrefs: 0040D86C
Temp, xrefs: 0040D8D5
CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName), xrefs: 0040D9A2
""", 0, xrefs: 0040D91C
8SG, xrefs: 0040D84A
open, xrefs: 0040D9ED
.vbs, xrefs: 0040D89A
CreateObject("WScript.Shell").Run "cmd /c "", xrefs: 0040D934

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: Process$CloseExecuteExitFileModuleNameObjectOpenQueryShellSingleTerminateValueWait
String ID: """, 0$.vbs$8SG$CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName)$CreateObject("WScript.Shell").Run "cmd /c ""$Temp$exepath$open
API String ID: 1913171305-3159800282
Opcode ID: 44289f883dd7562718e3be597d001429dd6f7e5766c69b57721553f9088b28da
Instruction ID: 6f299f75ad759bd4c56b3f4cab90e5e1fe41ff60d22e8747b975e3d2bb757992
Opcode Fuzzy Hash: 44289f883dd7562718e3be597d001429dd6f7e5766c69b57721553f9088b28da
Instruction Fuzzy Hash: 9B4129719001155ACB15FBA2DC56DEEB778AF50709F10017FB10AB21E2FF785E8ACA98

Function 00450680 Relevance: 18.4, APIs: 12, Instructions: 376COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 004506C8
_free.LIBCMT ref: 004506EC
_free.LIBCMT ref: 004506F9
_free.LIBCMT ref: 0045071E
_free.LIBCMT ref: 0045072B
_free.LIBCMT ref: 00450734
_free.LIBCMT ref: 00450A12
_free.LIBCMT ref: 00450A1A

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: f91d4b90763e5671f10523a72ee64b05bbc7cd6159c247d47fb1287d0ca389aa
Instruction ID: 80ca3ff3fa16d46db3e6ae4c9b8471dba03f652ca918f9f25067e0b92ee87d4d
Opcode Fuzzy Hash: f91d4b90763e5671f10523a72ee64b05bbc7cd6159c247d47fb1287d0ca389aa
Instruction Fuzzy Hash: 30C183B6D40204ABEB20DBA9CC43FDE77F8AB09705F150166FE04EB283D6B49D459768

Function 00455C5B Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00455929: CreateFileW.KERNEL32(00000000,00000000,?,00455D04,?,?,00000000,?,00455D04,00000000,0000000C), ref: 00455946

GetLastError.KERNEL32 ref: 00455D6F
__dosmaperr.LIBCMT ref: 00455D76
GetFileType.KERNEL32(00000000), ref: 00455D82
GetLastError.KERNEL32 ref: 00455D8C
__dosmaperr.LIBCMT ref: 00455D95
CloseHandle.KERNEL32(00000000), ref: 00455DB5
CloseHandle.KERNEL32(?), ref: 00455EFF
GetLastError.KERNEL32 ref: 00455F31
__dosmaperr.LIBCMT ref: 00455F38

Strings

H, xrefs: 00455EBD

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: 3e80e4deedef708004bf5c1f14aafc2c87dd9643035db764e93b071d2df20022
Instruction ID: 7cd045c9b8f196398d23f94ba58010557f508cd7b58f44c29b3e784ccbbfb847
Opcode Fuzzy Hash: 3e80e4deedef708004bf5c1f14aafc2c87dd9643035db764e93b071d2df20022
Instruction Fuzzy Hash: 44A14532A106049FDF19AF68DC657BE3BA0EB06325F24015EEC11AB392D6398D1AC759

Function 0044ACC9 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 216COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,tC,0043EA74,?,?,PkGNG,0044AF1A,00000001,00000001,A4E85006), ref: 0044AD23
__alloca_probe_16.LIBCMT ref: 0044AD5B
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,PkGNG,0044AF1A,00000001,00000001,A4E85006,?,?,?), ref: 0044ADA9
__alloca_probe_16.LIBCMT ref: 0044AE40
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,A4E85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 0044AEA3
__freea.LIBCMT ref: 0044AEB0

Part of subcall function 004461B8: RtlAllocateHeap.NTDLL(00000000,00435349,?,?,004388C7,?,?,00000000,00476B50,?,0040DE9D,00435349,?,?,?,?), ref: 004461EA

__freea.LIBCMT ref: 0044AEB9
__freea.LIBCMT ref: 0044AEDE

Strings

PkGNG, xrefs: 0044ACCB
tC, xrefs: 0044ACDB

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide__freea$__alloca_probe_16$AllocateHeap
String ID: PkGNG$tC
API String ID: 3864826663-4196309852
Opcode ID: a3cbb47ee8d45342a2f0fb6a002504832f0ae0c467949e665f7c3dc78735deda
Instruction ID: de232b2c18f644b0009b05ef7aad101f1c584e700cc6948cb3d999d9ae9be8cc
Opcode Fuzzy Hash: a3cbb47ee8d45342a2f0fb6a002504832f0ae0c467949e665f7c3dc78735deda
Instruction Fuzzy Hash: 41514C72A80206AFFB258F64CC41EBF77A9DB44750F25462EFC14D7240EB38DC60869A

Function 00450AA5 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 204COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00450B14
_free.LIBCMT ref: 00450B22
_free.LIBCMT ref: 00450C50
_free.LIBCMT ref: 00450C5B

Strings

`&G, xrefs: 00450CB4
\&G, xrefs: 00450CA4
\&G, xrefs: 00450C9C

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: _free
String ID: \&G$\&G$`&G
API String ID: 269201875-253610517
Opcode ID: f361c4fdd0f35bb0b590f5a399794b5d5c57f6d7c3c5bbd0b76040d27d65b4a3
Instruction ID: 59c4f5d9f803fa3be21c2588ad204ea2c1e8261bb9e1a4607c4596bf86990b35
Opcode Fuzzy Hash: f361c4fdd0f35bb0b590f5a399794b5d5c57f6d7c3c5bbd0b76040d27d65b4a3
Instruction Fuzzy Hash: 86610E75900205AFDB21DF69C842B9ABBF4EF06710F24426BED44EB242E774AD45CB58

Function 00414BEB Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 158COMMON

Download Yara Rule

Strings

udp, xrefs: 00414C9B, 00414CA3, 00414CA7
65535, xrefs: 00414BEE

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID:
String ID: 65535$udp
API String ID: 0-1267037602
Opcode ID: 92e56e7e39f2557d79d3192c533dec3724d183fd0175ec4c26052f24408cebce
Instruction ID: a9902b4e2b63063b067a15c036b171ad6d3a8658db747517b03e91dd9f9ead29
Opcode Fuzzy Hash: 92e56e7e39f2557d79d3192c533dec3724d183fd0175ec4c26052f24408cebce
Instruction Fuzzy Hash: FB51D431605301ABDB609B14E905BFB77E8ABC5754F08042FF88597390E76CCCC1969E

Function 0040AD11 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 156sleepCOMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 0040AD73
Sleep.KERNEL32(000001F4), ref: 0040AD7E
GetForegroundWindow.USER32 ref: 0040AD84
GetWindowTextLengthW.USER32(00000000), ref: 0040AD8D
GetWindowTextW.USER32(00000000,00000000,00000000), ref: 0040ADC1
Sleep.KERNEL32(000003E8), ref: 0040AE8F

Part of subcall function 0040A671: SetEvent.KERNEL32(?,?,00000000,0040B245,00000000), ref: 0040A69D

Strings

{ User has been idle for , xrefs: 0040AEC1
minutes }, xrefs: 0040AEB5
[, xrefs: 0040AE29
], xrefs: 0040AE23

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: Window$SleepText$EventForegroundInit_thread_footerLength
String ID: [${ User has been idle for $ minutes }$]
API String ID: 911427763-3954389425
Opcode ID: a9d80c92317e710bb0ee7b8060ee11baa7f71990c7fa4e3373d3f7fac537cda3
Instruction ID: 479ab846abdc3ffa357cf8cfb056c4a9d7a1c57035fbb5610920680a3dc8d5cf
Opcode Fuzzy Hash: a9d80c92317e710bb0ee7b8060ee11baa7f71990c7fa4e3373d3f7fac537cda3
Instruction Fuzzy Hash: 1251E2716043419BD714FB22D856AAE7795AF84308F10093FF986A22E2EF7C9D44C69F

Function 0043A8BA Relevance: 16.6, APIs: 11, Instructions: 116COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,00000050,000000FF,00000000,00000000,?,?,?,00401D55,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 0043A912
GetLastError.KERNEL32(?,?,00401D55,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 0043A91F
__dosmaperr.LIBCMT ref: 0043A926
MultiByteToWideChar.KERNEL32(?,00000000,00000050,000000FF,00000000,00000000,?,?,?,00401D55,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 0043A952
GetLastError.KERNEL32(?,?,?,00401D55,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 0043A95C
__dosmaperr.LIBCMT ref: 0043A963
WideCharToMultiByte.KERNEL32(?,00000000,00000000,000000FF,00000000,?,00000000,00000000,?,?,?,?,?,?,00401D55,?), ref: 0043A9A6
GetLastError.KERNEL32(?,?,?,?,?,?,00401D55,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 0043A9B0
__dosmaperr.LIBCMT ref: 0043A9B7
_free.LIBCMT ref: 0043A9C3
_free.LIBCMT ref: 0043A9CA

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: ByteCharErrorLastMultiWide__dosmaperr$_free
String ID:
API String ID: 2441525078-0
Opcode ID: 65e47024088546fc334146591d56820f873165bf99cfabfd31b4add3ed5f98c2
Instruction ID: 3a2165a63a30732921e8d6571a772c998230e0148124485b419b79488018c54b
Opcode Fuzzy Hash: 65e47024088546fc334146591d56820f873165bf99cfabfd31b4add3ed5f98c2
Instruction Fuzzy Hash: 8631D5B180420AFBDF01AFA5CC45EAF3B6CEF09324F11451AF950662A1DB38CD61DB66

Function 004054A0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 155windowmemoryCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?,?), ref: 004054BF
GetMessageA.USER32(?,00000000,00000000,00000000), ref: 0040556F
TranslateMessage.USER32(?), ref: 0040557E
DispatchMessageA.USER32(?), ref: 00405589
HeapCreate.KERNEL32(00000000,00000000,00000000,00000074,00474F78), ref: 00405641
HeapFree.KERNEL32(00000000,00000000,0000003B,0000003B,?,00000000), ref: 00405679

Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36

Strings

CloseChat, xrefs: 00405609
GetMessage, xrefs: 004055F8
DisplayMessage, xrefs: 004055EC

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: Message$Heap$CreateDispatchEventFreeTranslatesend
String ID: CloseChat$DisplayMessage$GetMessage
API String ID: 2956720200-749203953
Opcode ID: 591c48c1281b6b3b80d7ee549707424c1b5dd5eb9ee896b19b31c0dcecb944f2
Instruction ID: d37e718accd843302ceacc2187c81124e04698433963f5de03abd71ab6b9016f
Opcode Fuzzy Hash: 591c48c1281b6b3b80d7ee549707424c1b5dd5eb9ee896b19b31c0dcecb944f2
Instruction Fuzzy Hash: 39419071A04301ABCB14FB76DC5A86F37A9AB85704F40493EF516A31E1EF3C8905CB9A

Function 00417D1A Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 108filesynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00417F67: __EH_prolog.LIBCMT ref: 00417F6C

WaitForSingleObject.KERNEL32(00000000,000000FF,00000070,004660B4), ref: 00417E17
CloseHandle.KERNEL32(00000000), ref: 00417E20
DeleteFileA.KERNEL32(00000000), ref: 00417E2F
ShellExecuteExA.SHELL32(0000003C,00000000,00000010,?,?,?), ref: 00417DE3

Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36

Strings

0VG, xrefs: 00417DF0
<, xrefs: 00417DBE
@, xrefs: 00417DC5
Temp, xrefs: 00417D3B
0VG, xrefs: 00417E5C

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: CloseDeleteExecuteFileH_prologHandleObjectShellSingleWaitsend
String ID: 0VG$0VG$<$@$Temp
API String ID: 1704390241-2575729100
Opcode ID: 770267ec3d45abc508c60553e0d69256dfd3bd3466962ea0f4637c0737b4c84d
Instruction ID: 01f79aac078c9204ae4226344def03f9678a0966abb138ad227abf0e83d93267
Opcode Fuzzy Hash: 770267ec3d45abc508c60553e0d69256dfd3bd3466962ea0f4637c0737b4c84d
Instruction Fuzzy Hash: 18417E319002099ACB14FB62DC56AEE7735AF00318F50417EF50A761E1EF7C5A8ACB99

Function 0041697B Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 46clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 0041697C
EmptyClipboard.USER32 ref: 0041698A
CloseClipboard.USER32 ref: 00416990
OpenClipboard.USER32 ref: 00416997
GetClipboardData.USER32(0000000D), ref: 004169A7
GlobalLock.KERNEL32(00000000), ref: 004169B0
GlobalUnlock.KERNEL32(00000000), ref: 004169B9
CloseClipboard.USER32 ref: 004169BF

Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36

Strings

!D@, xrefs: 004170C4

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: Clipboard$CloseGlobalOpen$DataEmptyLockUnlocksend
String ID: !D@
API String ID: 2172192267-604454484
Opcode ID: da78ba80ec0729aaebbd7618c01a60a0d67124b513bef4f543176b1e835a0158
Instruction ID: c3dc955394dadbf9cb8fa72aed918e4e170398eafb94270add22466952777bd7
Opcode Fuzzy Hash: da78ba80ec0729aaebbd7618c01a60a0d67124b513bef4f543176b1e835a0158
Instruction Fuzzy Hash: AA014C31204301EFC714BB72DC49AAE7BA5AF88742F40047EF906861E2DF388C45C659

Function 0041330D Relevance: 15.2, APIs: 10, Instructions: 153fileCOMMON

Download Yara Rule

APIs

CreateFileMappingW.KERNEL32(?,00000000,00000002,00000000,00000000,00000000), ref: 00413452
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 00413460
GetFileSize.KERNEL32(?,00000000), ref: 0041346D
UnmapViewOfFile.KERNEL32(00000000), ref: 0041348D
CloseHandle.KERNEL32(00000000), ref: 0041349A
CloseHandle.KERNEL32(?), ref: 004134A0

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: File$CloseHandleView$CreateMappingSizeUnmap
String ID:
API String ID: 297527592-0
Opcode ID: 574f29b59094fb47ce71c879203f8806fd1a71798bcc0508934a1059045681f6
Instruction ID: 84c8eec30da1abd4ec43dfc3561b6153623c17c5959ee0fa3a13cc5c00e14cc2
Opcode Fuzzy Hash: 574f29b59094fb47ce71c879203f8806fd1a71798bcc0508934a1059045681f6
Instruction Fuzzy Hash: F041F331104301BBD7119F25EC49F6B3BACEFC9769F10052EF655D21A2DB38DA40866E

Function 0041AB9E Relevance: 15.1, APIs: 10, Instructions: 66serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,00000011,00000000,00000001,?,?,?,?,?,?,0041A517,00000000), ref: 0041ABAD
OpenServiceW.ADVAPI32(00000000,00000000,000F003F,?,?,?,?,?,?,0041A517,00000000), ref: 0041ABC4
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A517,00000000), ref: 0041ABD1
ControlService.ADVAPI32(00000000,00000001,?,?,?,?,?,?,?,0041A517,00000000), ref: 0041ABE0
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A517,00000000), ref: 0041ABF1
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A517,00000000), ref: 0041ABF4

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: Service$CloseHandle$Open$ControlManager
String ID:
API String ID: 221034970-0
Opcode ID: 06969d4054276dbf450069cd14adbb04630f9483e2dd0d38d9b092c5558579ee
Instruction ID: a7ddf6af562b27afc3fdb57d9320cc893b1711f81dd6882f7bac22400d97ef93
Opcode Fuzzy Hash: 06969d4054276dbf450069cd14adbb04630f9483e2dd0d38d9b092c5558579ee
Instruction Fuzzy Hash: 1411E931501218BFD711AF64DC85CFF3B6CDB41B66B000426FA0692191EB689D46AAFA

Function 004481A1 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 004481B5

Part of subcall function 00446802: HeapFree.KERNEL32(00000000,00000000,?,00450CEF,?,00000000,?,00000000,?,00450F93,?,00000007,?,?,004514DE,?), ref: 00446818
Part of subcall function 00446802: GetLastError.KERNEL32(?,?,00450CEF,?,00000000,?,00000000,?,00450F93,?,00000007,?,?,004514DE,?,?), ref: 0044682A

_free.LIBCMT ref: 004481C1
_free.LIBCMT ref: 004481CC
_free.LIBCMT ref: 004481D7
_free.LIBCMT ref: 004481E2
_free.LIBCMT ref: 004481ED
_free.LIBCMT ref: 004481F8
_free.LIBCMT ref: 00448203
_free.LIBCMT ref: 0044820E
_free.LIBCMT ref: 0044821C

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 7409258e8d3de90c3944c0df00460aed843c684c15a9003062b0a9d40dd376ab
Instruction ID: 68a5115f29dd4dda1e04096f5587add38bc33a27c3b2fba9646c6a67a64c999e
Opcode Fuzzy Hash: 7409258e8d3de90c3944c0df00460aed843c684c15a9003062b0a9d40dd376ab
Instruction Fuzzy Hash: AA11E9B6901108BFDB01FF55C852CDD3B65FF05354B0244AAF9488F222DB75DE509B95

Function 00411530 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 191COMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?,?), ref: 0041154F
inet_ntoa.WS2_32(?), ref: 004115EA

Strings

StartReverse, xrefs: 004116BA
NG, xrefs: 00411575
StartForward, xrefs: 004116AE
StopForward, xrefs: 004116CB
GetDirectListeningPort, xrefs: 004116ED
StopReverse, xrefs: 004116DC

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: Eventinet_ntoa
String ID: GetDirectListeningPort$StartForward$StartReverse$StopForward$StopReverse$NG
API String ID: 3578746661-3604713145
Opcode ID: 4e21a2f59a70c1706d024147cdd53ff7e95f6fec3846ad06d6566d393d8da941
Instruction ID: 5b49fc9f60f15aadef5e91219dcc0d557585a55aed20fbc46105045b647f8dc0
Opcode Fuzzy Hash: 4e21a2f59a70c1706d024147cdd53ff7e95f6fec3846ad06d6566d393d8da941
Instruction Fuzzy Hash: 5351D531A042015BC714FB36D95AAAE36A5AB84344F40453FFA06676F2EF7C8985C7CE

Function 00455F84 Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 154COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,?,0045707F), ref: 00455FA7

Strings

exp, xrefs: 0045606C, 004560CE
log10, xrefs: 00455FF1, 00456041
log, xrefs: 0045604D, 00456059
acos, xrefs: 0045611F
sqrt, xrefs: 0045612B
asin, xrefs: 00456113
pow, xrefs: 0045608B, 00456137, 0045614A

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: DecodePointer
String ID: acos$asin$exp$log$log10$pow$sqrt
API String ID: 3527080286-3064271455
Opcode ID: 91e2bc993b3a5d0be0d2963f4ae304432519259fdd54363bb3d88c255dc20ba7
Instruction ID: a80f67f54703b8f0c72b4cfac69ffbb6288a0afb30985e2ab5cebdbe3ffe6fde
Opcode Fuzzy Hash: 91e2bc993b3a5d0be0d2963f4ae304432519259fdd54363bb3d88c255dc20ba7
Instruction Fuzzy Hash: BB515071900909DBCF10DF58E9481BDBBB0FF49306F924197D841A7396DB798928CB1E

Function 0044B43C Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 152fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(FF8BC35D,00000000,?,?,?,?,?,?,PkGNG,0044BBB1,?,00000000,FF8BC35D,00000000,00000000,FF8BC369), ref: 0044B47E
__fassign.LIBCMT ref: 0044B4F9
__fassign.LIBCMT ref: 0044B514
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,FF8BC35D,00000005,00000000,00000000), ref: 0044B53A
WriteFile.KERNEL32(?,FF8BC35D,00000000,0044BBB1,00000000,?,?,?,?,?,?,?,?,PkGNG,0044BBB1,?), ref: 0044B559
WriteFile.KERNEL32(?,?,00000001,0044BBB1,00000000,?,?,?,?,?,?,?,?,PkGNG,0044BBB1,?), ref: 0044B592

Strings

PkGNG, xrefs: 0044B43E

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID: PkGNG
API String ID: 1324828854-263838557
Opcode ID: 311db8d3e4a1a0a231de64f74e89b34bd80b314b172ec9a4a2cdea1eea97895d
Instruction ID: 262f0c9efa3d8d05c94b564727faad167cb6e35c827a04fe4b8fb241bd644287
Opcode Fuzzy Hash: 311db8d3e4a1a0a231de64f74e89b34bd80b314b172ec9a4a2cdea1eea97895d
Instruction Fuzzy Hash: 2151B470A00249AFDB10CFA8D845AEEFBF8EF09304F14456BE955E7291E734D941CBA9

Function 004174D0 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 104sleepfileCOMMON

Download Yara Rule

APIs

ShellExecuteW.SHELL32(00000000,open,dxdiag,00000000,00000000,00000000), ref: 00417530

Part of subcall function 0041C516: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000,00000000,?,?,00000000,0040412F,00465E84), ref: 0041C52F

Sleep.KERNEL32(00000064), ref: 0041755C
DeleteFileW.KERNEL32(00000000), ref: 00417590

Strings

dxdiag, xrefs: 00417525
/t , xrefs: 0041750F
open, xrefs: 0041752A
temp, xrefs: 004174E0
\sysinfo.txt, xrefs: 004174DB

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: File$CreateDeleteExecuteShellSleep
String ID: /t $\sysinfo.txt$dxdiag$open$temp
API String ID: 1462127192-2001430897
Opcode ID: f341753d6f3a08b8f61e7ed043ac881f71afe8c82c6e57c86a755af76922d4c4
Instruction ID: 6598d36db715e58345e35b35962d03aab6dacf30af49f41f33489dbeb2d48940
Opcode Fuzzy Hash: f341753d6f3a08b8f61e7ed043ac881f71afe8c82c6e57c86a755af76922d4c4
Instruction Fuzzy Hash: 17313F71940119AADB04FB61DC96DED7735AF50309F00017EF606731E2EF785A8ACA9C

Function 004073E7 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 99COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00472B14,00000000,004752D8,00003000,00000004,00000000,00000001), ref: 00407418
GetCurrentProcess.KERNEL32(00472B14,00000000,00008000,?,00000000,00000001,00000000,00407691,C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe), ref: 004074D9

Strings

\explorer.exe, xrefs: 0040743B
windir, xrefs: 00407425
[-] NtAllocateVirtualMemory Error, xrefs: 00407478
explorer.exe, xrefs: 0040748B, 004074B6
PEB: %x, xrefs: 004074EA
[+] NtAllocateVirtualMemory Success, xrefs: 0040744B

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: CurrentProcess
String ID: PEB: %x$[+] NtAllocateVirtualMemory Success$[-] NtAllocateVirtualMemory Error$\explorer.exe$explorer.exe$windir
API String ID: 2050909247-4242073005
Opcode ID: cf568b37148f4497f81ab12635e2dca67c7b70f724ed768a1d25f1bc6ab9bf95
Instruction ID: c8d37550e6f1e63eabf3c93e4c9511e0cbcdb01d3c289a22ccdf2b55afca88d7
Opcode Fuzzy Hash: cf568b37148f4497f81ab12635e2dca67c7b70f724ed768a1d25f1bc6ab9bf95
Instruction Fuzzy Hash: DE317EB1A44300ABD314EF65DD46F1677B8BB04705F10087EF509A6692EBB8B8458B6F

Function 00401D0B Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 89COMMON

Download Yara Rule

APIs

_strftime.LIBCMT ref: 00401D50

Part of subcall function 00401A6D: CreateFileW.KERNEL32(00000000,40000000,00000000), ref: 00401AD9

waveInUnprepareHeader.WINMM(00472A88,00000020,00000000,?), ref: 00401E02
waveInPrepareHeader.WINMM(00472A88,00000020), ref: 00401E40
waveInAddBuffer.WINMM(00472A88,00000020), ref: 00401E4F

Strings

dMG, xrefs: 00401D81
|MG, xrefs: 00401E08
.wav, xrefs: 00401D69
%Y-%m-%d %H.%M, xrefs: 00401D41

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: wave$Header$BufferCreateFilePrepareUnprepare_strftime
String ID: %Y-%m-%d %H.%M$.wav$dMG$|MG
API String ID: 3809562944-243156785
Opcode ID: 5ca57e464fc48cfd7ac60de242ae16507c8b77f4a1a81d17ad6b6b7cf7425d61
Instruction ID: 12771182903f202c4b9d99511a6abf0f0559d076e6e3c56183b1657b5f9df8bc
Opcode Fuzzy Hash: 5ca57e464fc48cfd7ac60de242ae16507c8b77f4a1a81d17ad6b6b7cf7425d61
Instruction Fuzzy Hash: AA318F315043019FC324EB22DC56A9E77A8FB84315F40443EF189A21F2EFB89A49CB5E

Function 00410E9C Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00410EA9
int.LIBCPMT ref: 00410EBC

Part of subcall function 0040E0FC: std::_Lockit::_Lockit.LIBCPMT ref: 0040E10D
Part of subcall function 0040E0FC: std::_Lockit::~_Lockit.LIBCPMT ref: 0040E127

std::_Facet_Register.LIBCPMT ref: 00410EFC
std::_Lockit::~_Lockit.LIBCPMT ref: 00410F05
__CxxThrowException@8.LIBVCRUNTIME ref: 00410F23
__Init_thread_footer.LIBCMT ref: 00410F64

Strings

,kG, xrefs: 00410F3F
0kG, xrefs: 00410F6C

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_Init_thread_footerRegisterThrow
String ID: ,kG$0kG
API String ID: 3815856325-2015055088
Opcode ID: 9b6f417909eb5cd4a3a9238d92eaca8e17f16862a4fd72c37d6a1f751429c824
Instruction ID: 6b7561e6e5701aa818233467e21ea388c72e3112cb5a37ed7db11c94fdfc7bf8
Opcode Fuzzy Hash: 9b6f417909eb5cd4a3a9238d92eaca8e17f16862a4fd72c37d6a1f751429c824
Instruction Fuzzy Hash: 682129329005249BCB14FB6AD8429DE77A9DF48324F21416FF404E72D1DFB9AD818B9D

Function 00401BE9 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 71COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(00000000,00000000), ref: 00401BF9
waveInOpen.WINMM(00472AC0,000000FF,00472AA8,Function_00001D0B,00000000,00000000,00000024), ref: 00401C8F
waveInPrepareHeader.WINMM(00472A88,00000020), ref: 00401CE3
waveInAddBuffer.WINMM(00472A88,00000020), ref: 00401CF2
waveInStart.WINMM ref: 00401CFE

Strings

|MG, xrefs: 00401C9B
PG, xrefs: 00401C27
dMG, xrefs: 00401BED

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: wave$BufferCreateDirectoryHeaderOpenPrepareStart
String ID: dMG$|MG$PG
API String ID: 1356121797-532278878
Opcode ID: e50daa58507802a607b8e69ff53587dfa1525f8723cff621260b0af96f5d677f
Instruction ID: 1e392cdedf79dd274444ae0cc0b76d6cc185fd36309c60cea9b16e967c73269b
Opcode Fuzzy Hash: e50daa58507802a607b8e69ff53587dfa1525f8723cff621260b0af96f5d677f
Instruction Fuzzy Hash: 51212A71604201AFC7399F66EE15A6A7BB6FB94715B00803FA10DD76B1DBB84881CB5C

Function 0041D4EE Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 48windowstringCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 0041D507

Part of subcall function 0041D5A0: RegisterClassExA.USER32(00000030), ref: 0041D5EC
Part of subcall function 0041D5A0: CreateWindowExA.USER32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,000000FD,00000000,00000000,00000000), ref: 0041D607
Part of subcall function 0041D5A0: GetLastError.KERNEL32 ref: 0041D611

ExtractIconA.SHELL32(00000000,?,00000000), ref: 0041D53E
lstrcpynA.KERNEL32(00474B60,Remcos,00000080), ref: 0041D558
Shell_NotifyIconA.SHELL32(00000000,00474B48), ref: 0041D56E
TranslateMessage.USER32(?), ref: 0041D57A
DispatchMessageA.USER32(?), ref: 0041D584
GetMessageA.USER32(?,00000000,00000000,00000000), ref: 0041D591

Strings

Remcos, xrefs: 0041D549

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: Message$Icon$ClassCreateDispatchErrorExtractFileLastModuleNameNotifyRegisterShell_TranslateWindowlstrcpyn
String ID: Remcos
API String ID: 1970332568-165870891
Opcode ID: bb528cd859a2941ef755fedfca18549d942758f832e9eaa985f33bd327a59cbd
Instruction ID: 0a96d410cd687733bc2db9baaca44b2a156926270a6f860d3af68fdb0bcdced8
Opcode Fuzzy Hash: bb528cd859a2941ef755fedfca18549d942758f832e9eaa985f33bd327a59cbd
Instruction Fuzzy Hash: CA0152B1840244EBD7109FA5EC4CFABBB7CEBC5705F00406AF515931A1D778D885CB58

Function 0044CE00 Relevance: 13.8, APIs: 9, Instructions: 300COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41332500f0008602d77d1c660e50033fd15bda36b9a02a1f3ccc300d02d52732
Instruction ID: c312da418a410335279f0cc1971bad4557be7deeadefc114a47e367d78dfde09
Opcode Fuzzy Hash: 41332500f0008602d77d1c660e50033fd15bda36b9a02a1f3ccc300d02d52732
Instruction Fuzzy Hash: 94C1FA70D04249AFEF11DFA8CC41BAE7BB0AF09304F19415AE915A7392C77C9941CB69

Function 00453E03 Relevance: 13.8, APIs: 9, Instructions: 268COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?), ref: 00453EAF
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 00453F32
__alloca_probe_16.LIBCMT ref: 00453F6A
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00453FC5
__alloca_probe_16.LIBCMT ref: 00454014
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 00453FDC

Part of subcall function 004461B8: RtlAllocateHeap.NTDLL(00000000,00435349,?,?,004388C7,?,?,00000000,00476B50,?,0040DE9D,00435349,?,?,?,?), ref: 004461EA

MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00454058
__freea.LIBCMT ref: 00454083
__freea.LIBCMT ref: 0045408F

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$__alloca_probe_16__freea$AllocateHeapInfo
String ID:
API String ID: 201697637-0
Opcode ID: 0e4c9693fbb30d8259a9360a9357c9a64508312006b92e836ecbd2da2b3ae83b
Instruction ID: 957693029e8655488503f3238c5b69ab87e72ad781d0cd1ca1c521277c14990f
Opcode Fuzzy Hash: 0e4c9693fbb30d8259a9360a9357c9a64508312006b92e836ecbd2da2b3ae83b
Instruction Fuzzy Hash: 2B91D472E002069BDB208E65C846EEFBBF59F49756F14051BED00EB282D73DCD898769

Function 004451FA Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 266COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00448295: GetLastError.KERNEL32(?,0043F770,0043A875,0043F770,00474EF8,PkGNG,0043CE65,FF8BC35D,00474EF8,00474EF8), ref: 00448299
Part of subcall function 00448295: _free.LIBCMT ref: 004482CC
Part of subcall function 00448295: SetLastError.KERNEL32(00000000,?,?,00000000), ref: 0044830D
Part of subcall function 00448295: _abort.LIBCMT ref: 00448313

_memcmp.LIBVCRUNTIME ref: 004454A4
_free.LIBCMT ref: 00445515
_free.LIBCMT ref: 0044552E
_free.LIBCMT ref: 00445560
_free.LIBCMT ref: 00445569
_free.LIBCMT ref: 00445575

Strings

C, xrefs: 00445362

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: _free$ErrorLast$_abort_memcmp
String ID: C
API String ID: 1679612858-1037565863
Opcode ID: 2813a1e0ac90985d52fee0968b9a0cfa35de9e1761f336dc1444ec918196fcc8
Instruction ID: c5fa7cd4a0def74fccfc383a36f0c71fd12082b8797d706f49daa7c6421ebafc
Opcode Fuzzy Hash: 2813a1e0ac90985d52fee0968b9a0cfa35de9e1761f336dc1444ec918196fcc8
Instruction Fuzzy Hash: D4B13775A016199FEB24DF18C885BAEB7B4FF48304F5085EAE809A7351E774AE90CF44

Function 00414945 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 225COMMON

Download Yara Rule

Strings

tcp, xrefs: 00414AAE
udp, xrefs: 00414A81

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID:
String ID: tcp$udp
API String ID: 0-3725065008
Opcode ID: e3882082d73cb51732241927fa811467e6376eb334e21639ae703d67e169e483
Instruction ID: 4fb2fbaa1818e082f2863e0a7c91e4ace7fe62ed23b491eff3584b955907a2f3
Opcode Fuzzy Hash: e3882082d73cb51732241927fa811467e6376eb334e21639ae703d67e169e483
Instruction Fuzzy Hash: FC7197706083028FDB248F55D4817ABB7E4AFC8355F20482FF88697351E778DE858B9A

Function 0040186A Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 142threadCOMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 004018BE
ExitThread.KERNEL32 ref: 004018F6
waveInUnprepareHeader.WINMM(?,00000020,00000000,?,00000020,00474EE0,00000000), ref: 00401A04

Part of subcall function 00434801: __onexit.LIBCMT ref: 00434807

Strings

NG, xrefs: 00401990
NG, xrefs: 0040190D
XMG, xrefs: 00401902
PkG, xrefs: 00401888

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: ExitHeaderInit_thread_footerThreadUnprepare__onexitwave
String ID: PkG$XMG$NG$NG
API String ID: 1649129571-3151166067
Opcode ID: a6c6281f9468bedd5a2c51a416d0a2a3443504d2818988bdbccb9fdc1c563a82
Instruction ID: 94ec9d015e3317cd6a1a8c0f3f0e5257b1b149af30ff9c9aaa6ade548e88cebb
Opcode Fuzzy Hash: a6c6281f9468bedd5a2c51a416d0a2a3443504d2818988bdbccb9fdc1c563a82
Instruction Fuzzy Hash: 7441D5312042109BC324FB26DD96ABE73A6AB85314F00453FF54AA61F2DF386D4AC71D

Function 0040799E Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 102fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,00000004,00000000,00000000,00000002,00000080,00000000,00000000,00474EE0,00465FB4,?,00000000,00408037,00000000), ref: 00407A00
WriteFile.KERNEL32(00000000,?,00000000,000186A0,00000000,?,000186A0,?,?,00000000,00408037,00000000,?,?,0000000A,00000000), ref: 00407A48

Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36

CloseHandle.KERNEL32(00000000,?,00000000,00408037,00000000,?,?,0000000A,00000000), ref: 00407A88
MoveFileW.KERNEL32(00000000,00000000), ref: 00407AA5
CloseHandle.KERNEL32(00000000,00000057,?,00000008,?,?,?,?,?,?,?,0000000A,00000000), ref: 00407AD0
DeleteFileW.KERNEL32(00000000,?,?,?,?,?,?,?,0000000A,00000000), ref: 00407AE0

Part of subcall function 00404B96: WaitForSingleObject.KERNEL32(?,000000FF,?,00474EF8,00404C49,00000000,?,?,?,00474EF8,?), ref: 00404BA5
Part of subcall function 00404B96: SetEvent.KERNEL32(?), ref: 00404BC3

Strings

.part, xrefs: 004079C4

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: File$CloseHandle$CreateDeleteEventMoveObjectSingleWaitWritesend
String ID: .part
API String ID: 1303771098-3499674018
Opcode ID: c438b6c3ad66c49b0c8fac277bcd0795076709a98bb5b529a829fc4e1ae4dc70
Instruction ID: fa021c15c5d1e87e569c09a19ead990ccf19330fc060556597d24b4305e87d8f
Opcode Fuzzy Hash: c438b6c3ad66c49b0c8fac277bcd0795076709a98bb5b529a829fc4e1ae4dc70
Instruction Fuzzy Hash: 3A31B571508345AFC310EB61D84599FB3A8FF94359F00493FB945A21D2EB78EE08CB9A

Function 004199DB Relevance: 12.1, APIs: 8, Instructions: 117keyboardCOMMON

Download Yara Rule

APIs

SendInput.USER32 ref: 00419A25
SendInput.USER32(00000001,?,0000001C,00000000), ref: 00419A4D
SendInput.USER32(00000001,0000001C,0000001C), ref: 00419A74
SendInput.USER32(00000001,0000001C,0000001C), ref: 00419A92
SendInput.USER32(00000001,0000001C,0000001C), ref: 00419AB2
SendInput.USER32(00000001,0000001C,0000001C), ref: 00419AD7
SendInput.USER32(00000001,0000001C,0000001C), ref: 00419AF9
SendInput.USER32(00000001,00000000,0000001C), ref: 00419B1C

Part of subcall function 004199CE: MapVirtualKeyA.USER32(00000000,00000000), ref: 004199D4

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: InputSend$Virtual
String ID:
API String ID: 1167301434-0
Opcode ID: fc4380392ba50379eb6d472fb1d17d58296046c22f58e77cb3b57b5de18c14a3
Instruction ID: b6cba15de7ba168fc32b54cb564de1fb898aed6d56f2455a0f9f7e0387a20004
Opcode Fuzzy Hash: fc4380392ba50379eb6d472fb1d17d58296046c22f58e77cb3b57b5de18c14a3
Instruction Fuzzy Hash: 2431AE71218349A9E220DFA5DC41BDFBBECAF89B44F04080FF58457291CAA49D8C876B

Function 004475F1 Relevance: 10.9, APIs: 3, Strings: 3, Instructions: 389COMMONLIBRARYCODE

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 004476F9
__freea.LIBCMT ref: 004477A3
__freea.LIBCMT ref: 004477C1

Part of subcall function 00435ECD: _free.LIBCMT ref: 00435EE3

Strings

h{D, xrefs: 00447A2B
a/p, xrefs: 00447888
am/pm, xrefs: 00447824

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16_free
String ID: a/p$am/pm$h{D
API String ID: 2936374016-2303565833
Opcode ID: 4ddb7e6ff69264204235b909ea28f14837368a743d4617b198cabd7c05983ebc
Instruction ID: c225e1f32c331ede1d29eb10815d0f52c76e58365e66366979e06629ded2ae5c
Opcode Fuzzy Hash: 4ddb7e6ff69264204235b909ea28f14837368a743d4617b198cabd7c05983ebc
Instruction Fuzzy Hash: 94D1E1719082068AFB299F68C845ABFB7B1EF05300F28455BE501AB351D73D9E43CBA9

Function 00444D7C Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 187COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 004461B8: RtlAllocateHeap.NTDLL(00000000,00435349,?,?,004388C7,?,?,00000000,00476B50,?,0040DE9D,00435349,?,?,?,?), ref: 004461EA

_free.LIBCMT ref: 00444E87
_free.LIBCMT ref: 00444E9E
_free.LIBCMT ref: 00444EBD
_free.LIBCMT ref: 00444ED8
_free.LIBCMT ref: 00444EEF

Strings

KED, xrefs: 00444DAC, 00444F2E

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: _free$AllocateHeap
String ID: KED
API String ID: 3033488037-2133951994
Opcode ID: 4e35ff1e2d87e21165085a9225b40beb0941a1a7db736cbd5727a613c3eec6b7
Instruction ID: 6eb5fd97c930506827bd935ec23fdf2bd7e2f8155051dcdfd38a61b70e77380a
Opcode Fuzzy Hash: 4e35ff1e2d87e21165085a9225b40beb0941a1a7db736cbd5727a613c3eec6b7
Instruction Fuzzy Hash: 2351B371A00604ABEB20DF29CC42B6B77F4FF89724B25456EE809D7751E739E901CB98

Function 00413A90 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 179registryCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32(?,?,00000104,00000000,?,?,?,?,?,?,?,?), ref: 00413AF7
RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000104,00000000,?,?,?,?), ref: 00413B26
RegEnumValueW.ADVAPI32(?,00000000,?,00003FFF,00000000,?,?,00002710,?,?,?,?,?,?,?,?), ref: 00413BC6

Strings

[regsplt], xrefs: 00413C52
xUG, xrefs: 00413C81
TG, xrefs: 00413C38

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: Enum$InfoQueryValue
String ID: [regsplt]$xUG$TG
API String ID: 3554306468-1165877943
Opcode ID: 0915e5250acf3bea082794a31251f109dca26ef8e60840e512c7265f34e5d9a1
Instruction ID: 25111a67c66830bda9a991cbd11294aa9b1843c944dfd5f4caafe5fa1545c2ae
Opcode Fuzzy Hash: 0915e5250acf3bea082794a31251f109dca26ef8e60840e512c7265f34e5d9a1
Instruction Fuzzy Hash: 05512D71900219AADB11EB95DC86EEEB77DAF04305F10007AE505B6191EF746B48CBA9

Function 00413D48 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 135registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,00020019,?), ref: 00413D81

Part of subcall function 00413A90: RegQueryInfoKeyW.ADVAPI32(?,?,00000104,00000000,?,?,?,?,?,?,?,?), ref: 00413AF7
Part of subcall function 00413A90: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000104,00000000,?,?,?,?), ref: 00413B26

Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36

RegCloseKey.ADVAPI32(00000000,004660B4,004660B4,00466478,00466478,00000071), ref: 00413EEF

Strings

xUG, xrefs: 00413EE1
NG, xrefs: 00413E5E
TG, xrefs: 00413ED5
NG, xrefs: 00413DA4

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: CloseEnumInfoOpenQuerysend
String ID: xUG$NG$NG$TG
API String ID: 3114080316-2811732169
Opcode ID: e4b1693873f9bfafd7d4200e3b5d9e02c59f6be64668d25b7482fecaa941673b
Instruction ID: 39136fa66a1b3d14a29046baa0c8a2124f92290552efa608aac098e6c3039c27
Opcode Fuzzy Hash: e4b1693873f9bfafd7d4200e3b5d9e02c59f6be64668d25b7482fecaa941673b
Instruction Fuzzy Hash: 03419F316042005AC324F726D852AEF76A99FD1384F40883FF549671D2EF7C5949866E

Function 004511AC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,000000FF,?,00000000,00000000,0043F918,?,00000000,?,00000001,?,000000FF,00000001,0043F918,?), ref: 004511F9
__alloca_probe_16.LIBCMT ref: 00451231
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00451282
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 00451294
__freea.LIBCMT ref: 0045129D

Part of subcall function 004461B8: RtlAllocateHeap.NTDLL(00000000,00435349,?,?,004388C7,?,?,00000000,00476B50,?,0040DE9D,00435349,?,?,?,?), ref: 004461EA

Strings

PkGNG, xrefs: 004511AE

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__alloca_probe_16__freea
String ID: PkGNG
API String ID: 313313983-263838557
Opcode ID: 9f5a2a67851111230ceb537eb1b7ccf29ba8faad681cfee17df3cfbc13bcf043
Instruction ID: f723c28c07ecd650b398e20bb728631ced1c531215915adb10fa1f31571a6cea
Opcode Fuzzy Hash: 9f5a2a67851111230ceb537eb1b7ccf29ba8faad681cfee17df3cfbc13bcf043
Instruction Fuzzy Hash: F7310331A0020AABDF249F65DC41EAF7BA5EB04701F0445AAFC08E72A2E739CC55CB94

Function 0041B71B Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 91COMMON

Download Yara Rule

APIs

Part of subcall function 00413656: RegOpenKeyExW.ADVAPI32(80000001,00000400,00000000,00020019,?,004750E4), ref: 00413678
Part of subcall function 00413656: RegQueryValueExW.ADVAPI32(?,0040F34E,00000000,00000000,?,00000400), ref: 00413697
Part of subcall function 00413656: RegCloseKey.ADVAPI32(?), ref: 004136A0

Part of subcall function 0041C048: GetCurrentProcess.KERNEL32(?,?,?,0040DAE5,WinDir,00000000,00000000), ref: 0041C059

_wcslen.LIBCMT ref: 0041B7F4

Strings

program files (x86)\, xrefs: 0041B7EE
8SG, xrefs: 0041B79A, 0041B79F
.exe, xrefs: 0041B746
program files\, xrefs: 0041B7DA, 0041B7E1, 0041B7F3
http\shell\open\command, xrefs: 0041B72B

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: CloseCurrentOpenProcessQueryValue_wcslen
String ID: .exe$8SG$http\shell\open\command$program files (x86)\$program files\
API String ID: 37874593-122982132
Opcode ID: 6e4530202917b19cbbea06c57cde587f82f9719f354b1f28db5066e5f2e92548
Instruction ID: 00334f857bbe6022557327a28fa8f115e820bd32ca6b34e50ab8c41aa79dd428
Opcode Fuzzy Hash: 6e4530202917b19cbbea06c57cde587f82f9719f354b1f28db5066e5f2e92548
Instruction Fuzzy Hash: 42218872A001046BDB14BAB59CD6AFE766D9B48728F10043FF505B72C3EE3C9D49426D

Function 0040BF24 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 87COMMON

Download Yara Rule

APIs

Part of subcall function 004135E1: RegOpenKeyExA.KERNELBASE(80000001,00000400,00000000,00020019,?), ref: 00413605
Part of subcall function 004135E1: RegQueryValueExA.KERNELBASE(?,?,00000000,00000000,?,00000400), ref: 00413622
Part of subcall function 004135E1: RegCloseKey.KERNELBASE(?), ref: 0041362D

ExpandEnvironmentStringsA.KERNEL32(00000000,?,00000104,00000000), ref: 0040BFA6
PathFileExistsA.SHLWAPI(?), ref: 0040BFB3

Strings

[IE cookies not found], xrefs: 0040BF7B
Cookies, xrefs: 0040BF38
Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders, xrefs: 0040BF3D
[IE cookies cleared!], xrefs: 0040C000, 0040C025

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: CloseEnvironmentExistsExpandFileOpenPathQueryStringsValue
String ID: [IE cookies cleared!]$[IE cookies not found]$Cookies$Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
API String ID: 1133728706-4073444585
Opcode ID: 82f3536f7391415d25674f0736c327500bde81d48cd9b738ac55359f41ca632d
Instruction ID: a06d8339010b4a31413dea3cf8b7af81beee50618fccc2c871009a62ab4f9f33
Opcode Fuzzy Hash: 82f3536f7391415d25674f0736c327500bde81d48cd9b738ac55359f41ca632d
Instruction Fuzzy Hash: BC215230A40219A6CB14F7F1CC969EE77299F50744F80017FE502B71D1EB7D6945C6DA

Function 00456BD3 Relevance: 10.6, APIs: 7, Instructions: 80COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6348a53403ba44e76667cab5d3d4b8c4f90ca5e92cff7b4211fa09d26e343de5
Instruction ID: d4e598e7927038c57750db0ba161657e9615562456f8c919f0676739ef068bdb
Opcode Fuzzy Hash: 6348a53403ba44e76667cab5d3d4b8c4f90ca5e92cff7b4211fa09d26e343de5
Instruction Fuzzy Hash: 931127B2504214BBEB216F768C05D1F7A5CEB86726B52062EFD55C7292DA3CCC0186A8

Function 00450F7A Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00450CC1: _free.LIBCMT ref: 00450CEA

_free.LIBCMT ref: 00450FC8

Part of subcall function 00446802: HeapFree.KERNEL32(00000000,00000000,?,00450CEF,?,00000000,?,00000000,?,00450F93,?,00000007,?,?,004514DE,?), ref: 00446818
Part of subcall function 00446802: GetLastError.KERNEL32(?,?,00450CEF,?,00000000,?,00000000,?,00450F93,?,00000007,?,?,004514DE,?,?), ref: 0044682A

_free.LIBCMT ref: 00450FD3
_free.LIBCMT ref: 00450FDE
_free.LIBCMT ref: 00451032
_free.LIBCMT ref: 0045103D
_free.LIBCMT ref: 00451048
_free.LIBCMT ref: 00451053

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 5e629f50e4f6999c0b477f1519b6f3e41be6fc4275a29973627e91760813f884
Instruction ID: 345e916fd15b447c36d88a7a8914fd19e4c3e0710e9d23c2e9f19f8556552687
Opcode Fuzzy Hash: 5e629f50e4f6999c0b477f1519b6f3e41be6fc4275a29973627e91760813f884
Instruction Fuzzy Hash: C111D231402704AAE621BB72CC03FCB779CAF03304F454D2EBEA967153C7ACB4185654

Function 0041119E Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 004111AB
int.LIBCPMT ref: 004111BE

Part of subcall function 0040E0FC: std::_Lockit::_Lockit.LIBCPMT ref: 0040E10D
Part of subcall function 0040E0FC: std::_Lockit::~_Lockit.LIBCPMT ref: 0040E127

std::_Facet_Register.LIBCPMT ref: 004111FE
std::_Lockit::~_Lockit.LIBCPMT ref: 00411207
__CxxThrowException@8.LIBVCRUNTIME ref: 00411225

Strings

(mG, xrefs: 004111B6

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_RegisterThrow
String ID: (mG
API String ID: 2536120697-4059303827
Opcode ID: 4fb09889b2dc78d6b9bc341806ed1c893def47308d87ec9f5bd5aa626124b671
Instruction ID: b4facbf35e110c19f3eede998f69f9310dce987b63f856d60fe44c7d5fb17b17
Opcode Fuzzy Hash: 4fb09889b2dc78d6b9bc341806ed1c893def47308d87ec9f5bd5aa626124b671
Instruction Fuzzy Hash: 42112732900114A7CB14EB9AD8018DEB7699F44364F11456FF904F72E1DB789E45CBC8

Function 0043A3DA Relevance: 10.6, APIs: 7, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0043A3D1,0043933E), ref: 0043A3E8
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0043A3F6
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0043A40F
SetLastError.KERNEL32(00000000,?,0043A3D1,0043933E), ref: 0043A461

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 786e665d26cf754d1d2cf441f113ccf6d654ddd054b4af6544b9cbcea7eecff9
Instruction ID: 228fd8bb196f6ae1284969ba5442ea73dc67404c1df350b3d70410c0baad6fb0
Opcode Fuzzy Hash: 786e665d26cf754d1d2cf441f113ccf6d654ddd054b4af6544b9cbcea7eecff9
Instruction Fuzzy Hash: 87019C322483515EA61027797C8A62B2648EB293B9F30523FF518805F1EF984C90910D

Function 004075EB Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 59COMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32(00000000,00000002,00000000,C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe), ref: 0040760B

Part of subcall function 00407538: _wcslen.LIBCMT ref: 0040755C
Part of subcall function 00407538: CoGetObject.OLE32(?,00000024,00466528,00000000), ref: 004075BD

CoUninitialize.OLE32 ref: 00407664

Strings

[+] before ShellExec, xrefs: 0040762C
[+] ucmCMLuaUtilShellExecMethod, xrefs: 004075F0
[+] ShellExec success, xrefs: 00407649
C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe, xrefs: 004075EB, 004075EE, 00407640

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: InitializeObjectUninitialize_wcslen
String ID: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe$[+] ShellExec success$[+] before ShellExec$[+] ucmCMLuaUtilShellExecMethod
API String ID: 3851391207-3544160903
Opcode ID: d877cea0863f9d3afa12868748af2f8600b5022738d517222c004e226c4c5a05
Instruction ID: e4e7d1672fbddd81374e29e92f863be8f9bad83f72bb7a306ddb251afa86686e
Opcode Fuzzy Hash: d877cea0863f9d3afa12868748af2f8600b5022738d517222c004e226c4c5a05
Instruction Fuzzy Hash: 4501D272B087116BE2246B65DC4AF6B3748DB41B25F11053FF901A62C1EAB9FC0146AB

Function 0040BADC Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 49fileCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNEL32(00000000,\AppData\Local\Google\Chrome\User Data\Default\Cookies), ref: 0040BB18
GetLastError.KERNEL32 ref: 0040BB22

Strings

[Chrome Cookies not found], xrefs: 0040BB3C
[Chrome Cookies found, cleared!], xrefs: 0040BB48
UserProfile, xrefs: 0040BAE8
\AppData\Local\Google\Chrome\User Data\Default\Cookies, xrefs: 0040BAE3

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: DeleteErrorFileLast
String ID: [Chrome Cookies found, cleared!]$[Chrome Cookies not found]$UserProfile$\AppData\Local\Google\Chrome\User Data\Default\Cookies
API String ID: 2018770650-304995407
Opcode ID: d4592947abf79dc324386ffcaf4b9b591dee499912662422a1d7ea612805fe04
Instruction ID: 5dee569c6883bfd73109a670bb68234af0f28e4caad238985ba957b2c74b96e7
Opcode Fuzzy Hash: d4592947abf79dc324386ffcaf4b9b591dee499912662422a1d7ea612805fe04
Instruction Fuzzy Hash: 5B01DF71A402055BCA04B7B6CC1B9BE7B24E922704B50017FF502726D6FE3E5D0986CE

Function 0041CE2C Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

AllocConsole.KERNEL32(00475338), ref: 0041CE35
ShowWindow.USER32(00000000,00000000), ref: 0041CE4E
SetConsoleOutputCP.KERNEL32(000004E4), ref: 0041CE73

Strings

5.1.3 Pro, xrefs: 0041CE9C
CONOUT$, xrefs: 0041CE61
Remcos v, xrefs: 0041CE8E

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: Console$AllocOutputShowWindow
String ID: Remcos v$5.1.3 Pro$CONOUT$
API String ID: 2425139147-2212855755
Opcode ID: bb520a2f19826cc6a1c283625bbcfbf44085728638f029a4a140c4eec348b460
Instruction ID: 6efa3de70d430de9448838496adf33c47162c0890a3ad1875f095e209401f165
Opcode Fuzzy Hash: bb520a2f19826cc6a1c283625bbcfbf44085728638f029a4a140c4eec348b460
Instruction Fuzzy Hash: A90144B1A80304BBD610F7F19C8BF9E77AC9B14B05F500527BA04A70D2EB6DD944466E

Function 004433DA Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,PkGNG,0044338B,00000003,PkGNG,0044332B,00000003,0046E958,0000000C,00443482,00000003,00000002), ref: 004433FA
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0044340D
FreeLibrary.KERNEL32(00000000,?,?,PkGNG,0044338B,00000003,PkGNG,0044332B,00000003,0046E958,0000000C,00443482,00000003,00000002,00000000,PkGNG), ref: 00443430

Strings

mscoree.dll, xrefs: 004433F3
PkGNG, xrefs: 004433DC
CorExitProcess, xrefs: 00443405

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$PkGNG$mscoree.dll
API String ID: 4061214504-213444651
Opcode ID: ffd65e2a986ef432bd98aae630379cdfc9b477bc787d361fad657d5437817096
Instruction ID: d7bd46dfab834bb5d48edea7818df211002af85bf4a2e706b61bd78119be3437
Opcode Fuzzy Hash: ffd65e2a986ef432bd98aae630379cdfc9b477bc787d361fad657d5437817096
Instruction Fuzzy Hash: 4EF04931900208FBDB159F65DC45B9EBF74EF04753F0040A5F805A2251DB758E40CA99

Function 0043AB5C Relevance: 9.3, APIs: 6, Instructions: 284COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 0043ACE9
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0043AD05
__allrem.LIBCMT ref: 0043AD1C
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0043AD3A
__allrem.LIBCMT ref: 0043AD51
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0043AD6F

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: 52068ab3a7cfe922dfe01ed446ba536eb0656cd97dd847f62b494b0202e28e08
Instruction ID: c7cd181284538591ee8af1586cca3d38175ba7b34bac8e5aa56d350f01832762
Opcode Fuzzy Hash: 52068ab3a7cfe922dfe01ed446ba536eb0656cd97dd847f62b494b0202e28e08
Instruction Fuzzy Hash: 5F815972A40B05ABE7209F29CC41B6FB3A99F48324F24152FF591D67C1E77CE910875A

Function 00404371 Relevance: 9.2, APIs: 1, Strings: 5, Instructions: 206sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000,?), ref: 004044C4

Part of subcall function 00404607: __EH_prolog.LIBCMT ref: 0040460C

Strings

FreeFrame, xrefs: 004045B0
CloseCamera, xrefs: 0040458E
OpenCamera, xrefs: 00404582
GetFrame, xrefs: 0040459F
HNG, xrefs: 004045E6

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: H_prologSleep
String ID: CloseCamera$FreeFrame$GetFrame$HNG$OpenCamera
API String ID: 3469354165-3054508432
Opcode ID: 154a516c2491a5844dffeeac7ac8ef46fb3276e3653f611f108f8d9256892f3c
Instruction ID: df1e58e957a7578ae16e417911435538e3341edc64810737793f4aa4f8849b6c
Opcode Fuzzy Hash: 154a516c2491a5844dffeeac7ac8ef46fb3276e3653f611f108f8d9256892f3c
Instruction Fuzzy Hash: A751E171A042106BCA14FB369D0A66E3755ABC4748F00443FFA0A676E2DF7D8E45839E

Function 00411D39 Relevance: 9.2, APIs: 6, Instructions: 206memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 004117D7: SetLastError.KERNEL32(0000000D,00411D57,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00411D35), ref: 004117DD

SetLastError.KERNEL32(000000C1,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00411D35), ref: 00411D72
GetNativeSystemInfo.KERNEL32(?,?,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00411D35), ref: 00411DE0
SetLastError.KERNEL32(0000000E,?,?,?,?,?,?,?,?,00000000), ref: 00411E04

Part of subcall function 00411CDE: VirtualAlloc.KERNEL32(00000040,00000040,00000040,00000040,00411E22,?,00000000,00003000,00000040,00000000,?,00000000), ref: 00411CEE

GetProcessHeap.KERNEL32(00000008,00000040,?,?,?,?,00000000), ref: 00411E4B
HeapAlloc.KERNEL32(00000000,?,?,?,?,00000000), ref: 00411E52
SetLastError.KERNEL32(0000045A,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00411F65

Part of subcall function 004120B2: GetProcessHeap.KERNEL32(00000000,00000000,?,00000000,00411F72,?,?,?,?,00000000), ref: 00412122
Part of subcall function 004120B2: HeapFree.KERNEL32(00000000,?,?,?,?,00000000), ref: 00412129

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: ErrorHeapLast$AllocProcess$FreeInfoNativeSystemVirtual
String ID:
API String ID: 3950776272-0
Opcode ID: 0997a6c101f2dd0e8850336bac1793923a5345a50e97098554ef69f44a303648
Instruction ID: da58ab861bd0a84ec3871346ef31e8b8814b9d9500880b3a3e1890ad13292c25
Opcode Fuzzy Hash: 0997a6c101f2dd0e8850336bac1793923a5345a50e97098554ef69f44a303648
Instruction Fuzzy Hash: F761A270700611ABCB209F66C981BAA7BA5AF44704F14411AFF05877A2D77CE8C2CBD9

Function 0044597A Relevance: 9.2, APIs: 6, Instructions: 200COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftoe.LIBCMT ref: 004459A6
__cftoe.LIBCMT ref: 004459D8

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: __cftoe
String ID:
API String ID: 4189289331-0
Opcode ID: 30f97a14dd6f87c9245b8e0b778041a74f07a421c1ac77e9beff42b74887127b
Instruction ID: b93b8478136607885b926496a305f1bfb884a7f6acf724e610c81469f19cb9e5
Opcode Fuzzy Hash: 30f97a14dd6f87c9245b8e0b778041a74f07a421c1ac77e9beff42b74887127b
Instruction Fuzzy Hash: 2551FD72500605ABFF209B598C81EAF77A8EF45334F25421FF915A6293DB3DD900C66D

Function 0041AD09 Relevance: 9.1, APIs: 6, Instructions: 67serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,00000002,00000000,00000000,?,?,?,0041A41F,00000000), ref: 0041AD19
OpenServiceW.ADVAPI32(00000000,00000000,00000002,?,?,?,0041A41F,00000000), ref: 0041AD2D
CloseServiceHandle.ADVAPI32(00000000,?,?,?,0041A41F,00000000), ref: 0041AD3A
ChangeServiceConfigW.ADVAPI32(00000000,000000FF,00000004,000000FF,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,0041A41F,00000000), ref: 0041AD6F
CloseServiceHandle.ADVAPI32(00000000,?,?,?,0041A41F,00000000), ref: 0041AD81
CloseServiceHandle.ADVAPI32(00000000,?,?,?,0041A41F,00000000), ref: 0041AD84

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: Service$CloseHandle$Open$ChangeConfigManager
String ID:
API String ID: 493672254-0
Opcode ID: f3d4b447748c037b2dac55463b57a149c398f0d820f611c96b244fdc7ed94624
Instruction ID: 77e668261cf9ee2bd18e5a0e87596c089765e66a1be6d3c981f75cbf7ed2a716
Opcode Fuzzy Hash: f3d4b447748c037b2dac55463b57a149c398f0d820f611c96b244fdc7ed94624
Instruction Fuzzy Hash: A7016D311462157AD6111B34AC4EFFB3B6CDB02772F10032BF625965D1DA68CE8195AB

Function 0044A084 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 305COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0044A10F
__alldvrm.LIBCMT ref: 0044A310
__alldvrm.LIBCMT ref: 0044A332

Strings

PkGNG, xrefs: 0044A086

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: __alldvrm$_strrchr
String ID: PkGNG
API String ID: 1036877536-263838557
Opcode ID: 8f78adc186be73fa66820e99e070c83f6be0ee509df7c4dfd67e0dde8c439993
Instruction ID: 8ce1af842cd152cb2b2428f5d584a25f6c9224aafe101b92c03b71ca88d34985
Opcode Fuzzy Hash: 8f78adc186be73fa66820e99e070c83f6be0ee509df7c4dfd67e0dde8c439993
Instruction Fuzzy Hash: 87A156729846829FF721CF58C8817AEBBA5FF15314F2841AFE8859B381D27C8C51C75A

Function 00448295 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,0043F770,0043A875,0043F770,00474EF8,PkGNG,0043CE65,FF8BC35D,00474EF8,00474EF8), ref: 00448299
_free.LIBCMT ref: 004482CC
_free.LIBCMT ref: 004482F4
SetLastError.KERNEL32(00000000,?,?,00000000), ref: 00448301
SetLastError.KERNEL32(00000000,?,?,00000000), ref: 0044830D
_abort.LIBCMT ref: 00448313

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: 0dc6b6a3e4ae5b17dec3dccad88ee1f92140bcc2d5108ccd544116d6be2417e2
Instruction ID: 8d34d3ffa9a8a5ca7629c839d325bdddc3ef58a145117f7ac1d0225592351e3a
Opcode Fuzzy Hash: 0dc6b6a3e4ae5b17dec3dccad88ee1f92140bcc2d5108ccd544116d6be2417e2
Instruction Fuzzy Hash: 8EF0A435101B006BF611772A6C06B6F26599BD3B69F36042FFD18962D2EF6DCC42816D

Function 0041AB37 Relevance: 9.0, APIs: 6, Instructions: 45serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,00000020,00000000,00000001,?,?,?,?,?,?,0041A6B4,00000000), ref: 0041AB46
OpenServiceW.ADVAPI32(00000000,00000000,00000020,?,?,?,?,?,?,0041A6B4,00000000), ref: 0041AB5A
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A6B4,00000000), ref: 0041AB67
ControlService.ADVAPI32(00000000,00000001,?,?,?,?,?,?,?,0041A6B4,00000000), ref: 0041AB76
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A6B4,00000000), ref: 0041AB88
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A6B4,00000000), ref: 0041AB8B

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: Service$CloseHandle$Open$ControlManager
String ID:
API String ID: 221034970-0
Opcode ID: bc8933c3fd8e2fa998b2246ab8c72ed9b0f5170f60f0245b371609b51ac54b8f
Instruction ID: 443f58cffa4f299642b313368f914f767bd977a6fac550f0ec2f38f013616b5a
Opcode Fuzzy Hash: bc8933c3fd8e2fa998b2246ab8c72ed9b0f5170f60f0245b371609b51ac54b8f
Instruction Fuzzy Hash: E4F0F631541318BBD7116F259C49DFF3B6CDB45B62F000026FE0992192EB68DD4595F9

Function 0041AC3B Relevance: 9.0, APIs: 6, Instructions: 45serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,00000040,00000000,00000001,?,?,?,?,?,?,0041A634,00000000), ref: 0041AC4A
OpenServiceW.ADVAPI32(00000000,00000000,00000040,?,?,?,?,?,?,0041A634,00000000), ref: 0041AC5E
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A634,00000000), ref: 0041AC6B
ControlService.ADVAPI32(00000000,00000002,?,?,?,?,?,?,?,0041A634,00000000), ref: 0041AC7A
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A634,00000000), ref: 0041AC8C
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A634,00000000), ref: 0041AC8F

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: Service$CloseHandle$Open$ControlManager
String ID:
API String ID: 221034970-0
Opcode ID: 94d93926ec858c5890fc603d54741d931e0eaafa3f6b468ff921a10e10d86c77
Instruction ID: 80b71cf000cc834045a6d48b23744411b71cc7e49355023a2f572df053a73ec4
Opcode Fuzzy Hash: 94d93926ec858c5890fc603d54741d931e0eaafa3f6b468ff921a10e10d86c77
Instruction Fuzzy Hash: 73F0C231501218ABD611AF65AC4AEFF3B6CDB45B62F00002AFE0992192EB38CD4595E9

Function 0041ACA2 Relevance: 9.0, APIs: 6, Instructions: 45serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,00000040,00000000,00000001,?,?,?,?,?,?,0041A5B4,00000000), ref: 0041ACB1
OpenServiceW.ADVAPI32(00000000,00000000,00000040,?,?,?,?,?,?,0041A5B4,00000000), ref: 0041ACC5
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A5B4,00000000), ref: 0041ACD2
ControlService.ADVAPI32(00000000,00000003,?,?,?,?,?,?,?,0041A5B4,00000000), ref: 0041ACE1
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A5B4,00000000), ref: 0041ACF3
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A5B4,00000000), ref: 0041ACF6

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: Service$CloseHandle$Open$ControlManager
String ID:
API String ID: 221034970-0
Opcode ID: 4f42f77feb4e09d2984437374767d6fba58dab4553ac710dbf5187c031f369c2
Instruction ID: 4c72e2560426042a93d841201029be6eaa37955ba2c7d49e75f16ae618c5df44
Opcode Fuzzy Hash: 4f42f77feb4e09d2984437374767d6fba58dab4553ac710dbf5187c031f369c2
Instruction Fuzzy Hash: 85F0F631501228BBD7116F25AC49DFF3B6CDB45B62F00002AFE0992192EB38CD46A6F9

Function 00456C9A Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 152COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00456DC9

Strings

@^E, xrefs: 00456CA2

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: _free
String ID: @^E
API String ID: 269201875-2908066071
Opcode ID: 5a84445a6d60efe319971740dde2d2f541f568e0726df331b0a843d8179482b0
Instruction ID: 6f8591e81a910498abf0b0e408487d1c0faf04506bf4bd3dd9e850377c22d226
Opcode Fuzzy Hash: 5a84445a6d60efe319971740dde2d2f541f568e0726df331b0a843d8179482b0
Instruction Fuzzy Hash: 34413931B00104AAEB207B7A9C4666F3AB5DF45735F570A1FFD28C7293DA7C481D426A

Function 00442851 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 133COMMON

Download Yara Rule

Strings

PkGNG, xrefs: 00442853

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID:
String ID: PkGNG
API String ID: 0-263838557
Opcode ID: 423e02715d989b220add50ecbde53982322c6e48bca96a6cd7fe69295545b5c8
Instruction ID: b0a34e1ed6630e1fb57c9e62860a3601010315cd62f19612bff23542d182db60
Opcode Fuzzy Hash: 423e02715d989b220add50ecbde53982322c6e48bca96a6cd7fe69295545b5c8
Instruction Fuzzy Hash: 70412AB1600704BFE724AF79CD41B5EBBE8EB88714F10462FF145DB281E3B999058798

Function 00404CC3 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 121synchronizationthreadCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,00000000,?,00000000,?,?,000000FF,00000000,?,00474F50), ref: 00404DB3
CreateThread.KERNEL32(00000000,00000000,?,00474EF8,00000000,00000000), ref: 00404DC7
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00404DD2
CloseHandle.KERNEL32(?), ref: 00404DDB

Strings

PkGNG, xrefs: 00404CCC

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: Create$CloseEventHandleObjectSingleThreadWait
String ID: PkGNG
API String ID: 3360349984-263838557
Opcode ID: 5462e3d1f33464a1ed2da8decfb29ddc2098cc431de268282224d20d0e393637
Instruction ID: 30d48123e17294c38ae6f490953f1b42a5ca81467cb0df1087f173bd09261e59
Opcode Fuzzy Hash: 5462e3d1f33464a1ed2da8decfb29ddc2098cc431de268282224d20d0e393637
Instruction Fuzzy Hash: 684182B1108301AFC714EB62CD55DBFB7EDAFD4314F40093EF992A22E1DB3899098666

Function 0040B19F Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 68timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?,Offline Keylogger Started,004750F0), ref: 0040B1AD
wsprintfW.USER32 ref: 0040B22E

Part of subcall function 0040A671: SetEvent.KERNEL32(?,?,00000000,0040B245,00000000), ref: 0040A69D

Strings

], xrefs: 0040B1BB
Offline Keylogger Started, xrefs: 0040B1A6
[%04i/%02i/%02i %02i:%02i:%02i , xrefs: 0040B1B6

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: EventLocalTimewsprintf
String ID: [%04i/%02i/%02i %02i:%02i:%02i $Offline Keylogger Started$]
API String ID: 1497725170-248792730
Opcode ID: b92970106d7d5ed65003fb4f3b7a0e91fd1e2f7406e6a9ff2526561c329a63fb
Instruction ID: 4bcbbea8953a56f0834a7592719eb704c83d71ae81c48fe005db4fd1b538d991
Opcode Fuzzy Hash: b92970106d7d5ed65003fb4f3b7a0e91fd1e2f7406e6a9ff2526561c329a63fb
Instruction Fuzzy Hash: 88114272404118AACB19AB96EC55CFE77BCEE48315B00012FF506A61D1FF7C5A45C6AD

Function 0040A6B0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58sleepfileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000007,00000000,00000003,00000080,00000000,?,?,?,0040A788), ref: 0040A6E6
GetFileSize.KERNEL32(00000000,00000000,?,?,?,0040A788), ref: 0040A6F5
Sleep.KERNEL32(00002710,?,?,?,0040A788), ref: 0040A722
CloseHandle.KERNEL32(00000000,?,?,?,0040A788), ref: 0040A729

Strings

XQG, xrefs: 0040A6DB

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSizeSleep
String ID: XQG
API String ID: 1958988193-3606453820
Opcode ID: 09b71735cca9286fb237afdc81f34cc8b89fa37515d8f2a58262fc809d9c95cd
Instruction ID: fa029248b1ac628aedb802b18ed81a98d1a4018e107c0b234daa3009ae89debe
Opcode Fuzzy Hash: 09b71735cca9286fb237afdc81f34cc8b89fa37515d8f2a58262fc809d9c95cd
Instruction Fuzzy Hash: 96110130600740AADA31A734988961F7BA9DB45356F44483EF1866B6D3C67DDC64C71F

Function 0041D5A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 57registryCOMMON

Download Yara Rule

APIs

RegisterClassExA.USER32(00000030), ref: 0041D5EC
CreateWindowExA.USER32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,000000FD,00000000,00000000,00000000), ref: 0041D607
GetLastError.KERNEL32 ref: 0041D611

Strings

0, xrefs: 0041D5BC
MsgWindowClass, xrefs: 0041D5B7

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: ClassCreateErrorLastRegisterWindow
String ID: 0$MsgWindowClass
API String ID: 2877667751-2410386613
Opcode ID: 722de5e8388a8877474a119f468a3301e062738380f3873f65828015e8b741e1
Instruction ID: e808ecd18ef19f47bd472c0c6462b34ef8490c58390ad3ae495a6aa035ed2a4b
Opcode Fuzzy Hash: 722de5e8388a8877474a119f468a3301e062738380f3873f65828015e8b741e1
Instruction Fuzzy Hash: 1F0125B1D00219ABDB00DFA5EC849EFBBBCEA08355F40453AF914A6241EB7589058AA4

Function 00407790 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 43processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(C:\Windows\System32\cmd.exe,/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 004077D6
CloseHandle.KERNEL32(?), ref: 004077E5
CloseHandle.KERNEL32(?), ref: 004077EA

Strings

C:\Windows\System32\cmd.exe, xrefs: 004077D1
/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f, xrefs: 004077CC

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateProcess
String ID: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f$C:\Windows\System32\cmd.exe
API String ID: 2922976086-4183131282
Opcode ID: c38a1c4fbaf06b70ee3143182280ce63ac5342037887d892980c2b2f1eb259a7
Instruction ID: 1887ccd63cb29ce90d3c4a9dee080bc6fb52b3336ad705aa4023eed0db3a7680
Opcode Fuzzy Hash: c38a1c4fbaf06b70ee3143182280ce63ac5342037887d892980c2b2f1eb259a7
Instruction Fuzzy Hash: 04F09672D4029C76CB20ABD7AC0EEDF7F3CEBC5B11F00051AF904A2045DA745400CAB5

Function 0040729B Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 40COMMON

Download Yara Rule

Strings

SG, xrefs: 00407715
C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe, xrefs: 004076FF

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID:
String ID: SG$C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe
API String ID: 0-2664107140
Opcode ID: 534232ae4986bc0cd44d5d9dbb6e579f37bf6e7b645008295a27304146529b35
Instruction ID: 5ffff352cfcc2e87221e4fa572a01d73507d198e899e6baa5594ec663d9dd15d
Opcode Fuzzy Hash: 534232ae4986bc0cd44d5d9dbb6e579f37bf6e7b645008295a27304146529b35
Instruction Fuzzy Hash: 8DF02BB0E04600EBCB1477345D296AA3656A780397F40487BF507EB2F2EBBD5C41871E

Function 004050E4 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 35synchronizationCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,00474EF8), ref: 00405120
SetEvent.KERNEL32(?), ref: 0040512C
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00405137
CloseHandle.KERNEL32(?), ref: 00405140

Part of subcall function 0041B580: GetLocalTime.KERNEL32(00000000), ref: 0041B59A

Strings

KeepAlive | Disabled, xrefs: 004050F9

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: Event$CloseCreateHandleLocalObjectSingleTimeWait
String ID: KeepAlive | Disabled
API String ID: 2993684571-305739064
Opcode ID: 260c2b08e01b5d66b359e99273a0c89895ec309b6af50f33d4504d26b953d9d7
Instruction ID: dc79248355977efa3495ea8e96f68553e1f2867eb32bbe7dc6984d352a193ca4
Opcode Fuzzy Hash: 260c2b08e01b5d66b359e99273a0c89895ec309b6af50f33d4504d26b953d9d7
Instruction Fuzzy Hash: 5DF06D71904711BBDB203B758D0AAAB7E95AB06315F0009BEF982916E2D6798C408F9A

Function 0041AE51 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0041B580: GetLocalTime.KERNEL32(00000000), ref: 0041B59A

GetModuleHandleA.KERNEL32(00000000,00020009), ref: 0041AE83
PlaySoundW.WINMM(00000000,00000000), ref: 0041AE91
Sleep.KERNEL32(00002710), ref: 0041AE98
PlaySoundW.WINMM(00000000,00000000,00000000), ref: 0041AEA1

Strings

Alarm triggered, xrefs: 0041AE5A

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: PlaySound$HandleLocalModuleSleepTime
String ID: Alarm triggered
API String ID: 614609389-2816303416
Opcode ID: fc1dfc3d80636db02bd80d67f349f84282c1adb2487fd06cf6dad27e320cdf65
Instruction ID: 264e31dd7f8ae4a58c3cd97330858728e5483d82e525179ed11d996d756d41c5
Opcode Fuzzy Hash: fc1dfc3d80636db02bd80d67f349f84282c1adb2487fd06cf6dad27e320cdf65
Instruction Fuzzy Hash: 3EE0D826A40220779A10337B6D0FD6F3D29CAC3B2570100BFFA05660C2DD540C01C6FB

Function 0041CDE9 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,00000000,?,?,?,?,?,?,0041CE7E), ref: 0041CDF3
GetConsoleScreenBufferInfo.KERNEL32(00000000,?,?,?,?,?,?,?,0041CE7E), ref: 0041CE00
SetConsoleTextAttribute.KERNEL32(00000000,0000000C,?,?,?,?,?,?,0041CE7E), ref: 0041CE0D
SetConsoleTextAttribute.KERNEL32(00000000,?,?,?,?,?,?,?,0041CE7E), ref: 0041CE20

Strings

______ (_____ \ _____) )_____ ____ ____ ___ ___ | __ /| ___ | \ / ___) _ \ /___)| | \ \| ____| | | ( (__| |_| |___ ||_| |_|_____)_|_|_|\____)___/(___/ , xrefs: 0041CE13

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: Console$AttributeText$BufferHandleInfoScreen
String ID: ______ (_____ \ _____) )_____ ____ ____ ___ ___ | __ /| ___ | \ / ___) _ \ /___)| | \ \| ____| | | ( (__| |_| |___ ||_| |_|_____)_|_|_|\____)___/(___/
API String ID: 3024135584-2418719853
Opcode ID: e39debb9b2b39d29e793f9bd33498d8add4ef2108ba1fa2e7e75c33182c8a1d6
Instruction ID: 3099d3b49c49d1df3d44327ff87017ee7d1b0803ff7cdb2815dc6b7c28d9377e
Opcode Fuzzy Hash: e39debb9b2b39d29e793f9bd33498d8add4ef2108ba1fa2e7e75c33182c8a1d6
Instruction Fuzzy Hash: B6E04872504315E7E31027B5EC4DCAB7B7CE745613B100266FA16915D39A749C41C6B5

Function 004413EA Relevance: 7.7, APIs: 5, Instructions: 222COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3500d967bf213ad3b95b014004bc41782de99095ad53c5e0f3d0147f9504bf37
Instruction ID: 15e211ccade7fc2a5debfa8ad78d9bfa955d5b29a73147504924d067d3782226
Opcode Fuzzy Hash: 3500d967bf213ad3b95b014004bc41782de99095ad53c5e0f3d0147f9504bf37
Instruction Fuzzy Hash: 2771D4319012569BEB21CF55C884AFFBB75EF55310F19412BE815672A0DB78CCC1CBA8

Function 0040F938 Relevance: 7.6, APIs: 5, Instructions: 132processCOMMON

Download Yara Rule

APIs

Part of subcall function 0041C048: GetCurrentProcess.KERNEL32(?,?,?,0040DAE5,WinDir,00000000,00000000), ref: 0041C059

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0040F956
Process32FirstW.KERNEL32(00000000,?), ref: 0040F97A
Process32NextW.KERNEL32(00000000,0000022C), ref: 0040F989
CloseHandle.KERNEL32(00000000), ref: 0040FB40

Part of subcall function 0041C076: OpenProcess.KERNEL32(00000400,00000000,?,?,00000000,0040F634,00000000,?,?,00475338), ref: 0041C08B

Part of subcall function 0041C26E: OpenProcess.KERNEL32(00001000,00000000,?,00000000,00000000,00000000), ref: 0041C286
Part of subcall function 0041C26E: OpenProcess.KERNEL32(00000400,00000000,?,?,00000000,00000000,00000000), ref: 0041C299

Process32NextW.KERNEL32(00000000,0000022C), ref: 0040FB31

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: Process$OpenProcess32$Next$CloseCreateCurrentFirstHandleSnapshotToolhelp32
String ID:
API String ID: 4269425633-0
Opcode ID: f228ff349881c5e95adb389dcff9344117252c23684542f11b6a3310bcbf0aa2
Instruction ID: d02cab962e177bd28921c4f9a71df23b762ba7d31cecf8da060328e0f3db66c6
Opcode Fuzzy Hash: f228ff349881c5e95adb389dcff9344117252c23684542f11b6a3310bcbf0aa2
Instruction Fuzzy Hash: 5F4136311083419BC325F722DC51AEFB3A5AF94305F50493EF58A921E2EF385A49C65A

Function 00443E99 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00443F0B
_free.LIBCMT ref: 00443F2B

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 1c82e8231a1e7df7fc61a9fb39ee41d92c56425fa3e393906510b0ca3dcf776a
Instruction ID: bbec49e9ccdd5c2af131aecc9b6810ea24321c3eb42f74c08fbdd36582e243a3
Opcode Fuzzy Hash: 1c82e8231a1e7df7fc61a9fb39ee41d92c56425fa3e393906510b0ca3dcf776a
Instruction Fuzzy Hash: 5F41E232E00200AFEB14DF78C881A5EB3B5EF89B18F1545AEE915EB351D735AE05CB84

Function 0044F3DA Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 0044F3E3
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0044F406

Part of subcall function 004461B8: RtlAllocateHeap.NTDLL(00000000,00435349,?,?,004388C7,?,?,00000000,00476B50,?,0040DE9D,00435349,?,?,?,?), ref: 004461EA

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0044F42C
_free.LIBCMT ref: 0044F43F
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0044F44E

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: 7d1f56057eec42b9e44eaca7954531e52edb8e618f6c0f5134274d299c642649
Instruction ID: b6d7bf627ac8e1e23e8e90154f8049d5dc13ee9613ce4caf203d647ba434722a
Opcode Fuzzy Hash: 7d1f56057eec42b9e44eaca7954531e52edb8e618f6c0f5134274d299c642649
Instruction Fuzzy Hash: 2401DF72602721BF37211ABB5C8DC7F6AACDEC6FA5355013AFD04D2202DE688D0691B9

Function 0041C482 Relevance: 7.6, APIs: 5, Instructions: 67fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000004,40000000,00000000,00000000,00000002,00000080,00000000,00000000,00000000,?,00000004,00000000,0041C5A1,00000000,00000000,00000000), ref: 0041C4C1
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,?,00000004,00000000,0041C5A1,00000000,00000000), ref: 0041C4DE
CloseHandle.KERNEL32(00000000,?,00000004,00000000,0041C5A1,00000000,00000000), ref: 0041C4EA
WriteFile.KERNEL32(00000000,00000000,00000000,00406FC0,00000000,?,00000004,00000000,0041C5A1,00000000,00000000), ref: 0041C4FB
CloseHandle.KERNEL32(00000000,?,00000004,00000000,0041C5A1,00000000,00000000), ref: 0041C508

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: File$CloseHandle$CreatePointerWrite
String ID:
API String ID: 1852769593-0
Opcode ID: 03b5af7f289a82a83928ea742180afc1da621273c2f808e1c0dcbcf6c59c1bfa
Instruction ID: 0233a984b642d2e84dd4fc2cab076f06cd7f632185dc4648213adf39284592b7
Opcode Fuzzy Hash: 03b5af7f289a82a83928ea742180afc1da621273c2f808e1c0dcbcf6c59c1bfa
Instruction Fuzzy Hash: 6311E571288215BFE7104A24ACC8EBB739CEB46365F10862BF912D22D0C624DC418639

Function 00448319 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000,?,0043BCD6,00000000,?,?,0043BD5A,00000000,00000000,00000000,00000000,00000000,?,?), ref: 0044831E
_free.LIBCMT ref: 00448353
_free.LIBCMT ref: 0044837A
SetLastError.KERNEL32(00000000), ref: 00448387
SetLastError.KERNEL32(00000000), ref: 00448390

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 9e58827e066efea2178fd81b79d5a13276d1a5d22b614d366fbfb6265f5784d7
Instruction ID: 5af5a014564f127a9d6b3613d5887cb4baea3ca98ff5bc54bcf39f1731b7af1a
Opcode Fuzzy Hash: 9e58827e066efea2178fd81b79d5a13276d1a5d22b614d366fbfb6265f5784d7
Instruction Fuzzy Hash: 3401F936100B006BB7117A2A5C45E6F3259DBD2B75B35093FFD1892292EF7ECC02812D

Function 00450A3C Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00450A54

Part of subcall function 00446802: HeapFree.KERNEL32(00000000,00000000,?,00450CEF,?,00000000,?,00000000,?,00450F93,?,00000007,?,?,004514DE,?), ref: 00446818
Part of subcall function 00446802: GetLastError.KERNEL32(?,?,00450CEF,?,00000000,?,00000000,?,00450F93,?,00000007,?,?,004514DE,?,?), ref: 0044682A

_free.LIBCMT ref: 00450A66
_free.LIBCMT ref: 00450A78
_free.LIBCMT ref: 00450A8A
_free.LIBCMT ref: 00450A9C

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 3215379f381551316c6ac489d477ac1f9e59373460363398d28d4bb450e902e5
Instruction ID: 72fff71e7c38304dd33e0b5962bcef44c8ad6e5fbb3f6de42623dcf71f8de19c
Opcode Fuzzy Hash: 3215379f381551316c6ac489d477ac1f9e59373460363398d28d4bb450e902e5
Instruction Fuzzy Hash: F7F012765053006B9620EB5DE883C1773D9EA157117A68C1BF549DB652C778FCC0866C

Function 004440E8 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00444106

Part of subcall function 00446802: HeapFree.KERNEL32(00000000,00000000,?,00450CEF,?,00000000,?,00000000,?,00450F93,?,00000007,?,?,004514DE,?), ref: 00446818
Part of subcall function 00446802: GetLastError.KERNEL32(?,?,00450CEF,?,00000000,?,00000000,?,00450F93,?,00000007,?,?,004514DE,?,?), ref: 0044682A

_free.LIBCMT ref: 00444118
_free.LIBCMT ref: 0044412B
_free.LIBCMT ref: 0044413C
_free.LIBCMT ref: 0044414D

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: d22801927142449f45bafb541f3c6c05cfc56c6a25697691e9266b530bc09d46
Instruction ID: 0e9c2896d1a2baf17e4b980eca3efa8a556ca0a6e45d827b59e8921ed08f8926
Opcode Fuzzy Hash: d22801927142449f45bafb541f3c6c05cfc56c6a25697691e9266b530bc09d46
Instruction Fuzzy Hash: 91F03AB18025208FA731AF2DBD528053BA1A705720356853BF40C62A71C7B849C2DFDF

Function 0044BAB7 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 186COMMONLIBRARYCODE

Download Yara Rule

Strings

PkGNG, xrefs: 0044BAB9

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID:
String ID: PkGNG
API String ID: 0-263838557
Opcode ID: 5e00ae4c16f04a5a408ad6ef1dd4f82ff0aaed16414488ba1079334ecebbb015
Instruction ID: da8fb74aa53f7b39327717419ea6793f6800af9799f3d5c2cf6102f7e15971fb
Opcode Fuzzy Hash: 5e00ae4c16f04a5a408ad6ef1dd4f82ff0aaed16414488ba1079334ecebbb015
Instruction Fuzzy Hash: 1451C171D00209AAEF109FA5D885BAFBBB8EF45314F14015FE905A7291CB38D911CBA9

Function 00415B25 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 163COMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?,?), ref: 00415B4A
GetTickCount.KERNEL32 ref: 00415BC1

Strings

!D@, xrefs: 004170C4
NG, xrefs: 00415B79

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: CountEventTick
String ID: !D@$NG
API String ID: 180926312-2721294649
Opcode ID: 63d056e295368291125df1ed9cb5381b068e75d4b4b365bbfc755fbf181ba45b
Instruction ID: 3ac9408315e1e6036cedb879f74fb80cbd33a95067926c5a5f9e9f7d680cff10
Opcode Fuzzy Hash: 63d056e295368291125df1ed9cb5381b068e75d4b4b365bbfc755fbf181ba45b
Instruction Fuzzy Hash: 3E51A5315082019AC724FB32D852AFF73A5AF94304F50483FF54A671E2EF3C5945C68A

Function 00409EDE Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 157COMMON

Download Yara Rule

APIs

GetKeyboardLayoutNameA.USER32(?), ref: 00409F0E

Part of subcall function 004048C8: connect.WS2_32(?,?,?), ref: 004048E0

Part of subcall function 0041C5A6: CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000,?,00000000,00409F96,00474EE0,?,00474EE0,00000000,00474EE0,00000000), ref: 0041C5BB

Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36

Strings

XQG, xrefs: 00409F83
NG, xrefs: 00409F6E
PG, xrefs: 00409F39

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: CreateFileKeyboardLayoutNameconnectsend
String ID: XQG$NG$PG
API String ID: 1634807452-3565412412
Opcode ID: fd0e2637303639c3914413e18f481dca8088ebaee1bdd9cde4e16d3ac9440c52
Instruction ID: 86122f73fea86c9dce3a8c8dcd7d10d1556e7c038dfd98f63e082762e027ad1b
Opcode Fuzzy Hash: fd0e2637303639c3914413e18f481dca8088ebaee1bdd9cde4e16d3ac9440c52
Instruction Fuzzy Hash: 955120315082419BC328FB32D851AEFB3E5AFD4348F50493FF54AA71E2EF78594A8649

Function 004434D5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe,00000104), ref: 00443515
_free.LIBCMT ref: 004435E0
_free.LIBCMT ref: 004435EA

Strings

C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe, xrefs: 0044350C, 00443513, 00443542, 0044357A

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\Desktop\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe
API String ID: 2506810119-2535001491
Opcode ID: 85df99244543f45e80e68b9da345e50485f416d8f0a3fa02bb076d818d98866e
Instruction ID: e5efe6401a3e5f1db0e1141fbbc5a3d1caea7301f6195c2e8eaff0a3f5655f7e
Opcode Fuzzy Hash: 85df99244543f45e80e68b9da345e50485f416d8f0a3fa02bb076d818d98866e
Instruction Fuzzy Hash: D63193B1A00254BFEB21DF9A998199EBBF8EB84B15F10406BF40597311D6B88F41CB99

Function 0044B89F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 101fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,?,?,00000D55,00000000,00000000,FF8BC35D,00000000,?,PkGNG,0044BBFE,?,00000000,FF8BC35D), ref: 0044B952
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0044B980
GetLastError.KERNEL32 ref: 0044B9B1

Strings

PkGNG, xrefs: 0044B8A1

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: ByteCharErrorFileLastMultiWideWrite
String ID: PkGNG
API String ID: 2456169464-263838557
Opcode ID: f851102e1cc74a1ce765c461dca65e8698d1b877b070f44673effa5d02d51bb5
Instruction ID: 31ac96f82a5847659344ef20b41dc67af7a50504b34fbd786f6314a6cc22fa3b
Opcode Fuzzy Hash: f851102e1cc74a1ce765c461dca65e8698d1b877b070f44673effa5d02d51bb5
Instruction Fuzzy Hash: B13161B5A102199FDB14CF59DD819EAB7B9FB08305F0444BEE90AD7251D734ED80CBA4

Function 0040404C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 93sleepCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00404066

Part of subcall function 0041BA09: GetCurrentProcessId.KERNEL32(00000000,?,?,?,?,?,?,0040407C), ref: 0041BA30

Part of subcall function 004185A3: CloseHandle.KERNEL32(004040F5,?,?,004040F5,00465E84), ref: 004185B9
Part of subcall function 004185A3: CloseHandle.KERNEL32(00465E84,?,?,004040F5,00465E84), ref: 004185C2

Part of subcall function 0041C516: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000,00000000,?,?,00000000,0040412F,00465E84), ref: 0041C52F

Sleep.KERNEL32(000000FA,00465E84), ref: 00404138

Strings

/sort "Visit Time" /stext ", xrefs: 004040B2
0NG, xrefs: 00404097

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: CloseFileHandle$CreateCurrentModuleNameProcessSleep
String ID: /sort "Visit Time" /stext "$0NG
API String ID: 368326130-3219657780
Opcode ID: f5c404a57f00050fa5d5548abde154df0d56c489b7f689880ad68785094229b8
Instruction ID: 7a7c83aa22bf4ff3424ba87d95d637a61540eed1193ecfb54830ab602693969f
Opcode Fuzzy Hash: f5c404a57f00050fa5d5548abde154df0d56c489b7f689880ad68785094229b8
Instruction Fuzzy Hash: 2C316371A0011956CB15FBA6DC569ED7375AF90308F00007FF60AB71E2EF785D49CA99

Function 0041631F Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 79COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00416330

Part of subcall function 004138B2: RegCreateKeyA.ADVAPI32(80000001,00000000,004660B4), ref: 004138C0
Part of subcall function 004138B2: RegSetValueExA.ADVAPI32(004660B4,000000AF,00000000,00000004,00000001,00000004,?,?,?,0040C18D,00466C58,00000001,000000AF,004660B4), ref: 004138DB
Part of subcall function 004138B2: RegCloseKey.ADVAPI32(004660B4,?,?,?,0040C18D,00466C58,00000001,000000AF,004660B4), ref: 004138E6

Part of subcall function 00409E1F: _wcslen.LIBCMT ref: 00409E38

Strings

!D@, xrefs: 004170C4
okmode, xrefs: 0041634A
PG, xrefs: 0041635D

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: _wcslen$CloseCreateValue
String ID: !D@$okmode$PG
API String ID: 3411444782-3370592832
Opcode ID: 35fbf123078c83e442a4a08110d0a28feb217dd0509abb738719859e34f9bafd
Instruction ID: 097cdf197a66b89fefcd85ce8a19d7acc75244c7017ebd4eb32b8c3ef24b572d
Opcode Fuzzy Hash: 35fbf123078c83e442a4a08110d0a28feb217dd0509abb738719859e34f9bafd
Instruction Fuzzy Hash: 1E11A571B442011BDA187B32D862BBD22969F84348F80843FF546AF2E2DFBD4C51975D

Function 0040C627 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

Part of subcall function 0040C4FE: PathFileExistsW.SHLWAPI(00000000,\AppData\Local\Google\Chrome\,00000000), ref: 0040C531

PathFileExistsW.SHLWAPI(00000000), ref: 0040C658
PathFileExistsW.SHLWAPI(00000000,-00000011,?,00000000,00000000), ref: 0040C6C3

Strings

User Data\Profile ?\Network\Cookies, xrefs: 0040C670
User Data\Default\Network\Cookies, xrefs: 0040C63E

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: ExistsFilePath
String ID: User Data\Default\Network\Cookies$User Data\Profile ?\Network\Cookies
API String ID: 1174141254-1980882731
Opcode ID: 94e3019874633fdbfa545aa7663ce5ff9a408d6cc8816db895689c957fef93bc
Instruction ID: a3c4a2fc075df05cc4efb8d324c4514c6f5a9a9113215be8183f294a60e8cc46
Opcode Fuzzy Hash: 94e3019874633fdbfa545aa7663ce5ff9a408d6cc8816db895689c957fef93bc
Instruction Fuzzy Hash: 0621E27190011A96CB14FBA2DC96DEEBB7CAE50319B40053FF506B31D2EF789946C6D8

Function 0040C6F6 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

Part of subcall function 0040C561: PathFileExistsW.SHLWAPI(00000000,\AppData\Local\Microsoft\Edge\,00000000), ref: 0040C594

PathFileExistsW.SHLWAPI(00000000), ref: 0040C727
PathFileExistsW.SHLWAPI(00000000,-00000011,?,00000000,00000000), ref: 0040C792

Strings

User Data\Profile ?\Network\Cookies, xrefs: 0040C73F
User Data\Default\Network\Cookies, xrefs: 0040C70D

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: ExistsFilePath
String ID: User Data\Default\Network\Cookies$User Data\Profile ?\Network\Cookies
API String ID: 1174141254-1980882731
Opcode ID: cd02b2d6f0091136f3bd33ffae0826dfdd9dcae469dd48ae7039cc879f52ebfc
Instruction ID: 531025beeaae0c5c42121d483a56170e39db3028f8febaf9efde6b64dfa31b71
Opcode Fuzzy Hash: cd02b2d6f0091136f3bd33ffae0826dfdd9dcae469dd48ae7039cc879f52ebfc
Instruction Fuzzy Hash: 4821127190011A96CB04F7A2DC96CEEBB78AE50359B40013FF506B31D2EF789946C6D8

Function 0040A1B4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,0040A2B8,004750F0,00000000,00000000), ref: 0040A239
CreateThread.KERNEL32(00000000,00000000,0040A2A2,004750F0,00000000,00000000), ref: 0040A249
CreateThread.KERNEL32(00000000,00000000,0040A2C4,004750F0,00000000,00000000), ref: 0040A255

Part of subcall function 0040B19F: GetLocalTime.KERNEL32(?,Offline Keylogger Started,004750F0), ref: 0040B1AD
Part of subcall function 0040B19F: wsprintfW.USER32 ref: 0040B22E

Strings

Offline Keylogger Started, xrefs: 0040A1D6, 0040A1DD, 0040A20A

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: CreateThread$LocalTimewsprintf
String ID: Offline Keylogger Started
API String ID: 465354869-4114347211
Opcode ID: 460aeebbd05c9109f8f1e9d4cf1c4a7c90257216c04fbe0fa29816e89daae231
Instruction ID: fa9a7328340dc7f48b0d085764b542104813bfc3ea66268f7111ac5d0199d402
Opcode Fuzzy Hash: 460aeebbd05c9109f8f1e9d4cf1c4a7c90257216c04fbe0fa29816e89daae231
Instruction Fuzzy Hash: 1111ABB12003187ED210BB368C87CBB765DDA4139CB40057FF946221C2EA795D14CAFB

Function 0040AF29 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 65threadCOMMON

Download Yara Rule

APIs

Part of subcall function 0040B19F: GetLocalTime.KERNEL32(?,Offline Keylogger Started,004750F0), ref: 0040B1AD
Part of subcall function 0040B19F: wsprintfW.USER32 ref: 0040B22E

Part of subcall function 0041B580: GetLocalTime.KERNEL32(00000000), ref: 0041B59A

CreateThread.KERNEL32(00000000,00000000,0040A2A2,?,00000000,00000000), ref: 0040AFA9
CreateThread.KERNEL32(00000000,00000000,0040A2C4,?,00000000,00000000), ref: 0040AFB5
CreateThread.KERNEL32(00000000,00000000,0040A2D0,?,00000000,00000000), ref: 0040AFC1

Strings

Online Keylogger Started, xrefs: 0040AF3E, 0040AF47, 0040AF71

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: CreateThread$LocalTime$wsprintf
String ID: Online Keylogger Started
API String ID: 112202259-1258561607
Opcode ID: 77df2eb5e9a30333ff56a104ce6f74fac6c8f24925e0e44ba138bd3ce2eab701
Instruction ID: 1fd114496b08e8c1d91a2f23279a740fccf8855fe00c80ef0b78f2cd7c44f0e8
Opcode Fuzzy Hash: 77df2eb5e9a30333ff56a104ce6f74fac6c8f24925e0e44ba138bd3ce2eab701
Instruction Fuzzy Hash: 2A01C4A07003193EE62076368C8BDBF7A6DCA91398F4004BFF641362C2E97D1C1586FA

Function 0041B580 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 59timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(00000000), ref: 0041B59A

Strings

| , xrefs: 0041B5CD
PkGNG, xrefs: 0041B580
%02i:%02i:%02i:%03i , xrefs: 0041B5AF

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: LocalTime
String ID: | $%02i:%02i:%02i:%03i $PkGNG
API String ID: 481472006-3277280411
Opcode ID: d9bff088cb76c426919b24c8266bea5d45f0a8ea700e32831e669085e32f1d03
Instruction ID: 036da7e0cd4114b6fa9428aab3af546923e8b827a5fb64715830670d2b1b9b5a
Opcode Fuzzy Hash: d9bff088cb76c426919b24c8266bea5d45f0a8ea700e32831e669085e32f1d03
Instruction Fuzzy Hash: 091190714082455AC304FB62D8519FFB3E9AB84348F50093FF88AA21E1EF3CDA45C69E

Function 00404F51 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58timethreadCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00404F81
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00404FCD
CreateThread.KERNEL32(00000000,00000000,00405150,?,00000000,00000000), ref: 00404FE0

Strings

KeepAlive | Enabled | Timeout: , xrefs: 00404F94

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: Create$EventLocalThreadTime
String ID: KeepAlive | Enabled | Timeout:
API String ID: 2532271599-1507639952
Opcode ID: a02ae91ac195284b5da0ea0fcd2ef2636c7927f14dee073a7222123f061fd718
Instruction ID: 41fa32a9fb91b1633a7afb8999ae97baef60c60c8d6252053b050d354fdafbcf
Opcode Fuzzy Hash: a02ae91ac195284b5da0ea0fcd2ef2636c7927f14dee073a7222123f061fd718
Instruction Fuzzy Hash: 82110A71800385BAC720A7779C0DEAB7FACDBD2714F04046FF54162291D6B89445CBBA

Function 00406A9E Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 53libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(crypt32,CryptUnprotectData), ref: 00406ABD
GetProcAddress.KERNEL32(00000000), ref: 00406AC4

Strings

CryptUnprotectData, xrefs: 00406AB3
crypt32, xrefs: 00406AB8

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: CryptUnprotectData$crypt32
API String ID: 2574300362-2380590389
Opcode ID: 905686a6130e311fdcec2a0cd22c75bab7e39712089f0cc697143e337071fc99
Instruction ID: 59ed3cbb63f31e38ea488d6bd85f24bb9ff1ce5495ed4d1509158228521d53cd
Opcode Fuzzy Hash: 905686a6130e311fdcec2a0cd22c75bab7e39712089f0cc697143e337071fc99
Instruction Fuzzy Hash: 2C01B975604216BBCB18CFAD9D449AF7BB4AB45300B00417EE956E3381DA74E9008B95

Function 0044C2D3 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(00000000,00000000,00000002,FF8BC369,00000000,FF8BC35D,00000000,10558B1C,10558B1C,PkGNG,0044C382,FF8BC369,00000000,00000002,00000000,PkGNG), ref: 0044C30C
GetLastError.KERNEL32 ref: 0044C316
__dosmaperr.LIBCMT ref: 0044C31D

Strings

PkGNG, xrefs: 0044C2D5

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: ErrorFileLastPointer__dosmaperr
String ID: PkGNG
API String ID: 2336955059-263838557
Opcode ID: 97215d8b8c2dce734124090270f13308d8b04423b03663272671d6b8c31aea6f
Instruction ID: 8193a85edd99f1e073baf55791db2896ff72ac9ff19ac05387a69161c0de0417
Opcode Fuzzy Hash: 97215d8b8c2dce734124090270f13308d8b04423b03663272671d6b8c31aea6f
Instruction Fuzzy Hash: FB019032A11108BBDB01DFDDDC4586E7B19EB81320B28034EFD2097280EAB4DD119794

Function 0040515C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 46synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000003E8,?,?,?,00405159), ref: 00405173
CloseHandle.KERNEL32(?), ref: 004051CA
SetEvent.KERNEL32(?), ref: 004051D9

Strings

Connection Timeout, xrefs: 00405198

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: CloseEventHandleObjectSingleWait
String ID: Connection Timeout
API String ID: 2055531096-499159329
Opcode ID: 638b915a1fb33ffee36d9cd6321bbf62091d502496d276d1835a730be56b6213
Instruction ID: b176daa04f7f78a72cd0d213bf0bcd41e0e3849ccec9e2477ca34bbc74fb9340
Opcode Fuzzy Hash: 638b915a1fb33ffee36d9cd6321bbf62091d502496d276d1835a730be56b6213
Instruction Fuzzy Hash: C901F530940F00AFD7216B368D8642BBFE0EF00306704093EE68356AE2D6789800CF89

Function 0040E800 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 0040E86E

Strings

ios_base::eofbit set, xrefs: 0040E85D
ios_base::failbit set, xrefs: 0040E850
ios_base::badbit set, xrefs: 0040E82A

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: Exception@8Throw
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2005118841-1866435925
Opcode ID: e1bdae5122e534e22181349a294e5dd283a76e5484cb2b4dd901af9da0e19607
Instruction ID: 287a1f786264602a2f100ba68ee8cd07dacd1bfc9ef62352ff5e55a88b78f620
Opcode Fuzzy Hash: e1bdae5122e534e22181349a294e5dd283a76e5484cb2b4dd901af9da0e19607
Instruction Fuzzy Hash: 59018F626583087AEB14B697CC03FBA33685B10708F10CC3BBD01765C2EA7D6A61C66F

Function 0041CB72 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 42windowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32(00001100,00000000,00000000,00000400,?,00000000,00000000,00474EF8,00474EF8,PkGNG,00404A40), ref: 0041CB9A
LocalFree.KERNEL32(?,?), ref: 0041CBC0

Strings

@J@, xrefs: 0041CB7E
PkGNG, xrefs: 0041CB72

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: FormatFreeLocalMessage
String ID: @J@$PkGNG
API String ID: 1427518018-1416487119
Opcode ID: 43e67b6722ad7e97e4d7411bd93802a0b45ac2c2c041eafaafa940aa2d942fec
Instruction ID: 923000db8f6a2d31ebee0df48ef62036c6bc2ff20d3f060cbaedccf048ea6ec3
Opcode Fuzzy Hash: 43e67b6722ad7e97e4d7411bd93802a0b45ac2c2c041eafaafa940aa2d942fec
Instruction Fuzzy Hash: 34F0A930B00219A6DF14A766DC4ADFF772DDB44305B10407FB605B21D1DE785D059659

Function 0040DFE1 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0040DFEC
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0040E02B

Part of subcall function 004356CD: _Yarn.LIBCPMT ref: 004356EC
Part of subcall function 004356CD: _Yarn.LIBCPMT ref: 00435710

__CxxThrowException@8.LIBVCRUNTIME ref: 0040E051

Strings

bad locale name, xrefs: 0040E03B

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: Yarnstd::_$Exception@8Locinfo::_Locinfo_ctorLockitLockit::_Throw
String ID: bad locale name
API String ID: 3628047217-1405518554
Opcode ID: 0e967f5f4c551f764c071b3c3fecd2d0a166eebc37c8bba363630da575d49789
Instruction ID: 7f9ccd90240ef42149755af47b5df127ed13e8783c268b42739d505c0e35a915
Opcode Fuzzy Hash: 0e967f5f4c551f764c071b3c3fecd2d0a166eebc37c8bba363630da575d49789
Instruction Fuzzy Hash: 77F08131544A085AC338FA62D863DDA73B49F14358F50457FB406268D2EF78BA0CCA9D

Function 004137AA Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 38registryCOMMON

Download Yara Rule

APIs

RegCreateKeyA.ADVAPI32(80000001,Control Panel\Desktop,0046612C), ref: 004137B9
RegSetValueExA.ADVAPI32(0046612C,?,00000000,?,00000000,00000000,Control Panel\Desktop,?,?,0041CB42,WallpaperStyle,0046612C,00000001,00474EE0,00000000), ref: 004137E1
RegCloseKey.ADVAPI32(0046612C,?,?,0041CB42,WallpaperStyle,0046612C,00000001,00474EE0,00000000,?,00408798,00000001), ref: 004137EC

Strings

Control Panel\Desktop, xrefs: 004137B3, 004137C3

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: CloseCreateValue
String ID: Control Panel\Desktop
API String ID: 1818849710-27424756
Opcode ID: 6030d9855dac89f4cd46f7f8c789974497344dcf9873e73d86c3d4cdefa30cde
Instruction ID: b09b06e14e5a963f4ed757ac8f346f2723baee7be417271cc0de3610a50c6458
Opcode Fuzzy Hash: 6030d9855dac89f4cd46f7f8c789974497344dcf9873e73d86c3d4cdefa30cde
Instruction Fuzzy Hash: A4F06272500218FBDF00AFA1DC45DEA376CEF04751F108566FD1AA61A1DB359E14DB54

Function 00416C68 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 33threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,Function_0001D4EE,00000000,00000000,00000000), ref: 00416C82
ShowWindow.USER32(00000009), ref: 00416C9C
SetForegroundWindow.USER32 ref: 00416CA8

Part of subcall function 0041CE2C: AllocConsole.KERNEL32(00475338), ref: 0041CE35
Part of subcall function 0041CE2C: ShowWindow.USER32(00000000,00000000), ref: 0041CE4E
Part of subcall function 0041CE2C: SetConsoleOutputCP.KERNEL32(000004E4), ref: 0041CE73

Strings

!D@, xrefs: 004170C4

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: Window$ConsoleShow$AllocCreateForegroundOutputThread
String ID: !D@
API String ID: 3446828153-604454484
Opcode ID: 4d9bf94020eca6f9e295162147b2deb229949cce80f8bc9c3a6d36dbd144fb99
Instruction ID: 9f5213224becab59645eda34593d96b16d6ada18beeab21aaf628210512d7754
Opcode Fuzzy Hash: 4d9bf94020eca6f9e295162147b2deb229949cce80f8bc9c3a6d36dbd144fb99
Instruction Fuzzy Hash: ECF05E70149340EAD720AB62ED45AFA7B69EB54341F01487BF909C20F2DB389C94865E

Function 00416129 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 27COMMON

Download Yara Rule

APIs

ShellExecuteW.SHELL32(00000000,open,cmd.exe,00000000,00000000,00000000), ref: 0041616B

Strings

cmd.exe, xrefs: 00416160
/C , xrefs: 00416149
open, xrefs: 00416165

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: ExecuteShell
String ID: /C $cmd.exe$open
API String ID: 587946157-3896048727
Opcode ID: df79394fdd2e8ac4c6a51a4d6bf5cb7422c6ad95fc7d3df390015c01fd08e55b
Instruction ID: 08f4dee505367bf09000beb2be63de5ecd082ae46aa0e0363999309db21c3e05
Opcode Fuzzy Hash: df79394fdd2e8ac4c6a51a4d6bf5cb7422c6ad95fc7d3df390015c01fd08e55b
Instruction Fuzzy Hash: 5EE0C0B0204305ABC605F675DC96CBF73ADAA94749B50483F7142A20E2EF7C9D49C65D

Function 0040140A Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 7libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(User32.dll,GetCursorInfo), ref: 00401414
GetProcAddress.KERNEL32(00000000), ref: 0040141B

Strings

GetCursorInfo, xrefs: 0040140A
User32.dll, xrefs: 0040140F

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: GetCursorInfo$User32.dll
API String ID: 1646373207-2714051624
Opcode ID: d896883a00b7c9d91a41f0e937368129b1e8cf7bb1ae53218dcc7360cef0261f
Instruction ID: 8b26e8b19aea132afe7ec2793fcae50f4a2deac5c44528798ee909e27cd98dc2
Opcode Fuzzy Hash: d896883a00b7c9d91a41f0e937368129b1e8cf7bb1ae53218dcc7360cef0261f
Instruction Fuzzy Hash: 6BB092B4981740FB8F102BB0AE4EA193A25B614703B1008B6F046961A2EBB888009A2E

Function 004014AF Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 7libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(User32.dll,GetLastInputInfo), ref: 004014B9
GetProcAddress.KERNEL32(00000000), ref: 004014C0

Strings

GetLastInputInfo, xrefs: 004014AF
User32.dll, xrefs: 004014B4

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: GetLastInputInfo$User32.dll
API String ID: 2574300362-1519888992
Opcode ID: 97ca63f656fbe05ba3a699769711b358361c41ed64750357eec187df6322536e
Instruction ID: d02e03e3b89f99dad65f23c179d95e13f318a7fd709defe56253aab8848571e2
Opcode Fuzzy Hash: 97ca63f656fbe05ba3a699769711b358361c41ed64750357eec187df6322536e
Instruction Fuzzy Hash: EFB092B8580300FBCB102FA0AD4E91E3A68AA18703B1008A7F441C21A1EBB888009F5F

Function 0040C047 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 103sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32 ref: 0040C05C
Sleep.KERNEL32(00001388), ref: 0040C0E4

Strings

[Cleared browsers logins and cookies.], xrefs: 0040C11F
Cleared browsers logins and cookies., xrefs: 0040C130

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: Sleep
String ID: [Cleared browsers logins and cookies.]$Cleared browsers logins and cookies.
API String ID: 3472027048-1236744412
Opcode ID: 857d3cd121560083d8ce3f08402db4584d0000cc5e9f96a8e1a49aed9ab164ab
Instruction ID: 5a72b8a34604a64e244bad04561a930bad76f77e78bf22f3e088d6afb7384554
Opcode Fuzzy Hash: 857d3cd121560083d8ce3f08402db4584d0000cc5e9f96a8e1a49aed9ab164ab
Instruction Fuzzy Hash: A431A805648381EDD6116BF514967AB7B824A53748F0882BFB8C4373C3DA7A4808C79F

Function 0040A564 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 71sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0041C5E2: GetForegroundWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0041C5F2
Part of subcall function 0041C5E2: GetWindowTextLengthW.USER32(00000000), ref: 0041C5FB
Part of subcall function 0041C5E2: GetWindowTextW.USER32(00000000,00000000,00000001), ref: 0041C625

Sleep.KERNEL32(000001F4), ref: 0040A5AE
Sleep.KERNEL32(00000064), ref: 0040A638

Strings

[ , xrefs: 0040A5CA
], xrefs: 0040A5B6

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: Window$SleepText$ForegroundLength
String ID: [ $ ]
API String ID: 3309952895-93608704
Opcode ID: 0877f6620f6187a1062b87b3f34e88cc83cbee9ae63c8039862e0d8bb1bff125
Instruction ID: 6255842b65d5da3793f092b3f1447ea5db7efb23f61c0c2d19f8aa6a86066f85
Opcode Fuzzy Hash: 0877f6620f6187a1062b87b3f34e88cc83cbee9ae63c8039862e0d8bb1bff125
Instruction Fuzzy Hash: CB119F315143006BC614BB26CC579AF77A8AB90348F40083FF552661E3EF79AE18869B

Function 00443AD3 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcebbc467d131149bede3708c03e30a5933a8f2bf6fa192c1d79c37d30f8ae05
Instruction ID: 2af8e1c260e5220142bf0b5f8a7e988c949d9a3a1697e0ff4d6bcf25ce69da1b
Opcode Fuzzy Hash: fcebbc467d131149bede3708c03e30a5933a8f2bf6fa192c1d79c37d30f8ae05
Instruction Fuzzy Hash: 7E01F2B26093557EFA202E786CC2F67630DCB51FBAB31033BB520612D2DB68DD40452C

Function 00443B52 Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d36049e99d51c5662ea1cdccde7f001ca18baa555cb14a41c95be32ad22d597f
Instruction ID: 437de9af4247593539f95cdbb70b1dc5411192884b5f12beac7b10196549b189
Opcode Fuzzy Hash: d36049e99d51c5662ea1cdccde7f001ca18baa555cb14a41c95be32ad22d597f
Instruction Fuzzy Hash: CB01ADB26096527ABA202E796CC5E27634CDB42BBA335037BF821512E3DF68DE054169

Function 004485E6 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00000000,00000000,?,0044858D,?,00000000,00000000,00000000,?,004488B9,00000006,FlsSetValue), ref: 00448618
GetLastError.KERNEL32(?,0044858D,?,00000000,00000000,00000000,?,004488B9,00000006,FlsSetValue,0045F170,0045F178,00000000,00000364,?,00448367), ref: 00448624
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,0044858D,?,00000000,00000000,00000000,?,004488B9,00000006,FlsSetValue,0045F170,0045F178,00000000), ref: 00448632

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: 8f9b5e85c90ff7ccd8dc2bf5dda10acfb836c822a6cf5ef36d60eb5c9189937f
Instruction ID: 239c22332ac31c5199b3ba4764290be2907fca328f5d1df1ca03bb1201a614b6
Opcode Fuzzy Hash: 8f9b5e85c90ff7ccd8dc2bf5dda10acfb836c822a6cf5ef36d60eb5c9189937f
Instruction Fuzzy Hash: D401FC32602322EBDB618A78EC4495F7758AF15BA2B22093AF909D3241DF24DC01C6EC

Function 0041C516 Relevance: 6.0, APIs: 4, Instructions: 50fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000,00000000,?,?,00000000,0040412F,00465E84), ref: 0041C52F
GetFileSize.KERNEL32(00000000,00000000,00000000,?,?,00000000,0040412F,00465E84), ref: 0041C543
ReadFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000,0040412F,00465E84), ref: 0041C568
CloseHandle.KERNEL32(00000000,?,00000000,0040412F,00465E84), ref: 0041C576

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleReadSize
String ID:
API String ID: 3919263394-0
Opcode ID: 253de0e05f1e183a51722a251bf095503662c065c08e6289a01aaeef394dcb57
Instruction ID: 4673af35f3eeaf13de89ae80f5e83caf65f56e40ae5cb47f4621101913e6d1ef
Opcode Fuzzy Hash: 253de0e05f1e183a51722a251bf095503662c065c08e6289a01aaeef394dcb57
Instruction Fuzzy Hash: 50F0C2B1241318BFE6101B25ADC9EBB369DDB866A9F10063EF802A22D1DA698D055139

Function 0041C26E Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00001000,00000000,?,00000000,00000000,00000000), ref: 0041C286
OpenProcess.KERNEL32(00000400,00000000,?,?,00000000,00000000,00000000), ref: 0041C299
CloseHandle.KERNEL32(00000000,?,00000000,00000000,00000000), ref: 0041C2C4
CloseHandle.KERNEL32(00000000,?,00000000,00000000,00000000), ref: 0041C2CC

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: CloseHandleOpenProcess
String ID:
API String ID: 39102293-0
Opcode ID: 81942e7addce2a1bdc39bfb83f2669cd8d6753e4bd6c5855ff2ce9cbe7850470
Instruction ID: 82f86893bb8475317186349f6084970b7a3011258d8579340058f5d8518f4318
Opcode Fuzzy Hash: 81942e7addce2a1bdc39bfb83f2669cd8d6753e4bd6c5855ff2ce9cbe7850470
Instruction Fuzzy Hash: 9C01F231680215ABD61066949C8AFA7B66C8B84756F0001ABFA08D22A2EF74CD81466A

Function 004398E3 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 004398FA

Part of subcall function 00439F32: ___AdjustPointer.LIBCMT ref: 00439F7C

_UnwindNestedFrames.LIBCMT ref: 00439911
___FrameUnwindToState.LIBVCRUNTIME ref: 00439923
CallCatchBlock.LIBVCRUNTIME ref: 00439947

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: CatchUnwind$AdjustBlockBuildCallFrameFramesNestedObjectPointerState
String ID:
API String ID: 2633735394-0
Opcode ID: f1135f3da04ba3a0995d0d42191a6de0eafd24a9b56dad318990318c05e81e44
Instruction ID: 1eef882e9718bbd9a0ab38cd68ce054dbb3f9d4064fa539f417e17899f1f7293
Opcode Fuzzy Hash: f1135f3da04ba3a0995d0d42191a6de0eafd24a9b56dad318990318c05e81e44
Instruction Fuzzy Hash: 38010532000109BBCF125F56CC01EDA3BAAEF5C754F05901AF95865221C3BAE862ABA4

Function 0041941E Relevance: 6.0, APIs: 4, Instructions: 43COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000004C), ref: 0041942B
GetSystemMetrics.USER32(0000004D), ref: 00419431
GetSystemMetrics.USER32(0000004E), ref: 00419437
GetSystemMetrics.USER32(0000004F), ref: 0041943D

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-0
Opcode ID: 8421f7446e2b2501a8c7f7ac55c2b56c52e48a318564101d3507d6038f1717f6
Instruction ID: fd4820a3fb0c8fcfb80096478546269f04700e3de9cdf271d69d174aa35805c7
Opcode Fuzzy Hash: 8421f7446e2b2501a8c7f7ac55c2b56c52e48a318564101d3507d6038f1717f6
Instruction Fuzzy Hash: 3FF0A4B1B043155BD700EE758C51A6B6ADAEBD4364F10043FF60887281EFB8DC468B84

Function 00438FB1 Relevance: 6.0, APIs: 4, Instructions: 14COMMON

Download Yara Rule

APIs

___vcrt_initialize_pure_virtual_call_handler.LIBVCRUNTIME ref: 00438FB1
___vcrt_initialize_winapi_thunks.LIBVCRUNTIME ref: 00438FB6
___vcrt_initialize_locks.LIBVCRUNTIME ref: 00438FBB

Part of subcall function 0043A4BA: ___vcrt_InitializeCriticalSectionEx.LIBVCRUNTIME ref: 0043A4CB

___vcrt_uninitialize_locks.LIBVCRUNTIME ref: 00438FD0

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: CriticalInitializeSection___vcrt____vcrt_initialize_locks___vcrt_initialize_pure_virtual_call_handler___vcrt_initialize_winapi_thunks___vcrt_uninitialize_locks
String ID:
API String ID: 1761009282-0
Opcode ID: 37419d0d218480942dadea5656795116f0d18a982b1fc86bcd770d00ce79fbb1
Instruction ID: 3a6c9073cd349407f79861cc5a63413a30b4b1af88e8d748f4708d1390bfb410
Opcode Fuzzy Hash: 37419d0d218480942dadea5656795116f0d18a982b1fc86bcd770d00ce79fbb1
Instruction Fuzzy Hash: 8DC04C44080381552C50B6B2110B2AF83521C7E38CF9074DFBDD1579474D5D052F553F

Function 00442CAD Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 00442D3D

Strings

pow, xrefs: 00442D15, 00442D32

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: ba08a0cb9aac2d09af1d9c353536d0054585ad8ee24c5cded07915036f7ff901
Instruction ID: 2abd0c7c8e13d4a8cd2c8141c546921d868ac315c0d238e81b652aa6ec7fde8b
Opcode Fuzzy Hash: ba08a0cb9aac2d09af1d9c353536d0054585ad8ee24c5cded07915036f7ff901
Instruction Fuzzy Hash: 92515AE1E0460296FB167714CE4137B6794AB50741F70497BF0D6823EAEA7C8C859B4F

Function 00449EBC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 116COMMONLIBRARYCODE

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(000000FF,00000000,00000006,00000001,?,?,00000000,?,00000000,?,?,00000000,00000006,?,?,?), ref: 00449F8F
GetLastError.KERNEL32 ref: 00449FAB

Strings

PkGNG, xrefs: 00449EBE

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: ByteCharErrorLastMultiWide
String ID: PkGNG
API String ID: 203985260-263838557
Opcode ID: d1185fb95bfff78fff583c453b007e19375680cfc0f7d37f8e74ebb942ffdfee
Instruction ID: e4919e29a80df6b7ced925805d10dfcffaa1b378e184719e11b938f1b8f94c7b
Opcode Fuzzy Hash: d1185fb95bfff78fff583c453b007e19375680cfc0f7d37f8e74ebb942ffdfee
Instruction Fuzzy Hash: 2331E430200201ABFB21EF56C845BAB7768EF45721F15016BF815C7391DB38CD45E7A9

Function 0040B783 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 88COMMON

Download Yara Rule

APIs

Part of subcall function 00434801: __onexit.LIBCMT ref: 00434807

__Init_thread_footer.LIBCMT ref: 0040B7D2

Strings

[Text copied to clipboard], xrefs: 0040B821
[End of clipboard], xrefs: 0040B814

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: Init_thread_footer__onexit
String ID: [End of clipboard]$[Text copied to clipboard]
API String ID: 1881088180-3686566968
Opcode ID: 7be63757e29b9f91be4cc1fce50211db745ac7e2ddcf3fa0e25e131e1c8bf245
Instruction ID: 844f446031992ee5170c212df839aebd4a436c67f2956c9e8fe8aff684c3a130
Opcode Fuzzy Hash: 7be63757e29b9f91be4cc1fce50211db745ac7e2ddcf3fa0e25e131e1c8bf245
Instruction Fuzzy Hash: 30217131A102198ACB14FBA6D8929EDB375AF54318F10443FE505771D2EF786D4ACA8C

Function 00451BB7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 88COMMON

Download Yara Rule

APIs

GetACP.KERNEL32(?,20001004,?,00000002), ref: 00451C92

Strings

ACP, xrefs: 00451BD5
OCP, xrefs: 00451C0B

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID:
String ID: ACP$OCP
API String ID: 0-711371036
Opcode ID: 28d359b86f53a769e50845c8979a9c95ba506d3f4f520eddc938968d94c37ac1
Instruction ID: 09b953eaa346ea86c897215e5a2a15a508f8bcb16f9b984b1dadcb699cf7d301
Opcode Fuzzy Hash: 28d359b86f53a769e50845c8979a9c95ba506d3f4f520eddc938968d94c37ac1
Instruction Fuzzy Hash: E821D862A80204A6DB36CF14C941BAB7266DB54B13F568426ED0AD7322F73BED45C35C

Function 0044B7B1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 81fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000,FF8BC35D,00000000,?,PkGNG,0044BBEE,?,00000000,FF8BC35D,00000000,00000000,FF8BC369), ref: 0044B85B
GetLastError.KERNEL32 ref: 0044B884

Strings

PkGNG, xrefs: 0044B7B3

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: ErrorFileLastWrite
String ID: PkGNG
API String ID: 442123175-263838557
Opcode ID: 9f33f136d580808b36a549075194831cac44b680ed95d57240af363647088f83
Instruction ID: 9972a58bdd01e134d13becd973f3089a2f7b3635eb9ddb95e5d59f4384582b5e
Opcode Fuzzy Hash: 9f33f136d580808b36a549075194831cac44b680ed95d57240af363647088f83
Instruction Fuzzy Hash: B2316F31A00619DBCB24DF59DD8099AF3F9FF48301B1485AAE909D7261E734ED81CBA8

Function 0044B6D2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000,FF8BC35D,00000000,?,PkGNG,0044BC0E,?,00000000,FF8BC35D,00000000,00000000,FF8BC369), ref: 0044B76D
GetLastError.KERNEL32 ref: 0044B796

Strings

PkGNG, xrefs: 0044B6D4

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: ErrorFileLastWrite
String ID: PkGNG
API String ID: 442123175-263838557
Opcode ID: 482fa6ac77512a0fc819500aa413458c203250297fd7de672378db3e029a087c
Instruction ID: c865f2f287ade0309940dd9d446f9ab1351fd896516eb6f8948e0fb5ca6ebdce
Opcode Fuzzy Hash: 482fa6ac77512a0fc819500aa413458c203250297fd7de672378db3e029a087c
Instruction Fuzzy Hash: 69219435600219DFDB14CF69D980BEAB3F9EB48312F1048AAE94AD7251D734ED85CB64

Function 00404FF4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?,00475598,?,00000000,?,?,?,?,?,?,00415D04,?,00000001,0000004C,00000000), ref: 00405030

Part of subcall function 0041B580: GetLocalTime.KERNEL32(00000000), ref: 0041B59A

GetLocalTime.KERNEL32(?,00475598,?,00000000,?,?,?,?,?,?,00415D04,?,00000001,0000004C,00000000), ref: 00405087

Strings

KeepAlive | Enabled | Timeout: , xrefs: 0040501F

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: LocalTime
String ID: KeepAlive | Enabled | Timeout:
API String ID: 481472006-1507639952
Opcode ID: 145f269d181a8435875c36411829170d0c63d951855ea4e88e6edb1186bb4574
Instruction ID: e3b05ee6596aa2f5bef7afedc99ae4e94a3de8d8e2082a6dce2ef35069f0368d
Opcode Fuzzy Hash: 145f269d181a8435875c36411829170d0c63d951855ea4e88e6edb1186bb4574
Instruction Fuzzy Hash: 8D2104719107806BD700B736980A76F7B64E751308F44097EE8491B2E2EB7D5A88CBEF

Function 00416676 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62sleepfilenetworkCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32 ref: 0041667B
URLDownloadToFileW.URLMON(00000000,00000000,00000002,00000000,00000000), ref: 004166DD

Strings

!D@, xrefs: 004170C4

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: DownloadFileSleep
String ID: !D@
API String ID: 1931167962-604454484
Opcode ID: 092e42fcb9aaa0e887aa486cfc6f9746e7f9b69877162c24d85fe42e211bf098
Instruction ID: 05e88009b36717a37a8ab5ea381c0ce1ab0270976c353b8abb87c8adb32aa340
Opcode Fuzzy Hash: 092e42fcb9aaa0e887aa486cfc6f9746e7f9b69877162c24d85fe42e211bf098
Instruction Fuzzy Hash: F21142716083029AC614FF72D8969AE77A4AF50348F400C7FF546531E2EE3C9949C65A

Function 0041ADA8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

PathFileExistsW.SHLWAPI(00000000), ref: 0041ADCD

Strings

hYG, xrefs: 0041ADD7
alarm.wav, xrefs: 0041ADB8

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: ExistsFilePath
String ID: alarm.wav$hYG
API String ID: 1174141254-2782910960
Opcode ID: b1264f66081e357ea998da1c4a3710e4054d322a9d90202bb867bf05cfcdbcb2
Instruction ID: 4122455f09fb97d0238bc6f6df8f07100adf7eded08faacdf9dae369850c3b42
Opcode Fuzzy Hash: b1264f66081e357ea998da1c4a3710e4054d322a9d90202bb867bf05cfcdbcb2
Instruction Fuzzy Hash: 6401B57078831156CA04F77688166EE77959B80718F00847FF64A162E2EFBC9E59C6CF

Function 0040B08C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 0040B19F: GetLocalTime.KERNEL32(?,Offline Keylogger Started,004750F0), ref: 0040B1AD
Part of subcall function 0040B19F: wsprintfW.USER32 ref: 0040B22E

Part of subcall function 0041B580: GetLocalTime.KERNEL32(00000000), ref: 0041B59A

CloseHandle.KERNEL32(?), ref: 0040B0EF
UnhookWindowsHookEx.USER32 ref: 0040B102

Strings

Online Keylogger Stopped, xrefs: 0040B09C, 0040B0A4, 0040B0CB

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: LocalTime$CloseHandleHookUnhookWindowswsprintf
String ID: Online Keylogger Stopped
API String ID: 1623830855-1496645233
Opcode ID: d2011962e6819f9b37a51f0e1cf8c7d5879c21619fea64d9aec53d325501bd1f
Instruction ID: 2c7fc3a8f12b1f8c565497f75251163d8124a4eac963031352a4caf2a1bdec21
Opcode Fuzzy Hash: d2011962e6819f9b37a51f0e1cf8c7d5879c21619fea64d9aec53d325501bd1f
Instruction Fuzzy Hash: 6F01F530600610ABD7217B35C81B7BE7B729B41304F4004BFE982265C2EBB91856C7DE

Function 00448C33 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,A4E85006,00000001,?,0043CEA5), ref: 00448CA4

Strings

LCMapStringEx, xrefs: 00448C4E
PkGNG, xrefs: 00448C35

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: String
String ID: LCMapStringEx$PkGNG
API String ID: 2568140703-1065776982
Opcode ID: aac5d351483de452061b997450265c1da9567a4c5720285b7a7b965a3286f227
Instruction ID: c3f282dcf0fd97a5c368a601407465e3bede0a00add2935535d0592c00eac712
Opcode Fuzzy Hash: aac5d351483de452061b997450265c1da9567a4c5720285b7a7b965a3286f227
Instruction Fuzzy Hash: 3001253254120CFBCF02AF91DD02EEE7F66EF08751F04416AFE1965161CA3A8971EB99

Function 004017EC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

waveInPrepareHeader.WINMM(?,00000020,?,?,00476B50,00474EE0,?,00000000,00401A15), ref: 00401849
waveInAddBuffer.WINMM(?,00000020,?,00000000,00401A15), ref: 0040185F

Strings

XMG, xrefs: 004017F8

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: wave$BufferHeaderPrepare
String ID: XMG
API String ID: 2315374483-813777761
Opcode ID: db4cc151110a5f9a71eb5ce2d7546914e9eb517e880c4322ad0588f055fadbe6
Instruction ID: 6f1d19605e244f5f119b09d66236675289974365e05be472c2159163c6862827
Opcode Fuzzy Hash: db4cc151110a5f9a71eb5ce2d7546914e9eb517e880c4322ad0588f055fadbe6
Instruction Fuzzy Hash: D3016D71700301AFD7209F75EC48969BBA9FB89355701413AF409D3762EB759C90CBA8

Function 00448B66 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

IsValidLocale.KERNEL32(00000000,kKD,00000000,00000001,?,?,00444B6B,?,?,?,?,00000004), ref: 00448BB2

Strings

IsValidLocaleName, xrefs: 00448B77, 00448B81
kKD, xrefs: 00448BA9, 00448B96

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: LocaleValid
String ID: IsValidLocaleName$kKD
API String ID: 1901932003-3269126172
Opcode ID: e2be842f2307acef5cef967ff3e72c46beaafbec9f28b2cc6d0622aebebc3446
Instruction ID: c774fcfd7954269485cc3e12fd2bed3330e0a6a7af379781e67d062e13931268
Opcode Fuzzy Hash: e2be842f2307acef5cef967ff3e72c46beaafbec9f28b2cc6d0622aebebc3446
Instruction Fuzzy Hash: 9BF05230A80708FBDB016B60DC06FAE7B54CB44B12F10007EFD046B291DE799E0091ED

Function 0040C4FE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

PathFileExistsW.SHLWAPI(00000000,\AppData\Local\Google\Chrome\,00000000), ref: 0040C531

Strings

\AppData\Local\Google\Chrome\, xrefs: 0040C51B
UserProfile, xrefs: 0040C505

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: ExistsFilePath
String ID: UserProfile$\AppData\Local\Google\Chrome\
API String ID: 1174141254-4188645398
Opcode ID: f9a07996837724957705d56df4e2d94e9c7b3399acd9f5249461b7d2a15f9b23
Instruction ID: 9b0ec594f197676e752fca63164bf20e3c748e9c9f1ad615e42e10c79405690b
Opcode Fuzzy Hash: f9a07996837724957705d56df4e2d94e9c7b3399acd9f5249461b7d2a15f9b23
Instruction Fuzzy Hash: FEF05E30A00219A6CA04BBB69C478AF7B289910759B40017FBA01B21D3EE78994586DD

Function 0040C561 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

PathFileExistsW.SHLWAPI(00000000,\AppData\Local\Microsoft\Edge\,00000000), ref: 0040C594

Strings

\AppData\Local\Microsoft\Edge\, xrefs: 0040C57E
UserProfile, xrefs: 0040C568

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: ExistsFilePath
String ID: UserProfile$\AppData\Local\Microsoft\Edge\
API String ID: 1174141254-2800177040
Opcode ID: b27d649c1a99b770e2ee573beac095cc0176eb12c484dff086be6ac562635e32
Instruction ID: ebfb9b6c20c42028ef61fa2b9513503d2b9bf0243ac81fc6585c9643e3935da3
Opcode Fuzzy Hash: b27d649c1a99b770e2ee573beac095cc0176eb12c484dff086be6ac562635e32
Instruction Fuzzy Hash: F1F05E70A0021AE6CA04BBB69C478EF7B2C9910755B40017BBA01721D3FE7CA94586ED

Function 0040C5C4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

PathFileExistsW.SHLWAPI(00000000,\Opera Software\Opera Stable\,00000000), ref: 0040C5F7

Strings

AppData, xrefs: 0040C5CB
\Opera Software\Opera Stable\, xrefs: 0040C5E1

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: ExistsFilePath
String ID: AppData$\Opera Software\Opera Stable\
API String ID: 1174141254-1629609700
Opcode ID: 92b8fe468143de46e4b25ecc4db10b81df2d2be94452298da839e48cb23232ed
Instruction ID: 695210f55460e2722832162fecb8267ed9c5d90cd61684e29202a639a57ef244
Opcode Fuzzy Hash: 92b8fe468143de46e4b25ecc4db10b81df2d2be94452298da839e48cb23232ed
Instruction Fuzzy Hash: 38F05E30A00219D6CA14BBB69C478EF7B2C9950755F1005BBBA01B21D3EE789941C6ED

Function 0040B681 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 32keyboardCOMMON

Download Yara Rule

APIs

GetKeyState.USER32(00000011), ref: 0040B686

Part of subcall function 0040A41B: GetForegroundWindow.USER32 ref: 0040A451
Part of subcall function 0040A41B: GetWindowThreadProcessId.USER32(00000000,?), ref: 0040A45D
Part of subcall function 0040A41B: GetKeyboardLayout.USER32(00000000), ref: 0040A464
Part of subcall function 0040A41B: GetKeyState.USER32(00000010), ref: 0040A46E
Part of subcall function 0040A41B: GetKeyboardState.USER32(?), ref: 0040A479
Part of subcall function 0040A41B: ToUnicodeEx.USER32(?,?,?,?,00000010,00000000,00000000), ref: 0040A49C
Part of subcall function 0040A41B: ToUnicodeEx.USER32(?,?,00000010,00000000,00000000), ref: 0040A4FC

Part of subcall function 0040A671: SetEvent.KERNEL32(?,?,00000000,0040B245,00000000), ref: 0040A69D

Strings

[AltL], xrefs: 0040B6C8
[AltR], xrefs: 0040B6BC

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: State$KeyboardUnicodeWindow$EventForegroundLayoutProcessThread
String ID: [AltL]$[AltR]
API String ID: 2738857842-2658077756
Opcode ID: 973633859d93ff8360b83ac9e1d77558cdb0b7c4d5bdbb5f5e50dc46d20ac961
Instruction ID: d407634c764e35d79823ffb94670adf82ecea3c262ef0a09b09082b5b6a355d5
Opcode Fuzzy Hash: 973633859d93ff8360b83ac9e1d77558cdb0b7c4d5bdbb5f5e50dc46d20ac961
Instruction Fuzzy Hash: B2E0652171032052C859363D592FABE2D11CB41B64B42097FF842AB7D6DABF4D5543CF

Function 004489D7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(00000000,0043AB37), ref: 00448A16

Strings

GetSystemTimePreciseAsFileTime, xrefs: 004489F2
PkGNG, xrefs: 004489D9

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: Time$FileSystem
String ID: GetSystemTimePreciseAsFileTime$PkGNG
API String ID: 2086374402-949981407
Opcode ID: 36094b6d006a7c5976d2fe62b58f2756bffc72267d66b89a94896d775de98ed0
Instruction ID: bacba389ed7ed90706db716b221aab5ed2509560655679cc0f09f15d90276a03
Opcode Fuzzy Hash: 36094b6d006a7c5976d2fe62b58f2756bffc72267d66b89a94896d775de98ed0
Instruction Fuzzy Hash: 79E0E531A81618FBD7116B25EC02E7EBB50DB08B02B10027FFC05A7292EE754D14D6DE

Function 004161C5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

ShellExecuteW.SHELL32(00000000,open,00000000,00000000,00000000,00000000), ref: 004161E3

Strings

!D@, xrefs: 004170C4
open, xrefs: 004161DD

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: ExecuteShell
String ID: !D@$open
API String ID: 587946157-1586967515
Opcode ID: 30a1d241cab23d886832e5a2cf84020a5ff996eade7e739dca91f4d882a6cfc9
Instruction ID: 3b2857edeaddefe186f4a0a52e989bb70d7a4cfa1db765b6d796ce97600c5b03
Opcode Fuzzy Hash: 30a1d241cab23d886832e5a2cf84020a5ff996eade7e739dca91f4d882a6cfc9
Instruction Fuzzy Hash: 4AE012712483059AD214EA72DC92EFEB35CAB54755F404C3FF506524E2EF3C5C49C66A

Function 004555CB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27COMMONLIBRARYCODE

Download Yara Rule

APIs

___initconout.LIBCMT ref: 004555DB

Part of subcall function 00456B9D: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,004555E0,00000000,PkGNG,0044B61D,?,FF8BC35D,00000000,?,00000000), ref: 00456BB0

WriteConsoleW.KERNEL32(FFFFFFFE,FF8BC369,00000001,00000000,00000000,00000000,PkGNG,0044B61D,?,FF8BC35D,00000000,?,00000000,PkGNG,0044BB99,?), ref: 004555FE

Strings

PkGNG, xrefs: 004555CD

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: ConsoleCreateFileWrite___initconout
String ID: PkGNG
API String ID: 3087715906-263838557
Opcode ID: 4fd586c33a7e536def3848490aff3c82696797501ee569242fdde9145b290049
Instruction ID: 53f4b2898eb153bde3bf118a85e4039abf363423ff24ad7888d91dc13aa78fd6
Opcode Fuzzy Hash: 4fd586c33a7e536def3848490aff3c82696797501ee569242fdde9145b290049
Instruction Fuzzy Hash: C5E0EDB0100548BBDA208B69DC29EBA3328EB00331F500369FE29C62D2EB34EC44C769

Function 0040B6DB Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24keyboardCOMMON

Download Yara Rule

APIs

GetKeyState.USER32(00000012), ref: 0040B6E0

Strings

[CtrlL], xrefs: 0040B70E
[CtrlR], xrefs: 0040B6FD

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: State
String ID: [CtrlL]$[CtrlR]
API String ID: 1649606143-2446555240
Opcode ID: 1321bbb6cc8174ef42da852326f734558715e41d50b56193fb2d1a3bfc871e5f
Instruction ID: b338140f060b4cc34328e336f8905ed3f99262ec5dadafe534bff25dd27afc5e
Opcode Fuzzy Hash: 1321bbb6cc8174ef42da852326f734558715e41d50b56193fb2d1a3bfc871e5f
Instruction Fuzzy Hash: CFE04F2160072052C5243A7D561A67A2911C7C2764F41057BE9826B7C6DABE891452DF

Function 0040E7DA Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 23COMMON

Download Yara Rule

APIs

Part of subcall function 00434801: __onexit.LIBCMT ref: 00434807

__Init_thread_footer.LIBCMT ref: 00410F64

Strings

,kG, xrefs: 00410F3F
0kG, xrefs: 00410F6C

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: Init_thread_footer__onexit
String ID: ,kG$0kG
API String ID: 1881088180-2015055088
Opcode ID: 9b05eae692bf82ff893255be440f7f21efe509fead0387458dc7709882e6db21
Instruction ID: 52a075922dd803dc3791164d579436726ad124eb3de8ddc986de269a183bf650
Opcode Fuzzy Hash: 9b05eae692bf82ff893255be440f7f21efe509fead0387458dc7709882e6db21
Instruction Fuzzy Hash: A8E0D8315149208EC514B729E542AC53395DB0E324B21907BF014D72D2CBAE78C28E5D

Function 00413A5E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 23registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\,00000000,00000002,?,80000002,80000002,0040D509,00000000,?,00000000), ref: 00413A6C
RegDeleteValueW.ADVAPI32(?,?,?,00000000), ref: 00413A80

Strings

Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\, xrefs: 00413A6A

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: DeleteOpenValue
String ID: Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\
API String ID: 2654517830-1051519024
Opcode ID: 37389d7ee51bec1c2129a7b253fd7a72f11d6a1cc032b6ab4e225ceb9c6d243b
Instruction ID: 8a242acd51d06e7ce72e997358fe7bb9804e2c240f13b939b69747d851efcbee
Opcode Fuzzy Hash: 37389d7ee51bec1c2129a7b253fd7a72f11d6a1cc032b6ab4e225ceb9c6d243b
Instruction Fuzzy Hash: FFE0C231244208FBEF104FB1DD06FFA7B2CDB01F42F1006A9BA0692192C626CE049664

Function 00440CE1 Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000009,?,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000,00401D55), ref: 00440D77
GetLastError.KERNEL32 ref: 00440D85
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00440DE0

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: aa9c90e467390f2e0f6591fe7c9965b03d9b59885bed7a4237b1e33e934d31eb
Instruction ID: 51be13377619d21db21fabe69686c0ed70cae26876ac5a8e773c252addda8789
Opcode Fuzzy Hash: aa9c90e467390f2e0f6591fe7c9965b03d9b59885bed7a4237b1e33e934d31eb
Instruction Fuzzy Hash: 2D412670A00212AFEF218FA5C8447BBBBA4EF41310F2045AAFA59573E1DB399C31C759

Function 00411B9A Relevance: 5.1, APIs: 4, Instructions: 119COMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000014), ref: 00411BC7
IsBadReadPtr.KERNEL32(?,00000014), ref: 00411C93
SetLastError.KERNEL32(0000007F,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00411CB5
SetLastError.KERNEL32(0000007E,00411F2B), ref: 00411CCC

Memory Dump Source

Source File: 00000002.00000002.1806092840.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE02113.jbxd

Yara matches

Similarity

API ID: ErrorLastRead
String ID:
API String ID: 4100373531-0
Opcode ID: 90639ee29dfdd48ecb3f8d3d3319bc7730bab7022ac74643829df8c5f46e8e60
Instruction ID: 65e884089caabfe283b2879acbb60db065d5dd9ad58be7743d127bf22715a70c
Opcode Fuzzy Hash: 90639ee29dfdd48ecb3f8d3d3319bc7730bab7022ac74643829df8c5f46e8e60
Instruction Fuzzy Hash: 60419D716443059FEB248F19DC84BA7B3E4FF44714F00082EEA4A876A1F738E845CB99

Analysis Process: Adobe.exePID: 7504, Parent PID: 7448COMMON

Execution Graph

Execution Coverage:	9.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	76
Total number of Limit Nodes:	4

Executed Functions

Function 070B6140 Relevance: 2.6, Strings: 2, Instructions: 71
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

8oq, xrefs: 070B619C
8oq, xrefs: 070B61D3

Memory Dump Source

Source File: 00000003.00000002.1826397176.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70b0000_Adobe.jbxd

Similarity

API ID:
String ID: 8oq$8oq
API String ID: 0-150699234
Opcode ID: fdd9867ddb377e9ab60effc054661e7cb7606c474d020f28cd9722b1be76d524
Instruction ID: d0bfb41342a212e238a962dda259c5f08596050a2f6d1ff4efae75d0d0e08454
Opcode Fuzzy Hash: fdd9867ddb377e9ab60effc054661e7cb7606c474d020f28cd9722b1be76d524
Instruction Fuzzy Hash: 62215774B14208DFC7148F78D9059BF76EAEBC8210F150A39E506E7381DE768E018792

Function 070BF930 Relevance: 1.6, Strings: 1, Instructions: 369
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'kq, xrefs: 070BFE40

Memory Dump Source

Source File: 00000003.00000002.1826397176.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70b0000_Adobe.jbxd

Similarity

API ID:
String ID: 4'kq
API String ID: 0-3255046985
Opcode ID: e1c0a1a17c9c9968ae624c6b52925e4c0fbf3b8c22c92d3c68df7e812a57130f
Instruction ID: 20243fb629d23861d47732b95db5acd61f47d5c900d01e881138004caca87c17
Opcode Fuzzy Hash: e1c0a1a17c9c9968ae624c6b52925e4c0fbf3b8c22c92d3c68df7e812a57130f
Instruction Fuzzy Hash: E9E16D74A00309DFCB05EFB8C954BAEBBB6EB88300F148565E405B7369CB35AE85CB51

Function 0575A290 Relevance: 1.6, APIs: 1, Instructions: 104
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetTimer.USER32(?,05096428,?,?,?,?,?,?,0575A0B0,00000000,00000000,?), ref: 0575A25D

Memory Dump Source

Source File: 00000003.00000002.1822827907.0000000005750000.00000040.00000800.00020000.00000000.sdmp, Offset: 05750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5750000_Adobe.jbxd

Similarity

API ID: Timer
String ID:
API String ID: 2870079774-0
Opcode ID: 5222eb555c4ee24c9a22cf18474a2e67452c5be9e523645794094a6530411587
Instruction ID: 76f24be7e3eb0cffb7cc2840babba7e23f9804d0b292894ada693cf990ec808f
Opcode Fuzzy Hash: 5222eb555c4ee24c9a22cf18474a2e67452c5be9e523645794094a6530411587
Instruction Fuzzy Hash: CE312631A042418FCB159B28D449AADBFF1EFC6322F1941AAD909DB3A2C676DC85DB50

Function 0129591C Relevance: 1.6, APIs: 1, Instructions: 98
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 012959D9

Memory Dump Source

Source File: 00000003.00000002.1816907264.0000000001290000.00000040.00000800.00020000.00000000.sdmp, Offset: 01290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1290000_Adobe.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: e25daab50b2ffef32015a9c072e714b45dc673b600af982a8f05c37c00ddf162
Instruction ID: 50df8acdec67204332277b626ce6c8e1631d4e22301964bd9c67720d069537f2
Opcode Fuzzy Hash: e25daab50b2ffef32015a9c072e714b45dc673b600af982a8f05c37c00ddf162
Instruction Fuzzy Hash: 9F41F1B0D10719CEDB24CFA9C884B8EBBB5BF49304F2080AAD408AB255DB756946CF90

Function 01294514 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 012959D9

Memory Dump Source

Source File: 00000003.00000002.1816907264.0000000001290000.00000040.00000800.00020000.00000000.sdmp, Offset: 01290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1290000_Adobe.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 07ef1d62848ed8d5e72fe7bb932f0ca85176c9bb654cef46cc4b7c40c3a1d03a
Instruction ID: 5b7bdf487096efd89e082079fea783a75501bf9a2715d29fe2777d8c0c30ae39
Opcode Fuzzy Hash: 07ef1d62848ed8d5e72fe7bb932f0ca85176c9bb654cef46cc4b7c40c3a1d03a
Instruction Fuzzy Hash: DD41F2B0D0071DCFDB24DFA9C884B8EBBB5BF49304F2080AAE508AB255DB756945CF90

Function 05144120 Relevance: 1.6, APIs: 1, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 051441E1

Memory Dump Source

Source File: 00000003.00000002.1820735499.0000000005140000.00000040.00000800.00020000.00000000.sdmp, Offset: 05140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5140000_Adobe.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 8cd76bee1dc4544ad177b2f1f470bd8cb9f498772cd81cafb98f95dc1a19ecaa
Instruction ID: 1b0c4fc18848dfeeb166889a71da2d234cf980d513b06bbebd1850aea0ad82d3
Opcode Fuzzy Hash: 8cd76bee1dc4544ad177b2f1f470bd8cb9f498772cd81cafb98f95dc1a19ecaa
Instruction Fuzzy Hash: 654118B9900205CFDB14CF99D848BAEBBF6FB98314F25C499D519AB321D774A841CFA0

Function 0129D0FC Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0129D76E,?,?,?,?,?), ref: 0129D82F

Memory Dump Source

Source File: 00000003.00000002.1816907264.0000000001290000.00000040.00000800.00020000.00000000.sdmp, Offset: 01290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1290000_Adobe.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: d7612429aa58bd66accac80d959689cda5b09bbf44588dd4f932e5c6ef0d1651
Instruction ID: a32b63033fa13497a7ab1d31ca04d22435a39e5775f2d30a45b02036d878218e
Opcode Fuzzy Hash: d7612429aa58bd66accac80d959689cda5b09bbf44588dd4f932e5c6ef0d1651
Instruction Fuzzy Hash: EE2103B59002089FDB10CF9AD984ADEBFF4FB48310F10802AE918A7311D374A940CFA0

Function 0129D7A2 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0129D76E,?,?,?,?,?), ref: 0129D82F

Memory Dump Source

Source File: 00000003.00000002.1816907264.0000000001290000.00000040.00000800.00020000.00000000.sdmp, Offset: 01290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1290000_Adobe.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 085c02a45abee3a976c65ed40535812d04d5cf9f959b18e86168717013c4183b
Instruction ID: 69903a619a6bfa487d83c6e1af580554b5e6d4879b00d5ae31b8d54896d276cc
Opcode Fuzzy Hash: 085c02a45abee3a976c65ed40535812d04d5cf9f959b18e86168717013c4183b
Instruction Fuzzy Hash: AB21E3B59002089FDB10CF9AD984ADEBFF8FB48310F14841AE958A7251D378A944CFA5

Function 0575A1F8 Relevance: 1.5, APIs: 1, Instructions: 48
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetTimer.USER32(?,05096428,?,?,?,?,?,?,0575A0B0,00000000,00000000,?), ref: 0575A25D

Memory Dump Source

Source File: 00000003.00000002.1822827907.0000000005750000.00000040.00000800.00020000.00000000.sdmp, Offset: 05750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5750000_Adobe.jbxd

Similarity

API ID: Timer
String ID:
API String ID: 2870079774-0
Opcode ID: f2a6a5c9da6344340c12862516feb020b37e25a660e080417447d308efc3045b
Instruction ID: 7b7f503fb7b6750c4afb559c3dd1364a2d57a57dc4ffe57ae48bda190ea2fa01
Opcode Fuzzy Hash: f2a6a5c9da6344340c12862516feb020b37e25a660e080417447d308efc3045b
Instruction Fuzzy Hash: A611F5B58003499FCB10DF99D849BDEBFF8FB58320F10841AD958A7211D3B5A584CFA5

Function 057588D8 Relevance: 1.5, APIs: 1, Instructions: 47
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetTimer.USER32(?,05096428,?,?,?,?,?,?,0575A0B0,00000000,00000000,?), ref: 0575A25D

Memory Dump Source

Source File: 00000003.00000002.1822827907.0000000005750000.00000040.00000800.00020000.00000000.sdmp, Offset: 05750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5750000_Adobe.jbxd

Similarity

API ID: Timer
String ID:
API String ID: 2870079774-0
Opcode ID: bf1cfbe324f40424ecd46c6585a29ec7e8a4f2e43beff259d62f391df22fd121
Instruction ID: 0d603385a92281c7c4c18c276c8eeb895cda75d0e7e8e115894c877dc655735c
Opcode Fuzzy Hash: bf1cfbe324f40424ecd46c6585a29ec7e8a4f2e43beff259d62f391df22fd121
Instruction Fuzzy Hash: A11106B5804348DFDB10DF99D845BDEBBF8FB48320F10846AE958A7210D3B5A984CFA5

Function 0129B0B8 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0129B11E

Memory Dump Source

Source File: 00000003.00000002.1816907264.0000000001290000.00000040.00000800.00020000.00000000.sdmp, Offset: 01290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1290000_Adobe.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 337842235cc73d3345d705b8ed142ab09c3d020f40ea4b5af2cce519717cfcea
Instruction ID: 176fe698274667e352b630f0bca8eda66a3b40f05c67540d0fa7a723a40410c4
Opcode Fuzzy Hash: 337842235cc73d3345d705b8ed142ab09c3d020f40ea4b5af2cce519717cfcea
Instruction Fuzzy Hash: 5C11E0B6C002498FDB10DF9AD848ADEFBF4AB88324F10842AD559A7610D379A545CFA5

Function 0129B0B7 Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0129B11E

Memory Dump Source

Source File: 00000003.00000002.1816907264.0000000001290000.00000040.00000800.00020000.00000000.sdmp, Offset: 01290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1290000_Adobe.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: f69275793a029ee542228b20d14c0bb2d795f61f8ba8805bb666e4fef825845c
Instruction ID: b227ac9dd34bb867aa2462a3024ea4b42e57ac86c52fb9547d25501663901286
Opcode Fuzzy Hash: f69275793a029ee542228b20d14c0bb2d795f61f8ba8805bb666e4fef825845c
Instruction Fuzzy Hash: A8111DB6C002098FDB10CF9AD948BDEFBF4AF48224F10842AC568B7610C378A545CFA1

Function 070BC62A Relevance: 1.5, Strings: 1, Instructions: 233COMMON

Download Yara Rule

Strings

r, xrefs: 070BC71A

Memory Dump Source

Source File: 00000003.00000002.1826397176.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70b0000_Adobe.jbxd

Similarity

API ID:
String ID: r
API String ID: 0-1812594589
Opcode ID: 36b3f87854b7fabd5c9598ed9e10461834b4f25549e5b9e40f772c389c15888e
Instruction ID: 1cbc634cc66e1d4a0cebc5e1cfc548c6cefcfe22ed6e15c080bfd5876c01f09e
Opcode Fuzzy Hash: 36b3f87854b7fabd5c9598ed9e10461834b4f25549e5b9e40f772c389c15888e
Instruction Fuzzy Hash: 049119B0919105DFE714CF69C5848EEFBBABB4E301F15E255D41AAB242D734AA81CF60

Function 070B0040 Relevance: 1.4, Strings: 1, Instructions: 116COMMON

Download Yara Rule

Strings

(oq, xrefs: 070B01DD

Memory Dump Source

Source File: 00000003.00000002.1826397176.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70b0000_Adobe.jbxd

Similarity

API ID:
String ID: (oq
API String ID: 0-3175707579
Opcode ID: 497fe3788b937a58891c6a95d58547279b67cb1cda7b4717c2613b16519701f3
Instruction ID: d01a391cfc4a85872a9f5d6b5285c1f75854250f240ffb3994443aa880d60c3e
Opcode Fuzzy Hash: 497fe3788b937a58891c6a95d58547279b67cb1cda7b4717c2613b16519701f3
Instruction Fuzzy Hash: 4E4192B1700209AFCB58DF69D4146AEBBE6EFC8350F108929E805AB390DF74DE45CB50

Function 070BADC0 Relevance: 1.3, Strings: 1, Instructions: 77COMMON

Download Yara Rule

Strings

Tekq, xrefs: 070BAF7A

Memory Dump Source

Source File: 00000003.00000002.1826397176.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70b0000_Adobe.jbxd

Similarity

API ID:
String ID: Tekq
API String ID: 0-2319236580
Opcode ID: a2ef543730d43c0411ddb17628703f80398e8cb92fd7abbb75a411196cf6fba0
Instruction ID: 0880e29d79350f3a4e96f5f52dc7f574ab135b7bb0d7ea4876dc962876cd9831
Opcode Fuzzy Hash: a2ef543730d43c0411ddb17628703f80398e8cb92fd7abbb75a411196cf6fba0
Instruction Fuzzy Hash: EB31C2B4E082488FCB14DFA9C8846EDBBF6BF4A305F14D169E41AAB295D7345946CF40

Function 070BAE25 Relevance: 1.3, Strings: 1, Instructions: 73COMMON

Download Yara Rule

Strings

Tekq, xrefs: 070BAEC9

Memory Dump Source

Source File: 00000003.00000002.1826397176.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70b0000_Adobe.jbxd

Similarity

API ID:
String ID: Tekq
API String ID: 0-2319236580
Opcode ID: 26205880c32946b7531b89dd6660a3e2a54ddf366a18f84a5288b7d4ad24298b
Instruction ID: 98a6b59a43562547fc6b591fa6e4eaab20b1d9f7a6ee4ed2b3258e5e6b26b504
Opcode Fuzzy Hash: 26205880c32946b7531b89dd6660a3e2a54ddf366a18f84a5288b7d4ad24298b
Instruction Fuzzy Hash: BE31A0B4E00219CFCF04CFE9C8849EDBBB5FF49314F20812AE919AB265C7356945CB50

Function 070B6130 Relevance: 1.3, Strings: 1, Instructions: 66COMMON

Download Yara Rule

Strings

8oq, xrefs: 070B619C

Memory Dump Source

Source File: 00000003.00000002.1826397176.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70b0000_Adobe.jbxd

Similarity

API ID:
String ID: 8oq
API String ID: 0-3198120224
Opcode ID: 6065526ac695ceb9af2cac85880cfb55e6d075e854a936abe8c2d31db6beff54
Instruction ID: b3bc428bf128de07a74f111c6f2c229fb10efb821cc0c473748abb9b0f6af470
Opcode Fuzzy Hash: 6065526ac695ceb9af2cac85880cfb55e6d075e854a936abe8c2d31db6beff54
Instruction Fuzzy Hash: AB1166B5B14204DFC7148F78DA05AAE77F6ABC9200F190A3AE102E7382DB358B018752

Function 070BAE3F Relevance: 1.3, Strings: 1, Instructions: 54COMMON

Download Yara Rule

Strings

Tekq, xrefs: 070BAEC9

Memory Dump Source

Source File: 00000003.00000002.1826397176.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70b0000_Adobe.jbxd

Similarity

API ID:
String ID: Tekq
API String ID: 0-2319236580
Opcode ID: 5a72a74b9838fef61eb71bf8bcbd7c8494d987997b2c0e2a8d7e700a73ce4395
Instruction ID: 45835cfe8c9520910f23ee4487fc0b2dc478ab475c0eb077b311da4cf2f1463c
Opcode Fuzzy Hash: 5a72a74b9838fef61eb71bf8bcbd7c8494d987997b2c0e2a8d7e700a73ce4395
Instruction Fuzzy Hash: 8011A4B5E00209CFCF04CFD9C5849EDBBB6FB89304F108129D919AB265C7355955CF50

Function 070B30C0 Relevance: .3, Instructions: 332COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1826397176.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70b0000_Adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 192a51ee8fd0223e84f24482548c225b7777348780ab6dc493c2cfc58a8fc1ae
Instruction ID: 5d26d1cb1820c857400940549213ecfd322e584e076ea7f57335aa7d336e14c0
Opcode Fuzzy Hash: 192a51ee8fd0223e84f24482548c225b7777348780ab6dc493c2cfc58a8fc1ae
Instruction Fuzzy Hash: C3E1EA71D1061A8FCF11DFA8C8546EDBBB5FF49310F1086AAD549B7254EB30AA89CF90

Function 070B30F0 Relevance: .3, Instructions: 332COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1826397176.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70b0000_Adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f7a4297dc9f70541ae9de86a944e5bb3faf79195fcb7271e02779306f64d371
Instruction ID: 88857a85712564e87667de52630e7d9e9e37ce13534f54df8512695887a850c3
Opcode Fuzzy Hash: 9f7a4297dc9f70541ae9de86a944e5bb3faf79195fcb7271e02779306f64d371
Instruction Fuzzy Hash: 3FF1C771D1061A8BCF10DFA8C894AEDF7B5FF59300F1086AAD559B7214EB70AA85CF90

Function 070B3700 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1826397176.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70b0000_Adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8462e2754f1d86dd0fb966898f6ec68849c3a43e95d8165de527d18f00005c9
Instruction ID: aec1d9b62ed7f316ca3086789456fe3fe1eade8edad1dcac66a7e2f0b1dea267
Opcode Fuzzy Hash: b8462e2754f1d86dd0fb966898f6ec68849c3a43e95d8165de527d18f00005c9
Instruction Fuzzy Hash: 81C13C71A102198FCB24DF68C8546EDF7B2FF85300F6486A9D456BB351EB30AE85CB91

Function 070B2380 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1826397176.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70b0000_Adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd384b88229e3c0ee0e7a4e1886fbb73e865c31feb00c02d5a82c97336d40d37
Instruction ID: cc02db3bea44198a9589c91ff1aa16b7d105a8c0faf7fd33d5119f0c7d76fce2
Opcode Fuzzy Hash: fd384b88229e3c0ee0e7a4e1886fbb73e865c31feb00c02d5a82c97336d40d37
Instruction Fuzzy Hash: 9E81B2B0A10219DFCB21EF68D8986EDBBF0FF45300F11426AD455A72A4EB70DAA5CB41

Function 070B7B68 Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1826397176.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70b0000_Adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f2e2bd156c47729110eb1c39c4978dc0098e135d4a4d735d3e79079223a5925
Instruction ID: e1473b4162e323644feb8750bed57f22fb59dc63ec17273a5e0ea7414eae8fa4
Opcode Fuzzy Hash: 6f2e2bd156c47729110eb1c39c4978dc0098e135d4a4d735d3e79079223a5925
Instruction Fuzzy Hash: 8A71B2B0A041588FCB20DFA5C590AEEBBF1FF89304F109666E565AB385D734ED42CB50

Function 070B73F7 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1826397176.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70b0000_Adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b27e6d5ec4aba85c95b6c2fbd6e2aa809ad6cb020ebfee28b42503144ae7fd7b
Instruction ID: 0dcb37445c634c5e5bb10c11c748217c3a2b87d8800cc0cc6e96211eed0ab196
Opcode Fuzzy Hash: b27e6d5ec4aba85c95b6c2fbd6e2aa809ad6cb020ebfee28b42503144ae7fd7b
Instruction Fuzzy Hash: A451D5B0E041059FDB14DFA9C9517FEBBB2BB85300F108226E961AB3D4DB349E42CB91

Function 070B4F1A Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1826397176.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70b0000_Adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e6d4649366a62dac9758f2ae29d96bca3aed65afe2fb269455dbb5eead3446f
Instruction ID: 7e114e0a49441123edc5a3602dc4f71228874f91d91de533b4c0f77a9960edd7
Opcode Fuzzy Hash: 2e6d4649366a62dac9758f2ae29d96bca3aed65afe2fb269455dbb5eead3446f
Instruction Fuzzy Hash: 41511430B002549FC705ABB4D4556AEBBB2BFC9300F55C9A9EC85AB396CF346D49C781

Function 070B4F28 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1826397176.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70b0000_Adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fe5ef2beb5604866f54cccddae54a9f50638a38e0d1bb069a41253d1a9403d6
Instruction ID: 7ca3a76d664e1b3afb470e3d9a41fa9d46ed2e7131182fa6893bde764dfa5181
Opcode Fuzzy Hash: 9fe5ef2beb5604866f54cccddae54a9f50638a38e0d1bb069a41253d1a9403d6
Instruction Fuzzy Hash: 3351F431B00214AFC704ABB4D4556AEBBB2BFC8300F55C9A9EC55AB396CF346E49C781

Function 070B0328 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1826397176.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70b0000_Adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa0630538d6fd621e083b545a77e4b81449dab16c75055144fe0892f665f1b6b
Instruction ID: 9900bec2bbc0173796a80238ed87f439405da4253fd42226a0ce547635dc2cd6
Opcode Fuzzy Hash: fa0630538d6fd621e083b545a77e4b81449dab16c75055144fe0892f665f1b6b
Instruction Fuzzy Hash: 88518EB0B01209CFCB29DF68D5586DEBBF2BF89214F148169E405AB261DB71CD46CB50

Function 070B41C8 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1826397176.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70b0000_Adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d89cf13cbb4a7e7d82c6e578cdd5f8fdde0b6bece85f6e55b23d1cebd4a169d
Instruction ID: e8dcaed23e4b22bd914e229dde2b2e6ebf0e7e1c232870acf120553f3f092be4
Opcode Fuzzy Hash: 0d89cf13cbb4a7e7d82c6e578cdd5f8fdde0b6bece85f6e55b23d1cebd4a169d
Instruction Fuzzy Hash: A541B0B0B11206DFCB68DFA4D948AAEB7F6BF89301F154269E816E7351DB34CA40CB51

Function 070B3E68 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1826397176.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70b0000_Adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a75ed7af6890a7741fba83ed650006cf4a1fd82d669349a20edd6a48b9277f25
Instruction ID: 56805bc15183f7d1706ee0601eabf4655c96e658284dbb369f86016a07a81700
Opcode Fuzzy Hash: a75ed7af6890a7741fba83ed650006cf4a1fd82d669349a20edd6a48b9277f25
Instruction Fuzzy Hash: 6B518331B10609DFCB00EFA8D4848EDF7B5FF89310F10866AE555AB321EB70A945CB91

Function 070BB550 Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1826397176.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70b0000_Adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33f778fa650db5a9bff357c00b517452200655d062d824d478eb141c624702c3
Instruction ID: b5c59c199535e9aff94a0a2fd90758144ef50832f88f1d27c89b695789b546b1
Opcode Fuzzy Hash: 33f778fa650db5a9bff357c00b517452200655d062d824d478eb141c624702c3
Instruction Fuzzy Hash: D24136F0E05209CBDB18CF9AD9846EEBBF6AB8D301F14D229E419A7251DB384E41CB54

Function 070B2170 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1826397176.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70b0000_Adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 326c060dcc4347bea51fb2d6b8e1e72f473206bf7b4f623bd16ba3d118635c75
Instruction ID: 164a767d02155c4caf974fbde09bd7cee23648b3203b6eba8cfc6ce919a26ddf
Opcode Fuzzy Hash: 326c060dcc4347bea51fb2d6b8e1e72f473206bf7b4f623bd16ba3d118635c75
Instruction Fuzzy Hash: A8413A71B112099FDB14EFA8D454AEDBBF6BF89310F158269E401FB3A0DB709941CB90

Function 070BB540 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1826397176.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70b0000_Adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ddf8a16f24ff44d0d27aad1f4b306ca7d7e1820128375c3dd5cb582ebbd37013
Instruction ID: f88d990f2cb08d0e7d51a946bf2857573f60fffe6b6ad60646c3ac84d28244e2
Opcode Fuzzy Hash: ddf8a16f24ff44d0d27aad1f4b306ca7d7e1820128375c3dd5cb582ebbd37013
Instruction Fuzzy Hash: F8414CF0E05209CFDB18CF9AD9446EEBBF6AB8D301F14D129E419A7251DB384E40CB55

Function 070B2180 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1826397176.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70b0000_Adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27cfdd43f55c161536389d82f35e0f05a9f6a44d4699e578056ea6708638dbfb
Instruction ID: b86c1410980b809933da8103d23906ff7aef4e6cc696e3852d3484ac11131b3c
Opcode Fuzzy Hash: 27cfdd43f55c161536389d82f35e0f05a9f6a44d4699e578056ea6708638dbfb
Instruction Fuzzy Hash: 0B412B71A112099FDB14EFA9D854AEDBBF2BF89310F148269E401FB3A0DB709941CB50

Function 070BE032 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1826397176.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70b0000_Adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bad27aa04bf5a7fa1e09d9f883962aa78e763d848c83f12f85d87250fbd9e06
Instruction ID: 40afe8fda48f94573c06fe9b5f37b1d7dd1a35ee03cd02b281c2ceeb92920736
Opcode Fuzzy Hash: 4bad27aa04bf5a7fa1e09d9f883962aa78e763d848c83f12f85d87250fbd9e06
Instruction Fuzzy Hash: D9415BB4901209CFDB54DF64DA55A9C7BB6FB88300F2083A9D809EB315DB386D81CF50

Function 070B4018 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1826397176.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70b0000_Adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21e1655e2e729b0075c42aef34ccff8e828f1f2a9e1ebbfc08c43b18e3f7fd99
Instruction ID: f4948c595d35b2c2a56f1aa031fb2abdfbaa0e99c610058d92e273a3f66adac6
Opcode Fuzzy Hash: 21e1655e2e729b0075c42aef34ccff8e828f1f2a9e1ebbfc08c43b18e3f7fd99
Instruction Fuzzy Hash: 723191B1E10219DFCB24DFA8D54489DB7B6FF88210F10822AE405A7324DB719E45CB81

Function 070B514E Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1826397176.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70b0000_Adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efeceda92aced3804170efa8fb7c2e918d504f59bca7332320a8b6f4966a5297
Instruction ID: 7a8ae84530b8cf943ade1a8e15aace87da4097fce75b2240eaebd52331048995
Opcode Fuzzy Hash: efeceda92aced3804170efa8fb7c2e918d504f59bca7332320a8b6f4966a5297
Instruction Fuzzy Hash: 6331BEB461E3804FD7129774982936A3FF2AB87210F0945EBE452CB3D7CE288D45C762

Function 070B41B7 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1826397176.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70b0000_Adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1171b38f81812997c284db18b043a49e73a7a457b3fb1e5a4065d96854e9a34a
Instruction ID: 2e89638e6e3dee77dafae2b109b6aa0839f50de69f8f93c5ea837d799bdc2592
Opcode Fuzzy Hash: 1171b38f81812997c284db18b043a49e73a7a457b3fb1e5a4065d96854e9a34a
Instruction Fuzzy Hash: F231D1B0A112819FDB28EB64C908AEE77F6BF89310F654279E815D3352CB748B05DB52

Function 070B84A8 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1826397176.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70b0000_Adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bf7d2571e32618146f117bd66fc4f4a6b28ff4346930f2b23171e2be9b8d598
Instruction ID: a402290ab297e2f2ee3ca02bb56b247c4a8628bf37f8dd2c17c913bdeaa27e7c
Opcode Fuzzy Hash: 4bf7d2571e32618146f117bd66fc4f4a6b28ff4346930f2b23171e2be9b8d598
Instruction Fuzzy Hash: FB31CFB0914249CFCB24CB69C4806FEBBF9FB46201F14C6BAD465D76A1D334DA42CBA1

Function 070B0088 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1826397176.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70b0000_Adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe3d538816226bf1d3a0c929840fe0c33cd1e0e2fb4a469b46f2801eeda130c1
Instruction ID: 291d158f115481f0ae8ad1c004404fc75f657842bbb5f3bef0480f88d1f4e2fe
Opcode Fuzzy Hash: fe3d538816226bf1d3a0c929840fe0c33cd1e0e2fb4a469b46f2801eeda130c1
Instruction Fuzzy Hash: B03161B0600309EFDB24DF64C858BAEBBF6FF88310F108919E8169B391DB759904CB50

Function 070B4AF8 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1826397176.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70b0000_Adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d61f3f4fc6cf27bbe56e3b4a4354552a48d3eb7140e911709c9453fda876174
Instruction ID: 8748d8fe0dd51f8d2834e7b7dc4db90d476306acb2607dffef1e35f5c5f54d10
Opcode Fuzzy Hash: 3d61f3f4fc6cf27bbe56e3b4a4354552a48d3eb7140e911709c9453fda876174
Instruction Fuzzy Hash: FB21E57075E2408FD7159B78E82967E3FE2ABC6200F1485A7E412CB3D5DE388E55C752

Function 00E5D3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1816399531.0000000000E5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e5d000_Adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbc363115d4013f1757a777d87375deb12f4f1301e7b151477d3bd37e1536e8d
Instruction ID: 43e325022ab2ebbac15b7db03328d0da77368e01078743ba022eccf618b1e99f
Opcode Fuzzy Hash: cbc363115d4013f1757a777d87375deb12f4f1301e7b151477d3bd37e1536e8d
Instruction Fuzzy Hash: 51214871108204DFDB24DF04CDC0B26BF65FB94325F20C969DC095B256C336E85AC6A2

Function 070B2F4B Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1826397176.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70b0000_Adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 183272eefe9a0a52326618c4fce5c3a687c69ba9eb7c935f7e291e56dc95cc5f
Instruction ID: 4ba83c14bbeb24603f9f042ac0e361117805eacdff6b502a19df6031cba5e381
Opcode Fuzzy Hash: 183272eefe9a0a52326618c4fce5c3a687c69ba9eb7c935f7e291e56dc95cc5f
Instruction Fuzzy Hash: 6D216274B102068FCB04EF79C8948EEBBB5FF89200750467AD905E7355EB30EA45CBA0

Function 00E6D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1816495996.0000000000E6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e6d000_Adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76b7270c2865295f93e818ccc749ddaa7f956837fa05dc3352fee0952b56b7e5
Instruction ID: 5bfdc47742b2736063f525a0b655e35fcbd2c7305d4288c340a751d146dafa2a
Opcode Fuzzy Hash: 76b7270c2865295f93e818ccc749ddaa7f956837fa05dc3352fee0952b56b7e5
Instruction Fuzzy Hash: 8B214971A88200DFCB01DF14EDD0B26BBA5FB84318F64C56DD8095B262C336D846CA61

Function 00E6D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1816495996.0000000000E6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e6d000_Adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96fd713a5eea0aac2f39a3eeb98cf246c092ea45e24da9823335fbe2c15f9bdd
Instruction ID: 431fb8ccebf31b2c07b3896e77e4fd811c0374a687b25b4dffa1e2f680e1e4e2
Opcode Fuzzy Hash: 96fd713a5eea0aac2f39a3eeb98cf246c092ea45e24da9823335fbe2c15f9bdd
Instruction Fuzzy Hash: 0C213771A88200DFCB54DF14E9C4B26BF66FB84318F60C56DD8095B296C337D847CA61

Function 070B2F58 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1826397176.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70b0000_Adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e723d1c226ab829d105851112c442b4cef1d66a4af5a0408892fbe51ce798670
Instruction ID: 651eefc27ff2969d727016c8a0d2e76f935fd3c59c54a3eb7bb0f9cfc6b46d0a
Opcode Fuzzy Hash: e723d1c226ab829d105851112c442b4cef1d66a4af5a0408892fbe51ce798670
Instruction Fuzzy Hash: EC213D75A1020A8FCF44EF69C8948EEF7B5FF89200B508679D905B7351EB30EA45CBA0

Function 070BCAF8 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1826397176.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70b0000_Adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c763be06082d25a487bab039735a6ca305f232a7d9258d9d68dbb7f5be17a104
Instruction ID: b83a3170927f85f46d5ef877cecea6b039fab6ffb8b02a7433b6cc70dd09828c
Opcode Fuzzy Hash: c763be06082d25a487bab039735a6ca305f232a7d9258d9d68dbb7f5be17a104
Instruction Fuzzy Hash: 23215CB4A09208DFDB50CFA8C644AAEBFF5EF4A300F1492D6D4189B212D7309B10DB51

Function 070B0258 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1826397176.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70b0000_Adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5313e9d62ea573f68c253e679e4cc4ee029e74d202e979c9080c016277cd2cc3
Instruction ID: b06692c44e9df1478553ab30e873e37d4eae9f93e78dcdc5bb55a46106f3675d
Opcode Fuzzy Hash: 5313e9d62ea573f68c253e679e4cc4ee029e74d202e979c9080c016277cd2cc3
Instruction Fuzzy Hash: 6E11AFB06007028FE735D72AD588BAFB796FFC0310F04892AD916466B8DF71D9CAC650

Function 070B83D8 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1826397176.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70b0000_Adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 974fc53a5cae272e7bd269986c86124bc3afd4c4838c188ce39ac7d08ebc917e
Instruction ID: 02227d0bb8c775a323b048a3df2524385989eb22e7a99a81633e08b4610dc990
Opcode Fuzzy Hash: 974fc53a5cae272e7bd269986c86124bc3afd4c4838c188ce39ac7d08ebc917e
Instruction Fuzzy Hash: C41138707442109FD7364A268C15B6A3BDBAB86700F25C5B6E102DF2F6DAB9CC4187D2

Function 070BB6F0 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1826397176.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70b0000_Adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cf252e61d35319930b209b460781cd4b8ae3da490ff641910d0c134eadef3a8
Instruction ID: e60489762da58e06903ed5d006b3f2fca025653b665f1291900e57cc52aeaacd
Opcode Fuzzy Hash: 1cf252e61d35319930b209b460781cd4b8ae3da490ff641910d0c134eadef3a8
Instruction Fuzzy Hash: F021F8B8D09209DFCB44CFA9C581AEEBBF5BF4A300F605199D919A7312D7309A41CF61

Function 070BBE72 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1826397176.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70b0000_Adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 357a1de798e2a33427085085c8f9e9eefa1b6ef8d88cba832cef98d19e798fc3
Instruction ID: 9abbb720b8c6031a1f8083fd0050f4d63a1a1d05a1b80ffbac2b2abfdb850c14
Opcode Fuzzy Hash: 357a1de798e2a33427085085c8f9e9eefa1b6ef8d88cba832cef98d19e798fc3
Instruction Fuzzy Hash: 3621F5B4905219CFEB20CF94C684AEDBBF6BB4E311F545299D419A7341C7399E80CF20

Function 070B4B51 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1826397176.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70b0000_Adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8b7bef11bbf2fff350c94f723b8bff94a2be6e92dac6817abc242d91e4d4c81
Instruction ID: 20bd41b41ca13b063b0e15538e38b3c0837926d6b1efe82add53838e5bf5876e
Opcode Fuzzy Hash: a8b7bef11bbf2fff350c94f723b8bff94a2be6e92dac6817abc242d91e4d4c81
Instruction Fuzzy Hash: 321184B471A2008FEB149B74E81967E3AD2B7C5211F14466AF513C73D4DE398E51C751

Function 00E6D005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1816495996.0000000000E6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e6d000_Adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a3c4793dd24dc4361731ebafd5b28f64c2a249b87837170d8202ab916fe5719
Instruction ID: cfce3304ff4517aef70c5ba1848a1adb439aa4f0bd469f8f63a644f7e0cc145a
Opcode Fuzzy Hash: 3a3c4793dd24dc4361731ebafd5b28f64c2a249b87837170d8202ab916fe5719
Instruction Fuzzy Hash: F621537554D3808FD712CF24D994715BF72EB46318F28C5EAD8498F6A7C33A980ACB62

Function 070BF470 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1826397176.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70b0000_Adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9843a9d132462f5d5128a49de0ed669cb79354fb40153748e0da70af1e91c2a5
Instruction ID: f2847e52a24015724355107e9aa5a9aad5ed81812a74e9f6b855383d980bc80b
Opcode Fuzzy Hash: 9843a9d132462f5d5128a49de0ed669cb79354fb40153748e0da70af1e91c2a5
Instruction Fuzzy Hash: E311A7B0B0021A8BDB689E799D14ABF76E6EB84750F148629E91AD7341EF70DF4087D0

Function 070BBC78 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1826397176.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70b0000_Adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c71bd32ff812acd7bcf1c3e990005e8e55ac511166c618dd665f82a37308f45
Instruction ID: 1c160ec04c32fa4663b00e88e8c6db4d3cc1e423c567c350c03625e267583b77
Opcode Fuzzy Hash: 2c71bd32ff812acd7bcf1c3e990005e8e55ac511166c618dd665f82a37308f45
Instruction Fuzzy Hash: 7B21F7B0D016189BEB19CFABC9447DEFFF2AFC9300F14C16AD448A6264DB7409468FA0

Function 070B83C9 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1826397176.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70b0000_Adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 363ddf92f1676d829207c02f08570ff0aeade9902a4d46653b5041076a22ea58
Instruction ID: 38756cf3f733b8e4ef6a38d4392f0b182394669df9a5db0e9798dd91506f0f87
Opcode Fuzzy Hash: 363ddf92f1676d829207c02f08570ff0aeade9902a4d46653b5041076a22ea58
Instruction Fuzzy Hash: AF110A707441409FD7758B258C14BAA7B97AB85704F25C276E1129F1F6C6B88841C7D1

Function 00E5D3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1816399531.0000000000E5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e5d000_Adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: 63c6f2424861e7c9f8304842462c31bb85603cf4b2df3db7145ff4367eddb508
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: 43110372404240CFDB16CF00D9C4B16BF72FB94328F24C6A9DC090B256C33AE85ACBA1

Function 070BB7AA Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1826397176.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70b0000_Adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4f6fa74647543fd5937e090559349883ba56da283f2ee8cef309d1c86ee8dd9
Instruction ID: 4fdfb9d275a8be2da05769a8d2fc000d787ee61b238795e4c45cbf98496cf558
Opcode Fuzzy Hash: f4f6fa74647543fd5937e090559349883ba56da283f2ee8cef309d1c86ee8dd9
Instruction Fuzzy Hash: 4C1104F0D09209DFCB54DFA9C5409ADBBF5AF4A310F1496A9D418AB212D3309A45CB80

Function 00E6D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1816495996.0000000000E6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e6d000_Adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: 54d237c1e63dddfc1b561b3f908ee02a3123a10f46a08d37c3be916f4317051d
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: 9B11BE75A48240DFCB11CF50D9D4B15BF61FB84328F28C6A9D8494B266C33AD85ACB51

Function 070B25F7 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1826397176.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70b0000_Adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffa4819e77b1dba47824f61ba92d03878e5b16a523ed625280005b591c8ddf51
Instruction ID: 31524057ef17950c0b908a4adb0c8bff6431b4e76015379b4370e027b18aa609
Opcode Fuzzy Hash: ffa4819e77b1dba47824f61ba92d03878e5b16a523ed625280005b591c8ddf51
Instruction Fuzzy Hash: 4F11E570E0024A8FDB05EF68D8057EEBBF0AF49350F14816AD415FB391DBB49A45DB81

Function 070BE2A2 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1826397176.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70b0000_Adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2438c7b8fbab5e4e5c69d3d61e2b8137560d01029a4ea670c74ab9b11672f76
Instruction ID: 7ea1c8f10c8ae61664ee02bf22091a0ddd78275f69b8a41f4304dbe3e1faed49
Opcode Fuzzy Hash: a2438c7b8fbab5e4e5c69d3d61e2b8137560d01029a4ea670c74ab9b11672f76
Instruction Fuzzy Hash: 902144B4A0420ACFDB50CF28D5487AEBBF6FB09305F1182A4E409E7351DB38AA80CF41

Function 070B54C8 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1826397176.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70b0000_Adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b845ad7a52095e2523a1bfa0175e24178822623f363ec26e973c1f2672f6d65
Instruction ID: fc580fee906079d57b6d668c74ecf96765d7663559d289b6b328a9a92317efe7
Opcode Fuzzy Hash: 9b845ad7a52095e2523a1bfa0175e24178822623f363ec26e973c1f2672f6d65
Instruction Fuzzy Hash: 6501F7B122C1658FC334866CAC416AE7BE9FB4A216F2547A3F065C7681D375CA618361

Function 070B0253 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1826397176.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70b0000_Adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 983fee413616d329fc26a7bdc7c14ba1827db809708d1fe3666be9310643ad77
Instruction ID: 7f4a5f010dfe0a2a4c7e965a6978820b13b5ddb2bf46da06c31ebccef8e0c8b3
Opcode Fuzzy Hash: 983fee413616d329fc26a7bdc7c14ba1827db809708d1fe3666be9310643ad77
Instruction Fuzzy Hash: 8D01B5B06003028FEB35972BD599BEBBB96FFC0310F048525D916466A4DF70D98AC651

Function 070BDF50 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1826397176.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70b0000_Adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d7b571ef39222df0ed74d0786a3138d37c9124e8b6b0ac67f3a185e15e115b3
Instruction ID: c31420c52c938a1e77bd9906b4bafb401e368aa44ffff0de59acf916d2020e51
Opcode Fuzzy Hash: 4d7b571ef39222df0ed74d0786a3138d37c9124e8b6b0ac67f3a185e15e115b3
Instruction Fuzzy Hash: A611C2B0909205CFCB51DBA8D9056EC7FF9FB8A300F009775D10597369DA345E8ACB52

Function 070BBC88 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1826397176.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70b0000_Adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86333229b7616078f0cb6e03951dd5225756bf3c6fba9444faf809cc91127ca1
Instruction ID: 82a2100b80137e98ee78228b4c6d497c9ad3cc6db8c2d4c98dbc862830947cbf
Opcode Fuzzy Hash: 86333229b7616078f0cb6e03951dd5225756bf3c6fba9444faf809cc91127ca1
Instruction Fuzzy Hash: 2D11A7B1D016189BEB18CF9BC9457DEFAF7BFC8300F14C16AD408A6264DB7409458F90

Function 070BB7B8 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1826397176.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70b0000_Adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76f88aa5ae8ee2ec15e3b50f70edd425b178a68d619adea9df032b9a0db83667
Instruction ID: cc016b1539756febccd880978371fa7a036456378ad0141e1a40e9a4dea3ebb4
Opcode Fuzzy Hash: 76f88aa5ae8ee2ec15e3b50f70edd425b178a68d619adea9df032b9a0db83667
Instruction Fuzzy Hash: FC11D3F4E49208DFCB54DFA9C5409EDBBF9BB49310F1096A9D418A7211D330AB45CB80

Function 070B54B9 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1826397176.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70b0000_Adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5dcee115564fdb46e4965eb05c3b9e0851d07cea615a4a4324750db3e297d36
Instruction ID: 86f92837632adede14bf6bca79ac2cb07644cb439b96602867dfc0bb7ac2a8eb
Opcode Fuzzy Hash: f5dcee115564fdb46e4965eb05c3b9e0851d07cea615a4a4324750db3e297d36
Instruction Fuzzy Hash: 6701F7B221C2618FD3344A28DC816FEBBE9FB4A226F2547A3F065C7291D374CA508390

Function 070BAE06 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1826397176.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70b0000_Adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09b829f5eba8af046a06b8af546024f035368886c977e3189b9f68e9fc499e5a
Instruction ID: 26028a7dd70adbc4375faf030bd88d64408ff297379ac42317d1736c7df9b55c
Opcode Fuzzy Hash: 09b829f5eba8af046a06b8af546024f035368886c977e3189b9f68e9fc499e5a
Instruction Fuzzy Hash: F41160B4E04218DFCB14DFA9D984AEDB7F5BB4A301F109529E82AAB395D7349905CF10

Function 070BDFFA Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1826397176.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70b0000_Adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b22cf6cec49eb585199ab2cef7d48e18375764387e2d9d74db8a718b42abaf09
Instruction ID: ccf3523574bfc74307d7301aa7a28cc8c15e73018886b5db3e4122e8bb6fe60e
Opcode Fuzzy Hash: b22cf6cec49eb585199ab2cef7d48e18375764387e2d9d74db8a718b42abaf09
Instruction Fuzzy Hash: 2A113AB4A01309CFCB54DF64E6499ADBBF6FB85301B205729D40AEB756DB346C81CB40

Function 070B35F3 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1826397176.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70b0000_Adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb890bb74d57db05903284813d96d0f21b75e7b902be520c76b914ac8938c0ed
Instruction ID: de565db6987fc3da4634408469c6e929aa42486e113e640789dd15413b6e93c6
Opcode Fuzzy Hash: bb890bb74d57db05903284813d96d0f21b75e7b902be520c76b914ac8938c0ed
Instruction Fuzzy Hash: F11129B2D1420A9FCF11CFA8D9419EEBBB4EF19310F21812AE918F7241D7346B14CBA1

Function 070BCA78 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1826397176.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70b0000_Adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9602986d31e2abf4af708110242f711666f8432fd65807c452d54870f144f00c
Instruction ID: f5241631228bd711d06eb270d896e88ed1111c1201f194b45e99d3e1faf62834
Opcode Fuzzy Hash: 9602986d31e2abf4af708110242f711666f8432fd65807c452d54870f144f00c
Instruction Fuzzy Hash: 2301C074A08208DFC700CFA8C644AAEBFF5EF4A304F1581D5E4098B262D6309E00DB10

Function 070BDF60 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1826397176.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70b0000_Adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc8992233d910d6315fc34a80c7f094aac8618253d162884aface65b70a052a9
Instruction ID: 6acef2b5fb6af2488beabadce42f3d81d15927114b84d016eeaac4993048b862
Opcode Fuzzy Hash: cc8992233d910d6315fc34a80c7f094aac8618253d162884aface65b70a052a9
Instruction Fuzzy Hash: D50192B0904205CFCB60DBA8DA046EC7BF9FB89301F009734D10597759DF746D8A8B51

Function 00E5D745 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1816399531.0000000000E5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e5d000_Adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 400831536d2aa296a4788ba7a553b7b3887a28e1c6f318204e8a9ade56a002b0
Instruction ID: 1e30e3dfba3ff470af97bfa9cff17ee17be8f8632262a9da6acd443ba9a681bb
Opcode Fuzzy Hash: 400831536d2aa296a4788ba7a553b7b3887a28e1c6f318204e8a9ade56a002b0
Instruction Fuzzy Hash: 2701F73100C3409AE7308A29CD84BA7BF98DF49325F18C92BED085A286D239D844CA71

Function 070BCA00 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1826397176.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70b0000_Adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cad924fb1013088f59537eb79c6b5e66aa9bb463257cc4fdf80bf260d56abaa4
Instruction ID: fd0d8a8472c173a76d25920d7b32e9754043d85a145d3f5172eab88182aee45b
Opcode Fuzzy Hash: cad924fb1013088f59537eb79c6b5e66aa9bb463257cc4fdf80bf260d56abaa4
Instruction Fuzzy Hash: 6C01BCB0918248DFD724CF65C9009EEBBF8EF8A304F00A6A1D4199B212D3304F05DB64

Function 070B2608 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1826397176.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70b0000_Adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8beae2290217604b65f4959c3563bed305c00aa26b9d2dc7a025c97bf4cf99d2
Instruction ID: 4766de7cb71713da0d0c2c6a4f0ec4cea417212b8ae98534168a1865336c8d64
Opcode Fuzzy Hash: 8beae2290217604b65f4959c3563bed305c00aa26b9d2dc7a025c97bf4cf99d2
Instruction Fuzzy Hash: 5E019E70E0020A8FDB04EFA8D8017AEBBF0EF49344F108629D815F7390DBB49A45DB81

Function 070BAE52 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1826397176.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70b0000_Adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ddb9defc2a510735257419d72e8fc4f3a02ea7da8bd8319ea2a3851e989bd064
Instruction ID: 47513a211d641096181ab01589e51fac547ac4b1091dc73d33168eeaacc3f7f2
Opcode Fuzzy Hash: ddb9defc2a510735257419d72e8fc4f3a02ea7da8bd8319ea2a3851e989bd064
Instruction Fuzzy Hash: BE0193B4E04218CFCB14CFA8C984AEDB7F5BF4A301F109229E41AAB394D7349901CF00

Function 070BBD90 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1826397176.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70b0000_Adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7463bf69337c4a4d84399322fd59d4add2f50f8e910c000a1ff21d3e7455c72
Instruction ID: 81e9a3f5f767291133c1db9a543f193c45178a8870c9510acd9bfacc97d1dfbc
Opcode Fuzzy Hash: c7463bf69337c4a4d84399322fd59d4add2f50f8e910c000a1ff21d3e7455c72
Instruction Fuzzy Hash: D601E5B4A15119CFEB20CB48C9C4DEEB7BABB49300F55A281D419B7355C330AE818F74

Function 070B4649 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1826397176.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70b0000_Adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c84e18541aee5edbdbc1beb1614dc74663776953adab24c6422439462836dc3
Instruction ID: ddc95a478936d33e5c7b4365ee1a02af7524b98c82a034e3d9d1e44b2fdfab28
Opcode Fuzzy Hash: 2c84e18541aee5edbdbc1beb1614dc74663776953adab24c6422439462836dc3
Instruction Fuzzy Hash: BDF0F076300201AFC324AB29E444A9A7FA5FBEA720F11803AF548CB241CA35C902CBA0

Function 070B3670 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1826397176.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70b0000_Adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d49526f90f9f3ec08fd7acfe88c8c5412127e4b1dce88ef1a75bbbd7a6e076ac
Instruction ID: 88a6bbba66b8a26e1a2590fba0de0f7f692e3392736148d6daad7a434f12ca32
Opcode Fuzzy Hash: d49526f90f9f3ec08fd7acfe88c8c5412127e4b1dce88ef1a75bbbd7a6e076ac
Instruction Fuzzy Hash: 27F02231A043598BCF02AB78C8140DCBBB1EF4A210B0586A7CA81B7252EF305A1883A1

Function 070B3680 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1826397176.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70b0000_Adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d49b899eaaf0b990db4792d2b88a0cde97a4acbf5fc2d19350ad22ecc202f323
Instruction ID: 9c79625b974c3707a38f66e5be84c1605bc25bae1271d0835543cb8c3bd3ac26
Opcode Fuzzy Hash: d49b899eaaf0b990db4792d2b88a0cde97a4acbf5fc2d19350ad22ecc202f323
Instruction Fuzzy Hash: FD01A431A1062E8BCF04EB69DC144DDB3B5FF89310F418625DA1677250FF306A198BE1

Function 070BE0F1 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1826397176.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70b0000_Adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f60ef7171ae1e47218799d7f2f861dd0cee800e96edd8d626c63ac857d1ce36f
Instruction ID: 14b0b5677781a06ab430c7097256b3bfa45760f82afa60230a49090700e1e795
Opcode Fuzzy Hash: f60ef7171ae1e47218799d7f2f861dd0cee800e96edd8d626c63ac857d1ce36f
Instruction Fuzzy Hash: 51111BF5A05349DFCB50DBA4D65949CBBB6FB85300B205329D809DB716DB346D82CB01

Function 070BCA10 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1826397176.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70b0000_Adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 912c2bb1ef4429df4201c601ce1ae5b2563425786731bdf097dd805610f0a16e
Instruction ID: 69f1674d27f73cff1aa1a30c29c15336f5ef71b0884844d6cd31593d6721c500
Opcode Fuzzy Hash: 912c2bb1ef4429df4201c601ce1ae5b2563425786731bdf097dd805610f0a16e
Instruction Fuzzy Hash: 51F081B0918108DBD724CF55C5009EEBBF8AB8A304F00A6A5D4195B212D7308F44DB64

Function 00E5D744 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1816399531.0000000000E5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e5d000_Adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02e964bfadb841e9e4c1f4f48679861d75a438ecacb5b627e80e429bbd704dc0
Instruction ID: 5b6834d3d89e4fcbbc0b455e55f83da3ff61c01dfadba02ac372270f342f6611
Opcode Fuzzy Hash: 02e964bfadb841e9e4c1f4f48679861d75a438ecacb5b627e80e429bbd704dc0
Instruction Fuzzy Hash: EBF062714093449AE7208E1ACC88B62FFA8EB55739F18C85AFD085F686D3799844CAB1

Function 070B36F0 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1826397176.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70b0000_Adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64c91de47e22645ccdb07f7d4c795df6be70edb1ef3c01f02e1c6d0c3177ef0a
Instruction ID: 10bae09f25150e226ee8b97ffcd571d2e3487531356428d000a7ee1c58de241d
Opcode Fuzzy Hash: 64c91de47e22645ccdb07f7d4c795df6be70edb1ef3c01f02e1c6d0c3177ef0a
Instruction Fuzzy Hash: 1EF0BE79B143828FC7359B29AA9489EBFAAEFC6250B18426FE519C7251DF70C844C261

Function 070BF3FF Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1826397176.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70b0000_Adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ccddea0659123ed3aa4748e7914b536e8759dfee924a557720eb77c9959b2cc
Instruction ID: c2087085f35305b08a3f2528192eeba85f4812b35566815348edda83a34fc103
Opcode Fuzzy Hash: 8ccddea0659123ed3aa4748e7914b536e8759dfee924a557720eb77c9959b2cc
Instruction Fuzzy Hash: 06F0CD70A0434CEFCB12DFB8E9156DDBFF0AB49300F1082ABE99497291D7385A54DB91

Function 070BE329 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1826397176.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70b0000_Adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e9d7080983bd3a3b580b4efc298816a262c21121ec9f25aa83e322958373716
Instruction ID: 9b31036ed138e761b19e5497fd608f704cf1f13d84e47e625a378b8161be9b2a
Opcode Fuzzy Hash: 1e9d7080983bd3a3b580b4efc298816a262c21121ec9f25aa83e322958373716
Instruction Fuzzy Hash: 6CF090B0945209CFCB10DF68E6446EC7BB9FB89301F005724D016D7759DB305C868F00

Function 070BA552 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1826397176.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70b0000_Adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adb5f6146d0ef0ff3500d79a57cbcb31066a75f38f5b5545505974d174de646c
Instruction ID: 2dbd87f69f2a08fae06d94c946d5dc43ffdd70f58dc55313cb5d4242cf5c3f19
Opcode Fuzzy Hash: adb5f6146d0ef0ff3500d79a57cbcb31066a75f38f5b5545505974d174de646c
Instruction Fuzzy Hash: 0EF030F4B5A209CFCB64CE55C9806FCB7BEEB8A200F00E664C01AA2225D7700F84CB55

Function 070BE6C5 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1826397176.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70b0000_Adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7ab055b5d437f7248a29c9b9d4e7398cfd58a2413bbbaabd8faf3af9300c113
Instruction ID: 4ed23acae2f403afac9899560ff8a5ed820b5e356a1c6b4b75bee80b8fa11740
Opcode Fuzzy Hash: c7ab055b5d437f7248a29c9b9d4e7398cfd58a2413bbbaabd8faf3af9300c113
Instruction Fuzzy Hash: 71F05EB450520BCFCB608F64CA457D8BBF4FB08204F2087A6C54AE6215EB745E838F60

Function 070BF410 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1826397176.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70b0000_Adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13870a9597185896f55c6f2c5d814d86dd6a2cc295a1449eb0dd1371ec0702ee
Instruction ID: 78ad92a221eb7a62d105af92459101c444c5adea4013c9565f09002ddc16eaff
Opcode Fuzzy Hash: 13870a9597185896f55c6f2c5d814d86dd6a2cc295a1449eb0dd1371ec0702ee
Instruction Fuzzy Hash: 4CF030B4D0020CEBCB55DFA9D90569DBBF5EB48301F10C169E914A3350D7745A54DF41

Function 070BC49E Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1826397176.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70b0000_Adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d25705540be95b7e91360d87a23e69b46096a98aa127efb5446236412ad0e279
Instruction ID: 9b949646bd00ffec98ebdb7528e3b8e87e6c78a276136db6298d97b96e782b6d
Opcode Fuzzy Hash: d25705540be95b7e91360d87a23e69b46096a98aa127efb5446236412ad0e279
Instruction Fuzzy Hash: 6EF0F274A15116CFFB20DB08C994EAAB7B6BB89300F01D2D1D80A67395C734AE818E60

Function 070B8187 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1826397176.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70b0000_Adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0d87cbe7c62418639df11fd50f423a3e4272acd47ce7a43e26a9c758c81b725
Instruction ID: a18f25e5ca9d5b9cdcfd25ebd401f94e79b761967907c89edcba6d9256918e64
Opcode Fuzzy Hash: f0d87cbe7c62418639df11fd50f423a3e4272acd47ce7a43e26a9c758c81b725
Instruction Fuzzy Hash: AEE09B709442869ECB10CBB9C5456DABFF0DF0A324F24C6D5D465DB362D73951439F40

Function 070BDFA9 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1826397176.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70b0000_Adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fbe6794edee6b794c703c063518c2f02a8e547356df5ab09cbaae5b781c1fbb
Instruction ID: 3b5c1088927b3977f9a867f91e8e2bdeed64de7109320344bbdd2a84d589a161
Opcode Fuzzy Hash: 7fbe6794edee6b794c703c063518c2f02a8e547356df5ab09cbaae5b781c1fbb
Instruction Fuzzy Hash: 24F030B4506201CFC710DF28D589A9DBBF5FB0A705F159295E409D7751C734A9C1CF01

Function 070BA55D Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1826397176.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70b0000_Adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8977420a7c7fdb7aa6405d8267691f2ddc15e86c28bbb68b68d53a0ccbf10c99
Instruction ID: 37ef7a401f951bdb623ddc7054893830ffa04d2e0032da9003b6ffaf837b48a4
Opcode Fuzzy Hash: 8977420a7c7fdb7aa6405d8267691f2ddc15e86c28bbb68b68d53a0ccbf10c99
Instruction Fuzzy Hash: EFE04FF4B46209CFCB60DA55CAD06ECB7BAEB4A200F00D2A4D10A96224DB701F88CB42

Function 070BA9A4 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1826397176.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70b0000_Adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb990e15c5afbca8bdd215375fc02b81e304013887d6d738c0bd9b7d92eead85
Instruction ID: d73d9a39f915f0b92908a780bfe855527d208b417276369a75711cf153abdaab
Opcode Fuzzy Hash: fb990e15c5afbca8bdd215375fc02b81e304013887d6d738c0bd9b7d92eead85
Instruction Fuzzy Hash: 60E04FF474A6098FCB60AA15C9886EC77B9FB06200F10D3B4810996229DB704B88CF41

Function 070B8198 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1826397176.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70b0000_Adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 928388dc2882a6be91ff1ebd8c7d8635b2e77516d79cd2050d2e158a8107a891
Instruction ID: b5983d648ad5ca67c20cc68b69281e267f3c27babb2c2590e8f10b50c6c1b8d3
Opcode Fuzzy Hash: 928388dc2882a6be91ff1ebd8c7d8635b2e77516d79cd2050d2e158a8107a891
Instruction Fuzzy Hash: 23E01AB0D402099FC740DF69C50469EBBF4AB08200F10C965C014E7361E77096008F80

Function 070BAA22 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1826397176.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70b0000_Adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dac9ea4ef2635656a4af95ae7d45eb818435f8c79f5a96fd8f483674220d750c
Instruction ID: 86d7890188a1d6893b6a9bb565c57003bcb7a21a75d12a0ccc281363c3046a8e
Opcode Fuzzy Hash: dac9ea4ef2635656a4af95ae7d45eb818435f8c79f5a96fd8f483674220d750c
Instruction Fuzzy Hash: EEE0ECF864A2098FCB709A15DA416F8B7B9BB46200F10D795801A92224DB309B88CB41

Function 070BE433 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1826397176.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70b0000_Adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f45e690498db7554d8f20759a24196c0f103ebdd78fd56c862b1b2148bb92a60
Instruction ID: b42f5a77d4c7c4f5efcedf992f4275bef0df12ef6c5fd672ae17d19d5374f1fb
Opcode Fuzzy Hash: f45e690498db7554d8f20759a24196c0f103ebdd78fd56c862b1b2148bb92a60
Instruction Fuzzy Hash: 74E0B670D04249CFCB04DFD5CA4569DBBB6FB49310F208725E426EA79CDA345D46CB40

Function 070BA399 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1826397176.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70b0000_Adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8c3b4fb6dff3d9e47cabc13f916aec729184c235818fa4cff49f5d01c3c6097
Instruction ID: a027b8892d9743f02689ea83433fca7db12d01065626b3ef60fd3e7aa624881e
Opcode Fuzzy Hash: e8c3b4fb6dff3d9e47cabc13f916aec729184c235818fa4cff49f5d01c3c6097
Instruction Fuzzy Hash: 77D05B701097C68FC7135775E9162647FB46F03311F554291E585C10A3D7BC0424C721

Function 070B8281 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1826397176.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70b0000_Adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92f5d866dbfcd436d13483ffa078466f85e5d681cbd0bc613e3db03f870c7ed2
Instruction ID: 4545f17ac06edc5cfd58248a7978ea93fdb58106006a6f817893d1cc152c12c3
Opcode Fuzzy Hash: 92f5d866dbfcd436d13483ffa078466f85e5d681cbd0bc613e3db03f870c7ed2
Instruction Fuzzy Hash: 22D0C2A0549646DFD7750BB0C4141993AD97F42200F75837AC001C11F0E92E8546CB53

Function 070BE5CA Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1826397176.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70b0000_Adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4b543c8b6ee5a1ddcee3641ae0376e3e3ec857e53776aa3ee0ae667efa8c99f
Instruction ID: 98d492e87fd3cecb8279ff1569b037224d669f2fc2ff55ebe2df07b8a3ac1a44
Opcode Fuzzy Hash: e4b543c8b6ee5a1ddcee3641ae0376e3e3ec857e53776aa3ee0ae667efa8c99f
Instruction Fuzzy Hash: 29E0C27440A284CFCB01EB78D9284987FB0FF06200B050799D0049F25BD3B25C018B81

Function 070B6E59 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1826397176.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70b0000_Adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56f10a6e2bb70c74c83439aaad417d3f742603fcc4455feebd756a19f6df0e45
Instruction ID: 0dbabde84c61c293a1525f7b8d03eb46b14a614556090916ab7afc034b24262c
Opcode Fuzzy Hash: 56f10a6e2bb70c74c83439aaad417d3f742603fcc4455feebd756a19f6df0e45
Instruction Fuzzy Hash: FBC08C6914E3C24ED30313B04C614C3BF200E2321832E00D7C1C1C4463E19090ABD323

Function 070BA3A8 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1826397176.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70b0000_Adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b0d417e4ce56cc4da78942de8249c96eb8635b3cccb548d21febd3ab379132b
Instruction ID: 10a2d6ce16cf4fb1014d30b0cef0a58db568e06a3c90ef6e5014c45ec987d93a
Opcode Fuzzy Hash: 7b0d417e4ce56cc4da78942de8249c96eb8635b3cccb548d21febd3ab379132b
Instruction Fuzzy Hash: D5C08CB014220587C2616B95FA0E36877E87701202F418310B20C804A09FBC0020C661

Function 070BAA7F Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1826397176.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70b0000_Adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da7d1ba692c2586be86fe7518602e85f8f738fa27cfc293955c4a54e85ddab29
Instruction ID: 36d00d092271eba99b4c0195aae48f487e977c54a9d9519219d2896d6084ec9a
Opcode Fuzzy Hash: da7d1ba692c2586be86fe7518602e85f8f738fa27cfc293955c4a54e85ddab29
Instruction Fuzzy Hash: F0D0C9B494A3588FC791DB14DE517E8BB79BF56300F0182D1C14997266DB701EC8CF41

Function 070B565C Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1826397176.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70b0000_Adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f74bb780f1e1dfb81d1f4780020a15551fbdda76d469f4a0d1b777d7d37d60c7
Instruction ID: 07c0e0c0889c13586f041bd1762e95d1d5ccd3d541164571b8f81492a3a1b101
Opcode Fuzzy Hash: f74bb780f1e1dfb81d1f4780020a15551fbdda76d469f4a0d1b777d7d37d60c7
Instruction Fuzzy Hash: B5B012762E5200B5880173A4CA8896FD410FBB7B40F808C123317D0024877284B4E66B

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Containers, IaaS, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Remcos

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Exploits

Privilege Escalation

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Adobe\Adobe.exe

C:\ProgramData\Adobe\Adobe.exe:Zone.Identifier

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Adobe.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\json[1].json

Static File Info

General

File Icon

Windows Analysis Report
ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe

Function 06A381F0 Relevance: 3.9, Strings: 3, Instructions: 146
COMMON

Function 06A32C88 Relevance: 2.9, Strings: 2, Instructions: 376
COMMON

Function 06A86140 Relevance: 2.6, Strings: 2, Instructions: 71
COMMON

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may try to gather information about registered local system services. Adversaries may obtain information about services using tools as well as OS utility commands such as `sc query` , `tasklist /svc` , `systemctl --type=service` , and `net start` .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre